147 files changed, 10637 insertions, 8305 deletions

diff --git a/drivers/net/wireless/Kconfig b/drivers/net/wireless/Kconfig
index 714a6ca30ad2..3c3ef966c95b 100644
--- a/drivers/net/wireless/Kconfig
+++ b/drivers/net/wireless/Kconfig
@@ -146,12 +146,15 @@ config IPW2100
           configure your card:
 
           <http://www.hpl.hp.com/personal/Jean_Tourrilhes/Linux/Tools.html>.
+
+          It is recommended that you compile this driver as a module (M)
+          rather than built-in (Y). This driver requires firmware at device
+          initialization time, and when built-in this typically happens
+          before the filesystem is accessible (hence firmware will be
+          unavailable and initialization will fail). If you do choose to build
+          this driver into your kernel image, you can avoid this problem by
+          including the firmware and a firmware loader in an initramfs.
  
-          If you want to compile the driver as a module ( = code which can be
-          inserted in and removed from the running kernel whenever you want),
-          say M here and read <file:Documentation/kbuild/modules.txt>.
-          The module will be called ipw2100.ko.
-        
 config IPW2100_MONITOR
         bool "Enable promiscuous mode"
         depends on IPW2100
@@ -201,11 +204,14 @@ config IPW2200
           configure your card:
 
           <http://www.hpl.hp.com/personal/Jean_Tourrilhes/Linux/Tools.html>.
- 
-          If you want to compile the driver as a module ( = code which can be
-          inserted in and removed from the running kernel whenever you want),
-          say M here and read <file:Documentation/kbuild/modules.txt>.
-          The module will be called ipw2200.ko.
+
+          It is recommended that you compile this driver as a module (M)
+          rather than built-in (Y). This driver requires firmware at device
+          initialization time, and when built-in this typically happens
+          before the filesystem is accessible (hence firmware will be
+          unavailable and initialization will fail). If you do choose to build
+          this driver into your kernel image, you can avoid this problem by
+          including the firmware and a firmware loader in an initramfs.
 
 config IPW2200_MONITOR
         bool "Enable promiscuous mode"
@@ -732,23 +738,7 @@ config P54_PCI
 
           If you choose to build a module, it'll be called p54pci.
 
-config ATH5K
-        tristate "Atheros 5xxx wireless cards support"
-        depends on PCI && MAC80211 && WLAN_80211 && EXPERIMENTAL
-        ---help---
-          This module adds support for wireless adapters based on
-          Atheros 5xxx chipset.
-
-          Currently the following chip versions are supported:
-
-          MAC: AR5211 AR5212
-          PHY: RF5111/2111 RF5112/2112 RF5413/2413
-
-          This driver uses the kernel's mac80211 subsystem.
-
-          If you choose to build a module, it'll be called ath5k. Say M if
-          unsure.
-
+source "drivers/net/wireless/ath5k/Kconfig"
 source "drivers/net/wireless/iwlwifi/Kconfig"
 source "drivers/net/wireless/hostap/Kconfig"
 source "drivers/net/wireless/bcm43xx/Kconfig"
diff --git a/drivers/net/wireless/adm8211.c b/drivers/net/wireless/adm8211.c
index 79796186713e..2e257ee2783b 100644
--- a/drivers/net/wireless/adm8211.c
+++ b/drivers/net/wireless/adm8211.c
@@ -48,6 +48,32 @@ static struct pci_device_id adm8211_pci_id_table[] __devinitdata = {
         { 0 }
 };
 
+static struct ieee80211_rate adm8211_rates[] = {
+        { .bitrate = 10, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
+        { .bitrate = 20, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
+        { .bitrate = 55, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
+        { .bitrate = 110, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
+        { .bitrate = 220, .flags = IEEE80211_RATE_SHORT_PREAMBLE }, /* XX ?? */
+};
+
+static const struct ieee80211_channel adm8211_channels[] = {
+        { .center_freq = 2412},
+        { .center_freq = 2417},
+        { .center_freq = 2422},
+        { .center_freq = 2427},
+        { .center_freq = 2432},
+        { .center_freq = 2437},
+        { .center_freq = 2442},
+        { .center_freq = 2447},
+        { .center_freq = 2452},
+        { .center_freq = 2457},
+        { .center_freq = 2462},
+        { .center_freq = 2467},
+        { .center_freq = 2472},
+        { .center_freq = 2484},
+};
+
+
 static void adm8211_eeprom_register_read(struct eeprom_93cx6 *eeprom)
 {
         struct adm8211_priv *priv = eeprom->data;
@@ -155,17 +181,17 @@ static int adm8211_read_eeprom(struct ieee80211_hw *dev)
         printk(KERN_DEBUG "%s (adm8211): Channel range: %d - %d\n",
                pci_name(priv->pdev), (int)chan_range.min, (int)chan_range.max);
 
-        priv->modes[0].num_channels = chan_range.max - chan_range.min + 1;
-        priv->modes[0].channels = priv->channels;
+        BUILD_BUG_ON(sizeof(priv->channels) != sizeof(adm8211_channels));
 
-        memcpy(priv->channels, adm8211_channels, sizeof(adm8211_channels));
+        memcpy(priv->channels, adm8211_channels, sizeof(priv->channels));
+        priv->band.channels = priv->channels;
+        priv->band.n_channels = ARRAY_SIZE(adm8211_channels);
+        priv->band.bitrates = adm8211_rates;
+        priv->band.n_bitrates = ARRAY_SIZE(adm8211_rates);
 
         for (i = 1; i <= ARRAY_SIZE(adm8211_channels); i++)
-                if (i >= chan_range.min && i <= chan_range.max)
-                        priv->channels[i - 1].flag =
-                                IEEE80211_CHAN_W_SCAN |
-                                IEEE80211_CHAN_W_ACTIVE_SCAN |
-                                IEEE80211_CHAN_W_IBSS;
+                if (i < chan_range.min || i > chan_range.max)
+                        priv->channels[i - 1].flags |= IEEE80211_CHAN_DISABLED;
 
         switch (priv->eeprom->specific_bbptype) {
         case ADM8211_BBP_RFMD3000:
@@ -347,7 +373,6 @@ static void adm8211_interrupt_rci(struct ieee80211_hw *dev)
         unsigned int pktlen;
         struct sk_buff *skb, *newskb;
         unsigned int limit = priv->rx_ring_size;
-        static const u8 rate_tbl[] = {10, 20, 55, 110, 220};
         u8 rssi, rate;
 
         while (!(priv->rx_ring[entry].status & cpu_to_le32(RDES0_STATUS_OWN))) {
@@ -425,12 +450,10 @@ static void adm8211_interrupt_rci(struct ieee80211_hw *dev)
                         else
                                 rx_status.ssi = 100 - rssi;
 
-                        if (rate <= 4)
-                                rx_status.rate = rate_tbl[rate];
+                        rx_status.rate_idx = rate;
 
-                        rx_status.channel = priv->channel;
-                        rx_status.freq = adm8211_channels[priv->channel - 1].freq;
-                        rx_status.phymode = MODE_IEEE80211B;
+                        rx_status.freq = adm8211_channels[priv->channel - 1].center_freq;
+                        rx_status.band = IEEE80211_BAND_2GHZ;
 
                         ieee80211_rx_irqsafe(dev, skb, &rx_status);
                 }
@@ -1054,7 +1077,7 @@ static int adm8211_set_rate(struct ieee80211_hw *dev)
         if (priv->pdev->revision != ADM8211_REV_BA) {
                 rate_buf[0] = ARRAY_SIZE(adm8211_rates);
                 for (i = 0; i < ARRAY_SIZE(adm8211_rates); i++)
-                        rate_buf[i + 1] = (adm8211_rates[i].rate / 5) | 0x80;
+                        rate_buf[i + 1] = (adm8211_rates[i].bitrate / 5) | 0x80;
         } else {
                 /* workaround for rev BA specific bug */
                 rate_buf[0] = 0x04;
@@ -1086,7 +1109,7 @@ static void adm8211_hw_init(struct ieee80211_hw *dev)
         u32 reg;
         u8 cline;
 
-        reg = le32_to_cpu(ADM8211_CSR_READ(PAR));
+        reg = ADM8211_CSR_READ(PAR);
         reg |= ADM8211_PAR_MRLE | ADM8211_PAR_MRME;
         reg &= ~(ADM8211_PAR_BAR | ADM8211_PAR_CAL);
 
@@ -1303,9 +1326,10 @@ static int adm8211_set_ssid(struct ieee80211_hw *dev, u8 *ssid, size_t ssid_len)
 static int adm8211_config(struct ieee80211_hw *dev, struct ieee80211_conf *conf)
 {
         struct adm8211_priv *priv = dev->priv;
+        int channel = ieee80211_frequency_to_channel(conf->channel->center_freq);
 
-        if (conf->channel != priv->channel) {
-                priv->channel = conf->channel;
+        if (channel != priv->channel) {
+                priv->channel = channel;
                 adm8211_rf_set_channel(dev, priv->channel);
         }
 
@@ -1678,13 +1702,9 @@ static int adm8211_tx(struct ieee80211_hw *dev, struct sk_buff *skb,
         int plcp, dur, len, plcp_signal, short_preamble;
         struct ieee80211_hdr *hdr;
 
-        if (control->tx_rate < 0) {
-                short_preamble = 1;
-                plcp_signal = -control->tx_rate;
-        } else {
-                short_preamble = 0;
-                plcp_signal = control->tx_rate;
-        }
+        short_preamble = !!(control->tx_rate->flags &
+                                        IEEE80211_TXCTL_SHORT_PREAMBLE);
+        plcp_signal = control->tx_rate->bitrate;
 
         hdr = (struct ieee80211_hdr *)skb->data;
         fc = le16_to_cpu(hdr->frame_control) & ~IEEE80211_FCTL_PROTECTED;
@@ -1880,18 +1900,11 @@ static int __devinit adm8211_probe(struct pci_dev *pdev,
         SET_IEEE80211_PERM_ADDR(dev, perm_addr);
 
         dev->extra_tx_headroom = sizeof(struct adm8211_tx_hdr);
-        dev->flags = IEEE80211_HW_DEFAULT_REG_DOMAIN_CONFIGURED;
-        /* IEEE80211_HW_RX_INCLUDES_FCS in promisc mode */
+        /* dev->flags = IEEE80211_HW_RX_INCLUDES_FCS in promisc mode */
 
         dev->channel_change_time = 1000;
         dev->max_rssi = 100;    /* FIXME: find better value */
 
-        priv->modes[0].mode = MODE_IEEE80211B;
-        /* channel info filled in by adm8211_read_eeprom */
-        memcpy(priv->rates, adm8211_rates, sizeof(adm8211_rates));
-        priv->modes[0].num_rates = ARRAY_SIZE(adm8211_rates);
-        priv->modes[0].rates = priv->rates;
-
         dev->queues = 1; /* ADM8211C supports more, maybe ADM8211B too */
 
         priv->retry_limit = 3;
@@ -1917,14 +1930,9 @@ static int __devinit adm8211_probe(struct pci_dev *pdev,
                 goto err_free_desc;
         }
 
-        priv->channel = priv->modes[0].channels[0].chan;
+        priv->channel = 1;
 
-        err = ieee80211_register_hwmode(dev, &priv->modes[0]);
-        if (err) {
-                printk(KERN_ERR "%s (adm8211): Can't register hwmode\n",
-                       pci_name(pdev));
-                goto err_free_desc;
-        }
+        dev->wiphy->bands[IEEE80211_BAND_2GHZ] = &priv->band;
 
         err = ieee80211_register_hw(dev);
         if (err) {
diff --git a/drivers/net/wireless/adm8211.h b/drivers/net/wireless/adm8211.h
index ef326fed42e4..8d7c564b3b04 100644
--- a/drivers/net/wireless/adm8211.h
+++ b/drivers/net/wireless/adm8211.h
@@ -534,61 +534,6 @@ struct adm8211_eeprom {
         u8      cis_data[0];            /* 0x80, 384 bytes */
 } __attribute__ ((packed));
 
-static const struct ieee80211_rate adm8211_rates[] = {
-        { .rate = 10,
-          .val = 10,
-          .val2 = -10,
-          .flags = IEEE80211_RATE_CCK_2 },
-        { .rate = 20,
-          .val = 20,
-          .val2 = -20,
-          .flags = IEEE80211_RATE_CCK_2 },
-        { .rate = 55,
-          .val = 55,
-          .val2 = -55,
-          .flags = IEEE80211_RATE_CCK_2 },
-        { .rate = 110,
-          .val = 110,
-          .val2 = -110,
-          .flags = IEEE80211_RATE_CCK_2 }
-};
-
-struct ieee80211_chan_range {
-        u8 min;
-        u8 max;
-};
-
-static const struct ieee80211_channel adm8211_channels[] = {
-        { .chan = 1,
-          .freq = 2412},
-        { .chan = 2,
-          .freq = 2417},
-        { .chan = 3,
-          .freq = 2422},
-        { .chan = 4,
-          .freq = 2427},
-        { .chan = 5,
-          .freq = 2432},
-        { .chan = 6,
-          .freq = 2437},
-        { .chan = 7,
-          .freq = 2442},
-        { .chan = 8,
-          .freq = 2447},
-        { .chan = 9,
-          .freq = 2452},
-        { .chan = 10,
-          .freq = 2457},
-        { .chan = 11,
-          .freq = 2462},
-        { .chan = 12,
-          .freq = 2467},
-        { .chan = 13,
-          .freq = 2472},
-        { .chan = 14,
-          .freq = 2484},
-};
-
 struct adm8211_priv {
         struct pci_dev *pdev;
         spinlock_t lock;
@@ -603,9 +548,8 @@ struct adm8211_priv {
         unsigned int cur_tx, dirty_tx, cur_rx;
 
         struct ieee80211_low_level_stats stats;
-        struct ieee80211_hw_mode modes[1];
-        struct ieee80211_channel channels[ARRAY_SIZE(adm8211_channels)];
-        struct ieee80211_rate rates[ARRAY_SIZE(adm8211_rates)];
+        struct ieee80211_supported_band band;
+        struct ieee80211_channel channels[14];
         int mode;
 
         int channel;
@@ -643,6 +587,11 @@ struct adm8211_priv {
         } transceiver_type;
 };
 
+struct ieee80211_chan_range {
+        u8 min;
+        u8 max;
+};
+
 static const struct ieee80211_chan_range cranges[] = {
         {1,  11},       /* FCC */
         {1,  11},       /* IC */
diff --git a/drivers/net/wireless/ath5k/Kconfig b/drivers/net/wireless/ath5k/Kconfig
new file mode 100644
index 000000000000..f1f2aea2eab4
--- /dev/null
+++ b/drivers/net/wireless/ath5k/Kconfig
@@ -0,0 +1,37 @@
+config ATH5K
+        tristate "Atheros 5xxx wireless cards support"
+        depends on PCI && MAC80211 && WLAN_80211 && EXPERIMENTAL
+        ---help---
+          This module adds support for wireless adapters based on
+          Atheros 5xxx chipset.
+
+          Currently the following chip versions are supported:
+
+          MAC: AR5211 AR5212
+          PHY: RF5111/2111 RF5112/2112 RF5413/2413
+
+          This driver uses the kernel's mac80211 subsystem.
+
+          If you choose to build a module, it'll be called ath5k. Say M if
+          unsure.
+
+config ATH5K_DEBUG
+        bool "Atheros 5xxx debugging"
+        depends on ATH5K
+        ---help---
+          Atheros 5xxx debugging messages.
+
+          Say Y, if and you will get debug options for ath5k.
+          To use this, you need to mount debugfs:
+
+          mkdir /debug/
+          mount -t debugfs debug /debug/
+
+          You will get access to files under:
+          /debug/ath5k/phy0/
+
+          To enable debug, pass the debug level to the debug module
+          parameter. For example:
+
+          modprobe ath5k debug=0x00000400
+
diff --git a/drivers/net/wireless/ath5k/Makefile b/drivers/net/wireless/ath5k/Makefile
index 321641f99e13..564ecd0c5d4b 100644
--- a/drivers/net/wireless/ath5k/Makefile
+++ b/drivers/net/wireless/ath5k/Makefile
@@ -1,2 +1,6 @@
-ath5k-objs              = base.o hw.o regdom.o initvals.o phy.o debug.o
-obj-$(CONFIG_ATH5K)     += ath5k.o
+ath5k-y                         += base.o
+ath5k-y                         += hw.o
+ath5k-y                         += initvals.o
+ath5k-y                         += phy.o
+ath5k-$(CONFIG_ATH5K_DEBUG)     += debug.o
+obj-$(CONFIG_ATH5K)             += ath5k.o
diff --git a/drivers/net/wireless/ath5k/ath5k.h b/drivers/net/wireless/ath5k/ath5k.h
index 69dea3392612..18223d9833f1 100644
--- a/drivers/net/wireless/ath5k/ath5k.h
+++ b/drivers/net/wireless/ath5k/ath5k.h
@@ -30,7 +30,6 @@
 #include <net/mac80211.h>
 
 #include "hw.h"
-#include "regdom.h"
 
 /* PCI IDs */
 #define PCI_DEVICE_ID_ATHEROS_AR5210            0x0007 /* AR5210 */
@@ -251,19 +250,23 @@ struct ath5k_srev_name {
  */
 #define MODULATION_TURBO        0x00000080
 
-enum ath5k_vendor_mode {
-        MODE_ATHEROS_TURBO = NUM_IEEE80211_MODES+1,
-        MODE_ATHEROS_TURBOG
+enum ath5k_driver_mode {
+        AR5K_MODE_11A           =       0,
+        AR5K_MODE_11A_TURBO     =       1,
+        AR5K_MODE_11B           =       2,
+        AR5K_MODE_11G           =       3,
+        AR5K_MODE_11G_TURBO     =       4,
+        AR5K_MODE_XR            =       0,
+        AR5K_MODE_MAX           =       5
 };
 
-/* Number of supported mac80211 enum ieee80211_phymode modes by this driver */
-#define NUM_DRIVER_MODES        3
-
 /* adding this flag to rate_code enables short preamble, see ar5212_reg.h */
 #define AR5K_SET_SHORT_PREAMBLE 0x04
 
-#define HAS_SHPREAMBLE(_ix) (rt->rates[_ix].modulation == IEEE80211_RATE_CCK_2)
-#define SHPREAMBLE_FLAG(_ix) (HAS_SHPREAMBLE(_ix) ? AR5K_SET_SHORT_PREAMBLE : 0)
+#define HAS_SHPREAMBLE(_ix) \
+        (rt->rates[_ix].modulation == IEEE80211_RATE_SHORT_PREAMBLE)
+#define SHPREAMBLE_FLAG(_ix) \
+        (HAS_SHPREAMBLE(_ix) ? AR5K_SET_SHORT_PREAMBLE : 0)
 
 /****************\
   TX DEFINITIONS
@@ -560,8 +563,8 @@ struct ath5k_desc {
  * Used internaly in OpenHAL (ar5211.c/ar5212.c
  * for reset_tx_queue). Also see struct struct ieee80211_channel.
  */
-#define IS_CHAN_XR(_c)  ((_c.val & CHANNEL_XR) != 0)
-#define IS_CHAN_B(_c)   ((_c.val & CHANNEL_B) != 0)
+#define IS_CHAN_XR(_c)  ((_c.hw_value & CHANNEL_XR) != 0)
+#define IS_CHAN_B(_c)   ((_c.hw_value & CHANNEL_B) != 0)
 
 /*
  * The following structure will be used to map 2GHz channels to
@@ -584,7 +587,7 @@ struct ath5k_athchan_2ghz {
 
 /**
  * struct ath5k_rate - rate structure
- * @valid: is this a valid rate for the current mode
+ * @valid: is this a valid rate for rate control (remove)
  * @modulation: respective mac80211 modulation
  * @rate_kbps: rate in kbit/s
  * @rate_code: hardware rate value, used in &struct ath5k_desc, on RX on
@@ -643,47 +646,48 @@ struct ath5k_rate_table {
 
 /*
  * Rate tables...
+ * TODO: CLEAN THIS !!!
  */
 #define AR5K_RATES_11A { 8, {                                   \
         255, 255, 255, 255, 255, 255, 255, 255, 6, 4, 2, 0,     \
         7, 5, 3, 1, 255, 255, 255, 255, 255, 255, 255, 255,     \
         255, 255, 255, 255, 255, 255, 255, 255 }, {             \
-        { 1, IEEE80211_RATE_OFDM, 6000, 11, 140, 0 },           \
-        { 1, IEEE80211_RATE_OFDM, 9000, 15, 18, 0 },            \
-        { 1, IEEE80211_RATE_OFDM, 12000, 10, 152, 2 },          \
-        { 1, IEEE80211_RATE_OFDM, 18000, 14, 36, 2 },           \
-        { 1, IEEE80211_RATE_OFDM, 24000, 9, 176, 4 },           \
-        { 1, IEEE80211_RATE_OFDM, 36000, 13, 72, 4 },           \
-        { 1, IEEE80211_RATE_OFDM, 48000, 8, 96, 4 },            \
-        { 1, IEEE80211_RATE_OFDM, 54000, 12, 108, 4 } }         \
+        { 1, 0, 6000, 11, 140, 0 },             \
+        { 1, 0, 9000, 15, 18, 0 },              \
+        { 1, 0, 12000, 10, 152, 2 },            \
+        { 1, 0, 18000, 14, 36, 2 },             \
+        { 1, 0, 24000, 9, 176, 4 },             \
+        { 1, 0, 36000, 13, 72, 4 },             \
+        { 1, 0, 48000, 8, 96, 4 },              \
+        { 1, 0, 54000, 12, 108, 4 } }           \
 }
 
 #define AR5K_RATES_11B { 4, {                                           \
         255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255,     \
         255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255,     \
         3, 2, 1, 0, 255, 255, 255, 255 }, {                             \
-        { 1, IEEE80211_RATE_CCK, 1000, 27, 130, 0 },    \
-        { 1, IEEE80211_RATE_CCK_2, 2000, 26, 132, 1 },  \
-        { 1, IEEE80211_RATE_CCK_2, 5500, 25, 139, 1 },  \
-        { 1, IEEE80211_RATE_CCK_2, 11000, 24, 150, 1 } }        \
+        { 1, 0, 1000, 27, 130, 0 },     \
+        { 1, IEEE80211_RATE_SHORT_PREAMBLE, 2000, 26, 132, 1 }, \
+        { 1, IEEE80211_RATE_SHORT_PREAMBLE, 5500, 25, 139, 1 }, \
+        { 1, IEEE80211_RATE_SHORT_PREAMBLE, 11000, 24, 150, 1 } }       \
 }
 
 #define AR5K_RATES_11G { 12, {                                  \
         255, 255, 255, 255, 255, 255, 255, 255, 10, 8, 6, 4,    \
         11, 9, 7, 5, 255, 255, 255, 255, 255, 255, 255, 255,    \
         3, 2, 1, 0, 255, 255, 255, 255 }, {                     \
-        { 1, IEEE80211_RATE_CCK, 1000, 27, 2, 0 },              \
-        { 1, IEEE80211_RATE_CCK_2, 2000, 26, 4, 1 },            \
-        { 1, IEEE80211_RATE_CCK_2, 5500, 25, 11, 1 },           \
-        { 1, IEEE80211_RATE_CCK_2, 11000, 24, 22, 1 },  \
-        { 0, IEEE80211_RATE_OFDM, 6000, 11, 12, 4 },    \
-        { 0, IEEE80211_RATE_OFDM, 9000, 15, 18, 4 },    \
-        { 1, IEEE80211_RATE_OFDM, 12000, 10, 24, 6 },   \
-        { 1, IEEE80211_RATE_OFDM, 18000, 14, 36, 6 },   \
-        { 1, IEEE80211_RATE_OFDM, 24000, 9, 48, 8 },    \
-        { 1, IEEE80211_RATE_OFDM, 36000, 13, 72, 8 },   \
-        { 1, IEEE80211_RATE_OFDM, 48000, 8, 96, 8 },    \
-        { 1, IEEE80211_RATE_OFDM, 54000, 12, 108, 8 } } \
+        { 1, 0, 1000, 27, 2, 0 },               \
+        { 1, IEEE80211_RATE_SHORT_PREAMBLE, 2000, 26, 4, 1 },           \
+        { 1, IEEE80211_RATE_SHORT_PREAMBLE, 5500, 25, 11, 1 },          \
+        { 1, IEEE80211_RATE_SHORT_PREAMBLE, 11000, 24, 22, 1 }, \
+        { 0, 0, 6000, 11, 12, 4 },      \
+        { 0, 0, 9000, 15, 18, 4 },      \
+        { 1, 0, 12000, 10, 24, 6 },     \
+        { 1, 0, 18000, 14, 36, 6 },     \
+        { 1, 0, 24000, 9, 48, 8 },      \
+        { 1, 0, 36000, 13, 72, 8 },     \
+        { 1, 0, 48000, 8, 96, 8 },      \
+        { 1, 0, 54000, 12, 108, 8 } }   \
 }
 
 #define AR5K_RATES_TURBO { 8, {                                 \
@@ -708,14 +712,14 @@ struct ath5k_rate_table {
         { 1, MODULATION_XR, 1000, 2, 139, 1 },          \
         { 1, MODULATION_XR, 2000, 6, 150, 2 },          \
         { 1, MODULATION_XR, 3000, 1, 150, 3 },          \
-        { 1, IEEE80211_RATE_OFDM, 6000, 11, 140, 4 },   \
-        { 1, IEEE80211_RATE_OFDM, 9000, 15, 18, 4 },    \
-        { 1, IEEE80211_RATE_OFDM, 12000, 10, 152, 6 },  \
-        { 1, IEEE80211_RATE_OFDM, 18000, 14, 36, 6 },   \
-        { 1, IEEE80211_RATE_OFDM, 24000, 9, 176, 8 },   \
-        { 1, IEEE80211_RATE_OFDM, 36000, 13, 72, 8 },   \
-        { 1, IEEE80211_RATE_OFDM, 48000, 8, 96, 8 },    \
-        { 1, IEEE80211_RATE_OFDM, 54000, 12, 108, 8 } } \
+        { 1, 0, 6000, 11, 140, 4 },     \
+        { 1, 0, 9000, 15, 18, 4 },      \
+        { 1, 0, 12000, 10, 152, 6 },    \
+        { 1, 0, 18000, 14, 36, 6 },     \
+        { 1, 0, 24000, 9, 176, 8 },     \
+        { 1, 0, 36000, 13, 72, 8 },     \
+        { 1, 0, 48000, 8, 96, 8 },      \
+        { 1, 0, 54000, 12, 108, 8 } }   \
 }
 
 /*
@@ -890,12 +894,14 @@ enum ath5k_capability_type {
         AR5K_CAP_RFSILENT               = 20,   /* Supports RFsilent */
 };
 
+
+/* XXX: we *may* move cap_range stuff to struct wiphy */
 struct ath5k_capabilities {
         /*
          * Supported PHY modes
          * (ie. CHANNEL_A, CHANNEL_B, ...)
          */
-        DECLARE_BITMAP(cap_mode, NUM_DRIVER_MODES);
+        DECLARE_BITMAP(cap_mode, AR5K_MODE_MAX);
 
         /*
          * Frequency range (without regulation restrictions)
@@ -908,14 +914,6 @@ struct ath5k_capabilities {
         } cap_range;
 
         /*
-         * Active regulation domain settings
-         */
-        struct {
-                enum ath5k_regdom reg_current;
-                enum ath5k_regdom reg_hw;
-        } cap_regdomain;
-
-        /*
          * Values stored in the EEPROM (some of them...)
          */
         struct ath5k_eeprom_info        cap_eeprom;
@@ -1129,8 +1127,6 @@ extern int ath5k_hw_set_gpio_input(struct ath5k_hw *ah, u32 gpio);
 extern u32 ath5k_hw_get_gpio(struct ath5k_hw *ah, u32 gpio);
 extern int ath5k_hw_set_gpio(struct ath5k_hw *ah, u32 gpio, u32 val);
 extern void ath5k_hw_set_gpio_intr(struct ath5k_hw *ah, unsigned int gpio, u32 interrupt_level);
-/* Regulatory Domain/Channels Setup */
-extern u16 ath5k_get_regdomain(struct ath5k_hw *ah);
 /* Misc functions */
 extern int ath5k_hw_get_capability(struct ath5k_hw *ah, enum ath5k_capability_type cap_type, u32 capability, u32 *result);
 
diff --git a/drivers/net/wireless/ath5k/base.c b/drivers/net/wireless/ath5k/base.c
index bef967ce34a6..393b5f3c25a7 100644
--- a/drivers/net/wireless/ath5k/base.c
+++ b/drivers/net/wireless/ath5k/base.c
@@ -80,7 +80,7 @@ MODULE_AUTHOR("Nick Kossifidis");
 MODULE_DESCRIPTION("Support for 5xxx series of Atheros 802.11 wireless LAN cards.");
 MODULE_SUPPORTED_DEVICE("Atheros 5xxx WLAN cards");
 MODULE_LICENSE("Dual BSD/GPL");
-MODULE_VERSION("0.1.1 (EXPERIMENTAL)");
+MODULE_VERSION("0.5.0 (EXPERIMENTAL)");
 
 
 /* Known PCI ids */
@@ -240,6 +240,8 @@ static int 	ath5k_chan_set(struct ath5k_softc *sc,
 static void     ath5k_setcurmode(struct ath5k_softc *sc,
                                 unsigned int mode);
 static void     ath5k_mode_setup(struct ath5k_softc *sc);
+static void     ath5k_set_total_hw_rates(struct ath5k_softc *sc);
+
 /* Descriptor setup */
 static int      ath5k_desc_alloc(struct ath5k_softc *sc,
                                 struct pci_dev *pdev);
@@ -511,35 +513,46 @@ ath5k_pci_probe(struct pci_dev *pdev,
                                         sc->ah->ah_mac_srev,
                                         sc->ah->ah_phy_revision);
 
-        if(!sc->ah->ah_single_chip){
+        if (!sc->ah->ah_single_chip) {
                 /* Single chip radio (!RF5111) */
-                if(sc->ah->ah_radio_5ghz_revision && !sc->ah->ah_radio_2ghz_revision) {
+                if (sc->ah->ah_radio_5ghz_revision &&
+                        !sc->ah->ah_radio_2ghz_revision) {
                         /* No 5GHz support -> report 2GHz radio */
-                        if(!test_bit(MODE_IEEE80211A, sc->ah->ah_capabilities.cap_mode)){
+                        if (!test_bit(AR5K_MODE_11A,
+                                sc->ah->ah_capabilities.cap_mode)) {
                                 ATH5K_INFO(sc, "RF%s 2GHz radio found (0x%x)\n",
-                                        ath5k_chip_name(AR5K_VERSION_RAD,sc->ah->ah_radio_5ghz_revision),
-                                                        sc->ah->ah_radio_5ghz_revision);
-                        /* No 2GHz support (5110 and some 5Ghz only cards) -> report 5Ghz radio */
-                        } else if(!test_bit(MODE_IEEE80211B, sc->ah->ah_capabilities.cap_mode)){
+                                        ath5k_chip_name(AR5K_VERSION_RAD,
+                                                sc->ah->ah_radio_5ghz_revision),
+                                                sc->ah->ah_radio_5ghz_revision);
+                        /* No 2GHz support (5110 and some
+                         * 5Ghz only cards) -> report 5Ghz radio */
+                        } else if (!test_bit(AR5K_MODE_11B,
+                                sc->ah->ah_capabilities.cap_mode)) {
                                 ATH5K_INFO(sc, "RF%s 5GHz radio found (0x%x)\n",
-                                        ath5k_chip_name(AR5K_VERSION_RAD,sc->ah->ah_radio_5ghz_revision),
-                                                        sc->ah->ah_radio_5ghz_revision);
+                                        ath5k_chip_name(AR5K_VERSION_RAD,
+                                                sc->ah->ah_radio_5ghz_revision),
+                                                sc->ah->ah_radio_5ghz_revision);
                         /* Multiband radio */
                         } else {
                                 ATH5K_INFO(sc, "RF%s multiband radio found"
                                         " (0x%x)\n",
-                                        ath5k_chip_name(AR5K_VERSION_RAD,sc->ah->ah_radio_5ghz_revision),
-                                                        sc->ah->ah_radio_5ghz_revision);
+                                        ath5k_chip_name(AR5K_VERSION_RAD,
+                                                sc->ah->ah_radio_5ghz_revision),
+                                                sc->ah->ah_radio_5ghz_revision);
                         }
                 }
-                /* Multi chip radio (RF5111 - RF2111) -> report both 2GHz/5GHz radios */
-                else if(sc->ah->ah_radio_5ghz_revision && sc->ah->ah_radio_2ghz_revision){
+                /* Multi chip radio (RF5111 - RF2111) ->
+                 * report both 2GHz/5GHz radios */
+                else if (sc->ah->ah_radio_5ghz_revision &&
+                                sc->ah->ah_radio_2ghz_revision){
                         ATH5K_INFO(sc, "RF%s 5GHz radio found (0x%x)\n",
-                                ath5k_chip_name(AR5K_VERSION_RAD,sc->ah->ah_radio_5ghz_revision),
-                                                sc->ah->ah_radio_5ghz_revision);
+                                ath5k_chip_name(AR5K_VERSION_RAD,
+                                        sc->ah->ah_radio_5ghz_revision),
+                                        sc->ah->ah_radio_5ghz_revision);
                         ATH5K_INFO(sc, "RF%s 2GHz radio found (0x%x)\n",
-                                ath5k_chip_name(AR5K_VERSION_RAD,sc->ah->ah_radio_2ghz_revision),
-                                                sc->ah->ah_radio_2ghz_revision);
+                                ath5k_chip_name(AR5K_VERSION_RAD,
+                                        sc->ah->ah_radio_2ghz_revision),
+                                        sc->ah->ah_radio_2ghz_revision);
                 }
         }
 
@@ -693,11 +706,14 @@ ath5k_attach(struct pci_dev *pdev, struct ieee80211_hw *hw)
                 goto err;
         }
 
+        /* Set *_rates so we can map hw rate index */
+        ath5k_set_total_hw_rates(sc);
+
         /* NB: setup here so ath5k_rate_update is happy */
-        if (test_bit(MODE_IEEE80211A, ah->ah_modes))
-                ath5k_setcurmode(sc, MODE_IEEE80211A);
+        if (test_bit(AR5K_MODE_11A, ah->ah_modes))
+                ath5k_setcurmode(sc, AR5K_MODE_11A);
         else
-                ath5k_setcurmode(sc, MODE_IEEE80211B);
+                ath5k_setcurmode(sc, AR5K_MODE_11B);
 
         /*
          * Allocate tx+rx descriptors and populate the lists.
@@ -837,12 +853,9 @@ ath5k_copy_rates(struct ieee80211_rate *rates,
                 return 0;
 
         for (i = 0, count = 0; i < rt->rate_count && max > 0; i++) {
-                if (!rt->rates[i].valid)
-                        continue;
-                rates->rate = rt->rates[i].rate_kbps / 100;
-                rates->val = rt->rates[i].rate_code;
-                rates->flags = rt->rates[i].modulation;
-                rates++;
+                rates[count].bitrate = rt->rates[i].rate_kbps / 100;
+                rates[count].hw_value = rt->rates[i].rate_code;
+                rates[count].flags = rt->rates[i].modulation;
                 count++;
                 max--;
         }
@@ -856,43 +869,22 @@ ath5k_copy_channels(struct ath5k_hw *ah,
                 unsigned int mode,
                 unsigned int max)
 {
-        static const struct { unsigned int mode, mask, chan; } map[] = {
-                [MODE_IEEE80211A] = { CHANNEL_OFDM, CHANNEL_OFDM | CHANNEL_TURBO, CHANNEL_A },
-                [MODE_ATHEROS_TURBO] = { CHANNEL_OFDM|CHANNEL_TURBO, CHANNEL_OFDM | CHANNEL_TURBO, CHANNEL_T },
-                [MODE_IEEE80211B] = { CHANNEL_CCK, CHANNEL_CCK, CHANNEL_B },
-                [MODE_IEEE80211G] = { CHANNEL_OFDM, CHANNEL_OFDM, CHANNEL_G },
-                [MODE_ATHEROS_TURBOG] = { CHANNEL_OFDM | CHANNEL_TURBO, CHANNEL_OFDM | CHANNEL_TURBO, CHANNEL_TG },
-        };
-        static const struct ath5k_regchannel chans_2ghz[] =
-                IEEE80211_CHANNELS_2GHZ;
-        static const struct ath5k_regchannel chans_5ghz[] =
-                IEEE80211_CHANNELS_5GHZ;
-        const struct ath5k_regchannel *chans;
-        enum ath5k_regdom dmn;
-        unsigned int i, count, size, chfreq, all, f, ch;
+        unsigned int i, count, size, chfreq, freq, ch;
 
         if (!test_bit(mode, ah->ah_modes))
                 return 0;
 
-        all = ah->ah_regdomain == DMN_DEFAULT || CHAN_DEBUG == 1;
-
         switch (mode) {
-        case MODE_IEEE80211A:
-        case MODE_ATHEROS_TURBO:
+        case AR5K_MODE_11A:
+        case AR5K_MODE_11A_TURBO:
                 /* 1..220, but 2GHz frequencies are filtered by check_channel */
-                size = all ? 220 : ARRAY_SIZE(chans_5ghz);
-                chans = chans_5ghz;
-                dmn = ath5k_regdom2flag(ah->ah_regdomain,
-                                IEEE80211_CHANNELS_5GHZ_MIN);
+                size = 220 ;
                 chfreq = CHANNEL_5GHZ;
                 break;
-        case MODE_IEEE80211B:
-        case MODE_IEEE80211G:
-        case MODE_ATHEROS_TURBOG:
-                size = all ? 26 : ARRAY_SIZE(chans_2ghz);
-                chans = chans_2ghz;
-                dmn = ath5k_regdom2flag(ah->ah_regdomain,
-                                IEEE80211_CHANNELS_2GHZ_MIN);
+        case AR5K_MODE_11B:
+        case AR5K_MODE_11G:
+        case AR5K_MODE_11G_TURBO:
+                size = 26;
                 chfreq = CHANNEL_2GHZ;
                 break;
         default:
@@ -901,25 +893,31 @@ ath5k_copy_channels(struct ath5k_hw *ah,
         }
 
         for (i = 0, count = 0; i < size && max > 0; i++) {
-                ch = all ? i + 1 : chans[i].chan;
-                f = ath5k_ieee2mhz(ch);
-                /* Check if channel is supported by the chipset */
-                if (!ath5k_channel_ok(ah, f, chfreq))
-                        continue;
+                ch = i + 1 ;
+                freq = ath5k_ieee2mhz(ch);
 
-                /* Match regulation domain */
-                if (!all && !(IEEE80211_DMN(chans[i].domain) &
-                                                        IEEE80211_DMN(dmn)))
+                /* Check if channel is supported by the chipset */
+                if (!ath5k_channel_ok(ah, freq, chfreq))
                         continue;
 
-                if (!all && (chans[i].mode & map[mode].mask) != map[mode].mode)
-                        continue;
+                /* Write channel info and increment counter */
+                channels[count].center_freq = freq;
+                channels[count].band = (chfreq == CHANNEL_2GHZ) ?
+                        IEEE80211_BAND_2GHZ : IEEE80211_BAND_5GHZ;
+                switch (mode) {
+                case AR5K_MODE_11A:
+                case AR5K_MODE_11G:
+                        channels[count].hw_value = chfreq | CHANNEL_OFDM;
+                        break;
+                case AR5K_MODE_11A_TURBO:
+                case AR5K_MODE_11G_TURBO:
+                        channels[count].hw_value = chfreq |
+                                CHANNEL_OFDM | CHANNEL_TURBO;
+                        break;
+                case AR5K_MODE_11B:
+                        channels[count].hw_value = CHANNEL_B;
+                }
 
-                /* Write channel and increment counter */
-                channels->chan = ch;
-                channels->freq = f;
-                channels->val = map[mode].chan;
-                channels++;
                 count++;
                 max--;
         }
@@ -927,95 +925,78 @@ ath5k_copy_channels(struct ath5k_hw *ah,
         return count;
 }
 
-/* Only tries to register modes our EEPROM says it can support */
-#define REGISTER_MODE(m) do { \
-        ret = ath5k_register_mode(hw, m); \
-        if (ret) \
-                return ret; \
-} while (0) \
-
-static inline int
-ath5k_register_mode(struct ieee80211_hw *hw, u8 m)
-{
-        struct ath5k_softc *sc = hw->priv;
-        struct ieee80211_hw_mode *modes = sc->modes;
-        unsigned int i;
-        int ret;
-
-        if (!test_bit(m, sc->ah->ah_capabilities.cap_mode))
-                return 0;
-
-        for (i = 0; i < NUM_DRIVER_MODES; i++) {
-                if (modes[i].mode != m || !modes[i].num_channels)
-                        continue;
-                ret = ieee80211_register_hwmode(hw, &modes[i]);
-                if (ret) {
-                        ATH5K_ERR(sc, "can't register hwmode %u\n", m);
-                        return ret;
-                }
-                return 0;
-        }
-        BUG();
-}
-
 static int
 ath5k_getchannels(struct ieee80211_hw *hw)
 {
         struct ath5k_softc *sc = hw->priv;
         struct ath5k_hw *ah = sc->ah;
-        struct ieee80211_hw_mode *modes = sc->modes;
-        unsigned int i, max_r, max_c;
-        int ret;
-
-        BUILD_BUG_ON(ARRAY_SIZE(sc->modes) < 3);
+        struct ieee80211_supported_band *sbands = sc->sbands;
+        const struct ath5k_rate_table *hw_rates;
+        unsigned int max_r, max_c, count_r, count_c;
+        int mode2g = AR5K_MODE_11G;
 
-        /* The order here does not matter */
-        modes[0].mode = MODE_IEEE80211G;
-        modes[1].mode = MODE_IEEE80211B;
-        modes[2].mode = MODE_IEEE80211A;
+        BUILD_BUG_ON(ARRAY_SIZE(sc->sbands) < IEEE80211_NUM_BANDS);
 
         max_r = ARRAY_SIZE(sc->rates);
         max_c = ARRAY_SIZE(sc->channels);
+        count_r = count_c = 0;
 
-        for (i = 0; i < NUM_DRIVER_MODES; i++) {
-                struct ieee80211_hw_mode *mode = &modes[i];
-                const struct ath5k_rate_table *hw_rates;
+        /* 2GHz band */
+        if (!test_bit(AR5K_MODE_11G, sc->ah->ah_capabilities.cap_mode)) {
+                mode2g = AR5K_MODE_11B;
+                if (!test_bit(AR5K_MODE_11B,
+                        sc->ah->ah_capabilities.cap_mode))
+                        mode2g = -1;
+        }
 
-                if (i == 0) {
-                        modes[0].rates  = sc->rates;
-                        modes->channels = sc->channels;
-                } else {
-                        struct ieee80211_hw_mode *prev_mode = &modes[i-1];
-                        int prev_num_r  = prev_mode->num_rates;
-                        int prev_num_c  = prev_mode->num_channels;
-                        mode->rates     = &prev_mode->rates[prev_num_r];
-                        mode->channels  = &prev_mode->channels[prev_num_c];
-                }
+        if (mode2g > 0) {
+                struct ieee80211_supported_band *sband =
+                        &sbands[IEEE80211_BAND_2GHZ];
+
+                sband->bitrates = sc->rates;
+                sband->channels = sc->channels;
+
+                sband->band = IEEE80211_BAND_2GHZ;
+                sband->n_channels = ath5k_copy_channels(ah, sband->channels,
+                                        mode2g, max_c);
+
+                hw_rates = ath5k_hw_get_rate_table(ah, mode2g);
+                sband->n_bitrates = ath5k_copy_rates(sband->bitrates,
+                                        hw_rates, max_r);
+
+                count_c = sband->n_channels;
+                count_r = sband->n_bitrates;
+
+                hw->wiphy->bands[IEEE80211_BAND_2GHZ] = sband;
+
+                max_r -= count_r;
+                max_c -= count_c;
 
-                hw_rates = ath5k_hw_get_rate_table(ah, mode->mode);
-                mode->num_rates    = ath5k_copy_rates(mode->rates, hw_rates,
-                        max_r);
-                mode->num_channels = ath5k_copy_channels(ah, mode->channels,
-                        mode->mode, max_c);
-                max_r -= mode->num_rates;
-                max_c -= mode->num_channels;
         }
 
-        /* We try to register all modes this driver supports. We don't bother
-         * with MODE_IEEE80211B for AR5212 as MODE_IEEE80211G already accounts
-         * for that as per mac80211. Then, REGISTER_MODE() will will actually
-         * check the eeprom reading for more reliable capability information.
-         * Order matters here as per mac80211's latest preference. This will
-         * all hopefullly soon go away. */
+        /* 5GHz band */
 
-        REGISTER_MODE(MODE_IEEE80211G);
-        if (ah->ah_version != AR5K_AR5212)
-                REGISTER_MODE(MODE_IEEE80211B);
-        REGISTER_MODE(MODE_IEEE80211A);
+        if (test_bit(AR5K_MODE_11A, sc->ah->ah_capabilities.cap_mode)) {
+                struct ieee80211_supported_band *sband =
+                        &sbands[IEEE80211_BAND_5GHZ];
 
-        ath5k_debug_dump_modes(sc, modes);
+                sband->bitrates = &sc->rates[count_r];
+                sband->channels = &sc->channels[count_c];
 
-        return ret;
+                sband->band = IEEE80211_BAND_5GHZ;
+                sband->n_channels = ath5k_copy_channels(ah, sband->channels,
+                                        AR5K_MODE_11A, max_c);
+
+                hw_rates = ath5k_hw_get_rate_table(ah, AR5K_MODE_11A);
+                sband->n_bitrates = ath5k_copy_rates(sband->bitrates,
+                                        hw_rates, max_r);
+
+                hw->wiphy->bands[IEEE80211_BAND_5GHZ] = sband;
+        }
+
+        ath5k_debug_dump_bands(sc);
+
+        return 0;
 }
 
 /*
@@ -1030,11 +1011,15 @@ ath5k_chan_set(struct ath5k_softc *sc, struct ieee80211_channel *chan)
         struct ath5k_hw *ah = sc->ah;
         int ret;
 
-        ATH5K_DBG(sc, ATH5K_DEBUG_RESET, "%u (%u MHz) -> %u (%u MHz)\n",
-                sc->curchan->chan, sc->curchan->freq,
-                chan->chan, chan->freq);
+        ATH5K_DBG(sc, ATH5K_DEBUG_RESET, "(%u MHz) -> (%u MHz)\n",
+                sc->curchan->center_freq, chan->center_freq);
+
+        if (chan->center_freq != sc->curchan->center_freq ||
+                chan->hw_value != sc->curchan->hw_value) {
+
+                sc->curchan = chan;
+                sc->curband = &sc->sbands[chan->band];
 
-        if (chan->freq != sc->curchan->freq || chan->val != sc->curchan->val) {
                 /*
                  * To switch channels clear any pending DMA operations;
                  * wait long enough for the RX fifo to drain, reset the
@@ -1044,13 +1029,13 @@ ath5k_chan_set(struct ath5k_softc *sc, struct ieee80211_channel *chan)
                 ath5k_hw_set_intr(ah, 0);       /* disable interrupts */
                 ath5k_txq_cleanup(sc);          /* clear pending tx frames */
                 ath5k_rx_stop(sc);              /* turn off frame recv */
-                ret = ath5k_hw_reset(ah, sc->opmode, chan, true);
+                ret = ath5k_hw_reset(ah, sc->opmode, sc->curchan, true);
                 if (ret) {
-                        ATH5K_ERR(sc, "%s: unable to reset channel %u "
-                                "(%u Mhz)\n", __func__, chan->chan, chan->freq);
+                        ATH5K_ERR(sc, "%s: unable to reset channel "
+                                "(%u Mhz)\n", __func__, chan->center_freq);
                         return ret;
                 }
-                sc->curchan = chan;
+
                 ath5k_hw_set_txpower_limit(sc->ah, 0);
 
                 /*
@@ -1081,6 +1066,9 @@ ath5k_chan_set(struct ath5k_softc *sc, struct ieee80211_channel *chan)
         return 0;
 }
 
+/*
+ * TODO: CLEAN THIS !!!
+ */
 static void
 ath5k_setcurmode(struct ath5k_softc *sc, unsigned int mode)
 {
@@ -1121,10 +1109,6 @@ ath5k_setcurmode(struct ath5k_softc *sc, unsigned int mode)
                                 continue;
                         }
                         sc->hwmap[i].txflags = IEEE80211_RADIOTAP_F_DATAPAD;
-                        if (SHPREAMBLE_FLAG(ix) || rt->rates[ix].modulation ==
-                                        IEEE80211_RATE_OFDM)
-                                sc->hwmap[i].txflags |=
-                                                IEEE80211_RADIOTAP_F_SHORTPRE;
                         /* receive frames include FCS */
                         sc->hwmap[i].rxflags = sc->hwmap[i].txflags |
                                         IEEE80211_RADIOTAP_F_FCS;
@@ -1142,6 +1126,12 @@ ath5k_setcurmode(struct ath5k_softc *sc, unsigned int mode)
         }
 
         sc->curmode = mode;
+
+        if (mode == AR5K_MODE_11A) {
+                sc->curband = &sc->sbands[IEEE80211_BAND_5GHZ];
+        } else {
+                sc->curband = &sc->sbands[IEEE80211_BAND_2GHZ];
+        }
 }
 
 static void
@@ -1164,6 +1154,72 @@ ath5k_mode_setup(struct ath5k_softc *sc)
         ATH5K_DBG(sc, ATH5K_DEBUG_MODE, "RX filter 0x%x\n", rfilt);
 }
 
+/*
+ * Match the hw provided rate index (through descriptors)
+ * to an index for sc->curband->bitrates, so it can be used
+ * by the stack.
+ *
+ * This one is a little bit tricky but i think i'm right
+ * about this...
+ *
+ * We have 4 rate tables in the following order:
+ * XR (4 rates)
+ * 802.11a (8 rates)
+ * 802.11b (4 rates)
+ * 802.11g (12 rates)
+ * that make the hw rate table.
+ *
+ * Lets take a 5211 for example that supports a and b modes only.
+ * First comes the 802.11a table and then 802.11b (total 12 rates).
+ * When hw returns eg. 11 it points to the last 802.11b rate (11Mbit),
+ * if it returns 2 it points to the second 802.11a rate etc.
+ *
+ * Same goes for 5212 who has xr/a/b/g support (total 28 rates).
+ * First comes the XR table, then 802.11a, 802.11b and 802.11g.
+ * When hw returns eg. 27 it points to the last 802.11g rate (54Mbits) etc
+ */
+static void
+ath5k_set_total_hw_rates(struct ath5k_softc *sc) {
+
+        struct ath5k_hw *ah = sc->ah;
+
+        if (test_bit(AR5K_MODE_11A, ah->ah_modes))
+                sc->a_rates = 8;
+
+        if (test_bit(AR5K_MODE_11B, ah->ah_modes))
+                sc->b_rates = 4;
+
+        if (test_bit(AR5K_MODE_11G, ah->ah_modes))
+                sc->g_rates = 12;
+
+        /* XXX: Need to see what what happens when
+                xr disable bits in eeprom are set */
+        if (ah->ah_version >= AR5K_AR5212)
+                sc->xr_rates = 4;
+
+}
+
+static inline int
+ath5k_hw_to_driver_rix(struct ath5k_softc *sc, int hw_rix) {
+
+        int mac80211_rix;
+
+        if(sc->curband->band == IEEE80211_BAND_2GHZ) {
+                /* We setup a g ratetable for both b/g modes */
+                mac80211_rix =
+                        hw_rix - sc->b_rates - sc->a_rates - sc->xr_rates;
+        } else {
+                mac80211_rix = hw_rix - sc->xr_rates;
+        }
+
+        /* Something went wrong, fallback to basic rate for this band */
+        if ((mac80211_rix >= sc->curband->n_bitrates) ||
+                (mac80211_rix <= 0 ))
+                mac80211_rix = 1;
+
+        return mac80211_rix;
+}
+
 
 
 
@@ -1268,7 +1324,8 @@ ath5k_txbuf_setup(struct ath5k_softc *sc, struct ath5k_buf *bf,
 
         ret = ah->ah_setup_tx_desc(ah, ds, pktlen,
                 ieee80211_get_hdrlen_from_skb(skb), AR5K_PKT_TYPE_NORMAL,
-                (ctl->power_level * 2), ctl->tx_rate, ctl->retry_limit, keyidx, 0, flags, 0, 0);
+                (sc->power_level * 2), ctl->tx_rate->hw_value,
+                ctl->retry_limit, keyidx, 0, flags, 0, 0);
         if (ret)
                 goto err_unmap;
 
@@ -1660,11 +1717,11 @@ ath5k_check_ibss_hw_merge(struct ath5k_softc *sc, struct sk_buff *skb)
         u32 hw_tu;
         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
 
-        if ((mgmt->frame_control & IEEE80211_FCTL_FTYPE) ==
+        if ((le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_FTYPE) ==
                 IEEE80211_FTYPE_MGMT &&
-            (mgmt->frame_control & IEEE80211_FCTL_STYPE) ==
+            (le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE) ==
                 IEEE80211_STYPE_BEACON &&
-            mgmt->u.beacon.capab_info & WLAN_CAPABILITY_IBSS &&
+            le16_to_cpu(mgmt->u.beacon.capab_info) & WLAN_CAPABILITY_IBSS &&
             memcmp(mgmt->bssid, sc->ah->ah_bssid, ETH_ALEN) == 0) {
                 /*
                  * Received an IBSS beacon with the same BSSID. Hardware might
@@ -1673,7 +1730,7 @@ ath5k_check_ibss_hw_merge(struct ath5k_softc *sc, struct sk_buff *skb)
                 hw_tu = TSF_TO_TU(ath5k_hw_get_tsf64(sc->ah));
                 if (hw_tu >= sc->nexttbtt) {
                         ath5k_beacon_update_timers(sc,
-                                mgmt->u.beacon.timestamp);
+                                le64_to_cpu(mgmt->u.beacon.timestamp));
                         ATH5K_DBG_UNLIMIT(sc, ATH5K_DEBUG_BEACON,
                                 "detected HW merge from received beacon\n");
                 }
@@ -1791,9 +1848,8 @@ accept:
                 rxs.mactime = ath5k_extend_tsf(sc->ah, ds->ds_rxstat.rs_tstamp);
                 rxs.flag |= RX_FLAG_TSFT;
 
-                rxs.freq = sc->curchan->freq;
-                rxs.channel = sc->curchan->chan;
-                rxs.phymode = sc->curmode;
+                rxs.freq = sc->curchan->center_freq;
+                rxs.band = sc->curband->band;
 
                 /*
                  * signal quality:
@@ -1811,7 +1867,8 @@ accept:
                 rxs.signal = ds->ds_rxstat.rs_rssi * 100 / 64;
 
                 rxs.antenna = ds->ds_rxstat.rs_antenna;
-                rxs.rate = ds->ds_rxstat.rs_rate;
+                rxs.rate_idx = ath5k_hw_to_driver_rix(sc,
+                        ds->ds_rxstat.rs_rate);
                 rxs.flag |= ath5k_rx_decrypted(sc, ds, skb);
 
                 ath5k_debug_dump_skb(sc, skb, "RX  ", 0);
@@ -1958,8 +2015,9 @@ ath5k_beacon_setup(struct ath5k_softc *sc, struct ath5k_buf *bf,
         ds->ds_data = bf->skbaddr;
         ret = ah->ah_setup_tx_desc(ah, ds, skb->len,
                         ieee80211_get_hdrlen_from_skb(skb),
-                        AR5K_PKT_TYPE_BEACON, (ctl->power_level * 2), ctl->tx_rate, 1,
-                        AR5K_TXKEYIX_INVALID, antenna, flags, 0, 0);
+                        AR5K_PKT_TYPE_BEACON, (sc->power_level * 2),
+                        ctl->tx_rate->hw_value, 1, AR5K_TXKEYIX_INVALID,
+                        antenna, flags, 0, 0);
         if (ret)
                 goto err_unmap;
 
@@ -2211,7 +2269,8 @@ ath5k_init(struct ath5k_softc *sc)
          * be followed by initialization of the appropriate bits
          * and then setup of the interrupt mask.
          */
-        sc->curchan = sc->hw->conf.chan;
+        sc->curchan = sc->hw->conf.channel;
+        sc->curband = &sc->sbands[sc->curchan->band];
         ret = ath5k_hw_reset(sc->ah, sc->opmode, sc->curchan, false);
         if (ret) {
                 ATH5K_ERR(sc, "unable to reset hardware: %d\n", ret);
@@ -2448,7 +2507,8 @@ ath5k_calibrate(unsigned long data)
         struct ath5k_hw *ah = sc->ah;
 
         ATH5K_DBG(sc, ATH5K_DEBUG_CALIBRATE, "channel %u/%x\n",
-                sc->curchan->chan, sc->curchan->val);
+                ieee80211_frequency_to_channel(sc->curchan->center_freq),
+                sc->curchan->hw_value);
 
         if (ath5k_hw_get_rf_gain(ah) == AR5K_RFGAIN_NEED_CHANGE) {
                 /*
@@ -2460,7 +2520,8 @@ ath5k_calibrate(unsigned long data)
         }
         if (ath5k_hw_phy_calibrate(ah, sc->curchan))
                 ATH5K_ERR(sc, "calibration of channel %u failed\n",
-                                sc->curchan->chan);
+                        ieee80211_frequency_to_channel(
+                                sc->curchan->center_freq));
 
         mod_timer(&sc->calib_tim, round_jiffies(jiffies +
                         msecs_to_jiffies(ath5k_calinterval * 1000)));
@@ -2558,7 +2619,7 @@ ath5k_tx(struct ieee80211_hw *hw, struct sk_buff *skb,
                 memmove(skb->data, skb->data+pad, hdrlen);
         }
 
-        sc->led_txrate = ctl->tx_rate;
+        sc->led_txrate = ctl->tx_rate->hw_value;
 
         spin_lock_irqsave(&sc->txbuflock, flags);
         if (list_empty(&sc->txbuf)) {
@@ -2597,11 +2658,6 @@ ath5k_reset(struct ieee80211_hw *hw)
         int ret;
 
         ATH5K_DBG(sc, ATH5K_DEBUG_RESET, "resetting\n");
-        /*
-         * Convert to a hw channel description with the flags
-         * constrained to reflect the current operating mode.
-         */
-        sc->curchan = hw->conf.chan;
 
         ath5k_hw_set_intr(ah, 0);
         ath5k_txq_cleanup(sc);
@@ -2692,6 +2748,9 @@ end:
         mutex_unlock(&sc->lock);
 }
 
+/*
+ * TODO: Phy disable/diversity etc
+ */
 static int
 ath5k_config(struct ieee80211_hw *hw,
                         struct ieee80211_conf *conf)
@@ -2699,9 +2758,9 @@ ath5k_config(struct ieee80211_hw *hw,
         struct ath5k_softc *sc = hw->priv;
 
         sc->bintval = conf->beacon_int;
-        ath5k_setcurmode(sc, conf->phymode);
+        sc->power_level = conf->power_level;
 
-        return ath5k_chan_set(sc, conf->chan);
+        return ath5k_chan_set(sc, conf->channel);
 }
 
 static int
@@ -2869,7 +2928,9 @@ ath5k_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
 
         switch(key->alg) {
         case ALG_WEP:
-                break;
+        /* XXX: fix hardware encryption, its not working. For now
+         * allow software encryption */
+                /* break; */
         case ALG_TKIP:
         case ALG_CCMP:
                 return -EOPNOTSUPP;
diff --git a/drivers/net/wireless/ath5k/base.h b/drivers/net/wireless/ath5k/base.h
index 8287ae787f12..3a9755893018 100644
--- a/drivers/net/wireless/ath5k/base.h
+++ b/drivers/net/wireless/ath5k/base.h
@@ -83,7 +83,7 @@ struct ath5k_txq {
 #if CHAN_DEBUG
 #define ATH_CHAN_MAX    (26+26+26+200+200)
 #else
-#define ATH_CHAN_MAX    (14+14+14+252+20)       /* XXX what's the max? */
+#define ATH_CHAN_MAX    (14+14+14+252+20)
 #endif
 
 /* Software Carrier, keeps track of the driver state
@@ -95,15 +95,22 @@ struct ath5k_softc {
         struct ieee80211_tx_queue_stats tx_stats;
         struct ieee80211_low_level_stats ll_stats;
         struct ieee80211_hw     *hw;            /* IEEE 802.11 common */
-        struct ieee80211_hw_mode modes[NUM_DRIVER_MODES];
+        struct ieee80211_supported_band sbands[IEEE80211_NUM_BANDS];
         struct ieee80211_channel channels[ATH_CHAN_MAX];
-        struct ieee80211_rate   rates[AR5K_MAX_RATES * NUM_DRIVER_MODES];
+        struct ieee80211_rate   rates[AR5K_MAX_RATES * IEEE80211_NUM_BANDS];
         enum ieee80211_if_types opmode;
         struct ath5k_hw         *ah;            /* Atheros HW */
 
-#if ATH5K_DEBUG
+        struct ieee80211_supported_band         *curband;
+
+        u8                      a_rates;
+        u8                      b_rates;
+        u8                      g_rates;
+        u8                      xr_rates;
+
+#ifdef CONFIG_ATH5K_DEBUG
         struct ath5k_dbg_info   debug;          /* debug info */
-#endif
+#endif /* CONFIG_ATH5K_DEBUG */
 
         struct ath5k_buf        *bufptr;        /* allocated buffer ptr */
         struct ath5k_desc       *desc;          /* TX/RX descriptors */
@@ -169,6 +176,7 @@ struct ath5k_softc {
         unsigned int            nexttbtt;       /* next beacon time in TU */
 
         struct timer_list       calib_tim;      /* calibration timer */
+        int                     power_level;    /* Requested tx power in dbm */
 };
 
 #define ath5k_hw_hasbssidmask(_ah) \
diff --git a/drivers/net/wireless/ath5k/debug.c b/drivers/net/wireless/ath5k/debug.c
index bb581ef6d1ef..05bf4fb8f907 100644
--- a/drivers/net/wireless/ath5k/debug.c
+++ b/drivers/net/wireless/ath5k/debug.c
@@ -65,7 +65,7 @@ static unsigned int ath5k_debug;
 module_param_named(debug, ath5k_debug, uint, 0);
 
 
-#if ATH5K_DEBUG
+#ifdef CONFIG_ATH5K_DEBUG
 
 #include <linux/seq_file.h>
 #include "reg.h"
@@ -340,7 +340,7 @@ static struct {
         { ATH5K_DEBUG_LED,      "led",          "LED mamagement" },
         { ATH5K_DEBUG_DUMP_RX,  "dumprx",       "print received skb content" },
         { ATH5K_DEBUG_DUMP_TX,  "dumptx",       "print transmit skb content" },
-        { ATH5K_DEBUG_DUMPMODES, "dumpmodes",   "dump modes" },
+        { ATH5K_DEBUG_DUMPBANDS, "dumpbands",   "dump bands" },
         { ATH5K_DEBUG_TRACE,    "trace",        "trace function calls" },
         { ATH5K_DEBUG_ANY,      "all",          "show all debug levels" },
 };
@@ -452,30 +452,47 @@ ath5k_debug_finish_device(struct ath5k_softc *sc)
 /* functions used in other places */
 
 void
-ath5k_debug_dump_modes(struct ath5k_softc *sc, struct ieee80211_hw_mode *modes)
+ath5k_debug_dump_bands(struct ath5k_softc *sc)
 {
-        unsigned int m, i;
+        unsigned int b, i;
 
-        if (likely(!(sc->debug.level & ATH5K_DEBUG_DUMPMODES)))
+        if (likely(!(sc->debug.level & ATH5K_DEBUG_DUMPBANDS)))
                 return;
 
-        for (m = 0; m < NUM_DRIVER_MODES; m++) {
-                printk(KERN_DEBUG "Mode %u: channels %d, rates %d\n", m,
-                                modes[m].num_channels, modes[m].num_rates);
+        BUG_ON(!sc->sbands);
+
+        for (b = 0; b < IEEE80211_NUM_BANDS; b++) {
+                struct ieee80211_supported_band *band = &sc->sbands[b];
+                char bname[5];
+                switch (band->band) {
+                case IEEE80211_BAND_2GHZ:
+                        strcpy(bname, "2 GHz");
+                        break;
+                case IEEE80211_BAND_5GHZ:
+                        strcpy(bname, "5 GHz");
+                        break;
+                default:
+                        printk(KERN_DEBUG "Band not supported: %d\n",
+                                band->band);
+                        return;
+                }
+                printk(KERN_DEBUG "Band %s: channels %d, rates %d\n", bname,
+                                band->n_channels, band->n_bitrates);
                 printk(KERN_DEBUG " channels:\n");
-                for (i = 0; i < modes[m].num_channels; i++)
+                for (i = 0; i < band->n_channels; i++)
                         printk(KERN_DEBUG "  %3d %d %.4x %.4x\n",
-                                        modes[m].channels[i].chan,
-                                        modes[m].channels[i].freq,
-                                        modes[m].channels[i].val,
-                                        modes[m].channels[i].flag);
+                                        ieee80211_frequency_to_channel(
+                                                band->channels[i].center_freq),
+                                        band->channels[i].center_freq,
+                                        band->channels[i].hw_value,
+                                        band->channels[i].flags);
                 printk(KERN_DEBUG " rates:\n");
-                for (i = 0; i < modes[m].num_rates; i++)
+                for (i = 0; i < band->n_bitrates; i++)
                         printk(KERN_DEBUG "  %4d %.4x %.4x %.4x\n",
-                                        modes[m].rates[i].rate,
-                                        modes[m].rates[i].val,
-                                        modes[m].rates[i].flags,
-                                        modes[m].rates[i].val2);
+                                        band->bitrates[i].bitrate,
+                                        band->bitrates[i].hw_value,
+                                        band->bitrates[i].flags,
+                                        band->bitrates[i].hw_value_short);
         }
 }
 
@@ -548,4 +565,4 @@ ath5k_debug_printtxbuf(struct ath5k_softc *sc,
                 !done ? ' ' : (ds->ds_txstat.ts_status == 0) ? '*' : '!');
 }
 
-#endif /* if ATH5K_DEBUG */
+#endif /* ifdef CONFIG_ATH5K_DEBUG */
diff --git a/drivers/net/wireless/ath5k/debug.h b/drivers/net/wireless/ath5k/debug.h
index c4fd8c43df0c..8c0b5c57c76b 100644
--- a/drivers/net/wireless/ath5k/debug.h
+++ b/drivers/net/wireless/ath5k/debug.h
@@ -61,11 +61,6 @@
 #ifndef _ATH5K_DEBUG_H
 #define _ATH5K_DEBUG_H
 
-/* set this to 1 for debugging output */
-#ifndef ATH5K_DEBUG
-#define ATH5K_DEBUG     0
-#endif
-
 struct ath5k_softc;
 struct ath5k_hw;
 struct ieee80211_hw_mode;
@@ -96,7 +91,7 @@ struct ath5k_dbg_info {
  * @ATH5K_DEBUG_LED: led management
  * @ATH5K_DEBUG_DUMP_RX: print received skb content
  * @ATH5K_DEBUG_DUMP_TX: print transmit skb content
- * @ATH5K_DEBUG_DUMPMODES: dump modes
+ * @ATH5K_DEBUG_DUMPBANDS: dump bands
  * @ATH5K_DEBUG_TRACE: trace function calls
  * @ATH5K_DEBUG_ANY: show at any debug level
  *
@@ -118,12 +113,12 @@ enum ath5k_debug_level {
         ATH5K_DEBUG_LED         = 0x00000080,
         ATH5K_DEBUG_DUMP_RX     = 0x00000100,
         ATH5K_DEBUG_DUMP_TX     = 0x00000200,
-        ATH5K_DEBUG_DUMPMODES   = 0x00000400,
+        ATH5K_DEBUG_DUMPBANDS   = 0x00000400,
         ATH5K_DEBUG_TRACE       = 0x00001000,
         ATH5K_DEBUG_ANY         = 0xffffffff
 };
 
-#if ATH5K_DEBUG
+#ifdef CONFIG_ATH5K_DEBUG
 
 #define ATH5K_TRACE(_sc) do { \
         if (unlikely((_sc)->debug.level & ATH5K_DEBUG_TRACE)) \
@@ -158,8 +153,7 @@ void
 ath5k_debug_printrxbuffs(struct ath5k_softc *sc, struct ath5k_hw *ah);
 
 void
-ath5k_debug_dump_modes(struct ath5k_softc *sc,
-                        struct ieee80211_hw_mode *modes);
+ath5k_debug_dump_bands(struct ath5k_softc *sc);
 
 void
 ath5k_debug_dump_skb(struct ath5k_softc *sc,
@@ -171,7 +165,9 @@ ath5k_debug_printtxbuf(struct ath5k_softc *sc,
 
 #else /* no debugging */
 
-#define ATH5K_TRACE(_sc) /* empty */
+#include <linux/compiler.h>
+
+#define ATH5K_TRACE(_sc) typecheck(struct ath5k_softc *, (_sc))
 
 static inline void __attribute__ ((format (printf, 3, 4)))
 ATH5K_DBG(struct ath5k_softc *sc, unsigned int m, const char *fmt, ...) {}
@@ -196,8 +192,7 @@ static inline void
 ath5k_debug_printrxbuffs(struct ath5k_softc *sc, struct ath5k_hw *ah) {}
 
 static inline void
-ath5k_debug_dump_modes(struct ath5k_softc *sc,
-                        struct ieee80211_hw_mode *modes) {}
+ath5k_debug_dump_bands(struct ath5k_softc *sc) {}
 
 static inline void
 ath5k_debug_dump_skb(struct ath5k_softc *sc,
@@ -207,6 +202,6 @@ static inline void
 ath5k_debug_printtxbuf(struct ath5k_softc *sc,
                         struct ath5k_buf *bf, int done) {}
 
-#endif /* if ATH5K_DEBUG */
+#endif /* ifdef CONFIG_ATH5K_DEBUG */
 
 #endif /* ifndef _ATH5K_DEBUG_H */
diff --git a/drivers/net/wireless/ath5k/hw.c b/drivers/net/wireless/ath5k/hw.c
index c2de2d958e8e..eec2b806a0de 100644
--- a/drivers/net/wireless/ath5k/hw.c
+++ b/drivers/net/wireless/ath5k/hw.c
@@ -140,9 +140,6 @@ struct ath5k_hw *ath5k_hw_attach(struct ath5k_softc *sc, u8 mac_version)
          * HW information
          */
 
-        /* Get reg domain from eeprom */
-        ath5k_get_regdomain(ah);
-
         ah->ah_op_mode = IEEE80211_IF_TYPE_STA;
         ah->ah_radar.r_enabled = AR5K_TUNE_RADAR_ALERT;
         ah->ah_turbo = false;
@@ -405,15 +402,15 @@ const struct ath5k_rate_table *ath5k_hw_get_rate_table(struct ath5k_hw *ah,
 
         /* Get rate tables */
         switch (mode) {
-        case MODE_IEEE80211A:
+        case AR5K_MODE_11A:
                 return &ath5k_rt_11a;
-        case MODE_ATHEROS_TURBO:
+        case AR5K_MODE_11A_TURBO:
                 return &ath5k_rt_turbo;
-        case MODE_IEEE80211B:
+        case AR5K_MODE_11B:
                 return &ath5k_rt_11b;
-        case MODE_IEEE80211G:
+        case AR5K_MODE_11G:
                 return &ath5k_rt_11g;
-        case MODE_ATHEROS_TURBOG:
+        case AR5K_MODE_11G_TURBO:
                 return &ath5k_rt_xr;
         }
 
@@ -457,15 +454,15 @@ static inline int ath5k_hw_write_ofdm_timings(struct ath5k_hw *ah,
                 ds_coef_exp, ds_coef_man, clock;
 
         if (!(ah->ah_version == AR5K_AR5212) ||
-                !(channel->val & CHANNEL_OFDM))
+                !(channel->hw_value & CHANNEL_OFDM))
                 BUG();
 
         /* Seems there are two PLLs, one for baseband sampling and one
          * for tuning. Tuning basebands are 40 MHz or 80MHz when in
          * turbo. */
-        clock = channel->val & CHANNEL_TURBO ? 80 : 40;
+        clock = channel->hw_value & CHANNEL_TURBO ? 80 : 40;
         coef_scaled = ((5 * (clock << 24)) / 2) /
-        channel->freq;
+        channel->center_freq;
 
         for (coef_exp = 31; coef_exp > 0; coef_exp--)
                 if ((coef_scaled >> coef_exp) & 0x1)
@@ -492,8 +489,7 @@ static inline int ath5k_hw_write_ofdm_timings(struct ath5k_hw *ah,
  * ath5k_hw_write_rate_duration - set rate duration during hw resets
  *
  * @ah: the &struct ath5k_hw
- * @driver_mode: one of enum ieee80211_phymode or our one of our own
- *     vendor modes
+ * @mode: one of enum ath5k_driver_mode
  *
  * Write the rate duration table for the current mode upon hw reset. This
  * is a helper for ath5k_hw_reset(). It seems all this is doing is setting
@@ -504,19 +500,20 @@ static inline int ath5k_hw_write_ofdm_timings(struct ath5k_hw *ah,
  *
  */
 static inline void ath5k_hw_write_rate_duration(struct ath5k_hw *ah,
-       unsigned int driver_mode)
+       unsigned int mode)
 {
         struct ath5k_softc *sc = ah->ah_sc;
         const struct ath5k_rate_table *rt;
+        struct ieee80211_rate srate = {};
         unsigned int i;
 
         /* Get rate table for the current operating mode */
-        rt = ath5k_hw_get_rate_table(ah,
-                driver_mode);
+        rt = ath5k_hw_get_rate_table(ah, mode);
 
         /* Write rate duration table */
         for (i = 0; i < rt->rate_count; i++) {
                 const struct ath5k_rate *rate, *control_rate;
+
                 u32 reg;
                 u16 tx_time;
 
@@ -526,14 +523,16 @@ static inline void ath5k_hw_write_rate_duration(struct ath5k_hw *ah,
                 /* Set ACK timeout */
                 reg = AR5K_RATE_DUR(rate->rate_code);
 
+                srate.bitrate = control_rate->rate_kbps/100;
+
                 /* An ACK frame consists of 10 bytes. If you add the FCS,
                  * which ieee80211_generic_frame_duration() adds,
                  * its 14 bytes. Note we use the control rate and not the
                  * actual rate for this rate. See mac80211 tx.c
                  * ieee80211_duration() for a brief description of
                  * what rate we should choose to TX ACKs. */
-                tx_time = ieee80211_generic_frame_duration(sc->hw,
-                        sc->vif, 10, control_rate->rate_kbps/100);
+                tx_time = le16_to_cpu(ieee80211_generic_frame_duration(sc->hw,
+                                                        sc->vif, 10, &srate));
 
                 ath5k_hw_reg_write(ah, tx_time, reg);
 
@@ -567,7 +566,7 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum ieee80211_if_types op_mode,
 {
         struct ath5k_eeprom_info *ee = &ah->ah_capabilities.cap_eeprom;
         u32 data, s_seq, s_ant, s_led[3];
-        unsigned int i, mode, freq, ee_mode, ant[2], driver_mode = -1;
+        unsigned int i, mode, freq, ee_mode, ant[2];
         int ret;
 
         ATH5K_TRACE(ah->ah_sc);
@@ -602,7 +601,7 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum ieee80211_if_types op_mode,
 
 
         /*Wakeup the device*/
-        ret = ath5k_hw_nic_wakeup(ah, channel->val, false);
+        ret = ath5k_hw_nic_wakeup(ah, channel->hw_value, false);
         if (ret)
                 return ret;
 
@@ -624,37 +623,32 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum ieee80211_if_types op_mode,
                         return -EINVAL;
                 }
 
-                switch (channel->val & CHANNEL_MODES) {
+                switch (channel->hw_value & CHANNEL_MODES) {
                 case CHANNEL_A:
-                        mode = AR5K_INI_VAL_11A;
+                        mode = AR5K_MODE_11A;
                         freq = AR5K_INI_RFGAIN_5GHZ;
                         ee_mode = AR5K_EEPROM_MODE_11A;
-                        driver_mode = MODE_IEEE80211A;
                         break;
                 case CHANNEL_G:
-                        mode = AR5K_INI_VAL_11G;
+                        mode = AR5K_MODE_11G;
                         freq = AR5K_INI_RFGAIN_2GHZ;
                         ee_mode = AR5K_EEPROM_MODE_11G;
-                        driver_mode = MODE_IEEE80211G;
                         break;
                 case CHANNEL_B:
-                        mode = AR5K_INI_VAL_11B;
+                        mode = AR5K_MODE_11B;
                         freq = AR5K_INI_RFGAIN_2GHZ;
                         ee_mode = AR5K_EEPROM_MODE_11B;
-                        driver_mode = MODE_IEEE80211B;
                         break;
                 case CHANNEL_T:
-                        mode = AR5K_INI_VAL_11A_TURBO;
+                        mode = AR5K_MODE_11A_TURBO;
                         freq = AR5K_INI_RFGAIN_5GHZ;
                         ee_mode = AR5K_EEPROM_MODE_11A;
-                        driver_mode = MODE_ATHEROS_TURBO;
                         break;
                 /*Is this ok on 5211 too ?*/
                 case CHANNEL_TG:
-                        mode = AR5K_INI_VAL_11G_TURBO;
+                        mode = AR5K_MODE_11G_TURBO;
                         freq = AR5K_INI_RFGAIN_2GHZ;
                         ee_mode = AR5K_EEPROM_MODE_11G;
-                        driver_mode = MODE_ATHEROS_TURBOG;
                         break;
                 case CHANNEL_XR:
                         if (ah->ah_version == AR5K_AR5211) {
@@ -662,14 +656,13 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum ieee80211_if_types op_mode,
                                         "XR mode not available on 5211");
                                 return -EINVAL;
                         }
-                        mode = AR5K_INI_VAL_XR;
+                        mode = AR5K_MODE_XR;
                         freq = AR5K_INI_RFGAIN_5GHZ;
                         ee_mode = AR5K_EEPROM_MODE_11A;
-                        driver_mode = MODE_IEEE80211A;
                         break;
                 default:
                         ATH5K_ERR(ah->ah_sc,
-                                "invalid channel: %d\n", channel->freq);
+                                "invalid channel: %d\n", channel->center_freq);
                         return -EINVAL;
                 }
 
@@ -702,7 +695,7 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum ieee80211_if_types op_mode,
                 if (ah->ah_version > AR5K_AR5211){ /* found on 5213+ */
                         ath5k_hw_reg_write(ah, 0x0002a002, AR5K_PHY(11));
 
-                        if (channel->val == CHANNEL_G)
+                        if (channel->hw_value == CHANNEL_G)
                                 ath5k_hw_reg_write(ah, 0x00f80d80, AR5K_PHY(83)); /* 0x00fc0ec0 */
                         else
                                 ath5k_hw_reg_write(ah, 0x00000000, AR5K_PHY(83));
@@ -720,7 +713,7 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum ieee80211_if_types op_mode,
                                 AR5K_SREV_RAD_5112A) {
                         ath5k_hw_reg_write(ah, AR5K_PHY_CCKTXCTL_WORLD,
                                         AR5K_PHY_CCKTXCTL);
-                        if (channel->val & CHANNEL_5GHZ)
+                        if (channel->hw_value & CHANNEL_5GHZ)
                                 data = 0xffb81020;
                         else
                                 data = 0xffb80d20;
@@ -740,7 +733,7 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum ieee80211_if_types op_mode,
                  * mac80211 are integrated */
                 if (ah->ah_version == AR5K_AR5212 &&
                         ah->ah_sc->vif != NULL)
-                        ath5k_hw_write_rate_duration(ah, driver_mode);
+                        ath5k_hw_write_rate_duration(ah, mode);
 
                 /*
                  * Write RF registers
@@ -756,7 +749,7 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum ieee80211_if_types op_mode,
 
                 /* Write OFDM timings on 5212*/
                 if (ah->ah_version == AR5K_AR5212 &&
-                        channel->val & CHANNEL_OFDM) {
+                        channel->hw_value & CHANNEL_OFDM) {
                         ret = ath5k_hw_write_ofdm_timings(ah, channel);
                         if (ret)
                                 return ret;
@@ -765,7 +758,7 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum ieee80211_if_types op_mode,
                 /*Enable/disable 802.11b mode on 5111
                 (enable 2111 frequency converter + CCK)*/
                 if (ah->ah_radio == AR5K_RF5111) {
-                        if (driver_mode == MODE_IEEE80211B)
+                        if (mode == AR5K_MODE_11B)
                                 AR5K_REG_ENABLE_BITS(ah, AR5K_TXCFG,
                                     AR5K_TXCFG_B_MODE);
                         else
@@ -903,7 +896,7 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum ieee80211_if_types op_mode,
         if (ah->ah_version != AR5K_AR5210) {
                 data = ath5k_hw_reg_read(ah, AR5K_PHY_RX_DELAY) &
                         AR5K_PHY_RX_DELAY_M;
-                data = (channel->val & CHANNEL_CCK) ?
+                data = (channel->hw_value & CHANNEL_CCK) ?
                         ((data << 2) / 22) : (data / 10);
 
                 udelay(100 + data);
@@ -920,11 +913,11 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum ieee80211_if_types op_mode,
         if (ath5k_hw_register_timeout(ah, AR5K_PHY_AGCCTL,
                         AR5K_PHY_AGCCTL_CAL, 0, false)) {
                 ATH5K_ERR(ah->ah_sc, "calibration timeout (%uMHz)\n",
-                        channel->freq);
+                        channel->center_freq);
                 return -EAGAIN;
         }
 
-        ret = ath5k_hw_noise_floor_calibration(ah, channel->freq);
+        ret = ath5k_hw_noise_floor_calibration(ah, channel->center_freq);
         if (ret)
                 return ret;
 
@@ -932,7 +925,7 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum ieee80211_if_types op_mode,
 
         /* A and G modes can use QAM modulation which requires enabling
          * I and Q calibration. Don't bother in B mode. */
-        if (!(driver_mode == MODE_IEEE80211B)) {
+        if (!(mode == AR5K_MODE_11B)) {
                 ah->ah_calibration = true;
                 AR5K_REG_WRITE_BITS(ah, AR5K_PHY_IQ,
                                 AR5K_PHY_IQ_CAL_NUM_LOG_MAX, 15);
@@ -1590,9 +1583,10 @@ static int ath5k_hw_eeprom_read(struct ath5k_hw *ah, u32 offset, u16 *data)
 /*
  * Write to eeprom - currently disabled, use at your own risk
  */
+#if 0
 static int ath5k_hw_eeprom_write(struct ath5k_hw *ah, u32 offset, u16 data)
 {
-#if 0
+
         u32 status, timeout;
 
         ATH5K_TRACE(ah->ah_sc);
@@ -1634,10 +1628,11 @@ static int ath5k_hw_eeprom_write(struct ath5k_hw *ah, u32 offset, u16 data)
                 }
                 udelay(15);
         }
-#endif
+
         ATH5K_ERR(ah->ah_sc, "EEPROM Write is disabled!");
         return -EIO;
 }
+#endif
 
 /*
  * Translate binary channel representation in EEPROM to frequency
@@ -2043,50 +2038,6 @@ static int ath5k_eeprom_read_mac(struct ath5k_hw *ah, u8 *mac)
 }
 
 /*
- * Read/Write regulatory domain
- */
-static bool ath5k_eeprom_regulation_domain(struct ath5k_hw *ah, bool write,
-        enum ath5k_regdom *regdomain)
-{
-        u16 ee_regdomain;
-
-        /* Read current value */
-        if (write != true) {
-                ee_regdomain = ah->ah_capabilities.cap_eeprom.ee_regdomain;
-                *regdomain = ath5k_regdom_to_ieee(ee_regdomain);
-                return true;
-        }
-
-        ee_regdomain = ath5k_regdom_from_ieee(*regdomain);
-
-        /* Try to write a new value */
-        if (ah->ah_capabilities.cap_eeprom.ee_protect &
-                        AR5K_EEPROM_PROTECT_WR_128_191)
-                return false;
-        if (ath5k_hw_eeprom_write(ah, AR5K_EEPROM_REG_DOMAIN, ee_regdomain)!=0)
-                return false;
-
-        ah->ah_capabilities.cap_eeprom.ee_regdomain = ee_regdomain;
-
-        return true;
-}
-
-/*
- * Use the above to write a new regulatory domain
- */
-int ath5k_hw_set_regdomain(struct ath5k_hw *ah, u16 regdomain)
-{
-        enum ath5k_regdom ieee_regdomain;
-
-        ieee_regdomain = ath5k_regdom_to_ieee(regdomain);
-
-        if (ath5k_eeprom_regulation_domain(ah, true, &ieee_regdomain) == true)
-                return 0;
-
-        return -EIO;
-}
-
-/*
  * Fill the capabilities struct
  */
 static int ath5k_hw_get_capabilities(struct ath5k_hw *ah)
@@ -2108,8 +2059,8 @@ static int ath5k_hw_get_capabilities(struct ath5k_hw *ah)
                 ah->ah_capabilities.cap_range.range_2ghz_max = 0;
 
                 /* Set supported modes */
-                __set_bit(MODE_IEEE80211A, ah->ah_capabilities.cap_mode);
-                __set_bit(MODE_ATHEROS_TURBO, ah->ah_capabilities.cap_mode);
+                __set_bit(AR5K_MODE_11A, ah->ah_capabilities.cap_mode);
+                __set_bit(AR5K_MODE_11A_TURBO, ah->ah_capabilities.cap_mode);
         } else {
                 /*
                  * XXX The tranceiver supports frequencies from 4920 to 6100GHz
@@ -2131,12 +2082,12 @@ static int ath5k_hw_get_capabilities(struct ath5k_hw *ah)
                         ah->ah_capabilities.cap_range.range_5ghz_max = 6100;
 
                         /* Set supported modes */
-                        __set_bit(MODE_IEEE80211A,
+                        __set_bit(AR5K_MODE_11A,
                                         ah->ah_capabilities.cap_mode);
-                        __set_bit(MODE_ATHEROS_TURBO,
+                        __set_bit(AR5K_MODE_11A_TURBO,
                                         ah->ah_capabilities.cap_mode);
                         if (ah->ah_version == AR5K_AR5212)
-                                __set_bit(MODE_ATHEROS_TURBOG,
+                                __set_bit(AR5K_MODE_11G_TURBO,
                                                 ah->ah_capabilities.cap_mode);
                 }
 
@@ -2148,11 +2099,11 @@ static int ath5k_hw_get_capabilities(struct ath5k_hw *ah)
                         ah->ah_capabilities.cap_range.range_2ghz_max = 2732;
 
                         if (AR5K_EEPROM_HDR_11B(ee_header))
-                                __set_bit(MODE_IEEE80211B,
+                                __set_bit(AR5K_MODE_11B,
                                                 ah->ah_capabilities.cap_mode);
 
                         if (AR5K_EEPROM_HDR_11G(ee_header))
-                                __set_bit(MODE_IEEE80211G,
+                                __set_bit(AR5K_MODE_11G,
                                                 ah->ah_capabilities.cap_mode);
                 }
         }
@@ -4248,35 +4199,6 @@ void ath5k_hw_set_gpio_intr(struct ath5k_hw *ah, unsigned int gpio,
 }
 
 
-/*********************************\
- Regulatory Domain/Channels Setup
-\*********************************/
-
-u16 ath5k_get_regdomain(struct ath5k_hw *ah)
-{
-        u16 regdomain;
-        enum ath5k_regdom ieee_regdomain;
-#ifdef COUNTRYCODE
-        u16 code;
-#endif
-
-        ath5k_eeprom_regulation_domain(ah, false, &ieee_regdomain);
-        ah->ah_capabilities.cap_regdomain.reg_hw = ieee_regdomain;
-
-#ifdef COUNTRYCODE
-        /*
-         * Get the regulation domain by country code. This will ignore
-         * the settings found in the EEPROM.
-         */
-        code = ieee80211_name2countrycode(COUNTRYCODE);
-        ieee_regdomain = ieee80211_countrycode2regdomain(code);
-#endif
-
-        regdomain = ath5k_regdom_from_ieee(ieee_regdomain);
-        ah->ah_capabilities.cap_regdomain.reg_current = regdomain;
-
-        return regdomain;
-}
 
 
 /****************\
diff --git a/drivers/net/wireless/ath5k/initvals.c b/drivers/net/wireless/ath5k/initvals.c
index 2c22f1d4ee64..cfcb1fe7bd34 100644
--- a/drivers/net/wireless/ath5k/initvals.c
+++ b/drivers/net/wireless/ath5k/initvals.c
@@ -1317,8 +1317,10 @@ int ath5k_hw_write_initvals(struct ath5k_hw *ah, u8 mode, bool change_channel)
         /* For AR5211 */
         } else if (ah->ah_version == AR5K_AR5211) {
 
-                if(mode > 2){ /* AR5K_INI_VAL_11B */
-                        ATH5K_ERR(ah->ah_sc,"unsupported channel mode: %d\n", mode);
+                /* AR5K_MODE_11B */
+                if (mode > 2) {
+                        ATH5K_ERR(ah->ah_sc,
+                                "unsupported channel mode: %d\n", mode);
                         return -EINVAL;
                 }
 
diff --git a/drivers/net/wireless/ath5k/phy.c b/drivers/net/wireless/ath5k/phy.c
index b95941797141..405195ffb24d 100644
--- a/drivers/net/wireless/ath5k/phy.c
+++ b/drivers/net/wireless/ath5k/phy.c
@@ -1018,7 +1018,7 @@ static int ath5k_hw_rf5111_rfregs(struct ath5k_hw *ah,
         int obdb = -1, bank = -1;
         u32 ee_mode;
 
-        AR5K_ASSERT_ENTRY(mode, AR5K_INI_VAL_MAX);
+        AR5K_ASSERT_ENTRY(mode, AR5K_MODE_MAX);
 
         rf = ah->ah_rf_banks;
 
@@ -1038,8 +1038,8 @@ static int ath5k_hw_rf5111_rfregs(struct ath5k_hw *ah,
         }
 
         /* Modify bank 0 */
-        if (channel->val & CHANNEL_2GHZ) {
-                if (channel->val & CHANNEL_CCK)
+        if (channel->hw_value & CHANNEL_2GHZ) {
+                if (channel->hw_value & CHANNEL_CCK)
                         ee_mode = AR5K_EEPROM_MODE_11B;
                 else
                         ee_mode = AR5K_EEPROM_MODE_11G;
@@ -1058,10 +1058,10 @@ static int ath5k_hw_rf5111_rfregs(struct ath5k_hw *ah,
         } else {
                 /* For 11a, Turbo and XR */
                 ee_mode = AR5K_EEPROM_MODE_11A;
-                obdb =   channel->freq >= 5725 ? 3 :
-                        (channel->freq >= 5500 ? 2 :
-                        (channel->freq >= 5260 ? 1 :
-                         (channel->freq > 4000 ? 0 : -1)));
+                obdb =   channel->center_freq >= 5725 ? 3 :
+                        (channel->center_freq >= 5500 ? 2 :
+                        (channel->center_freq >= 5260 ? 1 :
+                         (channel->center_freq > 4000 ? 0 : -1)));
 
                 if (!ath5k_hw_rfregs_op(rf, ah->ah_offset[6],
                                 ee->ee_pwd_84, 1, 51, 3, true))
@@ -1119,12 +1119,12 @@ static int ath5k_hw_rf5112_rfregs(struct ath5k_hw *ah,
         int obdb = -1, bank = -1;
         u32 ee_mode;
 
-        AR5K_ASSERT_ENTRY(mode, AR5K_INI_VAL_MAX);
+        AR5K_ASSERT_ENTRY(mode, AR5K_MODE_MAX);
 
         rf = ah->ah_rf_banks;
 
         if (ah->ah_radio_5ghz_revision >= AR5K_SREV_RAD_2112A
-                && !test_bit(MODE_IEEE80211A, ah->ah_capabilities.cap_mode)){
+                && !test_bit(AR5K_MODE_11A, ah->ah_capabilities.cap_mode)) {
                 rf_ini = rfregs_2112a;
                 rf_size = ARRAY_SIZE(rfregs_5112a);
                 if (mode < 2) {
@@ -1156,8 +1156,8 @@ static int ath5k_hw_rf5112_rfregs(struct ath5k_hw *ah,
         }
 
         /* Modify bank 6 */
-        if (channel->val & CHANNEL_2GHZ) {
-                if (channel->val & CHANNEL_OFDM)
+        if (channel->hw_value & CHANNEL_2GHZ) {
+                if (channel->hw_value & CHANNEL_OFDM)
                         ee_mode = AR5K_EEPROM_MODE_11G;
                 else
                         ee_mode = AR5K_EEPROM_MODE_11B;
@@ -1173,10 +1173,13 @@ static int ath5k_hw_rf5112_rfregs(struct ath5k_hw *ah,
         } else {
                 /* For 11a, Turbo and XR */
                 ee_mode = AR5K_EEPROM_MODE_11A;
-                obdb = channel->freq >= 5725 ? 3 :
-                    (channel->freq >= 5500 ? 2 :
-                        (channel->freq >= 5260 ? 1 :
-                            (channel->freq > 4000 ? 0 : -1)));
+                obdb = channel->center_freq >= 5725 ? 3 :
+                    (channel->center_freq >= 5500 ? 2 :
+                        (channel->center_freq >= 5260 ? 1 :
+                            (channel->center_freq > 4000 ? 0 : -1)));
+
+                if (obdb == -1)
+                        return -EINVAL;
 
                 if (!ath5k_hw_rfregs_op(rf, ah->ah_offset[6],
                                 ee->ee_ob[ee_mode][obdb], 3, 279, 0, true))
@@ -1219,7 +1222,7 @@ static int ath5k_hw_rf5413_rfregs(struct ath5k_hw *ah,
         unsigned int rf_size, i;
         int bank = -1;
 
-        AR5K_ASSERT_ENTRY(mode, AR5K_INI_VAL_MAX);
+        AR5K_ASSERT_ENTRY(mode, AR5K_MODE_MAX);
 
         rf = ah->ah_rf_banks;
 
@@ -1445,9 +1448,10 @@ static u32 ath5k_hw_rf5110_chan2athchan(struct ieee80211_channel *channel)
          * newer chipsets like the AR5212A who have a completely
          * different RF/PHY part.
          */
-        athchan = (ath5k_hw_bitswap((channel->chan - 24) / 2, 5) << 1) |
-                (1 << 6) | 0x1;
-
+        athchan = (ath5k_hw_bitswap(
+                        (ieee80211_frequency_to_channel(
+                                channel->center_freq) - 24) / 2, 5)
+                                << 1) | (1 << 6) | 0x1;
         return athchan;
 }
 
@@ -1506,7 +1510,8 @@ static int ath5k_hw_rf5111_channel(struct ath5k_hw *ah,
                 struct ieee80211_channel *channel)
 {
         struct ath5k_athchan_2ghz ath5k_channel_2ghz;
-        unsigned int ath5k_channel = channel->chan;
+        unsigned int ath5k_channel =
+                ieee80211_frequency_to_channel(channel->center_freq);
         u32 data0, data1, clock;
         int ret;
 
@@ -1515,10 +1520,11 @@ static int ath5k_hw_rf5111_channel(struct ath5k_hw *ah,
          */
         data0 = data1 = 0;
 
-        if (channel->val & CHANNEL_2GHZ) {
+        if (channel->hw_value & CHANNEL_2GHZ) {
                 /* Map 2GHz channel to 5GHz Atheros channel ID */
-                ret = ath5k_hw_rf5111_chan2athchan(channel->chan,
-                                &ath5k_channel_2ghz);
+                ret = ath5k_hw_rf5111_chan2athchan(
+                        ieee80211_frequency_to_channel(channel->center_freq),
+                        &ath5k_channel_2ghz);
                 if (ret)
                         return ret;
 
@@ -1555,7 +1561,7 @@ static int ath5k_hw_rf5112_channel(struct ath5k_hw *ah,
         u16 c;
 
         data = data0 = data1 = data2 = 0;
-        c = channel->freq;
+        c = channel->center_freq;
 
         /*
          * Set the channel on the RF5112 or newer
@@ -1599,19 +1605,17 @@ static int ath5k_hw_rf5112_channel(struct ath5k_hw *ah,
 int ath5k_hw_channel(struct ath5k_hw *ah, struct ieee80211_channel *channel)
 {
         int ret;
-
         /*
-         * Check bounds supported by the PHY
-         * (don't care about regulation restrictions at this point)
-         */
-        if ((channel->freq < ah->ah_capabilities.cap_range.range_2ghz_min ||
-            channel->freq > ah->ah_capabilities.cap_range.range_2ghz_max) &&
-            (channel->freq < ah->ah_capabilities.cap_range.range_5ghz_min ||
-            channel->freq > ah->ah_capabilities.cap_range.range_5ghz_max)) {
+         * Check bounds supported by the PHY (we don't care about regultory
+         * restrictions at this point). Note: hw_value already has the band
+         * (CHANNEL_2GHZ, or CHANNEL_5GHZ) so we inform ath5k_channel_ok()
+         * of the band by that */
+        if (!ath5k_channel_ok(ah, channel->center_freq, channel->hw_value)) {
                 ATH5K_ERR(ah->ah_sc,
-                        "channel out of supported range (%u MHz)\n",
-                        channel->freq);
-                return -EINVAL;
+                        "channel frequency (%u MHz) out of supported "
+                        "band range\n",
+                        channel->center_freq);
+                        return -EINVAL;
         }
 
         /*
@@ -1632,9 +1636,9 @@ int ath5k_hw_channel(struct ath5k_hw *ah, struct ieee80211_channel *channel)
         if (ret)
                 return ret;
 
-        ah->ah_current_channel.freq = channel->freq;
-        ah->ah_current_channel.val = channel->val;
-        ah->ah_turbo = channel->val == CHANNEL_T ? true : false;
+        ah->ah_current_channel.center_freq = channel->center_freq;
+        ah->ah_current_channel.hw_value = channel->hw_value;
+        ah->ah_turbo = channel->hw_value == CHANNEL_T ? true : false;
 
         return 0;
 }
@@ -1797,11 +1801,11 @@ static int ath5k_hw_rf5110_calibrate(struct ath5k_hw *ah,
 
         if (ret) {
                 ATH5K_ERR(ah->ah_sc, "calibration timeout (%uMHz)\n",
-                                channel->freq);
+                                channel->center_freq);
                 return ret;
         }
 
-        ret = ath5k_hw_noise_floor_calibration(ah, channel->freq);
+        ret = ath5k_hw_noise_floor_calibration(ah, channel->center_freq);
         if (ret)
                 return ret;
 
@@ -1848,10 +1852,10 @@ static int ath5k_hw_rf511x_calibrate(struct ath5k_hw *ah,
                 ((u32)q_coff) | ((u32)i_coff << AR5K_PHY_IQ_CORR_Q_I_COFF_S));
 
 done:
-        ath5k_hw_noise_floor_calibration(ah, channel->freq);
+        ath5k_hw_noise_floor_calibration(ah, channel->center_freq);
 
         /* Request RF gain */
-        if (channel->val & CHANNEL_5GHZ) {
+        if (channel->hw_value & CHANNEL_5GHZ) {
                 ath5k_hw_reg_write(ah, AR5K_REG_SM(ah->ah_txpower.txp_max,
                         AR5K_PHY_PAPD_PROBE_TXPOWER) |
                         AR5K_PHY_PAPD_PROBE_TX_NEXT, AR5K_PHY_PAPD_PROBE);
diff --git a/drivers/net/wireless/atmel.c b/drivers/net/wireless/atmel.c
index 63ec7a70ee76..ef2da4023d68 100644
--- a/drivers/net/wireless/atmel.c
+++ b/drivers/net/wireless/atmel.c
@@ -66,6 +66,7 @@
 #include <linux/device.h>
 #include <linux/moduleparam.h>
 #include <linux/firmware.h>
+#include <linux/jiffies.h>
 #include <net/ieee80211.h>
 #include "atmel.h"
 
@@ -516,7 +517,7 @@ struct atmel_private {
                 SITE_SURVEY_IN_PROGRESS,
                 SITE_SURVEY_COMPLETED
         } site_survey_state;
-        time_t last_survey;
+        unsigned long last_survey;
 
         int station_was_associated, station_is_associated;
         int fast_scan;
@@ -2283,7 +2284,7 @@ static int atmel_set_scan(struct net_device *dev,
                 return -EAGAIN;
 
         /* Timeout old surveys. */
-        if ((jiffies - priv->last_survey) > (20 * HZ))
+        if (time_after(jiffies, priv->last_survey + 20 * HZ))
                 priv->site_survey_state = SITE_SURVEY_IDLE;
         priv->last_survey = jiffies;
 
diff --git a/drivers/net/wireless/b43/b43.h b/drivers/net/wireless/b43/b43.h
index f13346ba9dd2..33459d61a717 100644
--- a/drivers/net/wireless/b43/b43.h
+++ b/drivers/net/wireless/b43/b43.h
@@ -144,7 +144,8 @@ enum {
 #define B43_SHM_SH_PHYTYPE              0x0052  /* PHY type */
 #define B43_SHM_SH_ANTSWAP              0x005C  /* Antenna swap threshold */
 #define B43_SHM_SH_HOSTFLO              0x005E  /* Hostflags for ucode options (low) */
-#define B43_SHM_SH_HOSTFHI              0x0060  /* Hostflags for ucode options (high) */
+#define B43_SHM_SH_HOSTFMI              0x0060  /* Hostflags for ucode options (middle) */
+#define B43_SHM_SH_HOSTFHI              0x0062  /* Hostflags for ucode options (high) */
 #define B43_SHM_SH_RFATT                0x0064  /* Current radio attenuation value */
 #define B43_SHM_SH_RADAR                0x0066  /* Radar register */
 #define B43_SHM_SH_PHYTXNOI             0x006E  /* PHY noise directly after TX (lower 8bit only) */
@@ -232,31 +233,41 @@ enum {
 #define B43_MMIO_RADIO_HWENABLED_LO_MASK (1 << 4)
 
 /* HostFlags. See b43_hf_read/write() */
-#define B43_HF_ANTDIVHELP               0x00000001      /* ucode antenna div helper */
-#define B43_HF_SYMW                     0x00000002      /* G-PHY SYM workaround */
-#define B43_HF_RXPULLW                  0x00000004      /* RX pullup workaround */
-#define B43_HF_CCKBOOST                 0x00000008      /* 4dB CCK power boost (exclusive with OFDM boost) */
-#define B43_HF_BTCOEX                   0x00000010      /* Bluetooth coexistance */
-#define B43_HF_GDCW                     0x00000020      /* G-PHY DV canceller filter bw workaround */
-#define B43_HF_OFDMPABOOST              0x00000040      /* Enable PA gain boost for OFDM */
-#define B43_HF_ACPR                     0x00000080      /* Disable for Japan, channel 14 */
-#define B43_HF_EDCF                     0x00000100      /* on if WME and MAC suspended */
-#define B43_HF_TSSIRPSMW                0x00000200      /* TSSI reset PSM ucode workaround */
-#define B43_HF_DSCRQ                    0x00000400      /* Disable slow clock request in ucode */
-#define B43_HF_ACIW                     0x00000800      /* ACI workaround: shift bits by 2 on PHY CRS */
-#define B43_HF_2060W                    0x00001000      /* 2060 radio workaround */
-#define B43_HF_RADARW                   0x00002000      /* Radar workaround */
-#define B43_HF_USEDEFKEYS               0x00004000      /* Enable use of default keys */
-#define B43_HF_BT4PRIOCOEX              0x00010000      /* Bluetooth 2-priority coexistance */
-#define B43_HF_FWKUP                    0x00020000      /* Fast wake-up ucode */
-#define B43_HF_VCORECALC                0x00040000      /* Force VCO recalculation when powering up synthpu */
-#define B43_HF_PCISCW                   0x00080000      /* PCI slow clock workaround */
-#define B43_HF_4318TSSI                 0x00200000      /* 4318 TSSI */
-#define B43_HF_FBCMCFIFO                0x00400000      /* Flush bcast/mcast FIFO immediately */
-#define B43_HF_HWPCTL                   0x00800000      /* Enable hardwarre power control */
-#define B43_HF_BTCOEXALT                0x01000000      /* Bluetooth coexistance in alternate pins */
-#define B43_HF_TXBTCHECK                0x02000000      /* Bluetooth check during transmission */
-#define B43_HF_SKCFPUP                  0x04000000      /* Skip CFP update */
+#define B43_HF_ANTDIVHELP       0x000000000001ULL /* ucode antenna div helper */
+#define B43_HF_SYMW             0x000000000002ULL /* G-PHY SYM workaround */
+#define B43_HF_RXPULLW          0x000000000004ULL /* RX pullup workaround */
+#define B43_HF_CCKBOOST         0x000000000008ULL /* 4dB CCK power boost (exclusive with OFDM boost) */
+#define B43_HF_BTCOEX           0x000000000010ULL /* Bluetooth coexistance */
+#define B43_HF_GDCW             0x000000000020ULL /* G-PHY DC canceller filter bw workaround */
+#define B43_HF_OFDMPABOOST      0x000000000040ULL /* Enable PA gain boost for OFDM */
+#define B43_HF_ACPR             0x000000000080ULL /* Disable for Japan, channel 14 */
+#define B43_HF_EDCF             0x000000000100ULL /* on if WME and MAC suspended */
+#define B43_HF_TSSIRPSMW        0x000000000200ULL /* TSSI reset PSM ucode workaround */
+#define B43_HF_20IN40IQW        0x000000000200ULL /* 20 in 40 MHz I/Q workaround (rev >= 13 only) */
+#define B43_HF_DSCRQ            0x000000000400ULL /* Disable slow clock request in ucode */
+#define B43_HF_ACIW             0x000000000800ULL /* ACI workaround: shift bits by 2 on PHY CRS */
+#define B43_HF_2060W            0x000000001000ULL /* 2060 radio workaround */
+#define B43_HF_RADARW           0x000000002000ULL /* Radar workaround */
+#define B43_HF_USEDEFKEYS       0x000000004000ULL /* Enable use of default keys */
+#define B43_HF_AFTERBURNER      0x000000008000ULL /* Afterburner enabled */
+#define B43_HF_BT4PRIOCOEX      0x000000010000ULL /* Bluetooth 4-priority coexistance */
+#define B43_HF_FWKUP            0x000000020000ULL /* Fast wake-up ucode */
+#define B43_HF_VCORECALC        0x000000040000ULL /* Force VCO recalculation when powering up synthpu */
+#define B43_HF_PCISCW           0x000000080000ULL /* PCI slow clock workaround */
+#define B43_HF_4318TSSI         0x000000200000ULL /* 4318 TSSI */
+#define B43_HF_FBCMCFIFO        0x000000400000ULL /* Flush bcast/mcast FIFO immediately */
+#define B43_HF_HWPCTL           0x000000800000ULL /* Enable hardwarre power control */
+#define B43_HF_BTCOEXALT        0x000001000000ULL /* Bluetooth coexistance in alternate pins */
+#define B43_HF_TXBTCHECK        0x000002000000ULL /* Bluetooth check during transmission */
+#define B43_HF_SKCFPUP          0x000004000000ULL /* Skip CFP update */
+#define B43_HF_N40W             0x000008000000ULL /* N PHY 40 MHz workaround (rev >= 13 only) */
+#define B43_HF_ANTSEL           0x000020000000ULL /* Antenna selection (for testing antenna div.) */
+#define B43_HF_BT3COEXT         0x000020000000ULL /* Bluetooth 3-wire coexistence (rev >= 13 only) */
+#define B43_HF_BTCANT           0x000040000000ULL /* Bluetooth coexistence (antenna mode) (rev >= 13 only) */
+#define B43_HF_ANTSELEN         0x000100000000ULL /* Antenna selection enabled (rev >= 13 only) */
+#define B43_HF_ANTSELMODE       0x000200000000ULL /* Antenna selection mode (rev >= 13 only) */
+#define B43_HF_MLADVW           0x001000000000ULL /* N PHY ML ADV workaround (rev >= 13 only) */
+#define B43_HF_PR45960W         0x080000000000ULL /* PR 45960 workaround (rev >= 13 only) */
 
 /* MacFilter offsets. */
 #define B43_MACFILTER_SELF              0x0000
@@ -458,20 +469,13 @@ struct b43_iv {
 } __attribute__((__packed__));
 
 
-#define B43_PHYMODE(phytype)            (1 << (phytype))
-#define B43_PHYMODE_A                   B43_PHYMODE(B43_PHYTYPE_A)
-#define B43_PHYMODE_B                   B43_PHYMODE(B43_PHYTYPE_B)
-#define B43_PHYMODE_G                   B43_PHYMODE(B43_PHYTYPE_G)
-
 struct b43_phy {
-        /* Possible PHYMODEs on this PHY */
-        u8 possible_phymodes;
+        /* Band support flags. */
+        bool supports_2ghz;
+        bool supports_5ghz;
+
         /* GMODE bit enabled? */
         bool gmode;
-        /* Possible ieee80211 subsystem hwmodes for this PHY.
-         * Which mode is selected, depends on thr GMODE enabled bit */
-#define B43_MAX_PHYHWMODES      2
-        struct ieee80211_hw_mode hwmodes[B43_MAX_PHYHWMODES];
 
         /* Analog Type */
         u8 analog;
@@ -727,7 +731,6 @@ struct b43_wldev {
 
         bool bad_frames_preempt;        /* Use "Bad Frames Preemption" (default off) */
         bool dfq_valid;         /* Directed frame queue valid (IBSS PS mode, ATIM) */
-        bool short_preamble;    /* TRUE, if short preamble is enabled. */
         bool short_slot;        /* TRUE, if short slot timing is enabled. */
         bool radio_hw_enable;   /* saved state of radio hardware enabled state */
         bool suspend_in_progress;       /* TRUE, if we are in a suspend/resume cycle */
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 51dfce16178a..f745308faaad 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -96,25 +96,29 @@ MODULE_DEVICE_TABLE(ssb, b43_ssb_tbl);
  * data in there. This data is the same for all devices, so we don't
  * get concurrency issues */
 #define RATETAB_ENT(_rateid, _flags) \
-        {                                                       \
-                .rate   = B43_RATE_TO_BASE100KBPS(_rateid),     \
-                .val    = (_rateid),                            \
-                .val2   = (_rateid),                            \
-                .flags  = (_flags),                             \
+        {                                                               \
+                .bitrate        = B43_RATE_TO_BASE100KBPS(_rateid),     \
+                .hw_value       = (_rateid),                            \
+                .flags          = (_flags),                             \
         }
+
+/*
+ * NOTE: When changing this, sync with xmit.c's
+ *       b43_plcp_get_bitrate_idx_* functions!
+ */
 static struct ieee80211_rate __b43_ratetable[] = {
-        RATETAB_ENT(B43_CCK_RATE_1MB, IEEE80211_RATE_CCK),
-        RATETAB_ENT(B43_CCK_RATE_2MB, IEEE80211_RATE_CCK_2),
-        RATETAB_ENT(B43_CCK_RATE_5MB, IEEE80211_RATE_CCK_2),
-        RATETAB_ENT(B43_CCK_RATE_11MB, IEEE80211_RATE_CCK_2),
-        RATETAB_ENT(B43_OFDM_RATE_6MB, IEEE80211_RATE_OFDM),
-        RATETAB_ENT(B43_OFDM_RATE_9MB, IEEE80211_RATE_OFDM),
-        RATETAB_ENT(B43_OFDM_RATE_12MB, IEEE80211_RATE_OFDM),
-        RATETAB_ENT(B43_OFDM_RATE_18MB, IEEE80211_RATE_OFDM),
-        RATETAB_ENT(B43_OFDM_RATE_24MB, IEEE80211_RATE_OFDM),
-        RATETAB_ENT(B43_OFDM_RATE_36MB, IEEE80211_RATE_OFDM),
-        RATETAB_ENT(B43_OFDM_RATE_48MB, IEEE80211_RATE_OFDM),
-        RATETAB_ENT(B43_OFDM_RATE_54MB, IEEE80211_RATE_OFDM),
+        RATETAB_ENT(B43_CCK_RATE_1MB, 0),
+        RATETAB_ENT(B43_CCK_RATE_2MB, IEEE80211_RATE_SHORT_PREAMBLE),
+        RATETAB_ENT(B43_CCK_RATE_5MB, IEEE80211_RATE_SHORT_PREAMBLE),
+        RATETAB_ENT(B43_CCK_RATE_11MB, IEEE80211_RATE_SHORT_PREAMBLE),
+        RATETAB_ENT(B43_OFDM_RATE_6MB, 0),
+        RATETAB_ENT(B43_OFDM_RATE_9MB, 0),
+        RATETAB_ENT(B43_OFDM_RATE_12MB, 0),
+        RATETAB_ENT(B43_OFDM_RATE_18MB, 0),
+        RATETAB_ENT(B43_OFDM_RATE_24MB, 0),
+        RATETAB_ENT(B43_OFDM_RATE_36MB, 0),
+        RATETAB_ENT(B43_OFDM_RATE_48MB, 0),
+        RATETAB_ENT(B43_OFDM_RATE_54MB, 0),
 };
 
 #define b43_a_ratetable         (__b43_ratetable + 4)
@@ -124,53 +128,144 @@ static struct ieee80211_rate __b43_ratetable[] = {
 #define b43_g_ratetable         (__b43_ratetable + 0)
 #define b43_g_ratetable_size    12
 
-#define CHANTAB_ENT(_chanid, _freq) \
-        {                                                       \
-                .chan   = (_chanid),                            \
-                .freq   = (_freq),                              \
-                .val    = (_chanid),                            \
-                .flag   = IEEE80211_CHAN_W_SCAN |               \
-                          IEEE80211_CHAN_W_ACTIVE_SCAN |        \
-                          IEEE80211_CHAN_W_IBSS,                \
-                .power_level    = 0xFF,                         \
-                .antenna_max    = 0xFF,                         \
-        }
+#define CHAN4G(_channel, _freq, _flags) {                       \
+        .band                   = IEEE80211_BAND_2GHZ,          \
+        .center_freq            = (_freq),                      \
+        .hw_value               = (_channel),                   \
+        .flags                  = (_flags),                     \
+        .max_antenna_gain       = 0,                            \
+        .max_power              = 30,                           \
+}
 static struct ieee80211_channel b43_2ghz_chantable[] = {
-        CHANTAB_ENT(1, 2412),
-        CHANTAB_ENT(2, 2417),
-        CHANTAB_ENT(3, 2422),
-        CHANTAB_ENT(4, 2427),
-        CHANTAB_ENT(5, 2432),
-        CHANTAB_ENT(6, 2437),
-        CHANTAB_ENT(7, 2442),
-        CHANTAB_ENT(8, 2447),
-        CHANTAB_ENT(9, 2452),
-        CHANTAB_ENT(10, 2457),
-        CHANTAB_ENT(11, 2462),
-        CHANTAB_ENT(12, 2467),
-        CHANTAB_ENT(13, 2472),
-        CHANTAB_ENT(14, 2484),
+        CHAN4G(1, 2412, 0),
+        CHAN4G(2, 2417, 0),
+        CHAN4G(3, 2422, 0),
+        CHAN4G(4, 2427, 0),
+        CHAN4G(5, 2432, 0),
+        CHAN4G(6, 2437, 0),
+        CHAN4G(7, 2442, 0),
+        CHAN4G(8, 2447, 0),
+        CHAN4G(9, 2452, 0),
+        CHAN4G(10, 2457, 0),
+        CHAN4G(11, 2462, 0),
+        CHAN4G(12, 2467, 0),
+        CHAN4G(13, 2472, 0),
+        CHAN4G(14, 2484, 0),
 };
-#define b43_2ghz_chantable_size ARRAY_SIZE(b43_2ghz_chantable)
-
-#if 0
-static struct ieee80211_channel b43_5ghz_chantable[] = {
-        CHANTAB_ENT(36, 5180),
-        CHANTAB_ENT(40, 5200),
-        CHANTAB_ENT(44, 5220),
-        CHANTAB_ENT(48, 5240),
-        CHANTAB_ENT(52, 5260),
-        CHANTAB_ENT(56, 5280),
-        CHANTAB_ENT(60, 5300),
-        CHANTAB_ENT(64, 5320),
-        CHANTAB_ENT(149, 5745),
-        CHANTAB_ENT(153, 5765),
-        CHANTAB_ENT(157, 5785),
-        CHANTAB_ENT(161, 5805),
-        CHANTAB_ENT(165, 5825),
+#undef CHAN4G
+
+#define CHAN5G(_channel, _flags) {                              \
+        .band                   = IEEE80211_BAND_5GHZ,          \
+        .center_freq            = 5000 + (5 * (_channel)),      \
+        .hw_value               = (_channel),                   \
+        .flags                  = (_flags),                     \
+        .max_antenna_gain       = 0,                            \
+        .max_power              = 30,                           \
+}
+static struct ieee80211_channel b43_5ghz_nphy_chantable[] = {
+        CHAN5G(32, 0),          CHAN5G(34, 0),
+        CHAN5G(36, 0),          CHAN5G(38, 0),
+        CHAN5G(40, 0),          CHAN5G(42, 0),
+        CHAN5G(44, 0),          CHAN5G(46, 0),
+        CHAN5G(48, 0),          CHAN5G(50, 0),
+        CHAN5G(52, 0),          CHAN5G(54, 0),
+        CHAN5G(56, 0),          CHAN5G(58, 0),
+        CHAN5G(60, 0),          CHAN5G(62, 0),
+        CHAN5G(64, 0),          CHAN5G(66, 0),
+        CHAN5G(68, 0),          CHAN5G(70, 0),
+        CHAN5G(72, 0),          CHAN5G(74, 0),
+        CHAN5G(76, 0),          CHAN5G(78, 0),
+        CHAN5G(80, 0),          CHAN5G(82, 0),
+        CHAN5G(84, 0),          CHAN5G(86, 0),
+        CHAN5G(88, 0),          CHAN5G(90, 0),
+        CHAN5G(92, 0),          CHAN5G(94, 0),
+        CHAN5G(96, 0),          CHAN5G(98, 0),
+        CHAN5G(100, 0),         CHAN5G(102, 0),
+        CHAN5G(104, 0),         CHAN5G(106, 0),
+        CHAN5G(108, 0),         CHAN5G(110, 0),
+        CHAN5G(112, 0),         CHAN5G(114, 0),
+        CHAN5G(116, 0),         CHAN5G(118, 0),
+        CHAN5G(120, 0),         CHAN5G(122, 0),
+        CHAN5G(124, 0),         CHAN5G(126, 0),
+        CHAN5G(128, 0),         CHAN5G(130, 0),
+        CHAN5G(132, 0),         CHAN5G(134, 0),
+        CHAN5G(136, 0),         CHAN5G(138, 0),
+        CHAN5G(140, 0),         CHAN5G(142, 0),
+        CHAN5G(144, 0),         CHAN5G(145, 0),
+        CHAN5G(146, 0),         CHAN5G(147, 0),
+        CHAN5G(148, 0),         CHAN5G(149, 0),
+        CHAN5G(150, 0),         CHAN5G(151, 0),
+        CHAN5G(152, 0),         CHAN5G(153, 0),
+        CHAN5G(154, 0),         CHAN5G(155, 0),
+        CHAN5G(156, 0),         CHAN5G(157, 0),
+        CHAN5G(158, 0),         CHAN5G(159, 0),
+        CHAN5G(160, 0),         CHAN5G(161, 0),
+        CHAN5G(162, 0),         CHAN5G(163, 0),
+        CHAN5G(164, 0),         CHAN5G(165, 0),
+        CHAN5G(166, 0),         CHAN5G(168, 0),
+        CHAN5G(170, 0),         CHAN5G(172, 0),
+        CHAN5G(174, 0),         CHAN5G(176, 0),
+        CHAN5G(178, 0),         CHAN5G(180, 0),
+        CHAN5G(182, 0),         CHAN5G(184, 0),
+        CHAN5G(186, 0),         CHAN5G(188, 0),
+        CHAN5G(190, 0),         CHAN5G(192, 0),
+        CHAN5G(194, 0),         CHAN5G(196, 0),
+        CHAN5G(198, 0),         CHAN5G(200, 0),
+        CHAN5G(202, 0),         CHAN5G(204, 0),
+        CHAN5G(206, 0),         CHAN5G(208, 0),
+        CHAN5G(210, 0),         CHAN5G(212, 0),
+        CHAN5G(214, 0),         CHAN5G(216, 0),
+        CHAN5G(218, 0),         CHAN5G(220, 0),
+        CHAN5G(222, 0),         CHAN5G(224, 0),
+        CHAN5G(226, 0),         CHAN5G(228, 0),
+};
+
+static struct ieee80211_channel b43_5ghz_aphy_chantable[] = {
+        CHAN5G(34, 0),          CHAN5G(36, 0),
+        CHAN5G(38, 0),          CHAN5G(40, 0),
+        CHAN5G(42, 0),          CHAN5G(44, 0),
+        CHAN5G(46, 0),          CHAN5G(48, 0),
+        CHAN5G(52, 0),          CHAN5G(56, 0),
+        CHAN5G(60, 0),          CHAN5G(64, 0),
+        CHAN5G(100, 0),         CHAN5G(104, 0),
+        CHAN5G(108, 0),         CHAN5G(112, 0),
+        CHAN5G(116, 0),         CHAN5G(120, 0),
+        CHAN5G(124, 0),         CHAN5G(128, 0),
+        CHAN5G(132, 0),         CHAN5G(136, 0),
+        CHAN5G(140, 0),         CHAN5G(149, 0),
+        CHAN5G(153, 0),         CHAN5G(157, 0),
+        CHAN5G(161, 0),         CHAN5G(165, 0),
+        CHAN5G(184, 0),         CHAN5G(188, 0),
+        CHAN5G(192, 0),         CHAN5G(196, 0),
+        CHAN5G(200, 0),         CHAN5G(204, 0),
+        CHAN5G(208, 0),         CHAN5G(212, 0),
+        CHAN5G(216, 0),
+};
+#undef CHAN5G
+
+static struct ieee80211_supported_band b43_band_5GHz_nphy = {
+        .band           = IEEE80211_BAND_5GHZ,
+        .channels       = b43_5ghz_nphy_chantable,
+        .n_channels     = ARRAY_SIZE(b43_5ghz_nphy_chantable),
+        .bitrates       = b43_a_ratetable,
+        .n_bitrates     = b43_a_ratetable_size,
+};
+
+static struct ieee80211_supported_band b43_band_5GHz_aphy = {
+        .band           = IEEE80211_BAND_5GHZ,
+        .channels       = b43_5ghz_aphy_chantable,
+        .n_channels     = ARRAY_SIZE(b43_5ghz_aphy_chantable),
+        .bitrates       = b43_a_ratetable,
+        .n_bitrates     = b43_a_ratetable_size,
+};
+
+static struct ieee80211_supported_band b43_band_2GHz = {
+        .band           = IEEE80211_BAND_2GHZ,
+        .channels       = b43_2ghz_chantable,
+        .n_channels     = ARRAY_SIZE(b43_2ghz_chantable),
+        .bitrates       = b43_g_ratetable,
+        .n_bitrates     = b43_g_ratetable_size,
 };
-#define b43_5ghz_chantable_size ARRAY_SIZE(b43_5ghz_chantable)
-#endif
 
 static void b43_wireless_core_exit(struct b43_wldev *dev);
 static int b43_wireless_core_init(struct b43_wldev *dev);
@@ -370,24 +465,30 @@ out:
 }
 
 /* Read HostFlags */
-u32 b43_hf_read(struct b43_wldev * dev)
+u64 b43_hf_read(struct b43_wldev * dev)
 {
-        u32 ret;
+        u64 ret;
 
         ret = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI);
         ret <<= 16;
+        ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI);
+        ret <<= 16;
         ret |= b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO);
 
         return ret;
 }
 
 /* Write HostFlags */
-void b43_hf_write(struct b43_wldev *dev, u32 value)
+void b43_hf_write(struct b43_wldev *dev, u64 value)
 {
-        b43_shm_write16(dev, B43_SHM_SHARED,
-                        B43_SHM_SH_HOSTFLO, (value & 0x0000FFFF));
-        b43_shm_write16(dev, B43_SHM_SHARED,
-                        B43_SHM_SH_HOSTFHI, ((value & 0xFFFF0000) >> 16));
+        u16 lo, mi, hi;
+
+        lo = (value & 0x00000000FFFFULL);
+        mi = (value & 0x0000FFFF0000ULL) >> 16;
+        hi = (value & 0xFFFF00000000ULL) >> 32;
+        b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFLO, lo);
+        b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFMI, mi);
+        b43_shm_write16(dev, B43_SHM_SHARED, B43_SHM_SH_HOSTFHI, hi);
 }
 
 void b43_tsf_read(struct b43_wldev *dev, u64 * tsf)
@@ -1222,17 +1323,18 @@ static void b43_write_beacon_template(struct b43_wldev *dev,
 }
 
 static void b43_write_probe_resp_plcp(struct b43_wldev *dev,
-                                      u16 shm_offset, u16 size, u8 rate)
+                                      u16 shm_offset, u16 size,
+                                      struct ieee80211_rate *rate)
 {
         struct b43_plcp_hdr4 plcp;
         u32 tmp;
         __le16 dur;
 
         plcp.data = 0;
-        b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate);
+        b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate->hw_value);
         dur = ieee80211_generic_frame_duration(dev->wl->hw,
                                                dev->wl->vif, size,
-                                               B43_RATE_TO_BASE100KBPS(rate));
+                                               rate);
         /* Write PLCP in two parts and timing for packet transfer */
         tmp = le32_to_cpu(plcp.data);
         b43_shm_write16(dev, B43_SHM_SHARED, shm_offset, tmp & 0xFFFF);
@@ -1247,7 +1349,8 @@ static void b43_write_probe_resp_plcp(struct b43_wldev *dev,
  * 3) Stripping TIM
  */
 static const u8 * b43_generate_probe_resp(struct b43_wldev *dev,
-                                          u16 *dest_size, u8 rate)
+                                          u16 *dest_size,
+                                          struct ieee80211_rate *rate)
 {
         const u8 *src_data;
         u8 *dest_data;
@@ -1292,7 +1395,7 @@ static const u8 * b43_generate_probe_resp(struct b43_wldev *dev,
                                          IEEE80211_STYPE_PROBE_RESP);
         dur = ieee80211_generic_frame_duration(dev->wl->hw,
                                                dev->wl->vif, *dest_size,
-                                               B43_RATE_TO_BASE100KBPS(rate));
+                                               rate);
         hdr->duration_id = dur;
 
         return dest_data;
@@ -1300,7 +1403,8 @@ static const u8 * b43_generate_probe_resp(struct b43_wldev *dev,
 
 static void b43_write_probe_resp_template(struct b43_wldev *dev,
                                           u16 ram_offset,
-                                          u16 shm_size_offset, u8 rate)
+                                          u16 shm_size_offset,
+                                          struct ieee80211_rate *rate)
 {
         const u8 *probe_resp_data;
         u16 size;
@@ -1313,14 +1417,15 @@ static void b43_write_probe_resp_template(struct b43_wldev *dev,
         /* Looks like PLCP headers plus packet timings are stored for
          * all possible basic rates
          */
-        b43_write_probe_resp_plcp(dev, 0x31A, size, B43_CCK_RATE_1MB);
-        b43_write_probe_resp_plcp(dev, 0x32C, size, B43_CCK_RATE_2MB);
-        b43_write_probe_resp_plcp(dev, 0x33E, size, B43_CCK_RATE_5MB);
-        b43_write_probe_resp_plcp(dev, 0x350, size, B43_CCK_RATE_11MB);
+        b43_write_probe_resp_plcp(dev, 0x31A, size, &b43_b_ratetable[0]);
+        b43_write_probe_resp_plcp(dev, 0x32C, size, &b43_b_ratetable[1]);
+        b43_write_probe_resp_plcp(dev, 0x33E, size, &b43_b_ratetable[2]);
+        b43_write_probe_resp_plcp(dev, 0x350, size, &b43_b_ratetable[3]);
 
         size = min((size_t) size, 0x200 - sizeof(struct b43_plcp_hdr6));
         b43_write_template_common(dev, probe_resp_data,
-                                  size, ram_offset, shm_size_offset, rate);
+                                  size, ram_offset, shm_size_offset,
+                                  rate->hw_value);
         kfree(probe_resp_data);
 }
 
@@ -1388,7 +1493,7 @@ static void handle_irq_beacon(struct b43_wldev *dev)
                         b43_write_beacon_template(dev, 0x68, 0x18,
                                                   B43_CCK_RATE_1MB);
                         b43_write_probe_resp_template(dev, 0x268, 0x4A,
-                                                      B43_CCK_RATE_11MB);
+                                                      &__b43_ratetable[3]);
                         wl->beacon0_uploaded = 1;
                 }
                 cmd |= B43_MACCMD_BEACON0_VALID;
@@ -2643,45 +2748,6 @@ static int b43_op_get_stats(struct ieee80211_hw *hw,
         return 0;
 }
 
-static const char *phymode_to_string(unsigned int phymode)
-{
-        switch (phymode) {
-        case B43_PHYMODE_A:
-                return "A";
-        case B43_PHYMODE_B:
-                return "B";
-        case B43_PHYMODE_G:
-                return "G";
-        default:
-                B43_WARN_ON(1);
-        }
-        return "";
-}
-
-static int find_wldev_for_phymode(struct b43_wl *wl,
-                                  unsigned int phymode,
-                                  struct b43_wldev **dev, bool * gmode)
-{
-        struct b43_wldev *d;
-
-        list_for_each_entry(d, &wl->devlist, list) {
-                if (d->phy.possible_phymodes & phymode) {
-                        /* Ok, this device supports the PHY-mode.
-                         * Now figure out how the gmode bit has to be
-                         * set to support it. */
-                        if (phymode == B43_PHYMODE_A)
-                                *gmode = 0;
-                        else
-                                *gmode = 1;
-                        *dev = d;
-
-                        return 0;
-                }
-        }
-
-        return -ESRCH;
-}
-
 static void b43_put_phy_into_reset(struct b43_wldev *dev)
 {
         struct ssb_device *sdev = dev->dev;
@@ -2701,28 +2767,64 @@ static void b43_put_phy_into_reset(struct b43_wldev *dev)
         msleep(1);
 }
 
+static const char * band_to_string(enum ieee80211_band band)
+{
+        switch (band) {
+        case IEEE80211_BAND_5GHZ:
+                return "5";
+        case IEEE80211_BAND_2GHZ:
+                return "2.4";
+        default:
+                break;
+        }
+        B43_WARN_ON(1);
+        return "";
+}
+
 /* Expects wl->mutex locked */
-static int b43_switch_phymode(struct b43_wl *wl, unsigned int new_mode)
+static int b43_switch_band(struct b43_wl *wl, struct ieee80211_channel *chan)
 {
-        struct b43_wldev *up_dev;
+        struct b43_wldev *up_dev = NULL;
         struct b43_wldev *down_dev;
+        struct b43_wldev *d;
         int err;
-        bool gmode = 0;
+        bool gmode;
         int prev_status;
 
-        err = find_wldev_for_phymode(wl, new_mode, &up_dev, &gmode);
-        if (err) {
-                b43err(wl, "Could not find a device for %s-PHY mode\n",
-                       phymode_to_string(new_mode));
-                return err;
+        /* Find a device and PHY which supports the band. */
+        list_for_each_entry(d, &wl->devlist, list) {
+                switch (chan->band) {
+                case IEEE80211_BAND_5GHZ:
+                        if (d->phy.supports_5ghz) {
+                                up_dev = d;
+                                gmode = 0;
+                        }
+                        break;
+                case IEEE80211_BAND_2GHZ:
+                        if (d->phy.supports_2ghz) {
+                                up_dev = d;
+                                gmode = 1;
+                        }
+                        break;
+                default:
+                        B43_WARN_ON(1);
+                        return -EINVAL;
+                }
+                if (up_dev)
+                        break;
+        }
+        if (!up_dev) {
+                b43err(wl, "Could not find a device for %s-GHz band operation\n",
+                       band_to_string(chan->band));
+                return -ENODEV;
         }
         if ((up_dev == wl->current_dev) &&
             (!!wl->current_dev->phy.gmode == !!gmode)) {
                 /* This device is already running. */
                 return 0;
         }
-        b43dbg(wl, "Reconfiguring PHYmode to %s-PHY\n",
-               phymode_to_string(new_mode));
+        b43dbg(wl, "Switching to %s-GHz band\n",
+               band_to_string(chan->band));
         down_dev = wl->current_dev;
 
         prev_status = b43_status(down_dev);
@@ -2744,8 +2846,8 @@ static int b43_switch_phymode(struct b43_wl *wl, unsigned int new_mode)
                 err = b43_wireless_core_init(up_dev);
                 if (err) {
                         b43err(wl, "Fatal: Could not initialize device for "
-                               "newly selected %s-PHY mode\n",
-                               phymode_to_string(new_mode));
+                               "selected %s-GHz band\n",
+                               band_to_string(chan->band));
                         goto init_failure;
                 }
         }
@@ -2753,8 +2855,8 @@ static int b43_switch_phymode(struct b43_wl *wl, unsigned int new_mode)
                 err = b43_wireless_core_start(up_dev);
                 if (err) {
                         b43err(wl, "Fatal: Coult not start device for "
-                               "newly selected %s-PHY mode\n",
-                               phymode_to_string(new_mode));
+                               "selected %s-GHz band\n",
+                               band_to_string(chan->band));
                         b43_wireless_core_exit(up_dev);
                         goto init_failure;
                 }
@@ -2764,7 +2866,7 @@ static int b43_switch_phymode(struct b43_wl *wl, unsigned int new_mode)
         wl->current_dev = up_dev;
 
         return 0;
-      init_failure:
+init_failure:
         /* Whoops, failed to init the new core. No core is operating now. */
         wl->current_dev = NULL;
         return err;
@@ -2822,28 +2924,14 @@ static int b43_op_config(struct ieee80211_hw *hw, struct ieee80211_conf *conf)
         struct b43_wldev *dev;
         struct b43_phy *phy;
         unsigned long flags;
-        unsigned int new_phymode = 0xFFFF;
         int antenna;
         int err = 0;
         u32 savedirqs;
 
         mutex_lock(&wl->mutex);
 
-        /* Switch the PHY mode (if necessary). */
-        switch (conf->phymode) {
-        case MODE_IEEE80211A:
-                new_phymode = B43_PHYMODE_A;
-                break;
-        case MODE_IEEE80211B:
-                new_phymode = B43_PHYMODE_B;
-                break;
-        case MODE_IEEE80211G:
-                new_phymode = B43_PHYMODE_G;
-                break;
-        default:
-                B43_WARN_ON(1);
-        }
-        err = b43_switch_phymode(wl, new_phymode);
+        /* Switch the band (if necessary). This might change the active core. */
+        err = b43_switch_band(wl, conf->channel);
         if (err)
                 goto out_unlock_mutex;
         dev = wl->current_dev;
@@ -2863,8 +2951,8 @@ static int b43_op_config(struct ieee80211_hw *hw, struct ieee80211_conf *conf)
 
         /* Switch to the requested channel.
          * The firmware takes care of races with the TX handler. */
-        if (conf->channel_val != phy->channel)
-                b43_radio_selectchannel(dev, conf->channel_val, 0);
+        if (conf->channel->hw_value != phy->channel)
+                b43_radio_selectchannel(dev, conf->channel->hw_value, 0);
 
         /* Enable/Disable ShortSlot timing. */
         if ((!!(conf->flags & IEEE80211_CONF_SHORT_SLOT_TIME)) !=
@@ -3806,31 +3894,23 @@ static void b43_chip_reset(struct work_struct *work)
                 b43info(wl, "Controller restarted\n");
 }
 
-static int b43_setup_modes(struct b43_wldev *dev,
+static int b43_setup_bands(struct b43_wldev *dev,
                            bool have_2ghz_phy, bool have_5ghz_phy)
 {
         struct ieee80211_hw *hw = dev->wl->hw;
-        struct ieee80211_hw_mode *mode;
-        struct b43_phy *phy = &dev->phy;
-        int err;
 
-        /* XXX: This function will go away soon, when mac80211
-         *      band stuff is rewritten. So this is just a hack.
-         *      For now we always claim GPHY mode, as there is no
-         *      support for NPHY and APHY in the device, yet.
-         *      This assumption is OK, as any B, N or A PHY will already
-         *      have died a horrible sanity check death earlier. */
-
-        mode = &phy->hwmodes[0];
-        mode->mode = MODE_IEEE80211G;
-        mode->num_channels = b43_2ghz_chantable_size;
-        mode->channels = b43_2ghz_chantable;
-        mode->num_rates = b43_g_ratetable_size;
-        mode->rates = b43_g_ratetable;
-        err = ieee80211_register_hwmode(hw, mode);
-        if (err)
-                return err;
-        phy->possible_phymodes |= B43_PHYMODE_G;
+        if (have_2ghz_phy)
+                hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &b43_band_2GHz;
+        if (dev->phy.type == B43_PHYTYPE_N) {
+                if (have_5ghz_phy)
+                        hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_nphy;
+        } else {
+                if (have_5ghz_phy)
+                        hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &b43_band_5GHz_aphy;
+        }
+
+        dev->phy.supports_2ghz = have_2ghz_phy;
+        dev->phy.supports_5ghz = have_5ghz_phy;
 
         return 0;
 }
@@ -3912,7 +3992,7 @@ static int b43_wireless_core_attach(struct b43_wldev *dev)
         err = b43_validate_chipaccess(dev);
         if (err)
                 goto err_powerdown;
-        err = b43_setup_modes(dev, have_2ghz_phy, have_5ghz_phy);
+        err = b43_setup_bands(dev, have_2ghz_phy, have_5ghz_phy);
         if (err)
                 goto err_powerdown;
 
diff --git a/drivers/net/wireless/b43/main.h b/drivers/net/wireless/b43/main.h
index 2d52d9de9305..24a79f5d6ff5 100644
--- a/drivers/net/wireless/b43/main.h
+++ b/drivers/net/wireless/b43/main.h
@@ -95,8 +95,8 @@ u16 b43_shm_read16(struct b43_wldev *dev, u16 routing, u16 offset);
 void b43_shm_write32(struct b43_wldev *dev, u16 routing, u16 offset, u32 value);
 void b43_shm_write16(struct b43_wldev *dev, u16 routing, u16 offset, u16 value);
 
-u32 b43_hf_read(struct b43_wldev *dev);
-void b43_hf_write(struct b43_wldev *dev, u32 value);
+u64 b43_hf_read(struct b43_wldev *dev);
+void b43_hf_write(struct b43_wldev *dev, u64 value);
 
 void b43_dummy_transmission(struct b43_wldev *dev);
 
diff --git a/drivers/net/wireless/b43/sysfs.c b/drivers/net/wireless/b43/sysfs.c
index f4faff6a7d6c..275095b8cbe7 100644
--- a/drivers/net/wireless/b43/sysfs.c
+++ b/drivers/net/wireless/b43/sysfs.c
@@ -47,29 +47,6 @@ static int get_integer(const char *buf, size_t count)
         return ret;
 }
 
-static int get_boolean(const char *buf, size_t count)
-{
-        if (count != 0) {
-                if (buf[0] == '1')
-                        return 1;
-                if (buf[0] == '0')
-                        return 0;
-                if (count >= 4 && memcmp(buf, "true", 4) == 0)
-                        return 1;
-                if (count >= 5 && memcmp(buf, "false", 5) == 0)
-                        return 0;
-                if (count >= 3 && memcmp(buf, "yes", 3) == 0)
-                        return 1;
-                if (count >= 2 && memcmp(buf, "no", 2) == 0)
-                        return 0;
-                if (count >= 2 && memcmp(buf, "on", 2) == 0)
-                        return 1;
-                if (count >= 3 && memcmp(buf, "off", 3) == 0)
-                        return 0;
-        }
-        return -EINVAL;
-}
-
 static ssize_t b43_attr_interfmode_show(struct device *dev,
                                         struct device_attribute *attr,
                                         char *buf)
@@ -155,82 +132,18 @@ static ssize_t b43_attr_interfmode_store(struct device *dev,
 static DEVICE_ATTR(interference, 0644,
                    b43_attr_interfmode_show, b43_attr_interfmode_store);
 
-static ssize_t b43_attr_preamble_show(struct device *dev,
-                                      struct device_attribute *attr, char *buf)
-{
-        struct b43_wldev *wldev = dev_to_b43_wldev(dev);
-        ssize_t count;
-
-        if (!capable(CAP_NET_ADMIN))
-                return -EPERM;
-
-        mutex_lock(&wldev->wl->mutex);
-
-        if (wldev->short_preamble)
-                count =
-                    snprintf(buf, PAGE_SIZE, "1 (Short Preamble enabled)\n");
-        else
-                count =
-                    snprintf(buf, PAGE_SIZE, "0 (Short Preamble disabled)\n");
-
-        mutex_unlock(&wldev->wl->mutex);
-
-        return count;
-}
-
-static ssize_t b43_attr_preamble_store(struct device *dev,
-                                       struct device_attribute *attr,
-                                       const char *buf, size_t count)
-{
-        struct b43_wldev *wldev = dev_to_b43_wldev(dev);
-        unsigned long flags;
-        int value;
-
-        if (!capable(CAP_NET_ADMIN))
-                return -EPERM;
-
-        value = get_boolean(buf, count);
-        if (value < 0)
-                return value;
-        mutex_lock(&wldev->wl->mutex);
-        spin_lock_irqsave(&wldev->wl->irq_lock, flags);
-
-        wldev->short_preamble = !!value;
-
-        spin_unlock_irqrestore(&wldev->wl->irq_lock, flags);
-        mutex_unlock(&wldev->wl->mutex);
-
-        return count;
-}
-
-static DEVICE_ATTR(shortpreamble, 0644,
-                   b43_attr_preamble_show, b43_attr_preamble_store);
-
 int b43_sysfs_register(struct b43_wldev *wldev)
 {
         struct device *dev = wldev->dev->dev;
-        int err;
 
         B43_WARN_ON(b43_status(wldev) != B43_STAT_INITIALIZED);
 
-        err = device_create_file(dev, &dev_attr_interference);
-        if (err)
-                goto out;
-        err = device_create_file(dev, &dev_attr_shortpreamble);
-        if (err)
-                goto err_remove_interfmode;
-
-      out:
-        return err;
-      err_remove_interfmode:
-        device_remove_file(dev, &dev_attr_interference);
-        goto out;
+        return device_create_file(dev, &dev_attr_interference);
 }
 
 void b43_sysfs_unregister(struct b43_wldev *wldev)
 {
         struct device *dev = wldev->dev->dev;
 
-        device_remove_file(dev, &dev_attr_shortpreamble);
         device_remove_file(dev, &dev_attr_interference);
 }
diff --git a/drivers/net/wireless/b43/xmit.c b/drivers/net/wireless/b43/xmit.c
index 7caa26eb4105..187c11bee0f1 100644
--- a/drivers/net/wireless/b43/xmit.c
+++ b/drivers/net/wireless/b43/xmit.c
@@ -32,46 +32,48 @@
 #include "dma.h"
 
 
-/* Extract the bitrate out of a CCK PLCP header. */
-static u8 b43_plcp_get_bitrate_cck(struct b43_plcp_hdr6 *plcp)
+/* Extract the bitrate index out of a CCK PLCP header. */
+static int b43_plcp_get_bitrate_idx_cck(struct b43_plcp_hdr6 *plcp)
 {
         switch (plcp->raw[0]) {
         case 0x0A:
-                return B43_CCK_RATE_1MB;
+                return 0;
         case 0x14:
-                return B43_CCK_RATE_2MB;
+                return 1;
         case 0x37:
-                return B43_CCK_RATE_5MB;
+                return 2;
         case 0x6E:
-                return B43_CCK_RATE_11MB;
+                return 3;
         }
         B43_WARN_ON(1);
-        return 0;
+        return -1;
 }
 
-/* Extract the bitrate out of an OFDM PLCP header. */
-static u8 b43_plcp_get_bitrate_ofdm(struct b43_plcp_hdr6 *plcp)
+/* Extract the bitrate index out of an OFDM PLCP header. */
+static u8 b43_plcp_get_bitrate_idx_ofdm(struct b43_plcp_hdr6 *plcp, bool aphy)
 {
+        int base = aphy ? 0 : 4;
+
         switch (plcp->raw[0] & 0xF) {
         case 0xB:
-                return B43_OFDM_RATE_6MB;
+                return base + 0;
         case 0xF:
-                return B43_OFDM_RATE_9MB;
+                return base + 1;
         case 0xA:
-                return B43_OFDM_RATE_12MB;
+                return base + 2;
         case 0xE:
-                return B43_OFDM_RATE_18MB;
+                return base + 3;
         case 0x9:
-                return B43_OFDM_RATE_24MB;
+                return base + 4;
         case 0xD:
-                return B43_OFDM_RATE_36MB;
+                return base + 5;
         case 0x8:
-                return B43_OFDM_RATE_48MB;
+                return base + 6;
         case 0xC:
-                return B43_OFDM_RATE_54MB;
+                return base + 7;
         }
         B43_WARN_ON(1);
-        return 0;
+        return -1;
 }
 
 u8 b43_plcp_get_ratecode_cck(const u8 bitrate)
@@ -191,6 +193,7 @@ int b43_generate_txhdr(struct b43_wldev *dev,
             (const struct ieee80211_hdr *)fragment_data;
         int use_encryption = (!(txctl->flags & IEEE80211_TXCTL_DO_NOT_ENCRYPT));
         u16 fctl = le16_to_cpu(wlhdr->frame_control);
+        struct ieee80211_rate *fbrate;
         u8 rate, rate_fb;
         int rate_ofdm, rate_fb_ofdm;
         unsigned int plcp_fragment_len;
@@ -200,9 +203,11 @@ int b43_generate_txhdr(struct b43_wldev *dev,
 
         memset(txhdr, 0, sizeof(*txhdr));
 
-        rate = txctl->tx_rate;
+        WARN_ON(!txctl->tx_rate);
+        rate = txctl->tx_rate ? txctl->tx_rate->hw_value : B43_CCK_RATE_1MB;
         rate_ofdm = b43_is_ofdm_rate(rate);
-        rate_fb = (txctl->alt_retry_rate == -1) ? rate : txctl->alt_retry_rate;
+        fbrate = txctl->alt_retry_rate ? : txctl->tx_rate;
+        rate_fb = fbrate->hw_value;
         rate_fb_ofdm = b43_is_ofdm_rate(rate_fb);
 
         if (rate_ofdm)
@@ -221,11 +226,10 @@ int b43_generate_txhdr(struct b43_wldev *dev,
                  * use the original dur_id field. */
                 txhdr->dur_fb = wlhdr->duration_id;
         } else {
-                int fbrate_base100kbps = B43_RATE_TO_BASE100KBPS(rate_fb);
                 txhdr->dur_fb = ieee80211_generic_frame_duration(dev->wl->hw,
                                                                  txctl->vif,
                                                                  fragment_len,
-                                                                 fbrate_base100kbps);
+                                                                 fbrate);
         }
 
         plcp_fragment_len = fragment_len + FCS_LEN;
@@ -287,7 +291,7 @@ int b43_generate_txhdr(struct b43_wldev *dev,
                 phy_ctl |= B43_TXH_PHY_ENC_OFDM;
         else
                 phy_ctl |= B43_TXH_PHY_ENC_CCK;
-        if (dev->short_preamble)
+        if (txctl->flags & IEEE80211_TXCTL_SHORT_PREAMBLE)
                 phy_ctl |= B43_TXH_PHY_SHORTPRMBL;
 
         switch (b43_ieee80211_antenna_sanitize(dev, txctl->antenna_sel_tx)) {
@@ -332,7 +336,8 @@ int b43_generate_txhdr(struct b43_wldev *dev,
                 int rts_rate_ofdm, rts_rate_fb_ofdm;
                 struct b43_plcp_hdr6 *plcp;
 
-                rts_rate = txctl->rts_cts_rate;
+                WARN_ON(!txctl->rts_cts_rate);
+                rts_rate = txctl->rts_cts_rate ? txctl->rts_cts_rate->hw_value : B43_CCK_RATE_1MB;
                 rts_rate_ofdm = b43_is_ofdm_rate(rts_rate);
                 rts_rate_fb = b43_calc_fallback_rate(rts_rate);
                 rts_rate_fb_ofdm = b43_is_ofdm_rate(rts_rate_fb);
@@ -506,6 +511,7 @@ void b43_rx(struct b43_wldev *dev, struct sk_buff *skb, const void *_rxhdr)
         u16 phystat0, phystat3, chanstat, mactime;
         u32 macstat;
         u16 chanid;
+        u16 phytype;
         u8 jssi;
         int padding;
 
@@ -518,6 +524,7 @@ void b43_rx(struct b43_wldev *dev, struct sk_buff *skb, const void *_rxhdr)
         macstat = le32_to_cpu(rxhdr->mac_status);
         mactime = le16_to_cpu(rxhdr->mac_time);
         chanstat = le16_to_cpu(rxhdr->channel);
+        phytype = chanstat & B43_RX_CHAN_PHYTYPE;
 
         if (macstat & B43_RX_MAC_FCSERR)
                 dev->wl->ieee_stats.dot11FCSErrorCount++;
@@ -575,18 +582,23 @@ void b43_rx(struct b43_wldev *dev, struct sk_buff *skb, const void *_rxhdr)
         /* the next line looks wrong, but is what mac80211 wants */
         status.signal = (jssi * 100) / B43_RX_MAX_SSI;
         if (phystat0 & B43_RX_PHYST0_OFDM)
-                status.rate = b43_plcp_get_bitrate_ofdm(plcp);
+                status.rate_idx = b43_plcp_get_bitrate_idx_ofdm(plcp,
+                                                phytype == B43_PHYTYPE_A);
         else
-                status.rate = b43_plcp_get_bitrate_cck(plcp);
+                status.rate_idx = b43_plcp_get_bitrate_idx_cck(plcp);
         status.antenna = !!(phystat0 & B43_RX_PHYST0_ANT);
 
         /*
-         * If monitors are present get full 64-bit timestamp. This
-         * code assumes we get to process the packet within 16 bits
-         * of timestamp, i.e. about 65 milliseconds after the PHY
-         * received the first symbol.
+         * All frames on monitor interfaces and beacons always need a full
+         * 64-bit timestamp. Monitor interfaces need it for diagnostic
+         * purposes and beacons for IBSS merging.
+         * This code assumes we get to process the packet within 16 bits
+         * of timestamp, i.e. about 65 milliseconds after the PHY received
+         * the first symbol.
          */
-        if (dev->wl->radiotap_enabled) {
+        if (((fctl & (IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE))
+            == (IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_BEACON)) ||
+            dev->wl->radiotap_enabled) {
                 u16 low_mactime_now;
 
                 b43_tsf_read(dev, &status.mactime);
@@ -601,29 +613,28 @@ void b43_rx(struct b43_wldev *dev, struct sk_buff *skb, const void *_rxhdr)
         chanid = (chanstat & B43_RX_CHAN_ID) >> B43_RX_CHAN_ID_SHIFT;
         switch (chanstat & B43_RX_CHAN_PHYTYPE) {
         case B43_PHYTYPE_A:
-                status.phymode = MODE_IEEE80211A;
+                status.band = IEEE80211_BAND_5GHZ;
                 B43_WARN_ON(1);
                 /* FIXME: We don't really know which value the "chanid" contains.
                  *        So the following assignment might be wrong. */
-                status.channel = chanid;
-                status.freq = b43_channel_to_freq_5ghz(status.channel);
+                status.freq = b43_channel_to_freq_5ghz(chanid);
                 break;
         case B43_PHYTYPE_G:
-                status.phymode = MODE_IEEE80211G;
+                status.band = IEEE80211_BAND_2GHZ;
                 /* chanid is the radio channel cookie value as used
                  * to tune the radio. */
                 status.freq = chanid + 2400;
-                status.channel = b43_freq_to_channel_2ghz(status.freq);
                 break;
         case B43_PHYTYPE_N:
-                status.phymode = 0xDEAD /*FIXME MODE_IEEE80211N*/;
                 /* chanid is the SHM channel cookie. Which is the plain
                  * channel number in b43. */
-                status.channel = chanid;
-                if (chanstat & B43_RX_CHAN_5GHZ)
-                        status.freq = b43_freq_to_channel_5ghz(status.freq);
-                else
-                        status.freq = b43_freq_to_channel_2ghz(status.freq);
+                if (chanstat & B43_RX_CHAN_5GHZ) {
+                        status.band = IEEE80211_BAND_5GHZ;
+                        status.freq = b43_freq_to_channel_5ghz(chanid);
+                } else {
+                        status.band = IEEE80211_BAND_2GHZ;
+                        status.freq = b43_freq_to_channel_2ghz(chanid);
+                }
                 break;
         default:
                 B43_WARN_ON(1);
diff --git a/drivers/net/wireless/b43legacy/b43legacy.h b/drivers/net/wireless/b43legacy/b43legacy.h
index 93d45b71799a..242b8ad4e33c 100644
--- a/drivers/net/wireless/b43legacy/b43legacy.h
+++ b/drivers/net/wireless/b43legacy/b43legacy.h
@@ -130,13 +130,19 @@
 #define B43legacy_SHM_SH_HOSTFHI        0x0060 /* Hostflags ucode opts (high) */
 /* SHM_SHARED crypto engine */
 #define B43legacy_SHM_SH_KEYIDXBLOCK    0x05D4 /* Key index/algorithm block */
-/* SHM_SHARED beacon variables */
+/* SHM_SHARED beacon/AP variables */
+#define B43legacy_SHM_SH_DTIMP          0x0012 /* DTIM period */
+#define B43legacy_SHM_SH_BTL0           0x0018 /* Beacon template length 0 */
+#define B43legacy_SHM_SH_BTL1           0x001A /* Beacon template length 1 */
+#define B43legacy_SHM_SH_BTSFOFF        0x001C /* Beacon TSF offset */
+#define B43legacy_SHM_SH_TIMPOS         0x001E /* TIM position in beacon */
 #define B43legacy_SHM_SH_BEACPHYCTL     0x0054 /* Beacon PHY TX control word */
 /* SHM_SHARED ACK/CTS control */
 #define B43legacy_SHM_SH_ACKCTSPHYCTL   0x0022 /* ACK/CTS PHY control word */
 /* SHM_SHARED probe response variables */
-#define B43legacy_SHM_SH_PRPHYCTL       0x0188 /* Probe Resp PHY TX control */
+#define B43legacy_SHM_SH_PRTLEN         0x004A /* Probe Response template length */
 #define B43legacy_SHM_SH_PRMAXTIME      0x0074 /* Probe Response max time */
+#define B43legacy_SHM_SH_PRPHYCTL       0x0188 /* Probe Resp PHY TX control */
 /* SHM_SHARED rate tables */
 /* SHM_SHARED microcode soft registers */
 #define B43legacy_SHM_SH_UCODEREV       0x0000 /* Microcode revision */
@@ -199,6 +205,13 @@
 #define B43legacy_MACCTL_TBTTHOLD       0x10000000 /* TBTT Hold */
 #define B43legacy_MACCTL_GMODE          0x80000000 /* G Mode */
 
+/* MAC Command bitfield */
+#define B43legacy_MACCMD_BEACON0_VALID  0x00000001 /* Beacon 0 in template RAM is busy/valid */
+#define B43legacy_MACCMD_BEACON1_VALID  0x00000002 /* Beacon 1 in template RAM is busy/valid */
+#define B43legacy_MACCMD_DFQ_VALID      0x00000004 /* Directed frame queue valid (IBSS PS mode, ATIM) */
+#define B43legacy_MACCMD_CCA            0x00000008 /* Clear channel assessment */
+#define B43legacy_MACCMD_BGNOISE        0x00000010 /* Background noise */
+
 /* 802.11 core specific TM State Low flags */
 #define B43legacy_TMSLOW_GMODE          0x20000000 /* G Mode Enable */
 #define B43legacy_TMSLOW_PLLREFSEL      0x00200000 /* PLL Freq Ref Select */
@@ -317,15 +330,7 @@ enum {
 # undef assert
 #endif
 #ifdef CONFIG_B43LEGACY_DEBUG
-# define B43legacy_WARN_ON(expr)                                        \
-        do {                                                            \
-                if (unlikely((expr))) {                                 \
-                        printk(KERN_INFO PFX "Test (%s) failed at:"     \
-                                              " %s:%d:%s()\n",          \
-                                              #expr, __FILE__,          \
-                                              __LINE__, __FUNCTION__);  \
-                }                                                       \
-        } while (0)
+# define B43legacy_WARN_ON(x)   WARN_ON(x)
 # define B43legacy_BUG_ON(expr)                                         \
         do {                                                            \
                 if (unlikely((expr))) {                                 \
@@ -336,7 +341,9 @@ enum {
         } while (0)
 # define B43legacy_DEBUG        1
 #else
-# define B43legacy_WARN_ON(x)   do { /* nothing */ } while (0)
+/* This will evaluate the argument even if debugging is disabled. */
+static inline bool __b43legacy_warn_on_dummy(bool x) { return x; }
+# define B43legacy_WARN_ON(x)   __b43legacy_warn_on_dummy(unlikely(!!(x)))
 # define B43legacy_BUG_ON(x)    do { /* nothing */ } while (0)
 # define B43legacy_DEBUG        0
 #endif
@@ -392,10 +399,6 @@ struct b43legacy_phy {
         u8 possible_phymodes;
         /* GMODE bit enabled in MACCTL? */
         bool gmode;
-        /* Possible ieee80211 subsystem hwmodes for this PHY.
-         * Which mode is selected, depends on thr GMODE enabled bit */
-#define B43legacy_MAX_PHYHWMODES        2
-        struct ieee80211_hw_mode hwmodes[B43legacy_MAX_PHYHWMODES];
 
         /* Analog Type */
         u8 analog;
@@ -598,6 +601,12 @@ struct b43legacy_wl {
         u8 nr_devs;
 
         bool radiotap_enabled;
+
+        /* The beacon we are currently using (AP or IBSS mode).
+         * This beacon stuff is protected by the irq_lock. */
+        struct sk_buff *current_beacon;
+        bool beacon0_uploaded;
+        bool beacon1_uploaded;
 };
 
 /* Pointers to the firmware data and meta information about it. */
@@ -649,7 +658,7 @@ struct b43legacy_wldev {
 
         bool __using_pio;       /* Using pio rather than dma. */
         bool bad_frames_preempt;/* Use "Bad Frames Preemption". */
-        bool reg124_set_0x4;    /* Variable to keep track of IRQ. */
+        bool dfq_valid;         /* Directed frame queue valid (IBSS PS mode, ATIM). */
         bool short_preamble;    /* TRUE if using short preamble. */
         bool short_slot;        /* TRUE if using short slot timing. */
         bool radio_hw_enable;   /* State of radio hardware enable bit. */
@@ -696,9 +705,6 @@ struct b43legacy_wldev {
         u8 max_nr_keys;
         struct b43legacy_key key[58];
 
-        /* Cached beacon template while uploading the template. */
-        struct sk_buff *cached_beacon;
-
         /* Firmware data */
         struct b43legacy_firmware fw;
 
diff --git a/drivers/net/wireless/b43legacy/main.c b/drivers/net/wireless/b43legacy/main.c
index c39de422e220..82953dd0bae0 100644
--- a/drivers/net/wireless/b43legacy/main.c
+++ b/drivers/net/wireless/b43legacy/main.c
@@ -95,28 +95,29 @@ MODULE_DEVICE_TABLE(ssb, b43legacy_ssb_tbl);
  * data in there. This data is the same for all devices, so we don't
  * get concurrency issues */
 #define RATETAB_ENT(_rateid, _flags) \
-        {                                                       \
-                .rate   = B43legacy_RATE_TO_100KBPS(_rateid),   \
-                .val    = (_rateid),                            \
-                .val2   = (_rateid),                            \
-                .flags  = (_flags),                             \
+        {                                                               \
+                .bitrate        = B43legacy_RATE_TO_100KBPS(_rateid),   \
+                .hw_value       = (_rateid),                            \
+                .flags          = (_flags),                             \
         }
+/*
+ * NOTE: When changing this, sync with xmit.c's
+ *       b43legacy_plcp_get_bitrate_idx_* functions!
+ */
 static struct ieee80211_rate __b43legacy_ratetable[] = {
-        RATETAB_ENT(B43legacy_CCK_RATE_1MB, IEEE80211_RATE_CCK),
-        RATETAB_ENT(B43legacy_CCK_RATE_2MB, IEEE80211_RATE_CCK_2),
-        RATETAB_ENT(B43legacy_CCK_RATE_5MB, IEEE80211_RATE_CCK_2),
-        RATETAB_ENT(B43legacy_CCK_RATE_11MB, IEEE80211_RATE_CCK_2),
-        RATETAB_ENT(B43legacy_OFDM_RATE_6MB, IEEE80211_RATE_OFDM),
-        RATETAB_ENT(B43legacy_OFDM_RATE_9MB, IEEE80211_RATE_OFDM),
-        RATETAB_ENT(B43legacy_OFDM_RATE_12MB, IEEE80211_RATE_OFDM),
-        RATETAB_ENT(B43legacy_OFDM_RATE_18MB, IEEE80211_RATE_OFDM),
-        RATETAB_ENT(B43legacy_OFDM_RATE_24MB, IEEE80211_RATE_OFDM),
-        RATETAB_ENT(B43legacy_OFDM_RATE_36MB, IEEE80211_RATE_OFDM),
-        RATETAB_ENT(B43legacy_OFDM_RATE_48MB, IEEE80211_RATE_OFDM),
-        RATETAB_ENT(B43legacy_OFDM_RATE_54MB, IEEE80211_RATE_OFDM),
+        RATETAB_ENT(B43legacy_CCK_RATE_1MB, 0),
+        RATETAB_ENT(B43legacy_CCK_RATE_2MB, IEEE80211_RATE_SHORT_PREAMBLE),
+        RATETAB_ENT(B43legacy_CCK_RATE_5MB, IEEE80211_RATE_SHORT_PREAMBLE),
+        RATETAB_ENT(B43legacy_CCK_RATE_11MB, IEEE80211_RATE_SHORT_PREAMBLE),
+        RATETAB_ENT(B43legacy_OFDM_RATE_6MB, 0),
+        RATETAB_ENT(B43legacy_OFDM_RATE_9MB, 0),
+        RATETAB_ENT(B43legacy_OFDM_RATE_12MB, 0),
+        RATETAB_ENT(B43legacy_OFDM_RATE_18MB, 0),
+        RATETAB_ENT(B43legacy_OFDM_RATE_24MB, 0),
+        RATETAB_ENT(B43legacy_OFDM_RATE_36MB, 0),
+        RATETAB_ENT(B43legacy_OFDM_RATE_48MB, 0),
+        RATETAB_ENT(B43legacy_OFDM_RATE_54MB, 0),
 };
-#define b43legacy_a_ratetable           (__b43legacy_ratetable + 4)
-#define b43legacy_a_ratetable_size      8
 #define b43legacy_b_ratetable           (__b43legacy_ratetable + 0)
 #define b43legacy_b_ratetable_size      4
 #define b43legacy_g_ratetable           (__b43legacy_ratetable + 0)
@@ -124,14 +125,8 @@ static struct ieee80211_rate __b43legacy_ratetable[] = {
 
 #define CHANTAB_ENT(_chanid, _freq) \
         {                                                       \
-                .chan   = (_chanid),                            \
-                .freq   = (_freq),                              \
-                .val    = (_chanid),                            \
-                .flag   = IEEE80211_CHAN_W_SCAN |               \
-                          IEEE80211_CHAN_W_ACTIVE_SCAN |        \
-                          IEEE80211_CHAN_W_IBSS,                \
-                .power_level    = 0x0A,                         \
-                .antenna_max    = 0xFF,                         \
+                .center_freq    = (_freq),                      \
+                .hw_value       = (_chanid),                    \
         }
 static struct ieee80211_channel b43legacy_bg_chantable[] = {
         CHANTAB_ENT(1, 2412),
@@ -149,7 +144,20 @@ static struct ieee80211_channel b43legacy_bg_chantable[] = {
         CHANTAB_ENT(13, 2472),
         CHANTAB_ENT(14, 2484),
 };
-#define b43legacy_bg_chantable_size     ARRAY_SIZE(b43legacy_bg_chantable)
+
+static struct ieee80211_supported_band b43legacy_band_2GHz_BPHY = {
+        .channels = b43legacy_bg_chantable,
+        .n_channels = ARRAY_SIZE(b43legacy_bg_chantable),
+        .bitrates = b43legacy_b_ratetable,
+        .n_bitrates = b43legacy_b_ratetable_size,
+};
+
+static struct ieee80211_supported_band b43legacy_band_2GHz_GPHY = {
+        .channels = b43legacy_bg_chantable,
+        .n_channels = ARRAY_SIZE(b43legacy_bg_chantable),
+        .bitrates = b43legacy_g_ratetable,
+        .n_bitrates = b43legacy_g_ratetable_size,
+};
 
 static void b43legacy_wireless_core_exit(struct b43legacy_wldev *dev);
 static int b43legacy_wireless_core_init(struct b43legacy_wldev *dev);
@@ -797,9 +805,8 @@ static void b43legacy_generate_noise_sample(struct b43legacy_wldev *dev)
 {
         b43legacy_jssi_write(dev, 0x7F7F7F7F);
         b43legacy_write32(dev, B43legacy_MMIO_MACCMD,
-                          b43legacy_read32(dev,
-                          B43legacy_MMIO_MACCMD)
-                          | (1 << 4));
+                          b43legacy_read32(dev, B43legacy_MMIO_MACCMD)
+                          | B43legacy_MACCMD_BGNOISE);
         B43legacy_WARN_ON(dev->noisecalc.channel_at_start !=
                             dev->phy.channel);
 }
@@ -888,18 +895,18 @@ static void handle_irq_tbtt_indication(struct b43legacy_wldev *dev)
                 if (1/*FIXME: the last PSpoll frame was sent successfully */)
                         b43legacy_power_saving_ctl_bits(dev, -1, -1);
         }
-        dev->reg124_set_0x4 = 0;
         if (b43legacy_is_mode(dev->wl, IEEE80211_IF_TYPE_IBSS))
-                dev->reg124_set_0x4 = 1;
+                dev->dfq_valid = 1;
 }
 
 static void handle_irq_atim_end(struct b43legacy_wldev *dev)
 {
-        if (!dev->reg124_set_0x4) /*FIXME rename this variable*/
-                return;
-        b43legacy_write32(dev, B43legacy_MMIO_MACCMD,
-                          b43legacy_read32(dev, B43legacy_MMIO_MACCMD)
-                          | 0x4);
+        if (dev->dfq_valid) {
+                b43legacy_write32(dev, B43legacy_MMIO_MACCMD,
+                                  b43legacy_read32(dev, B43legacy_MMIO_MACCMD)
+                                  | B43legacy_MACCMD_DFQ_VALID);
+                dev->dfq_valid = 0;
+        }
 }
 
 static void handle_irq_pmq(struct b43legacy_wldev *dev)
@@ -955,32 +962,77 @@ static void b43legacy_write_beacon_template(struct b43legacy_wldev *dev,
                                             u16 ram_offset,
                                             u16 shm_size_offset, u8 rate)
 {
-        int len;
-        const u8 *data;
 
-        B43legacy_WARN_ON(!dev->cached_beacon);
-        len = min((size_t)dev->cached_beacon->len,
+        unsigned int i, len, variable_len;
+        const struct ieee80211_mgmt *bcn;
+        const u8 *ie;
+        bool tim_found = 0;
+
+        bcn = (const struct ieee80211_mgmt *)(dev->wl->current_beacon->data);
+        len = min((size_t)dev->wl->current_beacon->len,
                   0x200 - sizeof(struct b43legacy_plcp_hdr6));
-        data = (const u8 *)(dev->cached_beacon->data);
-        b43legacy_write_template_common(dev, data,
-                                        len, ram_offset,
+
+        b43legacy_write_template_common(dev, (const u8 *)bcn, len, ram_offset,
                                         shm_size_offset, rate);
+
+        /* Find the position of the TIM and the DTIM_period value
+         * and write them to SHM. */
+        ie = bcn->u.beacon.variable;
+        variable_len = len - offsetof(struct ieee80211_mgmt, u.beacon.variable);
+        for (i = 0; i < variable_len - 2; ) {
+                uint8_t ie_id, ie_len;
+
+                ie_id = ie[i];
+                ie_len = ie[i + 1];
+                if (ie_id == 5) {
+                        u16 tim_position;
+                        u16 dtim_period;
+                        /* This is the TIM Information Element */
+
+                        /* Check whether the ie_len is in the beacon data range. */
+                        if (variable_len < ie_len + 2 + i)
+                                break;
+                        /* A valid TIM is at least 4 bytes long. */
+                        if (ie_len < 4)
+                                break;
+                        tim_found = 1;
+
+                        tim_position = sizeof(struct b43legacy_plcp_hdr6);
+                        tim_position += offsetof(struct ieee80211_mgmt,
+                                                 u.beacon.variable);
+                        tim_position += i;
+
+                        dtim_period = ie[i + 3];
+
+                        b43legacy_shm_write16(dev, B43legacy_SHM_SHARED,
+                                        B43legacy_SHM_SH_TIMPOS, tim_position);
+                        b43legacy_shm_write16(dev, B43legacy_SHM_SHARED,
+                                        B43legacy_SHM_SH_DTIMP, dtim_period);
+                        break;
+                }
+                i += ie_len + 2;
+        }
+        if (!tim_found) {
+                b43legacywarn(dev->wl, "Did not find a valid TIM IE in the "
+                              "beacon template packet. AP or IBSS operation "
+                              "may be broken.\n");
+        }
 }
 
 static void b43legacy_write_probe_resp_plcp(struct b43legacy_wldev *dev,
                                             u16 shm_offset, u16 size,
-                                            u8 rate)
+                                            struct ieee80211_rate *rate)
 {
         struct b43legacy_plcp_hdr4 plcp;
         u32 tmp;
         __le16 dur;
 
         plcp.data = 0;
-        b43legacy_generate_plcp_hdr(&plcp, size + FCS_LEN, rate);
+        b43legacy_generate_plcp_hdr(&plcp, size + FCS_LEN, rate->bitrate);
         dur = ieee80211_generic_frame_duration(dev->wl->hw,
                                                dev->wl->vif,
                                                size,
-                                               B43legacy_RATE_TO_100KBPS(rate));
+                                               rate);
         /* Write PLCP in two parts and timing for packet transfer */
         tmp = le32_to_cpu(plcp.data);
         b43legacy_shm_write16(dev, B43legacy_SHM_SHARED, shm_offset,
@@ -997,45 +1049,44 @@ static void b43legacy_write_probe_resp_plcp(struct b43legacy_wldev *dev,
  * 2) Patching duration field
  * 3) Stripping TIM
  */
-static u8 *b43legacy_generate_probe_resp(struct b43legacy_wldev *dev,
-                                         u16 *dest_size, u8 rate)
+static const u8 *b43legacy_generate_probe_resp(struct b43legacy_wldev *dev,
+                                               u16 *dest_size,
+                                               struct ieee80211_rate *rate)
 {
         const u8 *src_data;
         u8 *dest_data;
-        u16 src_size;
-        u16 elem_size;
-        u16 src_pos;
-        u16 dest_pos;
+        u16 src_size, elem_size, src_pos, dest_pos;
         __le16 dur;
         struct ieee80211_hdr *hdr;
+        size_t ie_start;
+
+        src_size = dev->wl->current_beacon->len;
+        src_data = (const u8 *)dev->wl->current_beacon->data;
 
-        B43legacy_WARN_ON(!dev->cached_beacon);
-        src_size = dev->cached_beacon->len;
-        src_data = (const u8 *)dev->cached_beacon->data;
+        /* Get the start offset of the variable IEs in the packet. */
+        ie_start = offsetof(struct ieee80211_mgmt, u.probe_resp.variable);
+        B43legacy_WARN_ON(ie_start != offsetof(struct ieee80211_mgmt,
+                                               u.beacon.variable));
 
-        if (unlikely(src_size < 0x24)) {
-                b43legacydbg(dev->wl, "b43legacy_generate_probe_resp: "
-                       "invalid beacon\n");
+        if (B43legacy_WARN_ON(src_size < ie_start))
                 return NULL;
-        }
 
         dest_data = kmalloc(src_size, GFP_ATOMIC);
         if (unlikely(!dest_data))
                 return NULL;
 
-        /* 0x24 is offset of first variable-len Information-Element
-         * in beacon frame.
-         */
-        memcpy(dest_data, src_data, 0x24);
-        src_pos = 0x24;
-        dest_pos = 0x24;
-        for (; src_pos < src_size - 2; src_pos += elem_size) {
+        /* Copy the static data and all Information Elements, except the TIM. */
+        memcpy(dest_data, src_data, ie_start);
+        src_pos = ie_start;
+        dest_pos = ie_start;
+        for ( ; src_pos < src_size - 2; src_pos += elem_size) {
                 elem_size = src_data[src_pos + 1] + 2;
-                if (src_data[src_pos] != 0x05) { /* TIM */
-                        memcpy(dest_data + dest_pos, src_data + src_pos,
-                               elem_size);
-                        dest_pos += elem_size;
+                if (src_data[src_pos] == 5) {
+                        /* This is the TIM. */
+                        continue;
                 }
+                memcpy(dest_data + dest_pos, src_data + src_pos, elem_size);
+                dest_pos += elem_size;
         }
         *dest_size = dest_pos;
         hdr = (struct ieee80211_hdr *)dest_data;
@@ -1046,7 +1097,7 @@ static u8 *b43legacy_generate_probe_resp(struct b43legacy_wldev *dev,
         dur = ieee80211_generic_frame_duration(dev->wl->hw,
                                                dev->wl->vif,
                                                *dest_size,
-                                               B43legacy_RATE_TO_100KBPS(rate));
+                                               rate);
         hdr->duration_id = dur;
 
         return dest_data;
@@ -1054,13 +1105,13 @@ static u8 *b43legacy_generate_probe_resp(struct b43legacy_wldev *dev,
 
 static void b43legacy_write_probe_resp_template(struct b43legacy_wldev *dev,
                                                 u16 ram_offset,
-                                                u16 shm_size_offset, u8 rate)
+                                                u16 shm_size_offset,
+                                                struct ieee80211_rate *rate)
 {
-        u8 *probe_resp_data;
+        const u8 *probe_resp_data;
         u16 size;
 
-        B43legacy_WARN_ON(!dev->cached_beacon);
-        size = dev->cached_beacon->len;
+        size = dev->wl->current_beacon->len;
         probe_resp_data = b43legacy_generate_probe_resp(dev, &size, rate);
         if (unlikely(!probe_resp_data))
                 return;
@@ -1069,59 +1120,37 @@ static void b43legacy_write_probe_resp_template(struct b43legacy_wldev *dev,
          * all possible basic rates
          */
         b43legacy_write_probe_resp_plcp(dev, 0x31A, size,
-                                        B43legacy_CCK_RATE_1MB);
+                                        &b43legacy_b_ratetable[0]);
         b43legacy_write_probe_resp_plcp(dev, 0x32C, size,
-                                        B43legacy_CCK_RATE_2MB);
+                                        &b43legacy_b_ratetable[1]);
         b43legacy_write_probe_resp_plcp(dev, 0x33E, size,
-                                        B43legacy_CCK_RATE_5MB);
+                                        &b43legacy_b_ratetable[2]);
         b43legacy_write_probe_resp_plcp(dev, 0x350, size,
-                                        B43legacy_CCK_RATE_11MB);
+                                        &b43legacy_b_ratetable[3]);
 
         size = min((size_t)size,
                    0x200 - sizeof(struct b43legacy_plcp_hdr6));
         b43legacy_write_template_common(dev, probe_resp_data,
                                         size, ram_offset,
-                                        shm_size_offset, rate);
+                                        shm_size_offset, rate->bitrate);
         kfree(probe_resp_data);
 }
 
-static int b43legacy_refresh_cached_beacon(struct b43legacy_wldev *dev,
-                                           struct sk_buff *beacon)
-{
-        if (dev->cached_beacon)
-                kfree_skb(dev->cached_beacon);
-        dev->cached_beacon = beacon;
-
-        return 0;
-}
-
-static void b43legacy_update_templates(struct b43legacy_wldev *dev)
-{
-        u32 status;
-
-        B43legacy_WARN_ON(!dev->cached_beacon);
-
-        b43legacy_write_beacon_template(dev, 0x68, 0x18,
-                                        B43legacy_CCK_RATE_1MB);
-        b43legacy_write_beacon_template(dev, 0x468, 0x1A,
-                                        B43legacy_CCK_RATE_1MB);
-        b43legacy_write_probe_resp_template(dev, 0x268, 0x4A,
-                                            B43legacy_CCK_RATE_11MB);
-
-        status = b43legacy_read32(dev, B43legacy_MMIO_MACCMD);
-        status |= 0x03;
-        b43legacy_write32(dev, B43legacy_MMIO_MACCMD, status);
-}
-
-static void b43legacy_refresh_templates(struct b43legacy_wldev *dev,
-                                        struct sk_buff *beacon)
+/* Asynchronously update the packet templates in template RAM.
+ * Locking: Requires wl->irq_lock to be locked. */
+static void b43legacy_update_templates(struct b43legacy_wl *wl,
+                                       struct sk_buff *beacon)
 {
-        int err;
+        /* This is the top half of the ansynchronous beacon update. The bottom
+         * half is the beacon IRQ. Beacon update must be asynchronous to avoid
+         * sending an invalid beacon. This can happen for example, if the
+         * firmware transmits a beacon while we are updating it. */
 
-        err = b43legacy_refresh_cached_beacon(dev, beacon);
-        if (unlikely(err))
-                return;
-        b43legacy_update_templates(dev);
+        if (wl->current_beacon)
+                dev_kfree_skb_any(wl->current_beacon);
+        wl->current_beacon = beacon;
+        wl->beacon0_uploaded = 0;
+        wl->beacon1_uploaded = 0;
 }
 
 static void b43legacy_set_ssid(struct b43legacy_wldev *dev,
@@ -1162,38 +1191,37 @@ static void b43legacy_set_beacon_int(struct b43legacy_wldev *dev,
 
 static void handle_irq_beacon(struct b43legacy_wldev *dev)
 {
-        u32 status;
+        struct b43legacy_wl *wl = dev->wl;
+        u32 cmd;
 
-        if (!b43legacy_is_mode(dev->wl, IEEE80211_IF_TYPE_AP))
+        if (!b43legacy_is_mode(wl, IEEE80211_IF_TYPE_AP))
                 return;
 
-        dev->irq_savedstate &= ~B43legacy_IRQ_BEACON;
-        status = b43legacy_read32(dev, B43legacy_MMIO_MACCMD);
-
-        if (!dev->cached_beacon || ((status & 0x1) && (status & 0x2))) {
-                /* ACK beacon IRQ. */
-                b43legacy_write32(dev, B43legacy_MMIO_GEN_IRQ_REASON,
-                                  B43legacy_IRQ_BEACON);
-                dev->irq_savedstate |= B43legacy_IRQ_BEACON;
-                if (dev->cached_beacon)
-                        kfree_skb(dev->cached_beacon);
-                dev->cached_beacon = NULL;
-                return;
-        }
-        if (!(status & 0x1)) {
-                b43legacy_write_beacon_template(dev, 0x68, 0x18,
-                                                B43legacy_CCK_RATE_1MB);
-                status |= 0x1;
-                b43legacy_write32(dev, B43legacy_MMIO_MACCMD,
-                                  status);
-        }
-        if (!(status & 0x2)) {
-                b43legacy_write_beacon_template(dev, 0x468, 0x1A,
-                                                B43legacy_CCK_RATE_1MB);
-                status |= 0x2;
-                b43legacy_write32(dev, B43legacy_MMIO_MACCMD,
-                                  status);
+        /* This is the bottom half of the asynchronous beacon update. */
+
+        cmd = b43legacy_read32(dev, B43legacy_MMIO_MACCMD);
+        if (!(cmd & B43legacy_MACCMD_BEACON0_VALID)) {
+                if (!wl->beacon0_uploaded) {
+                        b43legacy_write_beacon_template(dev, 0x68,
+                                                        B43legacy_SHM_SH_BTL0,
+                                                        B43legacy_CCK_RATE_1MB);
+                        b43legacy_write_probe_resp_template(dev, 0x268,
+                                                            B43legacy_SHM_SH_PRTLEN,
+                                                            &__b43legacy_ratetable[3]);
+                        wl->beacon0_uploaded = 1;
+                }
+                cmd |= B43legacy_MACCMD_BEACON0_VALID;
+        }
+        if (!(cmd & B43legacy_MACCMD_BEACON1_VALID)) {
+                if (!wl->beacon1_uploaded) {
+                        b43legacy_write_beacon_template(dev, 0x468,
+                                                        B43legacy_SHM_SH_BTL1,
+                                                        B43legacy_CCK_RATE_1MB);
+                        wl->beacon1_uploaded = 1;
+                }
+                cmd |= B43legacy_MACCMD_BEACON1_VALID;
         }
+        b43legacy_write32(dev, B43legacy_MMIO_MACCMD, cmd);
 }
 
 static void handle_irq_ucode_debug(struct b43legacy_wldev *dev)
@@ -2550,14 +2578,16 @@ static int b43legacy_op_dev_config(struct ieee80211_hw *hw,
         antenna_rx = b43legacy_antenna_from_ieee80211(conf->antenna_sel_rx);
 
         mutex_lock(&wl->mutex);
+        dev = wl->current_dev;
+        phy = &dev->phy;
 
         /* Switch the PHY mode (if necessary). */
-        switch (conf->phymode) {
-        case MODE_IEEE80211B:
-                new_phymode = B43legacy_PHYMODE_B;
-                break;
-        case MODE_IEEE80211G:
-                new_phymode = B43legacy_PHYMODE_G;
+        switch (conf->channel->band) {
+        case IEEE80211_BAND_2GHZ:
+                if (phy->type == B43legacy_PHYTYPE_B)
+                        new_phymode = B43legacy_PHYMODE_B;
+                else
+                        new_phymode = B43legacy_PHYMODE_G;
                 break;
         default:
                 B43legacy_WARN_ON(1);
@@ -2565,8 +2595,6 @@ static int b43legacy_op_dev_config(struct ieee80211_hw *hw,
         err = b43legacy_switch_phymode(wl, new_phymode);
         if (err)
                 goto out_unlock_mutex;
-        dev = wl->current_dev;
-        phy = &dev->phy;
 
         /* Disable IRQs while reconfiguring the device.
          * This makes it possible to drop the spinlock throughout
@@ -2582,8 +2610,8 @@ static int b43legacy_op_dev_config(struct ieee80211_hw *hw,
 
         /* Switch to the requested channel.
          * The firmware takes care of races with the TX handler. */
-        if (conf->channel_val != phy->channel)
-                b43legacy_radio_selectchannel(dev, conf->channel_val, 0);
+        if (conf->channel->hw_value != phy->channel)
+                b43legacy_radio_selectchannel(dev, conf->channel->hw_value, 0);
 
         /* Enable/Disable ShortSlot timing. */
         if ((!!(conf->flags & IEEE80211_CONF_SHORT_SLOT_TIME))
@@ -2700,7 +2728,7 @@ static int b43legacy_op_config_interface(struct ieee80211_hw *hw,
                         B43legacy_WARN_ON(conf->type != IEEE80211_IF_TYPE_AP);
                         b43legacy_set_ssid(dev, conf->ssid, conf->ssid_len);
                         if (conf->beacon)
-                                b43legacy_refresh_templates(dev, conf->beacon);
+                                b43legacy_update_templates(wl, conf->beacon);
                 }
                 b43legacy_write_mac_bssid_templates(dev);
         }
@@ -2918,7 +2946,7 @@ static void setup_struct_phy_for_init(struct b43legacy_wldev *dev,
 static void setup_struct_wldev_for_init(struct b43legacy_wldev *dev)
 {
         /* Flags */
-        dev->reg124_set_0x4 = 0;
+        dev->dfq_valid = 0;
 
         /* Stats */
         memset(&dev->stats, 0, sizeof(dev->stats));
@@ -3013,6 +3041,11 @@ static void b43legacy_wireless_core_exit(struct b43legacy_wldev *dev)
                 kfree(phy->tssi2dbm);
         kfree(phy->lo_control);
         phy->lo_control = NULL;
+        if (dev->wl->current_beacon) {
+                dev_kfree_skb_any(dev->wl->current_beacon);
+                dev->wl->current_beacon = NULL;
+        }
+
         ssb_device_disable(dev->dev, 0);
         ssb_bus_may_powerdown(dev->dev->bus);
 }
@@ -3337,6 +3370,41 @@ out_unlock:
         return err;
 }
 
+static int b43legacy_op_beacon_set_tim(struct ieee80211_hw *hw,
+                                       int aid, int set)
+{
+        struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);
+        struct sk_buff *beacon;
+        unsigned long flags;
+
+        /* We could modify the existing beacon and set the aid bit in the TIM
+         * field, but that would probably require resizing and moving of data
+         * within the beacon template. Simply request a new beacon and let
+         * mac80211 do the hard work. */
+        beacon = ieee80211_beacon_get(hw, wl->vif, NULL);
+        if (unlikely(!beacon))
+                return -ENOMEM;
+        spin_lock_irqsave(&wl->irq_lock, flags);
+        b43legacy_update_templates(wl, beacon);
+        spin_unlock_irqrestore(&wl->irq_lock, flags);
+
+        return 0;
+}
+
+static int b43legacy_op_ibss_beacon_update(struct ieee80211_hw *hw,
+                                           struct sk_buff *beacon,
+                                           struct ieee80211_tx_control *ctl)
+{
+        struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);
+        unsigned long flags;
+
+        spin_lock_irqsave(&wl->irq_lock, flags);
+        b43legacy_update_templates(wl, beacon);
+        spin_unlock_irqrestore(&wl->irq_lock, flags);
+
+        return 0;
+}
+
 static const struct ieee80211_ops b43legacy_hw_ops = {
         .tx                     = b43legacy_op_tx,
         .conf_tx                = b43legacy_op_conf_tx,
@@ -3350,6 +3418,8 @@ static const struct ieee80211_ops b43legacy_hw_ops = {
         .start                  = b43legacy_op_start,
         .stop                   = b43legacy_op_stop,
         .set_retry_limit        = b43legacy_op_set_retry_limit,
+        .set_tim                = b43legacy_op_beacon_set_tim,
+        .beacon_update          = b43legacy_op_ibss_beacon_update,
 };
 
 /* Hard-reset the chip. Do not call this directly.
@@ -3398,48 +3468,19 @@ static int b43legacy_setup_modes(struct b43legacy_wldev *dev,
                                  int have_gphy)
 {
         struct ieee80211_hw *hw = dev->wl->hw;
-        struct ieee80211_hw_mode *mode;
         struct b43legacy_phy *phy = &dev->phy;
-        int cnt = 0;
-        int err;
 
         phy->possible_phymodes = 0;
-        for (; 1; cnt++) {
-                if (have_bphy) {
-                        B43legacy_WARN_ON(cnt >= B43legacy_MAX_PHYHWMODES);
-                        mode = &phy->hwmodes[cnt];
-
-                        mode->mode = MODE_IEEE80211B;
-                        mode->num_channels = b43legacy_bg_chantable_size;
-                        mode->channels = b43legacy_bg_chantable;
-                        mode->num_rates = b43legacy_b_ratetable_size;
-                        mode->rates = b43legacy_b_ratetable;
-                        err = ieee80211_register_hwmode(hw, mode);
-                        if (err)
-                                return err;
-
-                        phy->possible_phymodes |= B43legacy_PHYMODE_B;
-                        have_bphy = 0;
-                        continue;
-                }
-                if (have_gphy) {
-                        B43legacy_WARN_ON(cnt >= B43legacy_MAX_PHYHWMODES);
-                        mode = &phy->hwmodes[cnt];
-
-                        mode->mode = MODE_IEEE80211G;
-                        mode->num_channels = b43legacy_bg_chantable_size;
-                        mode->channels = b43legacy_bg_chantable;
-                        mode->num_rates = b43legacy_g_ratetable_size;
-                        mode->rates = b43legacy_g_ratetable;
-                        err = ieee80211_register_hwmode(hw, mode);
-                        if (err)
-                                return err;
-
-                        phy->possible_phymodes |= B43legacy_PHYMODE_G;
-                        have_gphy = 0;
-                        continue;
-                }
-                break;
+        if (have_bphy) {
+                hw->wiphy->bands[IEEE80211_BAND_2GHZ] =
+                        &b43legacy_band_2GHz_BPHY;
+                phy->possible_phymodes |= B43legacy_PHYMODE_B;
+        }
+
+        if (have_gphy) {
+                hw->wiphy->bands[IEEE80211_BAND_2GHZ] =
+                        &b43legacy_band_2GHz_GPHY;
+                phy->possible_phymodes |= B43legacy_PHYMODE_G;
         }
 
         return 0;
diff --git a/drivers/net/wireless/b43legacy/xmit.c b/drivers/net/wireless/b43legacy/xmit.c
index d84408a82db9..dcad2491a606 100644
--- a/drivers/net/wireless/b43legacy/xmit.c
+++ b/drivers/net/wireless/b43legacy/xmit.c
@@ -37,45 +37,48 @@
 
 
 /* Extract the bitrate out of a CCK PLCP header. */
-static u8 b43legacy_plcp_get_bitrate_cck(struct b43legacy_plcp_hdr6 *plcp)
+static u8 b43legacy_plcp_get_bitrate_idx_cck(struct b43legacy_plcp_hdr6 *plcp)
 {
         switch (plcp->raw[0]) {
         case 0x0A:
-                return B43legacy_CCK_RATE_1MB;
+                return 0;
         case 0x14:
-                return B43legacy_CCK_RATE_2MB;
+                return 1;
         case 0x37:
-                return B43legacy_CCK_RATE_5MB;
+                return 2;
         case 0x6E:
-                return B43legacy_CCK_RATE_11MB;
+                return 3;
         }
         B43legacy_BUG_ON(1);
-        return 0;
+        return -1;
 }
 
 /* Extract the bitrate out of an OFDM PLCP header. */
-static u8 b43legacy_plcp_get_bitrate_ofdm(struct b43legacy_plcp_hdr6 *plcp)
+static u8 b43legacy_plcp_get_bitrate_idx_ofdm(struct b43legacy_plcp_hdr6 *plcp,
+                                              bool aphy)
 {
+        int base = aphy ? 0 : 4;
+
         switch (plcp->raw[0] & 0xF) {
         case 0xB:
-                return B43legacy_OFDM_RATE_6MB;
+                return base + 0;
         case 0xF:
-                return B43legacy_OFDM_RATE_9MB;
+                return base + 1;
         case 0xA:
-                return B43legacy_OFDM_RATE_12MB;
+                return base + 2;
         case 0xE:
-                return B43legacy_OFDM_RATE_18MB;
+                return base + 3;
         case 0x9:
-                return B43legacy_OFDM_RATE_24MB;
+                return base + 4;
         case 0xD:
-                return B43legacy_OFDM_RATE_36MB;
+                return base + 5;
         case 0x8:
-                return B43legacy_OFDM_RATE_48MB;
+                return base + 6;
         case 0xC:
-                return B43legacy_OFDM_RATE_54MB;
+                return base + 7;
         }
         B43legacy_BUG_ON(1);
-        return 0;
+        return -1;
 }
 
 u8 b43legacy_plcp_get_ratecode_cck(const u8 bitrate)
@@ -192,7 +195,7 @@ static int generate_txhdr_fw3(struct b43legacy_wldev *dev,
         int use_encryption = (!(txctl->flags & IEEE80211_TXCTL_DO_NOT_ENCRYPT));
         u16 fctl;
         u8 rate;
-        u8 rate_fb;
+        struct ieee80211_rate *rate_fb;
         int rate_ofdm;
         int rate_fb_ofdm;
         unsigned int plcp_fragment_len;
@@ -204,16 +207,16 @@ static int generate_txhdr_fw3(struct b43legacy_wldev *dev,
 
         memset(txhdr, 0, sizeof(*txhdr));
 
-        rate = txctl->tx_rate;
+        rate = txctl->tx_rate->hw_value;
         rate_ofdm = b43legacy_is_ofdm_rate(rate);
-        rate_fb = (txctl->alt_retry_rate == -1) ? rate : txctl->alt_retry_rate;
-        rate_fb_ofdm = b43legacy_is_ofdm_rate(rate_fb);
+        rate_fb = txctl->alt_retry_rate ? : txctl->tx_rate;
+        rate_fb_ofdm = b43legacy_is_ofdm_rate(rate_fb->hw_value);
 
         txhdr->mac_frame_ctl = wlhdr->frame_control;
         memcpy(txhdr->tx_receiver, wlhdr->addr1, 6);
 
         /* Calculate duration for fallback rate */
-        if ((rate_fb == rate) ||
+        if ((rate_fb->hw_value == rate) ||
             (wlhdr->duration_id & cpu_to_le16(0x8000)) ||
             (wlhdr->duration_id == cpu_to_le16(0))) {
                 /* If the fallback rate equals the normal rate or the
@@ -221,11 +224,10 @@ static int generate_txhdr_fw3(struct b43legacy_wldev *dev,
                  * use the original dur_id field. */
                 txhdr->dur_fb = wlhdr->duration_id;
         } else {
-                int fbrate_base100kbps = B43legacy_RATE_TO_100KBPS(rate_fb);
                 txhdr->dur_fb = ieee80211_generic_frame_duration(dev->wl->hw,
                                                          txctl->vif,
                                                          fragment_len,
-                                                         fbrate_base100kbps);
+                                                         rate_fb);
         }
 
         plcp_fragment_len = fragment_len + FCS_LEN;
@@ -266,7 +268,7 @@ static int generate_txhdr_fw3(struct b43legacy_wldev *dev,
                                     rate);
         b43legacy_generate_plcp_hdr((struct b43legacy_plcp_hdr4 *)
                                     (&txhdr->plcp_fb), plcp_fragment_len,
-                                    rate_fb);
+                                    rate_fb->hw_value);
 
         /* PHY TX Control word */
         if (rate_ofdm)
@@ -310,7 +312,7 @@ static int generate_txhdr_fw3(struct b43legacy_wldev *dev,
                 int rts_rate_ofdm;
                 int rts_rate_fb_ofdm;
 
-                rts_rate = txctl->rts_cts_rate;
+                rts_rate = txctl->rts_cts_rate->hw_value;
                 rts_rate_ofdm = b43legacy_is_ofdm_rate(rts_rate);
                 rts_rate_fb = b43legacy_calc_fallback_rate(rts_rate);
                 rts_rate_fb_ofdm = b43legacy_is_ofdm_rate(rts_rate_fb);
@@ -536,19 +538,24 @@ void b43legacy_rx(struct b43legacy_wldev *dev,
                                       (phystat3 & B43legacy_RX_PHYST3_TRSTATE));
         status.noise = dev->stats.link_noise;
         status.signal = (jssi * 100) / B43legacy_RX_MAX_SSI;
+        /* change to support A PHY */
         if (phystat0 & B43legacy_RX_PHYST0_OFDM)
-                status.rate = b43legacy_plcp_get_bitrate_ofdm(plcp);
+                status.rate_idx = b43legacy_plcp_get_bitrate_idx_ofdm(plcp, false);
         else
-                status.rate = b43legacy_plcp_get_bitrate_cck(plcp);
+                status.rate_idx = b43legacy_plcp_get_bitrate_idx_cck(plcp);
         status.antenna = !!(phystat0 & B43legacy_RX_PHYST0_ANT);
 
         /*
-         * If monitors are present get full 64-bit timestamp. This
-         * code assumes we get to process the packet within 16 bits
-         * of timestamp, i.e. about 65 milliseconds after the PHY
-         * received the first symbol.
+         * All frames on monitor interfaces and beacons always need a full
+         * 64-bit timestamp. Monitor interfaces need it for diagnostic
+         * purposes and beacons for IBSS merging.
+         * This code assumes we get to process the packet within 16 bits
+         * of timestamp, i.e. about 65 milliseconds after the PHY received
+         * the first symbol.
          */
-        if (dev->wl->radiotap_enabled) {
+        if (((fctl & (IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE))
+            == (IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_BEACON)) ||
+            dev->wl->radiotap_enabled) {
                 u16 low_mactime_now;
 
                 b43legacy_tsf_read(dev, &status.mactime);
@@ -564,14 +571,9 @@ void b43legacy_rx(struct b43legacy_wldev *dev,
                   B43legacy_RX_CHAN_ID_SHIFT;
         switch (chanstat & B43legacy_RX_CHAN_PHYTYPE) {
         case B43legacy_PHYTYPE_B:
-                status.phymode = MODE_IEEE80211B;
-                status.freq = chanid + 2400;
-                status.channel = b43legacy_freq_to_channel_bg(chanid + 2400);
-                break;
         case B43legacy_PHYTYPE_G:
-                status.phymode = MODE_IEEE80211G;
+                status.band = IEEE80211_BAND_2GHZ;
                 status.freq = chanid + 2400;
-                status.channel = b43legacy_freq_to_channel_bg(chanid + 2400);
                 break;
         default:
                 b43legacywarn(dev->wl, "Unexpected value for chanstat (0x%X)\n",
diff --git a/drivers/net/wireless/ipw2200.c b/drivers/net/wireless/ipw2200.c
index a56d9fc6354f..3d4b590046a8 100644
--- a/drivers/net/wireless/ipw2200.c
+++ b/drivers/net/wireless/ipw2200.c
@@ -10349,9 +10349,7 @@ static int ipw_tx_skb(struct ipw_priv *priv, struct ieee80211_txb *txb,
                                          remaining_bytes,
                                          PCI_DMA_TODEVICE));
 
-                        tfd->u.data.num_chunks =
-                            cpu_to_le32(le32_to_cpu(tfd->u.data.num_chunks) +
-                                        1);
+                        le32_add_cpu(&tfd->u.data.num_chunks, 1);
                 }
         }
 
diff --git a/drivers/net/wireless/iwlwifi/Kconfig b/drivers/net/wireless/iwlwifi/Kconfig
index d1af938b9aa6..24c3e3ddafc6 100644
--- a/drivers/net/wireless/iwlwifi/Kconfig
+++ b/drivers/net/wireless/iwlwifi/Kconfig
@@ -24,18 +24,10 @@ config IWL4965
           say M here and read <file:Documentation/kbuild/modules.txt>.  The
           module will be called iwl4965.ko.
 
-config IWL4965_QOS
-        bool "Enable Wireless QoS in iwl4965 driver"
-        depends on IWL4965
-        ---help---
-          This option will enable wireless quality of service (QoS) for the
-          iwl4965 driver.
-
 config IWL4965_HT
         bool "Enable 802.11n HT features in iwl4965 driver"
         depends on EXPERIMENTAL
-        depends on IWL4965 && IWL4965_QOS
-        depends on n
+        depends on IWL4965
         ---help---
           This option enables IEEE 802.11n High Throughput features
           for the iwl4965 driver.
@@ -105,13 +97,6 @@ config IWL3945
           say M here and read <file:Documentation/kbuild/modules.txt>.  The
           module will be called iwl3945.ko.
 
-config IWL3945_QOS
-        bool "Enable Wireless QoS in iwl3945 driver"
-        depends on IWL3945
-        ---help---
-          This option will enable wireless quality of service (QoS) for the
-          iwl3945 driver.
-
 config IWL3945_SPECTRUM_MEASUREMENT
         bool "Enable Spectrum Measurement in iwl3945 drivers"
         depends on IWL3945
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945-commands.h b/drivers/net/wireless/iwlwifi/iwl-3945-commands.h
index 46bb2c7d11dd..20fbb32c33bd 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945-commands.h
+++ b/drivers/net/wireless/iwlwifi/iwl-3945-commands.h
@@ -515,14 +515,20 @@ struct iwl3945_qosparam_cmd {
 #define STA_CONTROL_MODIFY_MSK          0x01
 
 /* key flags __le16*/
-#define STA_KEY_FLG_ENCRYPT_MSK __constant_cpu_to_le16(0x7)
-#define STA_KEY_FLG_NO_ENC      __constant_cpu_to_le16(0x0)
-#define STA_KEY_FLG_WEP         __constant_cpu_to_le16(0x1)
-#define STA_KEY_FLG_CCMP        __constant_cpu_to_le16(0x2)
-#define STA_KEY_FLG_TKIP        __constant_cpu_to_le16(0x3)
+#define STA_KEY_FLG_ENCRYPT_MSK __constant_cpu_to_le16(0x0007)
+#define STA_KEY_FLG_NO_ENC      __constant_cpu_to_le16(0x0000)
+#define STA_KEY_FLG_WEP         __constant_cpu_to_le16(0x0001)
+#define STA_KEY_FLG_CCMP        __constant_cpu_to_le16(0x0002)
+#define STA_KEY_FLG_TKIP        __constant_cpu_to_le16(0x0003)
 
 #define STA_KEY_FLG_KEYID_POS   8
 #define STA_KEY_FLG_INVALID     __constant_cpu_to_le16(0x0800)
+/* wep key is either from global key (0) or from station info array (1) */
+#define STA_KEY_FLG_WEP_KEY_MAP_MSK  __constant_cpu_to_le16(0x0008)
+
+/* wep key in STA: 5-bytes (0) or 13-bytes (1) */
+#define STA_KEY_FLG_KEY_SIZE_MSK     __constant_cpu_to_le16(0x1000)
+#define STA_KEY_MULTICAST_MSK        __constant_cpu_to_le16(0x4000)
 
 /* Flags indicate whether to modify vs. don't change various station params */
 #define STA_MODIFY_KEY_MASK             0x01
@@ -546,7 +552,8 @@ struct iwl3945_keyinfo {
         u8 tkip_rx_tsc_byte2;   /* TSC[2] for key mix ph1 detection */
         u8 reserved1;
         __le16 tkip_rx_ttak[5]; /* 10-byte unicast TKIP TTAK */
-        __le16 reserved2;
+        u8 key_offset;
+        u8 reserved2;
         u8 key[16];             /* 16-byte unicast decryption key */
 } __attribute__ ((packed));
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945-hw.h b/drivers/net/wireless/iwlwifi/iwl-3945-hw.h
index 571815d7e8bf..6693767adc9f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945-hw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-3945-hw.h
@@ -324,7 +324,6 @@ struct iwl3945_eeprom {
 /*=== CSR (control and status registers) ===*/
 #define CSR_BASE    (0x000)
 
-#define CSR_SW_VER              (CSR_BASE+0x000)
 #define CSR_HW_IF_CONFIG_REG    (CSR_BASE+0x000) /* hardware interface config */
 #define CSR_INT_COALESCING      (CSR_BASE+0x004) /* accum ints, 32-usec units */
 #define CSR_INT                 (CSR_BASE+0x008) /* host interrupt status/ack */
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945-io.h b/drivers/net/wireless/iwlwifi/iwl-3945-io.h
index 75e20d0a20d1..4a1872982027 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945-io.h
+++ b/drivers/net/wireless/iwlwifi/iwl-3945-io.h
@@ -59,28 +59,28 @@
  *
  */
 
-#define _iwl3945_write32(iwl, ofs, val) writel((val), (iwl)->hw_base + (ofs))
+#define _iwl3945_write32(priv, ofs, val) writel((val), (priv)->hw_base + (ofs))
 #ifdef CONFIG_IWL3945_DEBUG
-static inline void __iwl3945_write32(const char *f, u32 l, struct iwl3945_priv *iwl,
+static inline void __iwl3945_write32(const char *f, u32 l, struct iwl3945_priv *priv,
                                  u32 ofs, u32 val)
 {
         IWL_DEBUG_IO("write32(0x%08X, 0x%08X) - %s %d\n", ofs, val, f, l);
-        _iwl3945_write32(iwl, ofs, val);
+        _iwl3945_write32(priv, ofs, val);
 }
-#define iwl3945_write32(iwl, ofs, val) \
-        __iwl3945_write32(__FILE__, __LINE__, iwl, ofs, val)
+#define iwl3945_write32(priv, ofs, val) \
+        __iwl3945_write32(__FILE__, __LINE__, priv, ofs, val)
 #else
-#define iwl3945_write32(iwl, ofs, val) _iwl3945_write32(iwl, ofs, val)
+#define iwl3945_write32(priv, ofs, val) _iwl3945_write32(priv, ofs, val)
 #endif
 
-#define _iwl3945_read32(iwl, ofs) readl((iwl)->hw_base + (ofs))
+#define _iwl3945_read32(priv, ofs) readl((priv)->hw_base + (ofs))
 #ifdef CONFIG_IWL3945_DEBUG
-static inline u32 __iwl3945_read32(char *f, u32 l, struct iwl3945_priv *iwl, u32 ofs)
+static inline u32 __iwl3945_read32(char *f, u32 l, struct iwl3945_priv *priv, u32 ofs)
 {
         IWL_DEBUG_IO("read_direct32(0x%08X) - %s %d\n", ofs, f, l);
-        return _iwl3945_read32(iwl, ofs);
+        return _iwl3945_read32(priv, ofs);
 }
-#define iwl3945_read32(iwl, ofs) __iwl3945_read32(__FILE__, __LINE__, iwl, ofs)
+#define iwl3945_read32(priv, ofs) __iwl3945_read32(__FILE__, __LINE__, priv, ofs)
 #else
 #define iwl3945_read32(p, o) _iwl3945_read32(p, o)
 #endif
@@ -105,18 +105,13 @@ static inline int __iwl3945_poll_bit(const char *f, u32 l,
                                  u32 bits, u32 mask, int timeout)
 {
         int ret = _iwl3945_poll_bit(priv, addr, bits, mask, timeout);
-        if (unlikely(ret  == -ETIMEDOUT))
-                IWL_DEBUG_IO
-                    ("poll_bit(0x%08X, 0x%08X, 0x%08X) - timedout - %s %d\n",
-                     addr, bits, mask, f, l);
-        else
-                IWL_DEBUG_IO
-                    ("poll_bit(0x%08X, 0x%08X, 0x%08X) = 0x%08X - %s %d\n",
-                     addr, bits, mask, ret, f, l);
+        IWL_DEBUG_IO("poll_bit(0x%08X, 0x%08X, 0x%08X) - %s- %s %d\n",
+                      addr, bits, mask,
+                      unlikely(ret  == -ETIMEDOUT)?"timeout":"", f, l);
         return ret;
 }
-#define iwl3945_poll_bit(iwl, addr, bits, mask, timeout) \
-        __iwl3945_poll_bit(__FILE__, __LINE__, iwl, addr, bits, mask, timeout)
+#define iwl3945_poll_bit(priv, addr, bits, mask, timeout) \
+        __iwl3945_poll_bit(__FILE__, __LINE__, priv, addr, bits, mask, timeout)
 #else
 #define iwl3945_poll_bit(p, a, b, m, t) _iwl3945_poll_bit(p, a, b, m, t)
 #endif
@@ -321,8 +316,8 @@ static inline int __iwl3945_poll_direct_bit(const char *f, u32 l,
                              "- %s %d\n", addr, mask, ret, f, l);
         return ret;
 }
-#define iwl3945_poll_direct_bit(iwl, addr, mask, timeout) \
-        __iwl3945_poll_direct_bit(__FILE__, __LINE__, iwl, addr, mask, timeout)
+#define iwl3945_poll_direct_bit(priv, addr, mask, timeout) \
+        __iwl3945_poll_direct_bit(__FILE__, __LINE__, priv, addr, mask, timeout)
 #else
 #define iwl3945_poll_direct_bit _iwl3945_poll_direct_bit
 #endif
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945-rs.c b/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
index 80d31ae51e77..a8223c4cc97c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
@@ -100,14 +100,6 @@ static struct iwl3945_tpt_entry iwl3945_tpt_table_a[] = {
         {-89, IWL_RATE_6M_INDEX}
 };
 
-static struct iwl3945_tpt_entry iwl3945_tpt_table_b[] = {
-        {-86, IWL_RATE_11M_INDEX},
-        {-88, IWL_RATE_5M_INDEX},
-        {-90, IWL_RATE_2M_INDEX},
-        {-92, IWL_RATE_1M_INDEX}
-
-};
-
 static struct iwl3945_tpt_entry iwl3945_tpt_table_g[] = {
         {-60, IWL_RATE_54M_INDEX},
         {-64, IWL_RATE_48M_INDEX},
@@ -129,7 +121,7 @@ static struct iwl3945_tpt_entry iwl3945_tpt_table_g[] = {
 #define IWL_RATE_MIN_SUCCESS_TH       8
 #define IWL_RATE_DECREASE_TH       1920
 
-static u8 iwl3945_get_rate_index_by_rssi(s32 rssi, u8 mode)
+static u8 iwl3945_get_rate_index_by_rssi(s32 rssi, enum ieee80211_band band)
 {
         u32 index = 0;
         u32 table_size = 0;
@@ -138,21 +130,19 @@ static u8 iwl3945_get_rate_index_by_rssi(s32 rssi, u8 mode)
         if ((rssi < IWL_MIN_RSSI_VAL) || (rssi > IWL_MAX_RSSI_VAL))
                 rssi = IWL_MIN_RSSI_VAL;
 
-        switch (mode) {
-        case MODE_IEEE80211G:
+        switch (band) {
+        case IEEE80211_BAND_2GHZ:
                 tpt_table = iwl3945_tpt_table_g;
                 table_size = ARRAY_SIZE(iwl3945_tpt_table_g);
                 break;
 
-        case MODE_IEEE80211A:
+        case IEEE80211_BAND_5GHZ:
                 tpt_table = iwl3945_tpt_table_a;
                 table_size = ARRAY_SIZE(iwl3945_tpt_table_a);
                 break;
 
         default:
-        case MODE_IEEE80211B:
-                tpt_table = iwl3945_tpt_table_b;
-                table_size = ARRAY_SIZE(iwl3945_tpt_table_b);
+                BUG();
                 break;
         }
 
@@ -340,17 +330,17 @@ static void rs_rate_init(void *priv_rate, void *priv_sta,
          * after assoc.. */
 
         for (i = IWL_RATE_COUNT - 1; i >= 0; i--) {
-                if (sta->supp_rates & (1 << i)) {
-                        sta->txrate = i;
+                if (sta->supp_rates[local->hw.conf.channel->band] & (1 << i)) {
+                        sta->txrate_idx = i;
                         break;
                 }
         }
 
-        sta->last_txrate = sta->txrate;
+        sta->last_txrate_idx = sta->txrate_idx;
 
-        /* For MODE_IEEE80211A mode it start at IWL_FIRST_OFDM_RATE */
-        if (local->hw.conf.phymode == MODE_IEEE80211A)
-                sta->last_txrate += IWL_FIRST_OFDM_RATE;
+        /* For 5 GHz band it start at IWL_FIRST_OFDM_RATE */
+        if (local->hw.conf.channel->band == IEEE80211_BAND_5GHZ)
+                sta->last_txrate_idx += IWL_FIRST_OFDM_RATE;
 
         IWL_DEBUG_RATE("leave\n");
 }
@@ -429,17 +419,19 @@ static int rs_adjust_next_rate(struct iwl3945_priv *priv, int rate)
 {
         int next_rate = iwl3945_get_prev_ieee_rate(rate);
 
-        switch (priv->phymode) {
-        case MODE_IEEE80211A:
+        switch (priv->band) {
+        case IEEE80211_BAND_5GHZ:
                 if (rate == IWL_RATE_12M_INDEX)
                         next_rate = IWL_RATE_9M_INDEX;
                 else if (rate == IWL_RATE_6M_INDEX)
                         next_rate = IWL_RATE_6M_INDEX;
                 break;
+/* XXX cannot be invoked in current mac80211 so not a regression
         case MODE_IEEE80211B:
                 if (rate == IWL_RATE_11M_INDEX_TABLE)
                         next_rate = IWL_RATE_5M_INDEX_TABLE;
                 break;
+ */
         default:
                 break;
         }
@@ -465,15 +457,17 @@ static void rs_tx_status(void *priv_rate,
         struct iwl3945_priv *priv = (struct iwl3945_priv *)priv_rate;
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
         struct iwl3945_rs_sta *rs_sta;
+        struct ieee80211_supported_band *sband;
+
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
 
         IWL_DEBUG_RATE("enter\n");
 
         retries = tx_resp->retry_count;
-
-        first_index = tx_resp->control.tx_rate;
+        /* FIXME : this is wrong */
+        first_index = &sband->bitrates[0] - tx_resp->control.tx_rate;
         if ((first_index < 0) || (first_index >= IWL_RATE_COUNT)) {
-                IWL_DEBUG_RATE("leave: Rate out of bounds: %0x for %d\n",
-                               tx_resp->control.tx_rate, first_index);
+                IWL_DEBUG_RATE("leave: Rate out of bounds: %d\n", first_index);
                 return;
         }
 
@@ -561,14 +555,14 @@ static void rs_tx_status(void *priv_rate,
 }
 
 static u16 iwl3945_get_adjacent_rate(struct iwl3945_rs_sta *rs_sta,
-                                 u8 index, u16 rate_mask, int phymode)
+                                 u8 index, u16 rate_mask, enum ieee80211_band band)
 {
         u8 high = IWL_RATE_INVALID;
         u8 low = IWL_RATE_INVALID;
 
         /* 802.11A walks to the next literal adjacent rate in
          * the rate table */
-        if (unlikely(phymode == MODE_IEEE80211A)) {
+        if (unlikely(band == IEEE80211_BAND_5GHZ)) {
                 int i;
                 u32 mask;
 
@@ -639,7 +633,8 @@ static u16 iwl3945_get_adjacent_rate(struct iwl3945_rs_sta *rs_sta,
  *
  */
 static void rs_get_rate(void *priv_rate, struct net_device *dev,
-                        struct ieee80211_hw_mode *mode, struct sk_buff *skb,
+                        struct ieee80211_supported_band *band,
+                        struct sk_buff *skb,
                         struct rate_selection *sel)
 {
         u8 low = IWL_RATE_INVALID;
@@ -672,16 +667,16 @@ static void rs_get_rate(void *priv_rate, struct net_device *dev,
             is_multicast_ether_addr(hdr->addr1) ||
             !sta || !sta->rate_ctrl_priv) {
                 IWL_DEBUG_RATE("leave: No STA priv data to update!\n");
-                sel->rate = rate_lowest(local, local->oper_hw_mode, sta);
+                sel->rate = rate_lowest(local, band, sta);
                 if (sta)
                         sta_info_put(sta);
                 return;
         }
 
-        rate_mask = sta->supp_rates;
-        index = min(sta->last_txrate & 0xffff, IWL_RATE_COUNT - 1);
+        rate_mask = sta->supp_rates[band->band];
+        index = min(sta->last_txrate_idx & 0xffff, IWL_RATE_COUNT - 1);
 
-        if (priv->phymode == (u8) MODE_IEEE80211A)
+        if (priv->band == IEEE80211_BAND_5GHZ)
                 rate_mask = rate_mask << IWL_FIRST_OFDM_RATE;
 
         rs_sta = (void *)sta->rate_ctrl_priv;
@@ -732,7 +727,7 @@ static void rs_get_rate(void *priv_rate, struct net_device *dev,
         current_tpt = window->average_tpt;
 
         high_low = iwl3945_get_adjacent_rate(rs_sta, index, rate_mask,
-                                         local->hw.conf.phymode);
+                                             band->band);
         low = high_low & 0xff;
         high = (high_low >> 8) & 0xff;
 
@@ -810,11 +805,11 @@ static void rs_get_rate(void *priv_rate, struct net_device *dev,
 
  out:
 
-        sta->last_txrate = index;
-        if (priv->phymode == (u8) MODE_IEEE80211A)
-                sta->txrate = sta->last_txrate - IWL_FIRST_OFDM_RATE;
+        sta->last_txrate_idx = index;
+        if (priv->band == IEEE80211_BAND_5GHZ)
+                sta->txrate_idx = sta->last_txrate_idx - IWL_FIRST_OFDM_RATE;
         else
-                sta->txrate = sta->last_txrate;
+                sta->txrate_idx = sta->last_txrate_idx;
 
         sta_info_put(sta);
 
@@ -945,8 +940,9 @@ void iwl3945_rate_scale_init(struct ieee80211_hw *hw, s32 sta_id)
         spin_lock_irqsave(&rs_sta->lock, flags);
 
         rs_sta->tgg = 0;
-        switch (priv->phymode) {
-        case MODE_IEEE80211G:
+        switch (priv->band) {
+        case IEEE80211_BAND_2GHZ:
+                /* TODO: this always does G, not a regression */
                 if (priv->active_rxon.flags & RXON_FLG_TGG_PROTECT_MSK) {
                         rs_sta->tgg = 1;
                         rs_sta->expected_tpt = iwl3945_expected_tpt_g_prot;
@@ -954,14 +950,11 @@ void iwl3945_rate_scale_init(struct ieee80211_hw *hw, s32 sta_id)
                         rs_sta->expected_tpt = iwl3945_expected_tpt_g;
                 break;
 
-        case MODE_IEEE80211A:
+        case IEEE80211_BAND_5GHZ:
                 rs_sta->expected_tpt = iwl3945_expected_tpt_a;
                 break;
-
-        default:
-                IWL_WARNING("Invalid phymode.  Defaulting to 802.11b\n");
-        case MODE_IEEE80211B:
-                rs_sta->expected_tpt = iwl3945_expected_tpt_b;
+        case IEEE80211_NUM_BANDS:
+                BUG();
                 break;
         }
 
@@ -974,8 +967,7 @@ void iwl3945_rate_scale_init(struct ieee80211_hw *hw, s32 sta_id)
 
         IWL_DEBUG(IWL_DL_INFO | IWL_DL_RATE, "Network RSSI: %d\n", rssi);
 
-        rs_sta->start_rate =
-                        iwl3945_get_rate_index_by_rssi(rssi, priv->phymode);
+        rs_sta->start_rate = iwl3945_get_rate_index_by_rssi(rssi, priv->band);
 
         IWL_DEBUG_RATE("leave: rssi %d assign rate index: "
                        "%d (plcp 0x%x)\n", rssi, rs_sta->start_rate,
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.c b/drivers/net/wireless/iwlwifi/iwl-3945.c
index 8d4d91d35fd2..82d282730b75 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.c
@@ -247,7 +247,7 @@ static void iwl3945_add_radiotap(struct iwl3945_priv *priv,
          * the information provided in the skb from the hardware */
         s8 signal = stats->ssi;
         s8 noise = 0;
-        int rate = stats->rate;
+        int rate = stats->rate_idx;
         u64 tsf = stats->mactime;
         __le16 phy_flags_hw = rx_hdr->phy_flags;
 
@@ -315,7 +315,6 @@ static void iwl3945_add_radiotap(struct iwl3945_priv *priv,
                                           IEEE80211_CHAN_2GHZ),
                               &iwl3945_rt->rt_chbitmask);
 
-        rate = iwl3945_rate_index_from_plcp(rate);
         if (rate == -1)
                 iwl3945_rt->rt_rate = 0;
         else
@@ -387,11 +386,10 @@ static void iwl3945_rx_reply_rx(struct iwl3945_priv *priv,
         struct ieee80211_rx_status stats = {
                 .mactime = le64_to_cpu(rx_end->timestamp),
                 .freq = ieee80211chan2mhz(le16_to_cpu(rx_hdr->channel)),
-                .channel = le16_to_cpu(rx_hdr->channel),
-                .phymode = (rx_hdr->phy_flags & RX_RES_PHY_FLAGS_BAND_24_MSK) ?
-                MODE_IEEE80211G : MODE_IEEE80211A,
+                .band = (rx_hdr->phy_flags & RX_RES_PHY_FLAGS_BAND_24_MSK) ?
+                IEEE80211_BAND_2GHZ : IEEE80211_BAND_5GHZ,
                 .antenna = 0,
-                .rate = rx_hdr->rate,
+                .rate_idx = iwl3945_rate_index_from_plcp(rx_hdr->rate),
                 .flag = 0,
         };
         u8 network_packet;
@@ -450,8 +448,6 @@ static void iwl3945_rx_reply_rx(struct iwl3945_priv *priv,
                         stats.ssi, stats.noise, stats.signal,
                         rx_stats_sig_avg, rx_stats_noise_diff);
 
-        stats.freq = ieee80211chan2mhz(stats.channel);
-
         /* can be covered by iwl3945_report_frame() in most cases */
 /*      IWL_DEBUG_RX("RX status: 0x%08X\n", rx_end->status); */
 
@@ -464,8 +460,9 @@ static void iwl3945_rx_reply_rx(struct iwl3945_priv *priv,
                 IWL_DEBUG_STATS
                     ("[%c] %d RSSI: %d Signal: %u, Noise: %u, Rate: %u\n",
                      network_packet ? '*' : ' ',
-                     stats.channel, stats.ssi, stats.ssi,
-                     stats.ssi, stats.rate);
+                     le16_to_cpu(rx_hdr->channel),
+                     stats.ssi, stats.ssi,
+                     stats.ssi, stats.rate_idx);
 
         if (iwl3945_debug_level & (IWL_DL_RX))
                 /* Set "1" to report good data frames in groups of 100 */
@@ -689,7 +686,7 @@ void iwl3945_hw_build_tx_cmd_rate(struct iwl3945_priv *priv,
                               struct ieee80211_hdr *hdr, int sta_id, int tx_id)
 {
         unsigned long flags;
-        u16 rate_index = min(ctrl->tx_rate & 0xffff, IWL_RATE_COUNT - 1);
+        u16 rate_index = min(ctrl->tx_rate->hw_value & 0xffff, IWL_RATE_COUNT - 1);
         u16 rate_mask;
         int rate;
         u8 rts_retry_limit;
@@ -1552,14 +1549,14 @@ int iwl3945_hw_reg_send_txpower(struct iwl3945_priv *priv)
                 .channel = priv->active_rxon.channel,
         };
 
-        txpower.band = (priv->phymode == MODE_IEEE80211A) ? 0 : 1;
+        txpower.band = (priv->band == IEEE80211_BAND_5GHZ) ? 0 : 1;
         ch_info = iwl3945_get_channel_info(priv,
-                                       priv->phymode,
+                                       priv->band,
                                        le16_to_cpu(priv->active_rxon.channel));
         if (!ch_info) {
                 IWL_ERROR
                     ("Failed to get channel info for channel %d [%d]\n",
-                     le16_to_cpu(priv->active_rxon.channel), priv->phymode);
+                     le16_to_cpu(priv->active_rxon.channel), priv->band);
                 return -EINVAL;
         }
 
@@ -2241,8 +2238,8 @@ int iwl3945_init_hw_rate_table(struct iwl3945_priv *priv)
                 table[index].next_rate_index = iwl3945_rates[prev_index].table_rs_index;
         }
 
-        switch (priv->phymode) {
-        case MODE_IEEE80211A:
+        switch (priv->band) {
+        case IEEE80211_BAND_5GHZ:
                 IWL_DEBUG_RATE("Select A mode rate scale\n");
                 /* If one of the following CCK rates is used,
                  * have it fall back to the 6M OFDM rate */
@@ -2257,8 +2254,8 @@ int iwl3945_init_hw_rate_table(struct iwl3945_priv *priv)
                     iwl3945_rates[IWL_FIRST_OFDM_RATE].table_rs_index;
                 break;
 
-        case MODE_IEEE80211B:
-                IWL_DEBUG_RATE("Select B mode rate scale\n");
+        case IEEE80211_BAND_2GHZ:
+                IWL_DEBUG_RATE("Select B/G mode rate scale\n");
                 /* If an OFDM rate is used, have it fall back to the
                  * 1M CCK rates */
                 for (i = IWL_RATE_6M_INDEX_TABLE; i <= IWL_RATE_54M_INDEX_TABLE; i++)
@@ -2269,7 +2266,7 @@ int iwl3945_init_hw_rate_table(struct iwl3945_priv *priv)
                 break;
 
         default:
-                IWL_DEBUG_RATE("Select G mode rate scale\n");
+                WARN_ON(1);
                 break;
         }
 
@@ -2303,7 +2300,6 @@ int iwl3945_hw_set_hw_setting(struct iwl3945_priv *priv)
                 return -ENOMEM;
         }
 
-        priv->hw_setting.ac_queue_count = AC_NUM;
         priv->hw_setting.rx_buf_size = IWL_RX_BUF_SIZE;
         priv->hw_setting.max_pkt_size = 2342;
         priv->hw_setting.tx_cmd_len = sizeof(struct iwl3945_tx_cmd);
@@ -2311,6 +2307,8 @@ int iwl3945_hw_set_hw_setting(struct iwl3945_priv *priv)
         priv->hw_setting.max_rxq_log = RX_QUEUE_SIZE_LOG;
         priv->hw_setting.max_stations = IWL3945_STATION_COUNT;
         priv->hw_setting.bcast_sta_id = IWL3945_BROADCAST_ID;
+
+        priv->hw_setting.tx_ant_num = 2;
         return 0;
 }
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.h b/drivers/net/wireless/iwlwifi/iwl-3945.h
index 1da14f9bbe0f..dde389d31637 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.h
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.h
@@ -195,7 +195,7 @@ struct iwl3945_channel_info {
 
         u8 group_index;   /* 0-4, maps channel to group1/2/3/4/5 */
         u8 band_index;    /* 0-4, maps channel to band1/2/3/4/5 */
-        u8 phymode;       /* MODE_IEEE80211{A,B,G} */
+        enum ieee80211_band band;
 
         /* Radio/DSP gain settings for each "normal" data Tx rate.
          * These include, in addition to RF and DSP gain, a few fields for
@@ -431,8 +431,6 @@ union iwl3945_ht_rate_supp {
         };
 };
 
-#ifdef CONFIG_IWL3945_QOS
-
 union iwl3945_qos_capabity {
         struct {
                 u8 edca_count:4;        /* bit 0-3 */
@@ -460,7 +458,6 @@ struct iwl3945_qos_info {
         union iwl3945_qos_capabity qos_cap;
         struct iwl3945_qosparam_cmd def_qos_parm;
 };
-#endif /*CONFIG_IWL3945_QOS */
 
 #define STA_PS_STATUS_WAKE             0
 #define STA_PS_STATUS_SLEEP            1
@@ -511,8 +508,8 @@ struct iwl3945_ibss_seq {
 /**
  * struct iwl3945_driver_hw_info
  * @max_txq_num: Max # Tx queues supported
- * @ac_queue_count: # Tx queues for EDCA Access Categories (AC)
  * @tx_cmd_len: Size of Tx command (but not including frame itself)
+ * @tx_ant_num: Number of TX antennas
  * @max_rxq_size: Max # Rx frames in Rx queue (must be power-of-2)
  * @rx_buf_size:
  * @max_pkt_size:
@@ -524,8 +521,8 @@ struct iwl3945_ibss_seq {
  */
 struct iwl3945_driver_hw_info {
         u16 max_txq_num;
-        u16 ac_queue_count;
         u16 tx_cmd_len;
+        u16 tx_ant_num;
         u16 max_rxq_size;
         u32 rx_buf_size;
         u32 max_pkt_size;
@@ -699,14 +696,14 @@ struct iwl3945_priv {
         struct list_head free_frames;
         int frames_count;
 
-        u8 phymode;
+        enum ieee80211_band band;
         int alloc_rxb_skb;
         bool add_radiotap;
 
         void (*rx_handlers[REPLY_MAX])(struct iwl3945_priv *priv,
                                        struct iwl3945_rx_mem_buffer *rxb);
 
-        const struct ieee80211_hw_mode *modes;
+        struct ieee80211_supported_band bands[IEEE80211_NUM_BANDS];
 
 #ifdef CONFIG_IWL3945_SPECTRUM_MEASUREMENT
         /* spectrum measurement report caching */
@@ -869,9 +866,7 @@ struct iwl3945_priv {
         u16 assoc_capability;
         u8 ps_mode;
 
-#ifdef CONFIG_IWL3945_QOS
         struct iwl3945_qos_info qos_data;
-#endif /*CONFIG_IWL3945_QOS */
 
         struct workqueue_struct *workqueue;
 
@@ -937,13 +932,12 @@ static inline int is_channel_radar(const struct iwl3945_channel_info *ch_info)
 
 static inline u8 is_channel_a_band(const struct iwl3945_channel_info *ch_info)
 {
-        return ch_info->phymode == MODE_IEEE80211A;
+        return ch_info->band == IEEE80211_BAND_5GHZ;
 }
 
 static inline u8 is_channel_bg_band(const struct iwl3945_channel_info *ch_info)
 {
-        return ((ch_info->phymode == MODE_IEEE80211B) ||
-                (ch_info->phymode == MODE_IEEE80211G));
+        return ch_info->band == IEEE80211_BAND_2GHZ;
 }
 
 static inline int is_channel_passive(const struct iwl3945_channel_info *ch)
@@ -967,7 +961,7 @@ static inline int iwl3945_rate_index_from_plcp(int plcp)
 }
 
 extern const struct iwl3945_channel_info *iwl3945_get_channel_info(
-        const struct iwl3945_priv *priv, int phymode, u16 channel);
+        const struct iwl3945_priv *priv, enum ieee80211_band band, u16 channel);
 
 /* Requires full declaration of iwl3945_priv before including */
 #include "iwl-3945-io.h"
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965-commands.h b/drivers/net/wireless/iwlwifi/iwl-4965-commands.h
index f3470c896d9a..b21ffea325cf 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965-commands.h
+++ b/drivers/net/wireless/iwlwifi/iwl-4965-commands.h
@@ -727,14 +727,20 @@ struct iwl4965_qosparam_cmd {
 #define STA_CONTROL_MODIFY_MSK          0x01
 
 /* key flags __le16*/
-#define STA_KEY_FLG_ENCRYPT_MSK __constant_cpu_to_le16(0x7)
-#define STA_KEY_FLG_NO_ENC      __constant_cpu_to_le16(0x0)
-#define STA_KEY_FLG_WEP         __constant_cpu_to_le16(0x1)
-#define STA_KEY_FLG_CCMP        __constant_cpu_to_le16(0x2)
-#define STA_KEY_FLG_TKIP        __constant_cpu_to_le16(0x3)
+#define STA_KEY_FLG_ENCRYPT_MSK __constant_cpu_to_le16(0x0007)
+#define STA_KEY_FLG_NO_ENC      __constant_cpu_to_le16(0x0000)
+#define STA_KEY_FLG_WEP         __constant_cpu_to_le16(0x0001)
+#define STA_KEY_FLG_CCMP        __constant_cpu_to_le16(0x0002)
+#define STA_KEY_FLG_TKIP        __constant_cpu_to_le16(0x0003)
 
 #define STA_KEY_FLG_KEYID_POS   8
 #define STA_KEY_FLG_INVALID     __constant_cpu_to_le16(0x0800)
+/* wep key is either from global key (0) or from station info array (1) */
+#define STA_KEY_FLG_MAP_KEY_MSK __constant_cpu_to_le16(0x0008)
+
+/* wep key in STA: 5-bytes (0) or 13-bytes (1) */
+#define STA_KEY_FLG_KEY_SIZE_MSK     __constant_cpu_to_le16(0x1000)
+#define STA_KEY_MULTICAST_MSK        __constant_cpu_to_le16(0x4000)
 
 /* Flags indicate whether to modify vs. don't change various station params */
 #define STA_MODIFY_KEY_MASK             0x01
@@ -752,7 +758,8 @@ struct iwl4965_keyinfo {
         u8 tkip_rx_tsc_byte2;   /* TSC[2] for key mix ph1 detection */
         u8 reserved1;
         __le16 tkip_rx_ttak[5]; /* 10-byte unicast TKIP TTAK */
-        __le16 reserved2;
+        u8 key_offset;
+        u8 reserved2;
         u8 key[16];             /* 16-byte unicast decryption key */
 } __attribute__ ((packed));
 
@@ -1300,6 +1307,25 @@ struct iwl4965_tx_resp {
         __le32 status;  /* TX status (for aggregation status of 1st frame) */
 } __attribute__ ((packed));
 
+struct agg_tx_status {
+        __le16 status;
+        __le16 sequence;
+} __attribute__ ((packed));
+
+struct iwl4965_tx_resp_agg {
+        u8 frame_count;         /* 1 no aggregation, >1 aggregation */
+        u8 reserved1;
+        u8 failure_rts;
+        u8 failure_frame;
+        __le32 rate_n_flags;
+        __le16 wireless_media_time;
+        __le16 reserved3;
+        __le32 pa_power1;
+        __le32 pa_power2;
+        struct agg_tx_status status;    /* TX status (for aggregation status */
+                                        /* of 1st frame) */
+} __attribute__ ((packed));
+
 /*
  * REPLY_COMPRESSED_BA = 0xc5 (response only, not a command)
  *
@@ -1313,9 +1339,8 @@ struct iwl4965_compressed_ba_resp {
         /* Index of recipient (BA-sending) station in uCode's station table */
         u8 sta_id;
         u8 tid;
-        __le16 ba_seq_ctl;
-        __le32 ba_bitmap0;
-        __le32 ba_bitmap1;
+        __le16 seq_ctl;
+        __le64 bitmap;
         __le16 scd_flow;
         __le16 scd_ssn;
 } __attribute__ ((packed));
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965-hw.h b/drivers/net/wireless/iwlwifi/iwl-4965-hw.h
index ffe1e9dfdec7..cc726215ab93 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965-hw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-4965-hw.h
@@ -413,7 +413,6 @@ struct iwl4965_eeprom {
 /*=== CSR (control and status registers) ===*/
 #define CSR_BASE    (0x000)
 
-#define CSR_SW_VER              (CSR_BASE+0x000)
 #define CSR_HW_IF_CONFIG_REG    (CSR_BASE+0x000) /* hardware interface config */
 #define CSR_INT_COALESCING      (CSR_BASE+0x004) /* accum ints, 32-usec units */
 #define CSR_INT                 (CSR_BASE+0x008) /* host interrupt status/ack */
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965-io.h b/drivers/net/wireless/iwlwifi/iwl-4965-io.h
index 34a0b57eea0c..4af0c0175da2 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965-io.h
+++ b/drivers/net/wireless/iwlwifi/iwl-4965-io.h
@@ -59,28 +59,28 @@
  *
  */
 
-#define _iwl4965_write32(iwl, ofs, val) writel((val), (iwl)->hw_base + (ofs))
+#define _iwl4965_write32(priv, ofs, val) writel((val), (priv)->hw_base + (ofs))
 #ifdef CONFIG_IWL4965_DEBUG
-static inline void __iwl4965_write32(const char *f, u32 l, struct iwl4965_priv *iwl,
+static inline void __iwl4965_write32(const char *f, u32 l, struct iwl4965_priv *priv,
                                  u32 ofs, u32 val)
 {
         IWL_DEBUG_IO("write32(0x%08X, 0x%08X) - %s %d\n", ofs, val, f, l);
-        _iwl4965_write32(iwl, ofs, val);
+        _iwl4965_write32(priv, ofs, val);
 }
-#define iwl4965_write32(iwl, ofs, val) \
-        __iwl4965_write32(__FILE__, __LINE__, iwl, ofs, val)
+#define iwl4965_write32(priv, ofs, val) \
+        __iwl4965_write32(__FILE__, __LINE__, priv, ofs, val)
 #else
-#define iwl4965_write32(iwl, ofs, val) _iwl4965_write32(iwl, ofs, val)
+#define iwl4965_write32(priv, ofs, val) _iwl4965_write32(priv, ofs, val)
 #endif
 
-#define _iwl4965_read32(iwl, ofs) readl((iwl)->hw_base + (ofs))
+#define _iwl4965_read32(priv, ofs) readl((priv)->hw_base + (ofs))
 #ifdef CONFIG_IWL4965_DEBUG
-static inline u32 __iwl4965_read32(char *f, u32 l, struct iwl4965_priv *iwl, u32 ofs)
+static inline u32 __iwl4965_read32(char *f, u32 l, struct iwl4965_priv *priv, u32 ofs)
 {
         IWL_DEBUG_IO("read_direct32(0x%08X) - %s %d\n", ofs, f, l);
-        return _iwl4965_read32(iwl, ofs);
+        return _iwl4965_read32(priv, ofs);
 }
-#define iwl4965_read32(iwl, ofs) __iwl4965_read32(__FILE__, __LINE__, iwl, ofs)
+#define iwl4965_read32(priv, ofs) __iwl4965_read32(__FILE__, __LINE__, priv, ofs)
 #else
 #define iwl4965_read32(p, o) _iwl4965_read32(p, o)
 #endif
@@ -105,18 +105,13 @@ static inline int __iwl4965_poll_bit(const char *f, u32 l,
                                  u32 bits, u32 mask, int timeout)
 {
         int ret = _iwl4965_poll_bit(priv, addr, bits, mask, timeout);
-        if (unlikely(ret  == -ETIMEDOUT))
-                IWL_DEBUG_IO
-                    ("poll_bit(0x%08X, 0x%08X, 0x%08X) - timedout - %s %d\n",
-                     addr, bits, mask, f, l);
-        else
-                IWL_DEBUG_IO
-                    ("poll_bit(0x%08X, 0x%08X, 0x%08X) = 0x%08X - %s %d\n",
-                     addr, bits, mask, ret, f, l);
+        IWL_DEBUG_IO("poll_bit(0x%08X, 0x%08X, 0x%08X) - %s- %s %d\n",
+                     addr, bits, mask,
+                     unlikely(ret  == -ETIMEDOUT)?"timeout":"", f, l);
         return ret;
 }
-#define iwl4965_poll_bit(iwl, addr, bits, mask, timeout) \
-        __iwl4965_poll_bit(__FILE__, __LINE__, iwl, addr, bits, mask, timeout)
+#define iwl4965_poll_bit(priv, addr, bits, mask, timeout) \
+        __iwl4965_poll_bit(__FILE__, __LINE__, priv, addr, bits, mask, timeout)
 #else
 #define iwl4965_poll_bit(p, a, b, m, t) _iwl4965_poll_bit(p, a, b, m, t)
 #endif
@@ -321,8 +316,8 @@ static inline int __iwl4965_poll_direct_bit(const char *f, u32 l,
                              "- %s %d\n", addr, mask, ret, f, l);
         return ret;
 }
-#define iwl4965_poll_direct_bit(iwl, addr, mask, timeout) \
-        __iwl4965_poll_direct_bit(__FILE__, __LINE__, iwl, addr, mask, timeout)
+#define iwl4965_poll_direct_bit(priv, addr, mask, timeout) \
+        __iwl4965_poll_direct_bit(__FILE__, __LINE__, priv, addr, mask, timeout)
 #else
 #define iwl4965_poll_direct_bit _iwl4965_poll_direct_bit
 #endif
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965-rs.c b/drivers/net/wireless/iwlwifi/iwl-4965-rs.c
index d06462264147..48a6a85355ec 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-4965-rs.c
@@ -83,7 +83,7 @@ struct iwl4965_rate_scale_data {
 /**
  * struct iwl4965_scale_tbl_info -- tx params and success history for all rates
  *
- * There are two of these in struct iwl_rate_scale_priv,
+ * There are two of these in struct iwl4965_lq_sta,
  * one for "active", and one for "search".
  */
 struct iwl4965_scale_tbl_info {
@@ -98,8 +98,23 @@ struct iwl4965_scale_tbl_info {
         struct iwl4965_rate_scale_data win[IWL_RATE_COUNT]; /* rate histories */
 };
 
+#ifdef CONFIG_IWL4965_HT
+
+struct iwl4965_traffic_load {
+        unsigned long time_stamp;       /* age of the oldest statistics */
+        u32 packet_count[TID_QUEUE_MAX_SIZE];   /* packet count in this time
+                                                 * slice */
+        u32 total;                      /* total num of packets during the
+                                         * last TID_MAX_TIME_DIFF */
+        u8 queue_count;                 /* number of queues that has
+                                         * been used since the last cleanup */
+        u8 head;                        /* start of the circular buffer */
+};
+
+#endif /* CONFIG_IWL4965_HT */
+
 /**
- * struct iwl_rate_scale_priv -- driver's rate scaling private structure
+ * struct iwl4965_lq_sta -- driver's rate scaling private structure
  *
  * Pointer to this gets passed back and forth between driver and mac80211.
  */
@@ -124,7 +139,7 @@ struct iwl4965_lq_sta {
         u8 valid_antenna;
         u8 is_green;
         u8 is_dup;
-        u8 phymode;
+        enum ieee80211_band band;
         u8 ibss_sta_added;
 
         /* The following are bitmaps of rates; IWL_RATE_6M_MASK, etc. */
@@ -136,9 +151,16 @@ struct iwl4965_lq_sta {
 
         struct iwl4965_link_quality_cmd lq;
         struct iwl4965_scale_tbl_info lq_info[LQ_SIZE]; /* "active", "search" */
+#ifdef CONFIG_IWL4965_HT
+        struct iwl4965_traffic_load load[TID_MAX_LOAD_COUNT];
+        u8 tx_agg_tid_en;
+#endif
 #ifdef CONFIG_MAC80211_DEBUGFS
         struct dentry *rs_sta_dbgfs_scale_table_file;
         struct dentry *rs_sta_dbgfs_stats_table_file;
+#ifdef CONFIG_IWL4965_HT
+        struct dentry *rs_sta_dbgfs_tx_agg_tid_en_file;
+#endif
         struct iwl4965_rate dbg_fixed;
         struct iwl4965_priv *drv;
 #endif
@@ -269,6 +291,135 @@ static void rs_rate_scale_clear_window(struct iwl4965_rate_scale_data *window)
         window->stamp = 0;
 }
 
+#ifdef CONFIG_IWL4965_HT
+/*
+ *      removes the old data from the statistics. All data that is older than
+ *      TID_MAX_TIME_DIFF, will be deleted.
+ */
+static void rs_tl_rm_old_stats(struct iwl4965_traffic_load *tl, u32 curr_time)
+{
+        /* The oldest age we want to keep */
+        u32 oldest_time = curr_time - TID_MAX_TIME_DIFF;
+
+        while (tl->queue_count &&
+               (tl->time_stamp < oldest_time)) {
+                tl->total -= tl->packet_count[tl->head];
+                tl->packet_count[tl->head] = 0;
+                tl->time_stamp += TID_QUEUE_CELL_SPACING;
+                tl->queue_count--;
+                tl->head++;
+                if (tl->head >= TID_QUEUE_MAX_SIZE)
+                        tl->head = 0;
+        }
+}
+
+/*
+ *      increment traffic load value for tid and also remove
+ *      any old values if passed the certain time period
+ */
+static void rs_tl_add_packet(struct iwl4965_lq_sta *lq_data, u8 tid)
+{
+        u32 curr_time = jiffies_to_msecs(jiffies);
+        u32 time_diff;
+        s32 index;
+        struct iwl4965_traffic_load *tl = NULL;
+
+        if (tid >= TID_MAX_LOAD_COUNT)
+                return;
+
+        tl = &lq_data->load[tid];
+
+        curr_time -= curr_time % TID_ROUND_VALUE;
+
+        /* Happens only for the first packet. Initialize the data */
+        if (!(tl->queue_count)) {
+                tl->total = 1;
+                tl->time_stamp = curr_time;
+                tl->queue_count = 1;
+                tl->head = 0;
+                tl->packet_count[0] = 1;
+                return;
+        }
+
+        time_diff = TIME_WRAP_AROUND(tl->time_stamp, curr_time);
+        index = time_diff / TID_QUEUE_CELL_SPACING;
+
+        /* The history is too long: remove data that is older than */
+        /* TID_MAX_TIME_DIFF */
+        if (index >= TID_QUEUE_MAX_SIZE)
+                rs_tl_rm_old_stats(tl, curr_time);
+
+        index = (tl->head + index) % TID_QUEUE_MAX_SIZE;
+        tl->packet_count[index] = tl->packet_count[index] + 1;
+        tl->total = tl->total + 1;
+
+        if ((index + 1) > tl->queue_count)
+                tl->queue_count = index + 1;
+}
+
+/*
+        get the traffic load value for tid
+*/
+static u32 rs_tl_get_load(struct iwl4965_lq_sta *lq_data, u8 tid)
+{
+        u32 curr_time = jiffies_to_msecs(jiffies);
+        u32 time_diff;
+        s32 index;
+        struct iwl4965_traffic_load *tl = NULL;
+
+        if (tid >= TID_MAX_LOAD_COUNT)
+                return 0;
+
+        tl = &(lq_data->load[tid]);
+
+        curr_time -= curr_time % TID_ROUND_VALUE;
+
+        if (!(tl->queue_count))
+                return 0;
+
+        time_diff = TIME_WRAP_AROUND(tl->time_stamp, curr_time);
+        index = time_diff / TID_QUEUE_CELL_SPACING;
+
+        /* The history is too long: remove data that is older than */
+        /* TID_MAX_TIME_DIFF */
+        if (index >= TID_QUEUE_MAX_SIZE)
+                rs_tl_rm_old_stats(tl, curr_time);
+
+        return tl->total;
+}
+
+static void rs_tl_turn_on_agg_for_tid(struct iwl4965_priv *priv,
+                                struct iwl4965_lq_sta *lq_data, u8 tid,
+                                struct sta_info *sta)
+{
+        unsigned long state;
+        DECLARE_MAC_BUF(mac);
+
+        spin_lock_bh(&sta->ampdu_mlme.ampdu_tx);
+        state = sta->ampdu_mlme.tid_tx[tid].state;
+        spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
+
+        if (state == HT_AGG_STATE_IDLE &&
+            rs_tl_get_load(lq_data, tid) > IWL_AGG_LOAD_THRESHOLD) {
+                IWL_DEBUG_HT("Starting Tx agg: STA: %s tid: %d\n",
+                                print_mac(mac, sta->addr), tid);
+                ieee80211_start_tx_ba_session(priv->hw, sta->addr, tid);
+        }
+}
+
+static void rs_tl_turn_on_agg(struct iwl4965_priv *priv, u8 tid,
+                                struct iwl4965_lq_sta *lq_data,
+                                struct sta_info *sta)
+{
+        if ((tid < TID_MAX_LOAD_COUNT))
+                rs_tl_turn_on_agg_for_tid(priv, lq_data, tid, sta);
+        else if (tid == IWL_AGG_ALL_TID)
+                for (tid = 0; tid < TID_MAX_LOAD_COUNT; tid++)
+                        rs_tl_turn_on_agg_for_tid(priv, lq_data, tid, sta);
+}
+
+#endif /* CONFIG_IWLWIFI_HT */
+
 /**
  * rs_collect_tx_data - Update the success/failure sliding window
  *
@@ -277,7 +428,8 @@ static void rs_rate_scale_clear_window(struct iwl4965_rate_scale_data *window)
  * packets.
  */
 static int rs_collect_tx_data(struct iwl4965_rate_scale_data *windows,
-                              int scale_index, s32 tpt, u32 status)
+                              int scale_index, s32 tpt, int retries,
+                              int successes)
 {
         struct iwl4965_rate_scale_data *window = NULL;
         u64 mask;
@@ -298,26 +450,33 @@ static int rs_collect_tx_data(struct iwl4965_rate_scale_data *windows,
          * subtract "1" from the success counter (this is the main reason
          * we keep these bitmaps!).
          */
-        if (window->counter >= win_size) {
-                window->counter = win_size - 1;
-                mask = 1;
-                mask = (mask << (win_size - 1));
-                if ((window->data & mask)) {
-                        window->data &= ~mask;
-                        window->success_counter = window->success_counter - 1;
+        while (retries > 0) {
+                if (window->counter >= win_size) {
+                        window->counter = win_size - 1;
+                        mask = 1;
+                        mask = (mask << (win_size - 1));
+                        if (window->data & mask) {
+                                window->data &= ~mask;
+                                window->success_counter =
+                                        window->success_counter - 1;
+                        }
                 }
-        }
 
-        /* Increment frames-attempted counter */
-        window->counter = window->counter + 1;
+                /* Increment frames-attempted counter */
+                window->counter++;
+
+                /* Shift bitmap by one frame (throw away oldest history),
+                 * OR in "1", and increment "success" if this
+                 * frame was successful. */
+                mask = window->data;
+                window->data = (mask << 1);
+                if (successes > 0) {
+                        window->success_counter = window->success_counter + 1;
+                        window->data |= 0x1;
+                        successes--;
+                }
 
-        /* Shift bitmap by one frame (throw away oldest history),
-         * OR in "1", and increment "success" if this frame was successful. */
-        mask = window->data;
-        window->data = (mask << 1);
-        if (status != 0) {
-                window->success_counter = window->success_counter + 1;
-                window->data |= 0x1;
+                retries--;
         }
 
         /* Calculate current success ratio, avoid divide-by-0! */
@@ -404,7 +563,8 @@ static void rs_mcs_from_tbl(struct iwl4965_rate *mcs_rate,
  * fill "search" or "active" tx mode table.
  */
 static int rs_get_tbl_info_from_mcs(const struct iwl4965_rate *mcs_rate,
-                                    int phymode, struct iwl4965_scale_tbl_info *tbl,
+                                    enum ieee80211_band band,
+                                    struct iwl4965_scale_tbl_info *tbl,
                                     int *rate_idx)
 {
         int index;
@@ -429,7 +589,7 @@ static int rs_get_tbl_info_from_mcs(const struct iwl4965_rate *mcs_rate,
                         tbl->lq_type = LQ_NONE;
                 else {
 
-                        if (phymode == MODE_IEEE80211A)
+                        if (band == IEEE80211_BAND_5GHZ)
                                 tbl->lq_type = LQ_A;
                         else
                                 tbl->lq_type = LQ_G;
@@ -607,7 +767,7 @@ static void rs_get_lower_rate(struct iwl4965_lq_sta *lq_sta,
         if (!is_legacy(tbl->lq_type) && (!ht_possible || !scale_index)) {
                 switch_to_legacy = 1;
                 scale_index = rs_ht_to_legacy[scale_index];
-                if (lq_sta->phymode == MODE_IEEE80211A)
+                if (lq_sta->band == IEEE80211_BAND_5GHZ)
                         tbl->lq_type = LQ_A;
                 else
                         tbl->lq_type = LQ_G;
@@ -625,7 +785,7 @@ static void rs_get_lower_rate(struct iwl4965_lq_sta *lq_sta,
         /* Mask with station rate restriction */
         if (is_legacy(tbl->lq_type)) {
                 /* supp_rates has no CCK bits in A mode */
-                if (lq_sta->phymode == (u8) MODE_IEEE80211A)
+                if (lq_sta->band == IEEE80211_BAND_5GHZ)
                         rate_mask  = (u16)(rate_mask &
                            (lq_sta->supp_rates << IWL_FIRST_OFDM_RATE));
                 else
@@ -677,6 +837,11 @@ static void rs_tx_status(void *priv_rate, struct net_device *dev,
         if (!ieee80211_is_data(fc) || is_multicast_ether_addr(hdr->addr1))
                 return;
 
+        /* This packet was aggregated but doesn't carry rate scale info */
+        if ((tx_resp->control.flags & IEEE80211_TXCTL_AMPDU) &&
+            !(tx_resp->flags & IEEE80211_TX_STATUS_AMPDU))
+                return;
+
         retries = tx_resp->retry_count;
 
         if (retries > 15)
@@ -719,9 +884,9 @@ static void rs_tx_status(void *priv_rate, struct net_device *dev,
         search_win = (struct iwl4965_rate_scale_data *)
             &(search_tbl->win[0]);
 
-        tx_mcs.rate_n_flags = tx_resp->control.tx_rate;
+        tx_mcs.rate_n_flags = tx_resp->control.tx_rate->hw_value;
 
-        rs_get_tbl_info_from_mcs(&tx_mcs, priv->phymode,
+        rs_get_tbl_info_from_mcs(&tx_mcs, priv->band,
                                   &tbl_type, &rs_index);
         if ((rs_index < 0) || (rs_index >= IWL_RATE_COUNT)) {
                 IWL_DEBUG_RATE("bad rate index at: %d rate 0x%X\n",
@@ -754,7 +919,7 @@ static void rs_tx_status(void *priv_rate, struct net_device *dev,
                  * Each tx attempt steps one entry deeper in the rate table. */
                 tx_mcs.rate_n_flags =
                     le32_to_cpu(table->rs_table[index].rate_n_flags);
-                rs_get_tbl_info_from_mcs(&tx_mcs, priv->phymode,
+                rs_get_tbl_info_from_mcs(&tx_mcs, priv->band,
                                           &tbl_type, &rs_index);
 
                 /* If type matches "search" table,
@@ -766,7 +931,7 @@ static void rs_tx_status(void *priv_rate, struct net_device *dev,
                                 tpt = search_tbl->expected_tpt[rs_index];
                         else
                                 tpt = 0;
-                        rs_collect_tx_data(search_win, rs_index, tpt, 0);
+                        rs_collect_tx_data(search_win, rs_index, tpt, 1, 0);
 
                 /* Else if type matches "current/active" table,
                  * add failure to "current/active" history */
@@ -777,7 +942,7 @@ static void rs_tx_status(void *priv_rate, struct net_device *dev,
                                 tpt = curr_tbl->expected_tpt[rs_index];
                         else
                                 tpt = 0;
-                        rs_collect_tx_data(window, rs_index, tpt, 0);
+                        rs_collect_tx_data(window, rs_index, tpt, 1, 0);
                 }
 
                 /* If not searching for a new mode, increment failed counter
@@ -795,12 +960,12 @@ static void rs_tx_status(void *priv_rate, struct net_device *dev,
          * else look up the rate that was, finally, successful.
          */
         if (!tx_resp->retry_count)
-                tx_mcs.rate_n_flags = tx_resp->control.tx_rate;
+                tx_mcs.rate_n_flags = tx_resp->control.tx_rate->hw_value;
         else
                 tx_mcs.rate_n_flags =
                         le32_to_cpu(table->rs_table[index].rate_n_flags);
 
-        rs_get_tbl_info_from_mcs(&tx_mcs, priv->phymode,
+        rs_get_tbl_info_from_mcs(&tx_mcs, priv->band,
                                   &tbl_type, &rs_index);
 
         /* Update frame history window with "success" if Tx got ACKed ... */
@@ -818,9 +983,13 @@ static void rs_tx_status(void *priv_rate, struct net_device *dev,
                         tpt = search_tbl->expected_tpt[rs_index];
                 else
                         tpt = 0;
-                rs_collect_tx_data(search_win,
-                                    rs_index, tpt, status);
-
+                if (tx_resp->control.flags & IEEE80211_TXCTL_AMPDU)
+                        rs_collect_tx_data(search_win, rs_index, tpt,
+                                           tx_resp->ampdu_ack_len,
+                                           tx_resp->ampdu_ack_map);
+                else
+                        rs_collect_tx_data(search_win, rs_index, tpt,
+                                           1, status);
         /* Else if type matches "current/active" table,
          * add final tx status to "current/active" history */
         } else if ((tbl_type.lq_type == curr_tbl->lq_type) &&
@@ -830,16 +999,28 @@ static void rs_tx_status(void *priv_rate, struct net_device *dev,
                         tpt = curr_tbl->expected_tpt[rs_index];
                 else
                         tpt = 0;
-                rs_collect_tx_data(window, rs_index, tpt, status);
+                if (tx_resp->control.flags & IEEE80211_TXCTL_AMPDU)
+                        rs_collect_tx_data(window, rs_index, tpt,
+                                           tx_resp->ampdu_ack_len,
+                                           tx_resp->ampdu_ack_map);
+                else
+                        rs_collect_tx_data(window, rs_index, tpt,
+                                           1, status);
         }
 
         /* If not searching for new mode, increment success/failed counter
          * ... these help determine when to start searching again */
         if (lq_sta->stay_in_tbl) {
-                if (status)
-                        lq_sta->total_success++;
-                else
-                        lq_sta->total_failed++;
+                if (tx_resp->control.flags & IEEE80211_TXCTL_AMPDU) {
+                        lq_sta->total_success += tx_resp->ampdu_ack_map;
+                        lq_sta->total_failed +=
+                             (tx_resp->ampdu_ack_len - tx_resp->ampdu_ack_map);
+                } else {
+                        if (status)
+                                lq_sta->total_success++;
+                        else
+                                lq_sta->total_failed++;
+                }
         }
 
         /* See if there's a better rate or modulation mode to try. */
@@ -1105,7 +1286,7 @@ static int rs_switch_to_mimo(struct iwl4965_priv *priv,
         return 0;
 #else
         return -1;
-#endif                          /*CONFIG_IWL4965_HT */
+#endif  /*CONFIG_IWL4965_HT */
 }
 
 /*
@@ -1168,7 +1349,7 @@ static int rs_switch_to_siso(struct iwl4965_priv *priv,
 #else
         return -1;
 
-#endif                          /*CONFIG_IWL4965_HT */
+#endif  /*CONFIG_IWL4965_HT */
 }
 
 /*
@@ -1325,6 +1506,7 @@ static int rs_move_siso_to_other(struct iwl4965_priv *priv,
                         break;
                 case IWL_SISO_SWITCH_GI:
                         IWL_DEBUG_HT("LQ: SISO SWITCH TO GI\n");
+
                         memcpy(search_tbl, tbl, sz);
                         search_tbl->action = 0;
                         if (search_tbl->is_SGI)
@@ -1390,6 +1572,7 @@ static int rs_move_mimo_to_other(struct iwl4965_priv *priv,
                 case IWL_MIMO_SWITCH_ANTENNA_B:
                         IWL_DEBUG_HT("LQ: MIMO SWITCH TO SISO\n");
 
+
                         /* Set up new search table for SISO */
                         memcpy(search_tbl, tbl, sz);
                         search_tbl->lq_type = LQ_SISO;
@@ -1574,6 +1757,10 @@ static void rs_rate_scale_perform(struct iwl4965_priv *priv,
         u8 active_tbl = 0;
         u8 done_search = 0;
         u16 high_low;
+#ifdef CONFIG_IWL4965_HT
+        u8 tid = MAX_TID_COUNT;
+        __le16 *qc;
+#endif
 
         IWL_DEBUG_RATE("rate scale calculate new rate for skb\n");
 
@@ -1594,6 +1781,13 @@ static void rs_rate_scale_perform(struct iwl4965_priv *priv,
         }
         lq_sta = (struct iwl4965_lq_sta *)sta->rate_ctrl_priv;
 
+#ifdef CONFIG_IWL4965_HT
+        qc = ieee80211_get_qos_ctrl(hdr);
+        if (qc) {
+                tid = (u8)(le16_to_cpu(*qc) & 0xf);
+                rs_tl_add_packet(lq_sta, tid);
+        }
+#endif
         /*
          * Select rate-scale / modulation-mode table to work with in
          * the rest of this function:  "search" if searching for better
@@ -1608,7 +1802,7 @@ static void rs_rate_scale_perform(struct iwl4965_priv *priv,
         is_green = lq_sta->is_green;
 
         /* current tx rate */
-        index = sta->last_txrate;
+        index = sta->last_txrate_idx;
 
         IWL_DEBUG_RATE("Rate scale index %d for type %d\n", index,
                        tbl->lq_type);
@@ -1621,7 +1815,7 @@ static void rs_rate_scale_perform(struct iwl4965_priv *priv,
 
         /* mask with station rate restriction */
         if (is_legacy(tbl->lq_type)) {
-                if (lq_sta->phymode == (u8) MODE_IEEE80211A)
+                if (lq_sta->band == IEEE80211_BAND_5GHZ)
                         /* supp_rates has no CCK bits in A mode */
                         rate_scale_index_msk = (u16) (rate_mask &
                                 (lq_sta->supp_rates << IWL_FIRST_OFDM_RATE));
@@ -1914,15 +2108,14 @@ static void rs_rate_scale_perform(struct iwl4965_priv *priv,
                  * mode for a while before next round of mode comparisons. */
                 if (lq_sta->enable_counter &&
                     (lq_sta->action_counter >= IWL_ACTION_LIMIT)) {
-#ifdef CONFIG_IWL4965_HT_AGG
-                        /* If appropriate, set up aggregation! */
-                        if ((lq_sta->last_tpt > TID_AGG_TPT_THREHOLD) &&
-                            (priv->lq_mngr.agg_ctrl.auto_agg)) {
-                                priv->lq_mngr.agg_ctrl.tid_retry =
-                                    TID_ALL_SPECIFIED;
-                                schedule_work(&priv->agg_work);
+#ifdef CONFIG_IWL4965_HT
+                        if ((lq_sta->last_tpt > IWL_AGG_TPT_THREHOLD) &&
+                            (lq_sta->tx_agg_tid_en & (1 << tid)) &&
+                            (tid != MAX_TID_COUNT)) {
+                                IWL_DEBUG_HT("try to aggregate tid %d\n", tid);
+                                rs_tl_turn_on_agg(priv, tid, lq_sta, sta);
                         }
-#endif /*CONFIG_IWL4965_HT_AGG */
+#endif /*CONFIG_IWL4965_HT */
                         lq_sta->action_counter = 0;
                         rs_set_stay_in_table(0, lq_sta);
                 }
@@ -1942,15 +2135,15 @@ static void rs_rate_scale_perform(struct iwl4965_priv *priv,
 out:
         rs_mcs_from_tbl(&tbl->current_rate, tbl, index, is_green);
         i = index;
-        sta->last_txrate = i;
+        sta->last_txrate_idx = i;
 
-        /* sta->txrate is an index to A mode rates which start
+        /* sta->txrate_idx is an index to A mode rates which start
          * at IWL_FIRST_OFDM_RATE
          */
-        if (lq_sta->phymode == (u8) MODE_IEEE80211A)
-                sta->txrate = i - IWL_FIRST_OFDM_RATE;
+        if (lq_sta->band == IEEE80211_BAND_5GHZ)
+                sta->txrate_idx = i - IWL_FIRST_OFDM_RATE;
         else
-                sta->txrate = i;
+                sta->txrate_idx = i;
 
         return;
 }
@@ -1972,7 +2165,7 @@ static void rs_initialize_lq(struct iwl4965_priv *priv,
                 goto out;
 
         lq_sta = (struct iwl4965_lq_sta *)sta->rate_ctrl_priv;
-        i = sta->last_txrate;
+        i = sta->last_txrate_idx;
 
         if ((lq_sta->lq.sta_id == 0xff) &&
             (priv->iw_mode == IEEE80211_IF_TYPE_IBSS))
@@ -1996,7 +2189,7 @@ static void rs_initialize_lq(struct iwl4965_priv *priv,
                 mcs_rate.rate_n_flags |= RATE_MCS_CCK_MSK;
 
         tbl->antenna_type = ANT_AUX;
-        rs_get_tbl_info_from_mcs(&mcs_rate, priv->phymode, tbl, &rate_idx);
+        rs_get_tbl_info_from_mcs(&mcs_rate, priv->band, tbl, &rate_idx);
         if (!rs_is_ant_connected(priv->valid_antenna, tbl->antenna_type))
             rs_toggle_antenna(&mcs_rate, tbl);
 
@@ -2010,7 +2203,8 @@ static void rs_initialize_lq(struct iwl4965_priv *priv,
 }
 
 static void rs_get_rate(void *priv_rate, struct net_device *dev,
-                        struct ieee80211_hw_mode *mode, struct sk_buff *skb,
+                        struct ieee80211_supported_band *sband,
+                        struct sk_buff *skb,
                         struct rate_selection *sel)
 {
 
@@ -2032,14 +2226,14 @@ static void rs_get_rate(void *priv_rate, struct net_device *dev,
         fc = le16_to_cpu(hdr->frame_control);
         if (!ieee80211_is_data(fc) || is_multicast_ether_addr(hdr->addr1) ||
             !sta || !sta->rate_ctrl_priv) {
-                sel->rate = rate_lowest(local, local->oper_hw_mode, sta);
+                sel->rate = rate_lowest(local, sband, sta);
                 if (sta)
                         sta_info_put(sta);
                 return;
         }
 
         lq_sta = (struct iwl4965_lq_sta *)sta->rate_ctrl_priv;
-        i = sta->last_txrate;
+        i = sta->last_txrate_idx;
 
         if ((priv->iw_mode == IEEE80211_IF_TYPE_IBSS) &&
             !lq_sta->ibss_sta_added) {
@@ -2064,7 +2258,7 @@ static void rs_get_rate(void *priv_rate, struct net_device *dev,
 
  done:
         if ((i < 0) || (i > IWL_RATE_COUNT)) {
-                sel->rate = rate_lowest(local, local->oper_hw_mode, sta);
+                sel->rate = rate_lowest(local, sband, sta);
                 return;
         }
         sta_info_put(sta);
@@ -2099,13 +2293,15 @@ static void rs_rate_init(void *priv_rate, void *priv_sta,
 {
         int i, j;
         struct ieee80211_conf *conf = &local->hw.conf;
-        struct ieee80211_hw_mode *mode = local->oper_hw_mode;
+        struct ieee80211_supported_band *sband;
         struct iwl4965_priv *priv = (struct iwl4965_priv *)priv_rate;
         struct iwl4965_lq_sta *lq_sta = priv_sta;
 
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+
         lq_sta->flush_timer = 0;
-        lq_sta->supp_rates = sta->supp_rates;
-        sta->txrate = 3;
+        lq_sta->supp_rates = sta->supp_rates[sband->band];
+        sta->txrate_idx = 3;
         for (j = 0; j < LQ_SIZE; j++)
                 for (i = 0; i < IWL_RATE_COUNT; i++)
                         rs_rate_scale_clear_window(&(lq_sta->lq_info[j].win[i]));
@@ -2140,15 +2336,15 @@ static void rs_rate_init(void *priv_rate, void *priv_sta,
         }
 
         /* Find highest tx rate supported by hardware and destination station */
-        for (i = 0; i < mode->num_rates; i++) {
-                if ((sta->supp_rates & BIT(i)) &&
-                    (mode->rates[i].flags & IEEE80211_RATE_SUPPORTED))
-                        sta->txrate = i;
-        }
-        sta->last_txrate = sta->txrate;
+        for (i = 0; i < sband->n_bitrates; i++)
+                if (sta->supp_rates[sband->band] & BIT(i))
+                        sta->txrate_idx = i;
+
+        sta->last_txrate_idx = sta->txrate_idx;
+        /* WTF is with this bogus comment? A doesn't have cck rates */
         /* For MODE_IEEE80211A, cck rates are at end of rate table */
-        if (local->hw.conf.phymode == MODE_IEEE80211A)
-                sta->last_txrate += IWL_FIRST_OFDM_RATE;
+        if (local->hw.conf.channel->band == IEEE80211_BAND_5GHZ)
+                sta->last_txrate_idx += IWL_FIRST_OFDM_RATE;
 
         lq_sta->is_dup = 0;
         lq_sta->valid_antenna = priv->valid_antenna;
@@ -2157,7 +2353,7 @@ static void rs_rate_init(void *priv_rate, void *priv_sta,
         lq_sta->active_rate = priv->active_rate;
         lq_sta->active_rate &= ~(0x1000);
         lq_sta->active_rate_basic = priv->active_rate_basic;
-        lq_sta->phymode = priv->phymode;
+        lq_sta->band = priv->band;
 #ifdef CONFIG_IWL4965_HT
         /*
          * active_siso_rate mask includes 9 MBits (bit 5), and CCK (bits 0-3),
@@ -2180,6 +2376,8 @@ static void rs_rate_init(void *priv_rate, void *priv_sta,
         IWL_DEBUG_HT("SISO RATE 0x%X MIMO RATE 0x%X\n",
                      lq_sta->active_siso_rate,
                      lq_sta->active_mimo_rate);
+        /* as default allow aggregation for all tids */
+        lq_sta->tx_agg_tid_en = IWL_AGG_ALL_TID;
 #endif /*CONFIG_IWL4965_HT*/
 #ifdef CONFIG_MAC80211_DEBUGFS
         lq_sta->drv = priv;
@@ -2207,7 +2405,7 @@ static void rs_fill_link_cmd(struct iwl4965_lq_sta *lq_sta,
         rs_dbgfs_set_mcs(lq_sta, tx_mcs, index);
 
         /* Interpret rate_n_flags */
-        rs_get_tbl_info_from_mcs(tx_mcs, lq_sta->phymode,
+        rs_get_tbl_info_from_mcs(tx_mcs, lq_sta->band,
                                   &tbl_type, &rate_idx);
 
         /* How many times should we repeat the initial rate? */
@@ -2261,7 +2459,7 @@ static void rs_fill_link_cmd(struct iwl4965_lq_sta *lq_sta,
                         index++;
                 }
 
-                rs_get_tbl_info_from_mcs(&new_rate, lq_sta->phymode, &tbl_type,
+                rs_get_tbl_info_from_mcs(&new_rate, lq_sta->band, &tbl_type,
                                                 &rate_idx);
 
                 /* Indicate to uCode which entries might be MIMO.
@@ -2323,12 +2521,6 @@ static void rs_clear(void *priv_rate)
         IWL_DEBUG_RATE("enter\n");
 
         priv->lq_mngr.lq_ready = 0;
-#ifdef CONFIG_IWL4965_HT
-#ifdef CONFIG_IWL4965_HT_AGG
-        if (priv->lq_mngr.agg_ctrl.granted_ba)
-                iwl4965_turn_off_agg(priv, TID_ALL_SPECIFIED);
-#endif /*CONFIG_IWL4965_HT_AGG */
-#endif /* CONFIG_IWL4965_HT */
 
         IWL_DEBUG_RATE("leave\n");
 }
@@ -2354,7 +2546,7 @@ static void rs_dbgfs_set_mcs(struct iwl4965_lq_sta *lq_sta,
 {
         u32 base_rate;
 
-        if (lq_sta->phymode == (u8) MODE_IEEE80211A)
+        if (lq_sta->band == IEEE80211_BAND_5GHZ)
                 base_rate = 0x800D;
         else
                 base_rate = 0x820A;
@@ -2495,6 +2687,12 @@ static void rs_add_debugfs(void *priv, void *priv_sta,
         lq_sta->rs_sta_dbgfs_stats_table_file =
                 debugfs_create_file("rate_stats_table", 0600, dir,
                         lq_sta, &rs_sta_dbgfs_stats_table_ops);
+#ifdef CONFIG_IWL4965_HT
+        lq_sta->rs_sta_dbgfs_tx_agg_tid_en_file =
+                debugfs_create_u8("tx_agg_tid_enable", 0600, dir,
+                &lq_sta->tx_agg_tid_en);
+#endif
+
 }
 
 static void rs_remove_debugfs(void *priv, void *priv_sta)
@@ -2502,6 +2700,9 @@ static void rs_remove_debugfs(void *priv, void *priv_sta)
         struct iwl4965_lq_sta *lq_sta = priv_sta;
         debugfs_remove(lq_sta->rs_sta_dbgfs_scale_table_file);
         debugfs_remove(lq_sta->rs_sta_dbgfs_stats_table_file);
+#ifdef CONFIG_IWL4965_HT
+        debugfs_remove(lq_sta->rs_sta_dbgfs_tx_agg_tid_en_file);
+#endif
 }
 #endif
 
@@ -2605,7 +2806,7 @@ int iwl4965_fill_rs_info(struct ieee80211_hw *hw, char *buf, u8 sta_id)
 
         cnt += sprintf(&buf[cnt], "\nrate scale type %d antenna %d "
                          "active_search %d rate index %d\n", lq_type, antenna,
-                         lq_sta->search_better_tbl, sta->last_txrate);
+                         lq_sta->search_better_tbl, sta->last_txrate_idx);
 
         sta_info_put(sta);
         return cnt;
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965-rs.h b/drivers/net/wireless/iwlwifi/iwl-4965-rs.h
index 55f707382787..13b6c72eeb73 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965-rs.h
+++ b/drivers/net/wireless/iwlwifi/iwl-4965-rs.h
@@ -212,6 +212,18 @@ enum {
 
 #define LQ_SIZE         2       /* 2 mode tables:  "Active" and "Search" */
 
+/* load per tid defines for A-MPDU activation */
+#define IWL_AGG_TPT_THREHOLD    0
+#define IWL_AGG_LOAD_THRESHOLD  10
+#define IWL_AGG_ALL_TID         0xff
+#define TID_QUEUE_CELL_SPACING  50      /*mS */
+#define TID_QUEUE_MAX_SIZE      20
+#define TID_ROUND_VALUE         5       /* mS */
+#define TID_MAX_LOAD_COUNT      8
+
+#define TID_MAX_TIME_DIFF ((TID_QUEUE_MAX_SIZE - 1) * TID_QUEUE_CELL_SPACING)
+#define TIME_WRAP_AROUND(x, y) (((y) > (x)) ? (y) - (x) : (0-(x)) + (y))
+
 extern const struct iwl4965_rate_info iwl4965_rates[IWL_RATE_COUNT];
 
 enum iwl4965_table_type {
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965.c b/drivers/net/wireless/iwlwifi/iwl-4965.c
index d727de8b96fe..a9c30bcb65b8 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965.c
+++ b/drivers/net/wireless/iwlwifi/iwl-4965.c
@@ -79,6 +79,30 @@ const struct iwl4965_rate_info iwl4965_rates[IWL_RATE_COUNT] = {
         IWL_DECLARE_RATE_INFO(60, 60, 48, INV, 48, INV, 48, INV),/* 60mbps */
 };
 
+#ifdef CONFIG_IWL4965_HT
+
+static const u16 default_tid_to_tx_fifo[] = {
+        IWL_TX_FIFO_AC1,
+        IWL_TX_FIFO_AC0,
+        IWL_TX_FIFO_AC0,
+        IWL_TX_FIFO_AC1,
+        IWL_TX_FIFO_AC2,
+        IWL_TX_FIFO_AC2,
+        IWL_TX_FIFO_AC3,
+        IWL_TX_FIFO_AC3,
+        IWL_TX_FIFO_NONE,
+        IWL_TX_FIFO_NONE,
+        IWL_TX_FIFO_NONE,
+        IWL_TX_FIFO_NONE,
+        IWL_TX_FIFO_NONE,
+        IWL_TX_FIFO_NONE,
+        IWL_TX_FIFO_NONE,
+        IWL_TX_FIFO_NONE,
+        IWL_TX_FIFO_AC3
+};
+
+#endif  /*CONFIG_IWL4965_HT */
+
 static int is_fat_channel(__le32 rxon_flags)
 {
         return (rxon_flags & RXON_FLG_CHANNEL_MODE_PURE_40_MSK) ||
@@ -315,14 +339,15 @@ static int iwl4965_kw_alloc(struct iwl4965_priv *priv)
  *
  * Does not set up a command, or touch hardware.
  */
-int iwl4965_set_fat_chan_info(struct iwl4965_priv *priv, int phymode, u16 channel,
+int iwl4965_set_fat_chan_info(struct iwl4965_priv *priv,
+                              enum ieee80211_band band, u16 channel,
                               const struct iwl4965_eeprom_channel *eeprom_ch,
                               u8 fat_extension_channel)
 {
         struct iwl4965_channel_info *ch_info;
 
         ch_info = (struct iwl4965_channel_info *)
-                        iwl4965_get_channel_info(priv, phymode, channel);
+                        iwl4965_get_channel_info(priv, band, channel);
 
         if (!is_channel_valid(ch_info))
                 return -1;
@@ -520,9 +545,10 @@ int iwl4965_hw_nic_init(struct iwl4965_priv *priv)
 
         /* set CSR_HW_CONFIG_REG for uCode use */
 
-        iwl4965_set_bit(priv, CSR_SW_VER, CSR_HW_IF_CONFIG_REG_BIT_KEDRON_R |
-                    CSR_HW_IF_CONFIG_REG_BIT_RADIO_SI |
-                    CSR_HW_IF_CONFIG_REG_BIT_MAC_SI);
+        iwl4965_set_bit(priv, CSR_HW_IF_CONFIG_REG,
+                        CSR_HW_IF_CONFIG_REG_BIT_KEDRON_R |
+                        CSR_HW_IF_CONFIG_REG_BIT_RADIO_SI |
+                        CSR_HW_IF_CONFIG_REG_BIT_MAC_SI);
 
         rc = iwl4965_grab_nic_access(priv);
         if (rc < 0) {
@@ -1769,7 +1795,6 @@ int iwl4965_hw_set_hw_setting(struct iwl4965_priv *priv)
         memset(priv->hw_setting.shared_virt, 0, sizeof(struct iwl4965_shared));
 
         priv->hw_setting.max_txq_num = iwl4965_param_queues_num;
-        priv->hw_setting.ac_queue_count = AC_NUM;
         priv->hw_setting.tx_cmd_len = sizeof(struct iwl4965_tx_cmd);
         priv->hw_setting.max_rxq_size = RX_QUEUE_SIZE;
         priv->hw_setting.max_rxq_log = RX_QUEUE_SIZE_LOG;
@@ -1780,6 +1805,9 @@ int iwl4965_hw_set_hw_setting(struct iwl4965_priv *priv)
         priv->hw_setting.max_pkt_size = priv->hw_setting.rx_buf_size - 256;
         priv->hw_setting.max_stations = IWL4965_STATION_COUNT;
         priv->hw_setting.bcast_sta_id = IWL4965_BROADCAST_ID;
+
+        priv->hw_setting.tx_ant_num = 2;
+
         return 0;
 }
 
@@ -1915,11 +1943,12 @@ static s32 iwl4965_get_voltage_compensation(s32 eeprom_voltage,
 }
 
 static const struct iwl4965_channel_info *
-iwl4965_get_channel_txpower_info(struct iwl4965_priv *priv, u8 phymode, u16 channel)
+iwl4965_get_channel_txpower_info(struct iwl4965_priv *priv,
+                                 enum ieee80211_band band, u16 channel)
 {
         const struct iwl4965_channel_info *ch_info;
 
-        ch_info = iwl4965_get_channel_info(priv, phymode, channel);
+        ch_info = iwl4965_get_channel_info(priv, band, channel);
 
         if (!is_channel_valid(ch_info))
                 return NULL;
@@ -2368,7 +2397,7 @@ static int iwl4965_fill_txpower_tbl(struct iwl4965_priv *priv, u8 band, u16 chan
 
         /* Get current (RXON) channel, band, width */
         ch_info =
-                iwl4965_get_channel_txpower_info(priv, priv->phymode, channel);
+                iwl4965_get_channel_txpower_info(priv, priv->band, channel);
 
         IWL_DEBUG_TXPOWER("chan %d band %d is_fat %d\n", channel, band,
                           is_fat);
@@ -2595,8 +2624,7 @@ int iwl4965_hw_reg_send_txpower(struct iwl4965_priv *priv)
                 return -EAGAIN;
         }
 
-        band = ((priv->phymode == MODE_IEEE80211B) ||
-                (priv->phymode == MODE_IEEE80211G));
+        band = priv->band == IEEE80211_BAND_2GHZ;
 
         is_fat =  is_fat_channel(priv->active_rxon.flags);
 
@@ -2626,10 +2654,9 @@ int iwl4965_hw_channel_switch(struct iwl4965_priv *priv, u16 channel)
         struct iwl4965_channel_switch_cmd cmd = { 0 };
         const struct iwl4965_channel_info *ch_info;
 
-        band = ((priv->phymode == MODE_IEEE80211B) ||
-                (priv->phymode == MODE_IEEE80211G));
+        band = priv->band == IEEE80211_BAND_2GHZ;
 
-        ch_info = iwl4965_get_channel_info(priv, priv->phymode, channel);
+        ch_info = iwl4965_get_channel_info(priv, priv->band, channel);
 
         is_fat = is_fat_channel(priv->staging_rxon.flags);
 
@@ -2674,7 +2701,7 @@ void iwl4965_hw_build_tx_cmd_rate(struct iwl4965_priv *priv,
         u16 fc = le16_to_cpu(hdr->frame_control);
         u8 rate_plcp;
         u16 rate_flags = 0;
-        int rate_idx = min(ctrl->tx_rate & 0xffff, IWL_RATE_COUNT - 1);
+        int rate_idx = min(ctrl->tx_rate->hw_value & 0xffff, IWL_RATE_COUNT - 1);
 
         rate_plcp = iwl4965_rates[rate_idx].plcp;
 
@@ -2922,378 +2949,6 @@ void iwl4965_set_rxon_chain(struct iwl4965_priv *priv)
         IWL_DEBUG_ASSOC("rx chain %X\n", priv->staging_rxon.rx_chain);
 }
 
-#ifdef CONFIG_IWL4965_HT
-#ifdef CONFIG_IWL4965_HT_AGG
-/*
-        get the traffic load value for tid
-*/
-static u32 iwl4965_tl_get_load(struct iwl4965_priv *priv, u8 tid)
-{
-        u32 load = 0;
-        u32 current_time = jiffies_to_msecs(jiffies);
-        u32 time_diff;
-        s32 index;
-        unsigned long flags;
-        struct iwl4965_traffic_load *tid_ptr = NULL;
-
-        if (tid >= TID_MAX_LOAD_COUNT)
-                return 0;
-
-        tid_ptr = &(priv->lq_mngr.agg_ctrl.traffic_load[tid]);
-
-        current_time -= current_time % TID_ROUND_VALUE;
-
-        spin_lock_irqsave(&priv->lq_mngr.lock, flags);
-        if (!(tid_ptr->queue_count))
-                goto out;
-
-        time_diff = TIME_WRAP_AROUND(tid_ptr->time_stamp, current_time);
-        index = time_diff / TID_QUEUE_CELL_SPACING;
-
-        if (index >= TID_QUEUE_MAX_SIZE) {
-                u32 oldest_time = current_time - TID_MAX_TIME_DIFF;
-
-                while (tid_ptr->queue_count &&
-                       (tid_ptr->time_stamp < oldest_time)) {
-                        tid_ptr->total -= tid_ptr->packet_count[tid_ptr->head];
-                        tid_ptr->packet_count[tid_ptr->head] = 0;
-                        tid_ptr->time_stamp += TID_QUEUE_CELL_SPACING;
-                        tid_ptr->queue_count--;
-                        tid_ptr->head++;
-                        if (tid_ptr->head >= TID_QUEUE_MAX_SIZE)
-                                tid_ptr->head = 0;
-                }
-        }
-        load = tid_ptr->total;
-
- out:
-        spin_unlock_irqrestore(&priv->lq_mngr.lock, flags);
-        return load;
-}
-
-/*
-        increment traffic load value for tid and also remove
-        any old values if passed the certian time period
-*/
-static void iwl4965_tl_add_packet(struct iwl4965_priv *priv, u8 tid)
-{
-        u32 current_time = jiffies_to_msecs(jiffies);
-        u32 time_diff;
-        s32 index;
-        unsigned long flags;
-        struct iwl4965_traffic_load *tid_ptr = NULL;
-
-        if (tid >= TID_MAX_LOAD_COUNT)
-                return;
-
-        tid_ptr = &(priv->lq_mngr.agg_ctrl.traffic_load[tid]);
-
-        current_time -= current_time % TID_ROUND_VALUE;
-
-        spin_lock_irqsave(&priv->lq_mngr.lock, flags);
-        if (!(tid_ptr->queue_count)) {
-                tid_ptr->total = 1;
-                tid_ptr->time_stamp = current_time;
-                tid_ptr->queue_count = 1;
-                tid_ptr->head = 0;
-                tid_ptr->packet_count[0] = 1;
-                goto out;
-        }
-
-        time_diff = TIME_WRAP_AROUND(tid_ptr->time_stamp, current_time);
-        index = time_diff / TID_QUEUE_CELL_SPACING;
-
-        if (index >= TID_QUEUE_MAX_SIZE) {
-                u32 oldest_time = current_time - TID_MAX_TIME_DIFF;
-
-                while (tid_ptr->queue_count &&
-                       (tid_ptr->time_stamp < oldest_time)) {
-                        tid_ptr->total -= tid_ptr->packet_count[tid_ptr->head];
-                        tid_ptr->packet_count[tid_ptr->head] = 0;
-                        tid_ptr->time_stamp += TID_QUEUE_CELL_SPACING;
-                        tid_ptr->queue_count--;
-                        tid_ptr->head++;
-                        if (tid_ptr->head >= TID_QUEUE_MAX_SIZE)
-                                tid_ptr->head = 0;
-                }
-        }
-
-        index = (tid_ptr->head + index) % TID_QUEUE_MAX_SIZE;
-        tid_ptr->packet_count[index] = tid_ptr->packet_count[index] + 1;
-        tid_ptr->total = tid_ptr->total + 1;
-
-        if ((index + 1) > tid_ptr->queue_count)
-                tid_ptr->queue_count = index + 1;
- out:
-        spin_unlock_irqrestore(&priv->lq_mngr.lock, flags);
-
-}
-
-#define MMAC_SCHED_MAX_NUMBER_OF_HT_BACK_FLOWS   7
-enum HT_STATUS {
-        BA_STATUS_FAILURE = 0,
-        BA_STATUS_INITIATOR_DELBA,
-        BA_STATUS_RECIPIENT_DELBA,
-        BA_STATUS_RENEW_ADDBA_REQUEST,
-        BA_STATUS_ACTIVE,
-};
-
-/**
- * iwl4964_tl_ba_avail - Find out if an unused aggregation queue is available
- */
-static u8 iwl4964_tl_ba_avail(struct iwl4965_priv *priv)
-{
-        int i;
-        struct iwl4965_lq_mngr *lq;
-        u8 count = 0;
-        u16 msk;
-
-        lq = (struct iwl4965_lq_mngr *)&(priv->lq_mngr);
-
-        /* Find out how many agg queues are in use */
-        for (i = 0; i < TID_MAX_LOAD_COUNT ; i++) {
-                msk = 1 << i;
-                if ((lq->agg_ctrl.granted_ba & msk) ||
-                    (lq->agg_ctrl.wait_for_agg_status & msk))
-                        count++;
-        }
-
-        if (count < MMAC_SCHED_MAX_NUMBER_OF_HT_BACK_FLOWS)
-                return 1;
-
-        return 0;
-}
-
-static void iwl4965_ba_status(struct iwl4965_priv *priv,
-                              u8 tid, enum HT_STATUS status);
-
-static int iwl4965_perform_addba(struct iwl4965_priv *priv, u8 tid, u32 length,
-                                 u32 ba_timeout)
-{
-        int rc;
-
-        rc = ieee80211_start_BA_session(priv->hw, priv->bssid, tid);
-        if (rc)
-                iwl4965_ba_status(priv, tid, BA_STATUS_FAILURE);
-
-        return rc;
-}
-
-static int iwl4965_perform_delba(struct iwl4965_priv *priv, u8 tid)
-{
-        int rc;
-
-        rc = ieee80211_stop_BA_session(priv->hw, priv->bssid, tid);
-        if (rc)
-                iwl4965_ba_status(priv, tid, BA_STATUS_FAILURE);
-
-        return rc;
-}
-
-static void iwl4965_turn_on_agg_for_tid(struct iwl4965_priv *priv,
-                                        struct iwl4965_lq_mngr *lq,
-                                        u8 auto_agg, u8 tid)
-{
-        u32 tid_msk = (1 << tid);
-        unsigned long flags;
-
-        spin_lock_irqsave(&priv->lq_mngr.lock, flags);
-/*
-        if ((auto_agg) && (!lq->enable_counter)){
-                lq->agg_ctrl.next_retry = 0;
-                lq->agg_ctrl.tid_retry = 0;
-                spin_unlock_irqrestore(&priv->lq_mngr.lock, flags);
-                return;
-        }
-*/
-        if (!(lq->agg_ctrl.granted_ba & tid_msk) &&
-            (lq->agg_ctrl.requested_ba & tid_msk)) {
-                u8 available_queues;
-                u32 load;
-
-                spin_unlock_irqrestore(&priv->lq_mngr.lock, flags);
-                available_queues = iwl4964_tl_ba_avail(priv);
-                load = iwl4965_tl_get_load(priv, tid);
-
-                spin_lock_irqsave(&priv->lq_mngr.lock, flags);
-                if (!available_queues) {
-                        if (auto_agg)
-                                lq->agg_ctrl.tid_retry |= tid_msk;
-                        else {
-                                lq->agg_ctrl.requested_ba &= ~tid_msk;
-                                lq->agg_ctrl.wait_for_agg_status &= ~tid_msk;
-                        }
-                } else if ((auto_agg) &&
-                           ((load <= lq->agg_ctrl.tid_traffic_load_threshold) ||
-                            ((lq->agg_ctrl.wait_for_agg_status & tid_msk))))
-                        lq->agg_ctrl.tid_retry |= tid_msk;
-                else {
-                        lq->agg_ctrl.wait_for_agg_status |= tid_msk;
-                        spin_unlock_irqrestore(&priv->lq_mngr.lock, flags);
-                        iwl4965_perform_addba(priv, tid, 0x40,
-                                              lq->agg_ctrl.ba_timeout);
-                        spin_lock_irqsave(&priv->lq_mngr.lock, flags);
-                }
-        }
-        spin_unlock_irqrestore(&priv->lq_mngr.lock, flags);
-}
-
-static void iwl4965_turn_on_agg(struct iwl4965_priv *priv, u8 tid)
-{
-        struct iwl4965_lq_mngr *lq;
-        unsigned long flags;
-
-        lq = (struct iwl4965_lq_mngr *)&(priv->lq_mngr);
-
-        if ((tid < TID_MAX_LOAD_COUNT))
-                iwl4965_turn_on_agg_for_tid(priv, lq, lq->agg_ctrl.auto_agg,
-                                            tid);
-        else if (tid == TID_ALL_SPECIFIED) {
-                if (lq->agg_ctrl.requested_ba) {
-                        for (tid = 0; tid < TID_MAX_LOAD_COUNT; tid++)
-                                iwl4965_turn_on_agg_for_tid(priv, lq,
-                                        lq->agg_ctrl.auto_agg, tid);
-                } else {
-                        spin_lock_irqsave(&priv->lq_mngr.lock, flags);
-                        lq->agg_ctrl.tid_retry = 0;
-                        lq->agg_ctrl.next_retry = 0;
-                        spin_unlock_irqrestore(&priv->lq_mngr.lock, flags);
-                }
-        }
-
-}
-
-void iwl4965_turn_off_agg(struct iwl4965_priv *priv, u8 tid)
-{
-        u32 tid_msk;
-        struct iwl4965_lq_mngr *lq;
-        unsigned long flags;
-
-        lq = (struct iwl4965_lq_mngr *)&(priv->lq_mngr);
-
-        if ((tid < TID_MAX_LOAD_COUNT)) {
-                tid_msk = 1 << tid;
-                spin_lock_irqsave(&priv->lq_mngr.lock, flags);
-                lq->agg_ctrl.wait_for_agg_status |= tid_msk;
-                lq->agg_ctrl.requested_ba &= ~tid_msk;
-                spin_unlock_irqrestore(&priv->lq_mngr.lock, flags);
-                iwl4965_perform_delba(priv, tid);
-        } else if (tid == TID_ALL_SPECIFIED) {
-                spin_lock_irqsave(&priv->lq_mngr.lock, flags);
-                for (tid = 0; tid < TID_MAX_LOAD_COUNT; tid++) {
-                        tid_msk = 1 << tid;
-                        lq->agg_ctrl.wait_for_agg_status |= tid_msk;
-                        spin_unlock_irqrestore(&priv->lq_mngr.lock, flags);
-                        iwl4965_perform_delba(priv, tid);
-                        spin_lock_irqsave(&priv->lq_mngr.lock, flags);
-                }
-                lq->agg_ctrl.requested_ba = 0;
-                spin_unlock_irqrestore(&priv->lq_mngr.lock, flags);
-        }
-}
-
-/**
- * iwl4965_ba_status - Update driver's link quality mgr with tid's HT status
- */
-static void iwl4965_ba_status(struct iwl4965_priv *priv,
-                                u8 tid, enum HT_STATUS status)
-{
-        struct iwl4965_lq_mngr *lq;
-        u32 tid_msk = (1 << tid);
-        unsigned long flags;
-
-        lq = (struct iwl4965_lq_mngr *)&(priv->lq_mngr);
-
-        if ((tid >= TID_MAX_LOAD_COUNT))
-                goto out;
-
-        spin_lock_irqsave(&priv->lq_mngr.lock, flags);
-        switch (status) {
-        case BA_STATUS_ACTIVE:
-                if (!(lq->agg_ctrl.granted_ba & tid_msk))
-                        lq->agg_ctrl.granted_ba |= tid_msk;
-                break;
-        default:
-                if ((lq->agg_ctrl.granted_ba & tid_msk))
-                        lq->agg_ctrl.granted_ba &= ~tid_msk;
-                break;
-        }
-
-        lq->agg_ctrl.wait_for_agg_status &= ~tid_msk;
-        if (status != BA_STATUS_ACTIVE) {
-                if (lq->agg_ctrl.auto_agg) {
-                        lq->agg_ctrl.tid_retry |= tid_msk;
-                        lq->agg_ctrl.next_retry =
-                            jiffies + msecs_to_jiffies(500);
-                } else
-                        lq->agg_ctrl.requested_ba &= ~tid_msk;
-        }
-        spin_unlock_irqrestore(&priv->lq_mngr.lock, flags);
- out:
-        return;
-}
-
-static void iwl4965_bg_agg_work(struct work_struct *work)
-{
-        struct iwl4965_priv *priv = container_of(work, struct iwl4965_priv,
-                                        agg_work);
-
-        u32 tid;
-        u32 retry_tid;
-        u32 tid_msk;
-        unsigned long flags;
-        struct iwl4965_lq_mngr *lq = (struct iwl4965_lq_mngr *)&(priv->lq_mngr);
-
-        spin_lock_irqsave(&priv->lq_mngr.lock, flags);
-        retry_tid = lq->agg_ctrl.tid_retry;
-        lq->agg_ctrl.tid_retry = 0;
-        spin_unlock_irqrestore(&priv->lq_mngr.lock, flags);
-
-        if (retry_tid == TID_ALL_SPECIFIED)
-                iwl4965_turn_on_agg(priv, TID_ALL_SPECIFIED);
-        else {
-                for (tid = 0; tid < TID_MAX_LOAD_COUNT; tid++) {
-                        tid_msk = (1 << tid);
-                        if (retry_tid & tid_msk)
-                                iwl4965_turn_on_agg(priv, tid);
-                }
-        }
-
-        spin_lock_irqsave(&priv->lq_mngr.lock, flags);
-        if (lq->agg_ctrl.tid_retry)
-                lq->agg_ctrl.next_retry = jiffies + msecs_to_jiffies(500);
-        spin_unlock_irqrestore(&priv->lq_mngr.lock, flags);
-        return;
-}
-
-/* TODO: move this functionality to rate scaling */
-void iwl4965_tl_get_stats(struct iwl4965_priv *priv,
-                   struct ieee80211_hdr *hdr)
-{
-        __le16 *qc = ieee80211_get_qos_ctrl(hdr);
-
-        if (qc &&
-            (priv->iw_mode != IEEE80211_IF_TYPE_IBSS)) {
-                u8 tid = 0;
-                tid = (u8) (le16_to_cpu(*qc) & 0xF);
-                if (tid < TID_MAX_LOAD_COUNT)
-                        iwl4965_tl_add_packet(priv, tid);
-        }
-
-        if (priv->lq_mngr.agg_ctrl.next_retry &&
-            (time_after(priv->lq_mngr.agg_ctrl.next_retry, jiffies))) {
-                unsigned long flags;
-
-                spin_lock_irqsave(&priv->lq_mngr.lock, flags);
-                priv->lq_mngr.agg_ctrl.next_retry = 0;
-                spin_unlock_irqrestore(&priv->lq_mngr.lock, flags);
-                schedule_work(&priv->agg_work);
-        }
-}
-
-#endif /*CONFIG_IWL4965_HT_AGG */
-#endif /* CONFIG_IWL4965_HT */
-
 /**
  * sign_extend - Sign extend a value using specified bit as sign-bit
  *
@@ -3526,7 +3181,7 @@ static void iwl4965_add_radiotap(struct iwl4965_priv *priv,
 {
         s8 signal = stats->ssi;
         s8 noise = 0;
-        int rate = stats->rate;
+        int rate = stats->rate_idx;
         u64 tsf = stats->mactime;
         __le16 phy_flags_hw = rx_start->phy_flags;
         struct iwl4965_rt_rx_hdr {
@@ -3594,7 +3249,6 @@ static void iwl4965_add_radiotap(struct iwl4965_priv *priv,
                                           IEEE80211_CHAN_2GHZ),
                               &iwl4965_rt->rt_chbitmask);
 
-        rate = iwl4965_rate_index_from_plcp(rate);
         if (rate == -1)
                 iwl4965_rt->rt_rate = 0;
         else
@@ -3808,14 +3462,15 @@ static int parse_elems(u8 *start, size_t len, struct ieee802_11_elems *elems)
         return 0;
 }
 
-void iwl4965_init_ht_hw_capab(struct ieee80211_ht_info *ht_info, int mode)
+void iwl4965_init_ht_hw_capab(struct ieee80211_ht_info *ht_info,
+                              enum ieee80211_band band)
 {
         ht_info->cap = 0;
         memset(ht_info->supp_mcs_set, 0, 16);
 
         ht_info->ht_supported = 1;
 
-        if (mode == MODE_IEEE80211A) {
+        if (band == IEEE80211_BAND_5GHZ) {
                 ht_info->cap |= (u16)IEEE80211_HT_CAP_SUP_WIDTH;
                 ht_info->cap |= (u16)IEEE80211_HT_CAP_SGI_40;
                 ht_info->supp_mcs_set[4] = 0x01;
@@ -3890,12 +3545,13 @@ static void iwl4965_rx_reply_rx(struct iwl4965_priv *priv,
         u16 fc;
         struct ieee80211_rx_status stats = {
                 .mactime = le64_to_cpu(rx_start->timestamp),
-                .channel = le16_to_cpu(rx_start->channel),
-                .phymode =
+                .freq = ieee80211chan2mhz(le16_to_cpu(rx_start->channel)),
+                .band =
                         (rx_start->phy_flags & RX_RES_PHY_FLAGS_BAND_24_MSK) ?
-                        MODE_IEEE80211G : MODE_IEEE80211A,
+                        IEEE80211_BAND_2GHZ : IEEE80211_BAND_5GHZ,
                 .antenna = 0,
-                .rate = iwl4965_hw_get_rate(rx_start->rate_n_flags),
+                .rate_idx = iwl4965_rate_index_from_plcp(
+                                le32_to_cpu(rx_start->rate_n_flags)),
                 .flag = 0,
         };
         u8 network_packet;
@@ -3946,8 +3602,6 @@ static void iwl4965_rx_reply_rx(struct iwl4965_priv *priv,
 
         priv->ucode_beacon_time = le32_to_cpu(rx_start->beacon_time_stamp);
 
-        stats.freq = ieee80211chan2mhz(stats.channel);
-
         /* Find max signal strength (dBm) among 3 antenna/receiver chains */
         stats.ssi = iwl4965_calc_rssi(rx_start);
 
@@ -4167,24 +3821,6 @@ static void iwl4965_rx_missed_beacon_notif(struct iwl4965_priv *priv,
 }
 
 #ifdef CONFIG_IWL4965_HT
-#ifdef CONFIG_IWL4965_HT_AGG
-
-/**
- * iwl4965_set_tx_status - Update driver's record of one Tx frame's status
- *
- * This will get sent to mac80211.
- */
-static void iwl4965_set_tx_status(struct iwl4965_priv *priv, int txq_id, int idx,
-                                  u32 status, u32 retry_count, u32 rate)
-{
-        struct ieee80211_tx_status *tx_status =
-                &(priv->txq[txq_id].txb[idx].status);
-
-        tx_status->flags = status ? IEEE80211_TX_STATUS_ACK : 0;
-        tx_status->retry_count += retry_count;
-        tx_status->control.tx_rate = rate;
-}
-
 
 /**
  * iwl4965_sta_modify_enable_tid_tx - Enable Tx for this TID in station table
@@ -4204,7 +3840,6 @@ static void iwl4965_sta_modify_enable_tid_tx(struct iwl4965_priv *priv,
         iwl4965_send_add_station(priv, &priv->stations[sta_id].sta, CMD_ASYNC);
 }
 
-
 /**
  * iwl4965_tx_status_reply_compressed_ba - Update tx status from block-ack
  *
@@ -4218,10 +3853,11 @@ static int iwl4965_tx_status_reply_compressed_ba(struct iwl4965_priv *priv,
 
 {
         int i, sh, ack;
-        u16 ba_seq_ctl = le16_to_cpu(ba_resp->ba_seq_ctl);
-        u32 bitmap0, bitmap1;
-        u32 resp_bitmap0 = le32_to_cpu(ba_resp->ba_bitmap0);
-        u32 resp_bitmap1 = le32_to_cpu(ba_resp->ba_bitmap1);
+        u16 seq_ctl = le16_to_cpu(ba_resp->seq_ctl);
+        u16 scd_flow = le16_to_cpu(ba_resp->scd_flow);
+        u64 bitmap;
+        int successes = 0;
+        struct ieee80211_tx_status *tx_status;
 
         if (unlikely(!agg->wait_for_ba))  {
                 IWL_ERROR("Received BA when not expected\n");
@@ -4230,17 +3866,15 @@ static int iwl4965_tx_status_reply_compressed_ba(struct iwl4965_priv *priv,
 
         /* Mark that the expected block-ack response arrived */
         agg->wait_for_ba = 0;
-        IWL_DEBUG_TX_REPLY("BA %d %d\n", agg->start_idx, ba_resp->ba_seq_ctl);
+        IWL_DEBUG_TX_REPLY("BA %d %d\n", agg->start_idx, ba_resp->seq_ctl);
 
         /* Calculate shift to align block-ack bits with our Tx window bits */
-        sh = agg->start_idx - SEQ_TO_INDEX(ba_seq_ctl >> 4);
+        sh = agg->start_idx - SEQ_TO_INDEX(seq_ctl>>4);
         if (sh < 0) /* tbw something is wrong with indices */
                 sh += 0x100;
 
         /* don't use 64-bit values for now */
-        bitmap0 = resp_bitmap0 >> sh;
-        bitmap1 = resp_bitmap1 >> sh;
-        bitmap0 |= (resp_bitmap1 & ((1 << sh) | ((1 << sh) - 1))) << (32 - sh);
+        bitmap = le64_to_cpu(ba_resp->bitmap) >> sh;
 
         if (agg->frame_count > (64 - sh)) {
                 IWL_DEBUG_TX_REPLY("more frames than bitmap size");
@@ -4249,26 +3883,108 @@ static int iwl4965_tx_status_reply_compressed_ba(struct iwl4965_priv *priv,
 
         /* check for success or failure according to the
          * transmitted bitmap and block-ack bitmap */
-        bitmap0 &= agg->bitmap0;
-        bitmap1 &= agg->bitmap1;
+        bitmap &= agg->bitmap;
 
         /* For each frame attempted in aggregation,
          * update driver's record of tx frame's status. */
         for (i = 0; i < agg->frame_count ; i++) {
-                int idx = (agg->start_idx + i) & 0xff;
-                ack = bitmap0 & (1 << i);
+                ack = bitmap & (1 << i);
+                successes += !!ack;
                 IWL_DEBUG_TX_REPLY("%s ON i=%d idx=%d raw=%d\n",
-                        ack? "ACK":"NACK", i, idx, agg->start_idx + i);
-                iwl4965_set_tx_status(priv, agg->txq_id, idx, ack, 0,
-                        agg->rate_n_flags);
+                        ack? "ACK":"NACK", i, (agg->start_idx + i) & 0xff,
+                        agg->start_idx + i);
+        }
+
+        tx_status = &priv->txq[scd_flow].txb[agg->start_idx].status;
+        tx_status->flags = IEEE80211_TX_STATUS_ACK;
+        tx_status->flags |= IEEE80211_TX_STATUS_AMPDU;
+        tx_status->ampdu_ack_map = successes;
+        tx_status->ampdu_ack_len = agg->frame_count;
+        /* FIXME Wrong rate
+        tx_status->control.tx_rate = agg->rate_n_flags;
+        */
+
+        IWL_DEBUG_TX_REPLY("Bitmap %llx\n", bitmap);
+
+        return 0;
+}
+
+/**
+ * iwl4965_tx_queue_stop_scheduler - Stop queue, but keep configuration
+ */
+static void iwl4965_tx_queue_stop_scheduler(struct iwl4965_priv *priv,
+                                            u16 txq_id)
+{
+        /* Simply stop the queue, but don't change any configuration;
+         * the SCD_ACT_EN bit is the write-enable mask for the ACTIVE bit. */
+        iwl4965_write_prph(priv,
+                KDR_SCD_QUEUE_STATUS_BITS(txq_id),
+                (0 << SCD_QUEUE_STTS_REG_POS_ACTIVE)|
+                (1 << SCD_QUEUE_STTS_REG_POS_SCD_ACT_EN));
+}
 
+/**
+ * txq_id must be greater than IWL_BACK_QUEUE_FIRST_ID
+ */
+static int iwl4965_tx_queue_agg_disable(struct iwl4965_priv *priv, u16 txq_id,
+                                        u16 ssn_idx, u8 tx_fifo)
+{
+        if (IWL_BACK_QUEUE_FIRST_ID > txq_id) {
+                IWL_WARNING("queue number too small: %d, must be > %d\n",
+                                txq_id, IWL_BACK_QUEUE_FIRST_ID);
+                return -EINVAL;
         }
 
-        IWL_DEBUG_TX_REPLY("Bitmap %x%x\n", bitmap0, bitmap1);
+        iwl4965_tx_queue_stop_scheduler(priv, txq_id);
+
+        iwl4965_clear_bits_prph(priv, KDR_SCD_QUEUECHAIN_SEL, (1 << txq_id));
+
+        priv->txq[txq_id].q.read_ptr = (ssn_idx & 0xff);
+        priv->txq[txq_id].q.write_ptr = (ssn_idx & 0xff);
+        /* supposes that ssn_idx is valid (!= 0xFFF) */
+        iwl4965_set_wr_ptrs(priv, txq_id, ssn_idx);
+
+        iwl4965_clear_bits_prph(priv, KDR_SCD_INTERRUPT_MASK, (1 << txq_id));
+        iwl4965_txq_ctx_deactivate(priv, txq_id);
+        iwl4965_tx_queue_set_status(priv, &priv->txq[txq_id], tx_fifo, 0);
 
         return 0;
 }
 
+int iwl4965_check_empty_hw_queue(struct iwl4965_priv *priv, int sta_id,
+                                         u8 tid, int txq_id)
+{
+        struct iwl4965_queue *q = &priv->txq[txq_id].q;
+        u8 *addr = priv->stations[sta_id].sta.sta.addr;
+        struct iwl4965_tid_data *tid_data = &priv->stations[sta_id].tid[tid];
+
+        switch (priv->stations[sta_id].tid[tid].agg.state) {
+        case IWL_EMPTYING_HW_QUEUE_DELBA:
+                /* We are reclaiming the last packet of the */
+                /* aggregated HW queue */
+                if (txq_id  == tid_data->agg.txq_id &&
+                    q->read_ptr == q->write_ptr) {
+                        u16 ssn = SEQ_TO_SN(tid_data->seq_number);
+                        int tx_fifo = default_tid_to_tx_fifo[tid];
+                        IWL_DEBUG_HT("HW queue empty: continue DELBA flow\n");
+                        iwl4965_tx_queue_agg_disable(priv, txq_id,
+                                                     ssn, tx_fifo);
+                        tid_data->agg.state = IWL_AGG_OFF;
+                        ieee80211_stop_tx_ba_cb_irqsafe(priv->hw, addr, tid);
+                }
+                break;
+        case IWL_EMPTYING_HW_QUEUE_ADDBA:
+                /* We are reclaiming the last packet of the queue */
+                if (tid_data->tfds_in_queue == 0) {
+                        IWL_DEBUG_HT("HW queue empty: continue ADDBA flow\n");
+                        tid_data->agg.state = IWL_AGG_ON;
+                        ieee80211_start_tx_ba_cb_irqsafe(priv->hw, addr, tid);
+                }
+                break;
+        }
+        return 0;
+}
+
 /**
  * iwl4965_queue_dec_wrap - Decrement queue index, wrap back to end if needed
  * @index -- current index
@@ -4293,48 +4009,43 @@ static void iwl4965_rx_reply_compressed_ba(struct iwl4965_priv *priv,
         int index;
         struct iwl4965_tx_queue *txq = NULL;
         struct iwl4965_ht_agg *agg;
+        DECLARE_MAC_BUF(mac);
 
         /* "flow" corresponds to Tx queue */
-        u16 ba_resp_scd_flow = le16_to_cpu(ba_resp->scd_flow);
+        u16 scd_flow = le16_to_cpu(ba_resp->scd_flow);
 
         /* "ssn" is start of block-ack Tx window, corresponds to index
          * (in Tx queue's circular buffer) of first TFD/frame in window */
         u16 ba_resp_scd_ssn = le16_to_cpu(ba_resp->scd_ssn);
 
-        if (ba_resp_scd_flow >= ARRAY_SIZE(priv->txq)) {
+        if (scd_flow >= ARRAY_SIZE(priv->txq)) {
                 IWL_ERROR("BUG_ON scd_flow is bigger than number of queues");
                 return;
         }
 
-        txq = &priv->txq[ba_resp_scd_flow];
+        txq = &priv->txq[scd_flow];
         agg = &priv->stations[ba_resp->sta_id].tid[ba_resp->tid].agg;
 
         /* Find index just before block-ack window */
         index = iwl4965_queue_dec_wrap(ba_resp_scd_ssn & 0xff, txq->q.n_bd);
 
         /* TODO: Need to get this copy more safely - now good for debug */
-/*
-        {
-        DECLARE_MAC_BUF(mac);
+
         IWL_DEBUG_TX_REPLY("REPLY_COMPRESSED_BA [%d]Received from %s, "
                            "sta_id = %d\n",
                            agg->wait_for_ba,
                            print_mac(mac, (u8*) &ba_resp->sta_addr_lo32),
                            ba_resp->sta_id);
-        IWL_DEBUG_TX_REPLY("TID = %d, SeqCtl = %d, bitmap = 0x%X%X, scd_flow = "
+        IWL_DEBUG_TX_REPLY("TID = %d, SeqCtl = %d, bitmap = 0x%llx, scd_flow = "
                            "%d, scd_ssn = %d\n",
                            ba_resp->tid,
-                           ba_resp->ba_seq_ctl,
-                           ba_resp->ba_bitmap1,
-                           ba_resp->ba_bitmap0,
+                           ba_resp->seq_ctl,
+                           ba_resp->bitmap,
                            ba_resp->scd_flow,
                            ba_resp->scd_ssn);
-        IWL_DEBUG_TX_REPLY("DAT start_idx = %d, bitmap = 0x%X%X \n",
+        IWL_DEBUG_TX_REPLY("DAT start_idx = %d, bitmap = 0x%llx \n",
                            agg->start_idx,
-                           agg->bitmap1,
-                           agg->bitmap0);
-        }
-*/
+                           agg->bitmap);
 
         /* Update driver's record of ACK vs. not for each frame in window */
         iwl4965_tx_status_reply_compressed_ba(priv, agg, ba_resp);
@@ -4342,23 +4053,17 @@ static void iwl4965_rx_reply_compressed_ba(struct iwl4965_priv *priv,
         /* Release all TFDs before the SSN, i.e. all TFDs in front of
          * block-ack window (we assume that they've been successfully
          * transmitted ... if not, it's too late anyway). */
-        if (txq->q.read_ptr != (ba_resp_scd_ssn & 0xff))
-                iwl4965_tx_queue_reclaim(priv, ba_resp_scd_flow, index);
-
-}
-
-
-/**
- * iwl4965_tx_queue_stop_scheduler - Stop queue, but keep configuration
- */
-static void iwl4965_tx_queue_stop_scheduler(struct iwl4965_priv *priv, u16 txq_id)
-{
-        /* Simply stop the queue, but don't change any configuration;
-         * the SCD_ACT_EN bit is the write-enable mask for the ACTIVE bit. */
-        iwl4965_write_prph(priv,
-                KDR_SCD_QUEUE_STATUS_BITS(txq_id),
-                (0 << SCD_QUEUE_STTS_REG_POS_ACTIVE)|
-                (1 << SCD_QUEUE_STTS_REG_POS_SCD_ACT_EN));
+        if (txq->q.read_ptr != (ba_resp_scd_ssn & 0xff)) {
+                int freed = iwl4965_tx_queue_reclaim(priv, scd_flow, index);
+                priv->stations[ba_resp->sta_id].
+                        tid[ba_resp->tid].tfds_in_queue -= freed;
+                if (iwl4965_queue_space(&txq->q) > txq->q.low_mark &&
+                        priv->mac80211_registered &&
+                        agg->state != IWL_EMPTYING_HW_QUEUE_DELBA)
+                        ieee80211_wake_queue(priv->hw, scd_flow);
+                iwl4965_check_empty_hw_queue(priv, ba_resp->sta_id,
+                        ba_resp->tid, scd_flow);
+        }
 }
 
 /**
@@ -4388,6 +4093,7 @@ static int iwl4965_tx_queue_set_q2ratid(struct iwl4965_priv *priv, u16 ra_tid,
         return 0;
 }
 
+
 /**
  * iwl4965_tx_queue_agg_enable - Set up & enable aggregation for selected queue
  *
@@ -4455,48 +4161,6 @@ static int iwl4965_tx_queue_agg_enable(struct iwl4965_priv *priv, int txq_id,
         return 0;
 }
 
-/**
- * txq_id must be greater than IWL_BACK_QUEUE_FIRST_ID
- */
-static int iwl4965_tx_queue_agg_disable(struct iwl4965_priv *priv, u16 txq_id,
-                                        u16 ssn_idx, u8 tx_fifo)
-{
-        unsigned long flags;
-        int rc;
-
-        if (IWL_BACK_QUEUE_FIRST_ID > txq_id) {
-                IWL_WARNING("queue number too small: %d, must be > %d\n",
-                                txq_id, IWL_BACK_QUEUE_FIRST_ID);
-                return -EINVAL;
-        }
-
-        spin_lock_irqsave(&priv->lock, flags);
-        rc = iwl4965_grab_nic_access(priv);
-        if (rc) {
-                spin_unlock_irqrestore(&priv->lock, flags);
-                return rc;
-        }
-
-        iwl4965_tx_queue_stop_scheduler(priv, txq_id);
-
-        iwl4965_clear_bits_prph(priv, KDR_SCD_QUEUECHAIN_SEL, (1 << txq_id));
-
-        priv->txq[txq_id].q.read_ptr = (ssn_idx & 0xff);
-        priv->txq[txq_id].q.write_ptr = (ssn_idx & 0xff);
-        /* supposes that ssn_idx is valid (!= 0xFFF) */
-        iwl4965_set_wr_ptrs(priv, txq_id, ssn_idx);
-
-        iwl4965_clear_bits_prph(priv, KDR_SCD_INTERRUPT_MASK, (1 << txq_id));
-        iwl4965_txq_ctx_deactivate(priv, txq_id);
-        iwl4965_tx_queue_set_status(priv, &priv->txq[txq_id], tx_fifo, 0);
-
-        iwl4965_release_nic_access(priv);
-        spin_unlock_irqrestore(&priv->lock, flags);
-
-        return 0;
-}
-
-#endif/* CONFIG_IWL4965_HT_AGG */
 #endif /* CONFIG_IWL4965_HT */
 
 /**
@@ -4525,7 +4189,7 @@ void iwl4965_add_station(struct iwl4965_priv *priv, const u8 *addr, int is_ap)
          * all the way down to 1M in IEEE order, and then spin on 1M */
         if (is_ap)
                 r = IWL_RATE_54M_INDEX;
-        else if (priv->phymode == MODE_IEEE80211A)
+        else if (priv->band == IEEE80211_BAND_5GHZ)
                 r = IWL_RATE_6M_INDEX;
         else
                 r = IWL_RATE_1M_INDEX;
@@ -4558,12 +4222,13 @@ void iwl4965_add_station(struct iwl4965_priv *priv, const u8 *addr, int is_ap)
 
 #ifdef CONFIG_IWL4965_HT
 
-static u8 iwl4965_is_channel_extension(struct iwl4965_priv *priv, int phymode,
-                                   u16 channel, u8 extension_chan_offset)
+static u8 iwl4965_is_channel_extension(struct iwl4965_priv *priv,
+                                       enum ieee80211_band band,
+                                       u16 channel, u8 extension_chan_offset)
 {
         const struct iwl4965_channel_info *ch_info;
 
-        ch_info = iwl4965_get_channel_info(priv, phymode, channel);
+        ch_info = iwl4965_get_channel_info(priv, band, channel);
         if (!is_channel_valid(ch_info))
                 return 0;
 
@@ -4589,11 +4254,11 @@ static u8 iwl4965_is_fat_tx_allowed(struct iwl4965_priv *priv,
 
         if (sta_ht_inf) {
                 if ((!sta_ht_inf->ht_supported) ||
-                   (!sta_ht_inf->cap & IEEE80211_HT_CAP_SUP_WIDTH))
+                   (!(sta_ht_inf->cap & IEEE80211_HT_CAP_SUP_WIDTH)))
                         return 0;
         }
 
-        return (iwl4965_is_channel_extension(priv, priv->phymode,
+        return (iwl4965_is_channel_extension(priv, priv->band,
                                          iwl_ht_conf->control_channel,
                                          iwl_ht_conf->extension_chan_offset));
 }
@@ -4730,56 +4395,6 @@ static void iwl4965_sta_modify_del_ba_tid(struct iwl4965_priv *priv,
         iwl4965_send_add_station(priv, &priv->stations[sta_id].sta, CMD_ASYNC);
 }
 
-int iwl4965_mac_ampdu_action(struct ieee80211_hw *hw,
-                             enum ieee80211_ampdu_mlme_action action,
-                             const u8 *addr, u16 tid, u16 ssn)
-{
-        struct iwl4965_priv *priv = hw->priv;
-        int sta_id;
-        DECLARE_MAC_BUF(mac);
-
-        IWL_DEBUG_HT("A-MPDU action on da=%s tid=%d ",
-                        print_mac(mac, addr), tid);
-        sta_id = iwl4965_hw_find_station(priv, addr);
-        switch (action) {
-        case IEEE80211_AMPDU_RX_START:
-                IWL_DEBUG_HT("start Rx\n");
-                iwl4965_sta_modify_add_ba_tid(priv, sta_id, tid, ssn);
-                break;
-        case IEEE80211_AMPDU_RX_STOP:
-                IWL_DEBUG_HT("stop Rx\n");
-                iwl4965_sta_modify_del_ba_tid(priv, sta_id, tid);
-                break;
-        default:
-                IWL_DEBUG_HT("unknown\n");
-                return -EINVAL;
-                break;
-        }
-        return 0;
-}
-
-#ifdef CONFIG_IWL4965_HT_AGG
-
-static const u16 default_tid_to_tx_fifo[] = {
-        IWL_TX_FIFO_AC1,
-        IWL_TX_FIFO_AC0,
-        IWL_TX_FIFO_AC0,
-        IWL_TX_FIFO_AC1,
-        IWL_TX_FIFO_AC2,
-        IWL_TX_FIFO_AC2,
-        IWL_TX_FIFO_AC3,
-        IWL_TX_FIFO_AC3,
-        IWL_TX_FIFO_NONE,
-        IWL_TX_FIFO_NONE,
-        IWL_TX_FIFO_NONE,
-        IWL_TX_FIFO_NONE,
-        IWL_TX_FIFO_NONE,
-        IWL_TX_FIFO_NONE,
-        IWL_TX_FIFO_NONE,
-        IWL_TX_FIFO_NONE,
-        IWL_TX_FIFO_AC3
-};
-
 /*
  * Find first available (lowest unused) Tx Queue, mark it "active".
  * Called only when finding queue for aggregation.
@@ -4796,70 +4411,78 @@ static int iwl4965_txq_ctx_activate_free(struct iwl4965_priv *priv)
         return -1;
 }
 
-int iwl4965_mac_ht_tx_agg_start(struct ieee80211_hw *hw, u8 *da, u16 tid,
-                            u16 *start_seq_num)
+static int iwl4965_mac_ht_tx_agg_start(struct ieee80211_hw *hw, const u8 *da,
+                                       u16 tid, u16 *start_seq_num)
 {
-
         struct iwl4965_priv *priv = hw->priv;
         int sta_id;
         int tx_fifo;
         int txq_id;
         int ssn = -1;
+        int rc = 0;
         unsigned long flags;
         struct iwl4965_tid_data *tid_data;
         DECLARE_MAC_BUF(mac);
 
-        /* Determine Tx DMA/FIFO channel for this Traffic ID */
         if (likely(tid < ARRAY_SIZE(default_tid_to_tx_fifo)))
                 tx_fifo = default_tid_to_tx_fifo[tid];
         else
                 return -EINVAL;
 
-        IWL_WARNING("iwl-AGG iwl4965_mac_ht_tx_agg_start on da=%s"
-                    " tid=%d\n", print_mac(mac, da), tid);
+        IWL_WARNING("%s on da = %s tid = %d\n",
+                        __func__, print_mac(mac, da), tid);
 
-        /* Get index into station table */
         sta_id = iwl4965_hw_find_station(priv, da);
         if (sta_id == IWL_INVALID_STATION)
                 return -ENXIO;
 
-        /* Find available Tx queue for aggregation */
+        if (priv->stations[sta_id].tid[tid].agg.state != IWL_AGG_OFF) {
+                IWL_ERROR("Start AGG when state is not IWL_AGG_OFF !\n");
+                return -ENXIO;
+        }
+
         txq_id = iwl4965_txq_ctx_activate_free(priv);
         if (txq_id == -1)
                 return -ENXIO;
 
         spin_lock_irqsave(&priv->sta_lock, flags);
         tid_data = &priv->stations[sta_id].tid[tid];
-
-        /* Get starting sequence number for 1st frame in block ack window.
-         * We'll use least signif byte as 1st frame's index into Tx queue. */
         ssn = SEQ_TO_SN(tid_data->seq_number);
         tid_data->agg.txq_id = txq_id;
         spin_unlock_irqrestore(&priv->sta_lock, flags);
 
         *start_seq_num = ssn;
-
-        /* Update driver's link quality manager */
-        iwl4965_ba_status(priv, tid, BA_STATUS_ACTIVE);
-
-        /* Set up and enable aggregation for selected Tx queue and FIFO */
-        return iwl4965_tx_queue_agg_enable(priv, txq_id, tx_fifo,
+        rc = iwl4965_tx_queue_agg_enable(priv, txq_id, tx_fifo,
                                            sta_id, tid, ssn);
-}
+        if (rc)
+                return rc;
 
+        rc = 0;
+        if (tid_data->tfds_in_queue == 0) {
+                printk(KERN_ERR "HW queue is empty\n");
+                tid_data->agg.state = IWL_AGG_ON;
+                ieee80211_start_tx_ba_cb_irqsafe(hw, da, tid);
+        } else {
+                IWL_DEBUG_HT("HW queue is NOT empty: %d packets in HW queue\n",
+                                tid_data->tfds_in_queue);
+                tid_data->agg.state = IWL_EMPTYING_HW_QUEUE_ADDBA;
+        }
+        return rc;
+}
 
-int iwl4965_mac_ht_tx_agg_stop(struct ieee80211_hw *hw, u8 *da, u16 tid,
-                           int generator)
+static int iwl4965_mac_ht_tx_agg_stop(struct ieee80211_hw *hw, const u8 *da,
+                                      u16 tid)
 {
 
         struct iwl4965_priv *priv = hw->priv;
         int tx_fifo_id, txq_id, sta_id, ssn = -1;
         struct iwl4965_tid_data *tid_data;
-        int rc;
+        int rc, write_ptr, read_ptr;
+        unsigned long flags;
         DECLARE_MAC_BUF(mac);
 
         if (!da) {
-                IWL_ERROR("%s: da = NULL\n", __func__);
+                IWL_ERROR("da = NULL\n");
                 return -EINVAL;
         }
 
@@ -4873,24 +4496,81 @@ int iwl4965_mac_ht_tx_agg_stop(struct ieee80211_hw *hw, u8 *da, u16 tid,
         if (sta_id == IWL_INVALID_STATION)
                 return -ENXIO;
 
+        if (priv->stations[sta_id].tid[tid].agg.state != IWL_AGG_ON)
+                IWL_WARNING("Stopping AGG while state not IWL_AGG_ON\n");
+
         tid_data = &priv->stations[sta_id].tid[tid];
         ssn = (tid_data->seq_number & IEEE80211_SCTL_SEQ) >> 4;
         txq_id = tid_data->agg.txq_id;
+        write_ptr = priv->txq[txq_id].q.write_ptr;
+        read_ptr = priv->txq[txq_id].q.read_ptr;
+
+        /* The queue is not empty */
+        if (write_ptr != read_ptr) {
+                IWL_DEBUG_HT("Stopping a non empty AGG HW QUEUE\n");
+                priv->stations[sta_id].tid[tid].agg.state =
+                                IWL_EMPTYING_HW_QUEUE_DELBA;
+                return 0;
+        }
+
+        IWL_DEBUG_HT("HW queue empty\n");;
+        priv->stations[sta_id].tid[tid].agg.state = IWL_AGG_OFF;
 
+        spin_lock_irqsave(&priv->lock, flags);
+        rc = iwl4965_grab_nic_access(priv);
+        if (rc) {
+                spin_unlock_irqrestore(&priv->lock, flags);
+                return rc;
+        }
         rc = iwl4965_tx_queue_agg_disable(priv, txq_id, ssn, tx_fifo_id);
-        /* FIXME: need more safe way to handle error condition */
+        iwl4965_release_nic_access(priv);
+        spin_unlock_irqrestore(&priv->lock, flags);
+
         if (rc)
                 return rc;
 
-        iwl4965_ba_status(priv, tid, BA_STATUS_INITIATOR_DELBA);
+        ieee80211_stop_tx_ba_cb_irqsafe(priv->hw, da, tid);
+
         IWL_DEBUG_INFO("iwl4965_mac_ht_tx_agg_stop on da=%s tid=%d\n",
-                       print_mac(mac, da), tid);
+                        print_mac(mac, da), tid);
 
         return 0;
 }
 
+int iwl4965_mac_ampdu_action(struct ieee80211_hw *hw,
+                             enum ieee80211_ampdu_mlme_action action,
+                             const u8 *addr, u16 tid, u16 *ssn)
+{
+        struct iwl4965_priv *priv = hw->priv;
+        int sta_id;
+        DECLARE_MAC_BUF(mac);
+
+        IWL_DEBUG_HT("A-MPDU action on da=%s tid=%d ",
+                        print_mac(mac, addr), tid);
+        sta_id = iwl4965_hw_find_station(priv, addr);
+        switch (action) {
+        case IEEE80211_AMPDU_RX_START:
+                IWL_DEBUG_HT("start Rx\n");
+                iwl4965_sta_modify_add_ba_tid(priv, sta_id, tid, *ssn);
+                break;
+        case IEEE80211_AMPDU_RX_STOP:
+                IWL_DEBUG_HT("stop Rx\n");
+                iwl4965_sta_modify_del_ba_tid(priv, sta_id, tid);
+                break;
+        case IEEE80211_AMPDU_TX_START:
+                IWL_DEBUG_HT("start Tx\n");
+                return iwl4965_mac_ht_tx_agg_start(hw, addr, tid, ssn);
+        case IEEE80211_AMPDU_TX_STOP:
+                IWL_DEBUG_HT("stop Tx\n");
+                return iwl4965_mac_ht_tx_agg_stop(hw, addr, tid);
+        default:
+                IWL_DEBUG_HT("unknown\n");
+                return -EINVAL;
+                break;
+        }
+        return 0;
+}
 
-#endif /* CONFIG_IWL4965_HT_AGG */
 #endif /* CONFIG_IWL4965_HT */
 
 /* Set up 4965-specific Rx frame reply handlers */
@@ -4907,9 +4587,7 @@ void iwl4965_hw_rx_handler_setup(struct iwl4965_priv *priv)
             iwl4965_rx_missed_beacon_notif;
 
 #ifdef CONFIG_IWL4965_HT
-#ifdef CONFIG_IWL4965_HT_AGG
         priv->rx_handlers[REPLY_COMPRESSED_BA] = iwl4965_rx_reply_compressed_ba;
-#endif /* CONFIG_IWL4965_HT_AGG */
 #endif /* CONFIG_IWL4965_HT */
 }
 
@@ -4920,11 +4598,6 @@ void iwl4965_hw_setup_deferred_work(struct iwl4965_priv *priv)
 #ifdef CONFIG_IWL4965_SENSITIVITY
         INIT_WORK(&priv->sensitivity_work, iwl4965_bg_sensitivity_work);
 #endif
-#ifdef CONFIG_IWL4965_HT
-#ifdef CONFIG_IWL4965_HT_AGG
-        INIT_WORK(&priv->agg_work, iwl4965_bg_agg_work);
-#endif /* CONFIG_IWL4965_HT_AGG */
-#endif /* CONFIG_IWL4965_HT */
         init_timer(&priv->statistics_periodic);
         priv->statistics_periodic.data = (unsigned long)priv;
         priv->statistics_periodic.function = iwl4965_bg_statistics_periodic;
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965.h b/drivers/net/wireless/iwlwifi/iwl-4965.h
index 9cb82be0ff80..ce17e4fec838 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965.h
+++ b/drivers/net/wireless/iwlwifi/iwl-4965.h
@@ -206,7 +206,7 @@ struct iwl4965_channel_info {
 
         u8 group_index;   /* 0-4, maps channel to group1/2/3/4/5 */
         u8 band_index;    /* 0-4, maps channel to band1/2/3/4/5 */
-        u8 phymode;       /* MODE_IEEE80211{A,B,G} */
+        enum ieee80211_band band;
 
         /* Radio/DSP gain settings for each "normal" data Tx rate.
          * These include, in addition to RF and DSP gain, a few fields for
@@ -433,7 +433,6 @@ struct iwl4965_rx_queue {
 #define IWL_INVALID_VALUE    -1
 
 #ifdef CONFIG_IWL4965_HT
-#ifdef CONFIG_IWL4965_HT_AGG
 /**
  * struct iwl4965_ht_agg -- aggregation status while waiting for block-ack
  * @txq_id: Tx queue used for Tx attempt
@@ -453,19 +452,22 @@ struct iwl4965_ht_agg {
         u16 frame_count;
         u16 wait_for_ba;
         u16 start_idx;
-        u32 bitmap0;
-        u32 bitmap1;
+        u64 bitmap;
         u32 rate_n_flags;
+#define IWL_AGG_OFF 0
+#define IWL_AGG_ON 1
+#define IWL_EMPTYING_HW_QUEUE_ADDBA 2
+#define IWL_EMPTYING_HW_QUEUE_DELBA 3
+        u8 state;
 };
-#endif /* CONFIG_IWL4965_HT_AGG */
+
 #endif /* CONFIG_IWL4965_HT */
 
 struct iwl4965_tid_data {
         u16 seq_number;
+        u16 tfds_in_queue;
 #ifdef CONFIG_IWL4965_HT
-#ifdef CONFIG_IWL4965_HT_AGG
         struct iwl4965_ht_agg agg;
-#endif  /* CONFIG_IWL4965_HT_AGG */
 #endif /* CONFIG_IWL4965_HT */
 };
 
@@ -508,8 +510,6 @@ struct iwl_ht_info {
 };
 #endif                          /*CONFIG_IWL4965_HT */
 
-#ifdef CONFIG_IWL4965_QOS
-
 union iwl4965_qos_capabity {
         struct {
                 u8 edca_count:4;        /* bit 0-3 */
@@ -537,7 +537,6 @@ struct iwl4965_qos_info {
         union iwl4965_qos_capabity qos_cap;
         struct iwl4965_qosparam_cmd def_qos_parm;
 };
-#endif /*CONFIG_IWL4965_QOS */
 
 #define STA_PS_STATUS_WAKE             0
 #define STA_PS_STATUS_SLEEP            1
@@ -581,8 +580,8 @@ struct iwl4965_ibss_seq {
 /**
  * struct iwl4965_driver_hw_info
  * @max_txq_num: Max # Tx queues supported
- * @ac_queue_count: # Tx queues for EDCA Access Categories (AC)
  * @tx_cmd_len: Size of Tx command (but not including frame itself)
+ * @tx_ant_num: Number of TX antennas
  * @max_rxq_size: Max # Rx frames in Rx queue (must be power-of-2)
  * @rx_buffer_size:
  * @max_rxq_log: Log-base-2 of max_rxq_size
@@ -593,8 +592,8 @@ struct iwl4965_ibss_seq {
  */
 struct iwl4965_driver_hw_info {
         u16 max_txq_num;
-        u16 ac_queue_count;
         u16 tx_cmd_len;
+        u16 tx_ant_num;
         u16 max_rxq_size;
         u32 rx_buf_size;
         u32 max_pkt_size;
@@ -743,7 +742,7 @@ extern u8 iwl4965_hw_find_station(struct iwl4965_priv *priv, const u8 *bssid);
 
 extern int iwl4965_hw_channel_switch(struct iwl4965_priv *priv, u16 channel);
 extern int iwl4965_tx_queue_reclaim(struct iwl4965_priv *priv, int txq_id, int index);
-
+extern int iwl4965_queue_space(const struct iwl4965_queue *q);
 struct iwl4965_priv;
 
 /*
@@ -762,31 +761,29 @@ extern void iwl4965_update_rate_scaling(struct iwl4965_priv *priv, u8 mode);
 extern void iwl4965_chain_noise_reset(struct iwl4965_priv *priv);
 extern void iwl4965_init_sensitivity(struct iwl4965_priv *priv, u8 flags,
                                      u8 force);
-extern int iwl4965_set_fat_chan_info(struct iwl4965_priv *priv, int phymode,
+extern int iwl4965_set_fat_chan_info(struct iwl4965_priv *priv,
+                                enum ieee80211_band band,
                                 u16 channel,
                                 const struct iwl4965_eeprom_channel *eeprom_ch,
                                 u8 fat_extension_channel);
 extern void iwl4965_rf_kill_ct_config(struct iwl4965_priv *priv);
 
 #ifdef CONFIG_IWL4965_HT
-extern void iwl4965_init_ht_hw_capab(struct ieee80211_ht_info *ht_info,
-                                        int mode);
-extern void iwl4965_set_rxon_ht(struct iwl4965_priv *priv,
-                                struct iwl_ht_info *ht_info);
-extern void iwl4965_set_ht_add_station(struct iwl4965_priv *priv, u8 index,
+void iwl4965_init_ht_hw_capab(struct ieee80211_ht_info *ht_info,
+                              enum ieee80211_band band);
+void iwl4965_set_rxon_ht(struct iwl4965_priv *priv,
+                         struct iwl_ht_info *ht_info);
+void iwl4965_set_ht_add_station(struct iwl4965_priv *priv, u8 index,
                                 struct ieee80211_ht_info *sta_ht_inf);
-extern int iwl4965_mac_ampdu_action(struct ieee80211_hw *hw,
+int iwl4965_mac_ampdu_action(struct ieee80211_hw *hw,
                                     enum ieee80211_ampdu_mlme_action action,
-                                    const u8 *addr, u16 tid, u16 ssn);
-#ifdef CONFIG_IWL4965_HT_AGG
-extern int iwl4965_mac_ht_tx_agg_start(struct ieee80211_hw *hw, u8 *da,
-                                   u16 tid, u16 *start_seq_num);
-extern int iwl4965_mac_ht_tx_agg_stop(struct ieee80211_hw *hw, u8 *da,
-                                  u16 tid, int generator);
-extern void iwl4965_turn_off_agg(struct iwl4965_priv *priv, u8 tid);
-extern void iwl4965_tl_get_stats(struct iwl4965_priv *priv,
-                                struct ieee80211_hdr *hdr);
-#endif /* CONFIG_IWL4965_HT_AGG */
+                                    const u8 *addr, u16 tid, u16 *ssn);
+int iwl4965_check_empty_hw_queue(struct iwl4965_priv *priv, int sta_id,
+                                        u8 tid, int txq_id);
+#else
+static inline void iwl4965_init_ht_hw_capab(struct ieee80211_ht_info *ht_info,
+                                            enum ieee80211_band band) {}
+
 #endif /*CONFIG_IWL4965_HT */
 /* Structures, enum, and defines specific to the 4965 */
 
@@ -798,18 +795,6 @@ struct iwl4965_kw {
         size_t size;
 };
 
-#define TID_QUEUE_CELL_SPACING 50       /*mS */
-#define TID_QUEUE_MAX_SIZE     20
-#define TID_ROUND_VALUE        5        /* mS */
-#define TID_MAX_LOAD_COUNT     8
-
-#define TID_MAX_TIME_DIFF ((TID_QUEUE_MAX_SIZE - 1) * TID_QUEUE_CELL_SPACING)
-#define TIME_WRAP_AROUND(x, y) (((y) > (x)) ? (y) - (x) : (0-(x)) + (y))
-
-#define TID_ALL_ENABLED         0x7f
-#define TID_ALL_SPECIFIED       0xff
-#define TID_AGG_TPT_THREHOLD    0x0
-
 #define IWL_CHANNEL_WIDTH_20MHZ   0
 #define IWL_CHANNEL_WIDTH_40MHZ   1
 
@@ -834,37 +819,7 @@ struct iwl4965_kw {
 
 #define TX_POWER_IWL_ILLEGAL_VOLTAGE -10000
 
-struct iwl4965_traffic_load {
-        unsigned long time_stamp;
-        u32 packet_count[TID_QUEUE_MAX_SIZE];
-        u8 queue_count;
-        u8 head;
-        u32 total;
-};
-
-#ifdef CONFIG_IWL4965_HT_AGG
-/**
- * struct iwl4965_agg_control
- * @requested_ba: bit map of tids requesting aggregation/block-ack
- * @granted_ba: bit map of tids granted aggregation/block-ack
- */
-struct iwl4965_agg_control {
-        unsigned long next_retry;
-        u32 wait_for_agg_status;
-        u32 tid_retry;
-        u32 requested_ba;
-        u32 granted_ba;
-        u8 auto_agg;
-        u32 tid_traffic_load_threshold;
-        u32 ba_timeout;
-        struct iwl4965_traffic_load traffic_load[TID_MAX_LOAD_COUNT];
-};
-#endif                          /*CONFIG_IWL4965_HT_AGG */
-
 struct iwl4965_lq_mngr {
-#ifdef CONFIG_IWL4965_HT_AGG
-        struct iwl4965_agg_control agg_ctrl;
-#endif
         spinlock_t lock;
         s32 max_window_size;
         s32 *expected_tpt;
@@ -877,7 +832,6 @@ struct iwl4965_lq_mngr {
         u8 lq_ready;
 };
 
-
 /* Sensitivity and chain noise calibration */
 #define INTERFERENCE_DATA_AVAILABLE     __constant_cpu_to_le32(1)
 #define INITIALIZATION_VALUE            0xFFFF
@@ -1025,14 +979,14 @@ struct iwl4965_priv {
         struct list_head free_frames;
         int frames_count;
 
-        u8 phymode;
+        enum ieee80211_band band;
         int alloc_rxb_skb;
         bool add_radiotap;
 
         void (*rx_handlers[REPLY_MAX])(struct iwl4965_priv *priv,
                                        struct iwl4965_rx_mem_buffer *rxb);
 
-        const struct ieee80211_hw_mode *modes;
+        struct ieee80211_supported_band bands[IEEE80211_NUM_BANDS];
 
 #ifdef CONFIG_IWL4965_SPECTRUM_MEASUREMENT
         /* spectrum measurement report caching */
@@ -1216,9 +1170,7 @@ struct iwl4965_priv {
         u16 assoc_capability;
         u8 ps_mode;
 
-#ifdef CONFIG_IWL4965_QOS
         struct iwl4965_qos_info qos_data;
-#endif /*CONFIG_IWL4965_QOS */
 
         struct workqueue_struct *workqueue;
 
@@ -1265,11 +1217,7 @@ struct iwl4965_priv {
 #endif
         struct work_struct statistics_work;
         struct timer_list statistics_periodic;
-
-#ifdef CONFIG_IWL4965_HT_AGG
-        struct work_struct agg_work;
-#endif
-};                              /*iwl4965_priv */
+}; /*iwl4965_priv */
 
 static inline int iwl4965_is_associated(struct iwl4965_priv *priv)
 {
@@ -1295,13 +1243,12 @@ static inline int is_channel_radar(const struct iwl4965_channel_info *ch_info)
 
 static inline u8 is_channel_a_band(const struct iwl4965_channel_info *ch_info)
 {
-        return ch_info->phymode == MODE_IEEE80211A;
+        return ch_info->band == IEEE80211_BAND_5GHZ;
 }
 
 static inline u8 is_channel_bg_band(const struct iwl4965_channel_info *ch_info)
 {
-        return ((ch_info->phymode == MODE_IEEE80211B) ||
-                (ch_info->phymode == MODE_IEEE80211G));
+        return ch_info->band == IEEE80211_BAND_2GHZ;
 }
 
 static inline int is_channel_passive(const struct iwl4965_channel_info *ch)
@@ -1315,7 +1262,7 @@ static inline int is_channel_ibss(const struct iwl4965_channel_info *ch)
 }
 
 extern const struct iwl4965_channel_info *iwl4965_get_channel_info(
-        const struct iwl4965_priv *priv, int phymode, u16 channel);
+        const struct iwl4965_priv *priv, enum ieee80211_band band, u16 channel);
 
 /* Requires full declaration of iwl4965_priv before including */
 #include "iwl-4965-io.h"
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index 40b71bc2c4a4..0fab832ce8c2 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -91,7 +91,7 @@ int iwl3945_param_queues_num = IWL_MAX_NUM_QUEUES; /* def: 8 Tx queues */
 #define VS
 #endif
 
-#define IWLWIFI_VERSION "1.2.23k" VD VS
+#define IWLWIFI_VERSION "1.2.26k" VD VS
 #define DRV_COPYRIGHT   "Copyright(c) 2003-2007 Intel Corporation"
 #define DRV_VERSION     IWLWIFI_VERSION
 
@@ -116,16 +116,10 @@ static __le16 *ieee80211_get_qos_ctrl(struct ieee80211_hdr *hdr)
         return NULL;
 }
 
-static const struct ieee80211_hw_mode *iwl3945_get_hw_mode(
-                struct iwl3945_priv *priv, int mode)
+static const struct ieee80211_supported_band *iwl3945_get_band(
+                struct iwl3945_priv *priv, enum ieee80211_band band)
 {
-        int i;
-
-        for (i = 0; i < 3; i++)
-                if (priv->modes[i].mode == mode)
-                        return &priv->modes[i];
-
-        return NULL;
+        return priv->hw->wiphy->bands[band];
 }
 
 static int iwl3945_is_empty_essid(const char *essid, int essid_len)
@@ -547,7 +541,7 @@ u8 iwl3945_add_station(struct iwl3945_priv *priv, const u8 *addr, int is_ap, u8
         station->sta.sta.sta_id = index;
         station->sta.station_flags = 0;
 
-        if (priv->phymode == MODE_IEEE80211A)
+        if (priv->band == IEEE80211_BAND_5GHZ)
                 rate = IWL_RATE_6M_PLCP;
         else
                 rate =  IWL_RATE_1M_PLCP;
@@ -894,35 +888,37 @@ int iwl3945_send_statistics_request(struct iwl3945_priv *priv)
 
 /**
  * iwl3945_set_rxon_channel - Set the phymode and channel values in staging RXON
- * @phymode: MODE_IEEE80211A sets to 5.2GHz; all else set to 2.4GHz
- * @channel: Any channel valid for the requested phymode
+ * @band: 2.4 or 5 GHz band
+ * @channel: Any channel valid for the requested band
 
- * In addition to setting the staging RXON, priv->phymode is also set.
+ * In addition to setting the staging RXON, priv->band is also set.
  *
  * NOTE:  Does not commit to the hardware; it sets appropriate bit fields
- * in the staging RXON flag structure based on the phymode
+ * in the staging RXON flag structure based on the band
  */
-static int iwl3945_set_rxon_channel(struct iwl3945_priv *priv, u8 phymode, u16 channel)
+static int iwl3945_set_rxon_channel(struct iwl3945_priv *priv,
+                                    enum ieee80211_band band,
+                                    u16 channel)
 {
-        if (!iwl3945_get_channel_info(priv, phymode, channel)) {
+        if (!iwl3945_get_channel_info(priv, band, channel)) {
                 IWL_DEBUG_INFO("Could not set channel to %d [%d]\n",
-                               channel, phymode);
+                               channel, band);
                 return -EINVAL;
         }
 
         if ((le16_to_cpu(priv->staging_rxon.channel) == channel) &&
-            (priv->phymode == phymode))
+            (priv->band == band))
                 return 0;
 
         priv->staging_rxon.channel = cpu_to_le16(channel);
-        if (phymode == MODE_IEEE80211A)
+        if (band == IEEE80211_BAND_5GHZ)
                 priv->staging_rxon.flags &= ~RXON_FLG_BAND_24G_MSK;
         else
                 priv->staging_rxon.flags |= RXON_FLG_BAND_24G_MSK;
 
-        priv->phymode = phymode;
+        priv->band = band;
 
-        IWL_DEBUG_INFO("Staging channel set to %d [%d]\n", channel, phymode);
+        IWL_DEBUG_INFO("Staging channel set to %d [%d]\n", channel, band);
 
         return 0;
 }
@@ -1210,8 +1206,7 @@ static int iwl3945_commit_rxon(struct iwl3945_priv *priv)
                         return -EIO;
                 }
 
-        /* Init the hardware's rate fallback order based on the
-         * phymode */
+        /* Init the hardware's rate fallback order based on the band */
         rc = iwl3945_init_hw_rate_table(priv);
         if (rc) {
                 IWL_ERROR("Error setting HW rate table: %02X\n", rc);
@@ -1915,7 +1910,6 @@ static u16 iwl3945_fill_probe_req(struct iwl3945_priv *priv,
 /*
  * QoS  support
 */
-#ifdef CONFIG_IWL3945_QOS
 static int iwl3945_send_qos_params_command(struct iwl3945_priv *priv,
                                        struct iwl3945_qosparam_cmd *qos)
 {
@@ -2044,7 +2038,6 @@ static void iwl3945_activate_qos(struct iwl3945_priv *priv, u8 force)
         }
 }
 
-#endif /* CONFIG_IWL3945_QOS */
 /*
  * Power management (not Tx power!) functions
  */
@@ -2461,9 +2454,10 @@ static int iwl3945_set_rxon_hwcrypto(struct iwl3945_priv *priv, int hw_decrypt)
         return 0;
 }
 
-static void iwl3945_set_flags_for_phymode(struct iwl3945_priv *priv, u8 phymode)
+static void iwl3945_set_flags_for_phymode(struct iwl3945_priv *priv,
+                                          enum ieee80211_band band)
 {
-        if (phymode == MODE_IEEE80211A) {
+        if (band == IEEE80211_BAND_5GHZ) {
                 priv->staging_rxon.flags &=
                     ~(RXON_FLG_BAND_24G_MSK | RXON_FLG_AUTO_DETECT_MSK
                       | RXON_FLG_CCK_MSK);
@@ -2526,7 +2520,7 @@ static void iwl3945_connection_init_rx_config(struct iwl3945_priv *priv)
                 priv->staging_rxon.flags |= RXON_FLG_SHORT_PREAMBLE_MSK;
 #endif
 
-        ch_info = iwl3945_get_channel_info(priv, priv->phymode,
+        ch_info = iwl3945_get_channel_info(priv, priv->band,
                                        le16_to_cpu(priv->staging_rxon.channel));
 
         if (!ch_info)
@@ -2542,11 +2536,11 @@ static void iwl3945_connection_init_rx_config(struct iwl3945_priv *priv)
 
         priv->staging_rxon.channel = cpu_to_le16(ch_info->channel);
         if (is_channel_a_band(ch_info))
-                priv->phymode = MODE_IEEE80211A;
+                priv->band = IEEE80211_BAND_5GHZ;
         else
-                priv->phymode = MODE_IEEE80211G;
+                priv->band = IEEE80211_BAND_2GHZ;
 
-        iwl3945_set_flags_for_phymode(priv, priv->phymode);
+        iwl3945_set_flags_for_phymode(priv, priv->band);
 
         priv->staging_rxon.ofdm_basic_rates =
             (IWL_OFDM_RATES_MASK >> IWL_FIRST_OFDM_RATE) & 0xFF;
@@ -2560,7 +2554,7 @@ static int iwl3945_set_mode(struct iwl3945_priv *priv, int mode)
                 const struct iwl3945_channel_info *ch_info;
 
                 ch_info = iwl3945_get_channel_info(priv,
-                        priv->phymode,
+                        priv->band,
                         le16_to_cpu(priv->staging_rxon.channel));
 
                 if (!ch_info || !is_channel_ibss(ch_info)) {
@@ -2792,7 +2786,7 @@ static int iwl3945_tx_skb(struct iwl3945_priv *priv,
                 goto drop_unlock;
         }
 
-        if ((ctl->tx_rate & 0xFF) == IWL_INVALID_RATE) {
+        if ((ctl->tx_rate->hw_value & 0xFF) == IWL_INVALID_RATE) {
                 IWL_ERROR("ERROR: No TX rate available.\n");
                 goto drop_unlock;
         }
@@ -2992,12 +2986,12 @@ drop:
 
 static void iwl3945_set_rate(struct iwl3945_priv *priv)
 {
-        const struct ieee80211_hw_mode *hw = NULL;
+        const struct ieee80211_supported_band *sband = NULL;
         struct ieee80211_rate *rate;
         int i;
 
-        hw = iwl3945_get_hw_mode(priv, priv->phymode);
-        if (!hw) {
+        sband = iwl3945_get_band(priv, priv->band);
+        if (!sband) {
                 IWL_ERROR("Failed to set rate: unable to get hw mode\n");
                 return;
         }
@@ -3005,24 +2999,17 @@ static void iwl3945_set_rate(struct iwl3945_priv *priv)
         priv->active_rate = 0;
         priv->active_rate_basic = 0;
 
-        IWL_DEBUG_RATE("Setting rates for 802.11%c\n",
-                       hw->mode == MODE_IEEE80211A ?
-                       'a' : ((hw->mode == MODE_IEEE80211B) ? 'b' : 'g'));
-
-        for (i = 0; i < hw->num_rates; i++) {
-                rate = &(hw->rates[i]);
-                if ((rate->val < IWL_RATE_COUNT) &&
-                    (rate->flags & IEEE80211_RATE_SUPPORTED)) {
-                        IWL_DEBUG_RATE("Adding rate index %d (plcp %d)%s\n",
-                                       rate->val, iwl3945_rates[rate->val].plcp,
-                                       (rate->flags & IEEE80211_RATE_BASIC) ?
-                                       "*" : "");
-                        priv->active_rate |= (1 << rate->val);
-                        if (rate->flags & IEEE80211_RATE_BASIC)
-                                priv->active_rate_basic |= (1 << rate->val);
-                } else
-                        IWL_DEBUG_RATE("Not adding rate %d (plcp %d)\n",
-                                       rate->val, iwl3945_rates[rate->val].plcp);
+        IWL_DEBUG_RATE("Setting rates for %s GHz\n",
+                       sband->band == IEEE80211_BAND_2GHZ ? "2.4" : "5");
+
+        for (i = 0; i < sband->n_bitrates; i++) {
+                rate = &sband->bitrates[i];
+                if ((rate->hw_value < IWL_RATE_COUNT) &&
+                    !(rate->flags & IEEE80211_CHAN_DISABLED)) {
+                        IWL_DEBUG_RATE("Adding rate index %d (plcp %d)\n",
+                                       rate->hw_value, iwl3945_rates[rate->hw_value].plcp);
+                        priv->active_rate |= (1 << rate->hw_value);
+                }
         }
 
         IWL_DEBUG_RATE("Set active_rate = %0x, active_rate_basic = %0x\n",
@@ -3436,8 +3423,6 @@ static void iwl3945_rx_reply_tx(struct iwl3945_priv *priv,
         tx_status->flags =
             iwl3945_is_tx_success(status) ? IEEE80211_TX_STATUS_ACK : 0;
 
-        tx_status->control.tx_rate = iwl3945_rate_index_from_plcp(tx_resp->rate);
-
         IWL_DEBUG_TX("Tx queue %d Status %s (0x%08x) plcp rate %d retries %d\n",
                         txq_id, iwl3945_get_tx_fail_reason(status), status,
                         tx_resp->rate, tx_resp->failure_frame);
@@ -4792,7 +4777,7 @@ static void iwl3945_irq_tasklet(struct iwl3945_priv *priv)
                 /* Queue restart only if RF_KILL switch was set to "kill"
                  *   when we loaded driver, and is now set to "enable".
                  * After we're Alive, RF_KILL gets handled by
-                 *   iwl_rx_card_state_notif() */
+                 *   iwl3945_rx_card_state_notif() */
                 if (!hw_rf_kill && !test_bit(STATUS_ALIVE, &priv->status)) {
                         clear_bit(STATUS_RF_KILL_HW, &priv->status);
                         queue_work(priv->workqueue, &priv->restart);
@@ -5026,24 +5011,24 @@ static void iwl3945_init_band_reference(const struct iwl3945_priv *priv, int ban
  * Based on band and channel number.
  */
 const struct iwl3945_channel_info *iwl3945_get_channel_info(const struct iwl3945_priv *priv,
-                                                    int phymode, u16 channel)
+                                                    enum ieee80211_band band, u16 channel)
 {
         int i;
 
-        switch (phymode) {
-        case MODE_IEEE80211A:
+        switch (band) {
+        case IEEE80211_BAND_5GHZ:
                 for (i = 14; i < priv->channel_count; i++) {
                         if (priv->channel_info[i].channel == channel)
                                 return &priv->channel_info[i];
                 }
                 break;
 
-        case MODE_IEEE80211B:
-        case MODE_IEEE80211G:
+        case IEEE80211_BAND_2GHZ:
                 if (channel >= 1 && channel <= 14)
                         return &priv->channel_info[channel - 1];
                 break;
-
+        case IEEE80211_NUM_BANDS:
+                WARN_ON(1);
         }
 
         return NULL;
@@ -5106,8 +5091,8 @@ static int iwl3945_init_channel_map(struct iwl3945_priv *priv)
                 /* Loop through each band adding each of the channels */
                 for (ch = 0; ch < eeprom_ch_count; ch++) {
                         ch_info->channel = eeprom_ch_index[ch];
-                        ch_info->phymode = (band == 1) ? MODE_IEEE80211B :
-                            MODE_IEEE80211A;
+                        ch_info->band = (band == 1) ? IEEE80211_BAND_2GHZ :
+                            IEEE80211_BAND_5GHZ;
 
                         /* permanently store EEPROM's channel regulatory flags
                          *   and max power in channel info database. */
@@ -5203,18 +5188,20 @@ static void iwl3945_free_channel_map(struct iwl3945_priv *priv)
 #define IWL_PASSIVE_DWELL_BASE      (100)
 #define IWL_CHANNEL_TUNE_TIME       5
 
-static inline u16 iwl3945_get_active_dwell_time(struct iwl3945_priv *priv, int phymode)
+static inline u16 iwl3945_get_active_dwell_time(struct iwl3945_priv *priv,
+                                                enum ieee80211_band band)
 {
-        if (phymode == MODE_IEEE80211A)
+        if (band == IEEE80211_BAND_5GHZ)
                 return IWL_ACTIVE_DWELL_TIME_52;
         else
                 return IWL_ACTIVE_DWELL_TIME_24;
 }
 
-static u16 iwl3945_get_passive_dwell_time(struct iwl3945_priv *priv, int phymode)
+static u16 iwl3945_get_passive_dwell_time(struct iwl3945_priv *priv,
+                                          enum ieee80211_band band)
 {
-        u16 active = iwl3945_get_active_dwell_time(priv, phymode);
-        u16 passive = (phymode != MODE_IEEE80211A) ?
+        u16 active = iwl3945_get_active_dwell_time(priv, band);
+        u16 passive = (band == IEEE80211_BAND_2GHZ) ?
             IWL_PASSIVE_DWELL_BASE + IWL_PASSIVE_DWELL_TIME_24 :
             IWL_PASSIVE_DWELL_BASE + IWL_PASSIVE_DWELL_TIME_52;
 
@@ -5234,28 +5221,29 @@ static u16 iwl3945_get_passive_dwell_time(struct iwl3945_priv *priv, int phymode
         return passive;
 }
 
-static int iwl3945_get_channels_for_scan(struct iwl3945_priv *priv, int phymode,
+static int iwl3945_get_channels_for_scan(struct iwl3945_priv *priv,
+                                         enum ieee80211_band band,
                                      u8 is_active, u8 direct_mask,
                                      struct iwl3945_scan_channel *scan_ch)
 {
         const struct ieee80211_channel *channels = NULL;
-        const struct ieee80211_hw_mode *hw_mode;
+        const struct ieee80211_supported_band *sband;
         const struct iwl3945_channel_info *ch_info;
         u16 passive_dwell = 0;
         u16 active_dwell = 0;
         int added, i;
 
-        hw_mode = iwl3945_get_hw_mode(priv, phymode);
-        if (!hw_mode)
+        sband = iwl3945_get_band(priv, band);
+        if (!sband)
                 return 0;
 
-        channels = hw_mode->channels;
+        channels = sband->channels;
 
-        active_dwell = iwl3945_get_active_dwell_time(priv, phymode);
-        passive_dwell = iwl3945_get_passive_dwell_time(priv, phymode);
+        active_dwell = iwl3945_get_active_dwell_time(priv, band);
+        passive_dwell = iwl3945_get_passive_dwell_time(priv, band);
 
-        for (i = 0, added = 0; i < hw_mode->num_channels; i++) {
-                if (channels[i].chan ==
+        for (i = 0, added = 0; i < sband->n_channels; i++) {
+                if (channels[i].hw_value ==
                     le16_to_cpu(priv->active_rxon.channel)) {
                         if (iwl3945_is_associated(priv)) {
                                 IWL_DEBUG_SCAN
@@ -5266,9 +5254,9 @@ static int iwl3945_get_channels_for_scan(struct iwl3945_priv *priv, int phymode,
                 } else if (priv->only_active_channel)
                         continue;
 
-                scan_ch->channel = channels[i].chan;
+                scan_ch->channel = channels[i].hw_value;
 
-                ch_info = iwl3945_get_channel_info(priv, phymode, scan_ch->channel);
+                ch_info = iwl3945_get_channel_info(priv, band, scan_ch->channel);
                 if (!is_channel_valid(ch_info)) {
                         IWL_DEBUG_SCAN("Channel %d is INVALID for this SKU.\n",
                                        scan_ch->channel);
@@ -5276,7 +5264,7 @@ static int iwl3945_get_channels_for_scan(struct iwl3945_priv *priv, int phymode,
                 }
 
                 if (!is_active || is_channel_passive(ch_info) ||
-                    !(channels[i].flag & IEEE80211_CHAN_W_ACTIVE_SCAN))
+                    (channels[i].flags & IEEE80211_CHAN_PASSIVE_SCAN))
                         scan_ch->type = 0;      /* passive */
                 else
                         scan_ch->type = 1;      /* active */
@@ -5295,7 +5283,7 @@ static int iwl3945_get_channels_for_scan(struct iwl3945_priv *priv, int phymode,
                 /* scan_pwr_info->tpc.dsp_atten; */
 
                 /*scan_pwr_info->tpc.tx_gain; */
-                if (phymode == MODE_IEEE80211A)
+                if (band == IEEE80211_BAND_5GHZ)
                         scan_ch->tpc.tx_gain = ((1 << 5) | (3 << 3)) | 3;
                 else {
                         scan_ch->tpc.tx_gain = ((1 << 5) | (5 << 3));
@@ -5319,41 +5307,23 @@ static int iwl3945_get_channels_for_scan(struct iwl3945_priv *priv, int phymode,
         return added;
 }
 
-static void iwl3945_reset_channel_flag(struct iwl3945_priv *priv)
-{
-        int i, j;
-        for (i = 0; i < 3; i++) {
-                struct ieee80211_hw_mode *hw_mode = (void *)&priv->modes[i];
-                for (j = 0; j < hw_mode->num_channels; j++)
-                        hw_mode->channels[j].flag = hw_mode->channels[j].val;
-        }
-}
-
 static void iwl3945_init_hw_rates(struct iwl3945_priv *priv,
                               struct ieee80211_rate *rates)
 {
         int i;
 
         for (i = 0; i < IWL_RATE_COUNT; i++) {
-                rates[i].rate = iwl3945_rates[i].ieee * 5;
-                rates[i].val = i; /* Rate scaling will work on indexes */
-                rates[i].val2 = i;
-                rates[i].flags = IEEE80211_RATE_SUPPORTED;
-                /* Only OFDM have the bits-per-symbol set */
-                if ((i <= IWL_LAST_OFDM_RATE) && (i >= IWL_FIRST_OFDM_RATE))
-                        rates[i].flags |= IEEE80211_RATE_OFDM;
-                else {
+                rates[i].bitrate = iwl3945_rates[i].ieee * 5;
+                rates[i].hw_value = i; /* Rate scaling will work on indexes */
+                rates[i].hw_value_short = i;
+                rates[i].flags = 0;
+                if ((i > IWL_LAST_OFDM_RATE) || (i < IWL_FIRST_OFDM_RATE)) {
                         /*
-                         * If CCK 1M then set rate flag to CCK else CCK_2
-                         * which is CCK | PREAMBLE2
+                         * If CCK != 1M then set short preamble rate flag.
                          */
                         rates[i].flags |= (iwl3945_rates[i].plcp == 10) ?
-                                IEEE80211_RATE_CCK : IEEE80211_RATE_CCK_2;
+                                0 : IEEE80211_RATE_SHORT_PREAMBLE;
                 }
-
-                /* Set up which ones are basic rates... */
-                if (IWL_BASIC_RATES_MASK & (1 << i))
-                        rates[i].flags |= IEEE80211_RATE_BASIC;
         }
 }
 
@@ -5363,67 +5333,41 @@ static void iwl3945_init_hw_rates(struct iwl3945_priv *priv,
 static int iwl3945_init_geos(struct iwl3945_priv *priv)
 {
         struct iwl3945_channel_info *ch;
-        struct ieee80211_hw_mode *modes;
+        struct ieee80211_supported_band *band;
         struct ieee80211_channel *channels;
         struct ieee80211_channel *geo_ch;
         struct ieee80211_rate *rates;
         int i = 0;
-        enum {
-                A = 0,
-                B = 1,
-                G = 2,
-        };
-        int mode_count = 3;
 
-        if (priv->modes) {
+        if (priv->bands[IEEE80211_BAND_2GHZ].n_bitrates ||
+            priv->bands[IEEE80211_BAND_5GHZ].n_bitrates) {
                 IWL_DEBUG_INFO("Geography modes already initialized.\n");
                 set_bit(STATUS_GEO_CONFIGURED, &priv->status);
                 return 0;
         }
 
-        modes = kzalloc(sizeof(struct ieee80211_hw_mode) * mode_count,
-                        GFP_KERNEL);
-        if (!modes)
-                return -ENOMEM;
-
         channels = kzalloc(sizeof(struct ieee80211_channel) *
                            priv->channel_count, GFP_KERNEL);
-        if (!channels) {
-                kfree(modes);
+        if (!channels)
                 return -ENOMEM;
-        }
 
         rates = kzalloc((sizeof(struct ieee80211_rate) * (IWL_MAX_RATES + 1)),
                         GFP_KERNEL);
         if (!rates) {
-                kfree(modes);
                 kfree(channels);
                 return -ENOMEM;
         }
 
-        /* 0 = 802.11a
-         * 1 = 802.11b
-         * 2 = 802.11g
-         */
-
         /* 5.2GHz channels start after the 2.4GHz channels */
-        modes[A].mode = MODE_IEEE80211A;
-        modes[A].channels = &channels[ARRAY_SIZE(iwl3945_eeprom_band_1)];
-        modes[A].rates = &rates[4];
-        modes[A].num_rates = 8; /* just OFDM */
-        modes[A].num_channels = 0;
-
-        modes[B].mode = MODE_IEEE80211B;
-        modes[B].channels = channels;
-        modes[B].rates = rates;
-        modes[B].num_rates = 4; /* just CCK */
-        modes[B].num_channels = 0;
-
-        modes[G].mode = MODE_IEEE80211G;
-        modes[G].channels = channels;
-        modes[G].rates = rates;
-        modes[G].num_rates = 12;        /* OFDM & CCK */
-        modes[G].num_channels = 0;
+        band = &priv->bands[IEEE80211_BAND_5GHZ];
+        band->channels = &channels[ARRAY_SIZE(iwl3945_eeprom_band_1)];
+        band->bitrates = &rates[4];
+        band->n_bitrates = 8;   /* just OFDM */
+
+        band = &priv->bands[IEEE80211_BAND_2GHZ];
+        band->channels = channels;
+        band->bitrates = rates;
+        band->n_bitrates = 12;  /* OFDM & CCK */
 
         priv->ieee_channels = channels;
         priv->ieee_rates = rates;
@@ -5442,37 +5386,33 @@ static int iwl3945_init_geos(struct iwl3945_priv *priv)
                 }
 
                 if (is_channel_a_band(ch))
-                        geo_ch = &modes[A].channels[modes[A].num_channels++];
-                else {
-                        geo_ch = &modes[B].channels[modes[B].num_channels++];
-                        modes[G].num_channels++;
-                }
+                        geo_ch = &priv->bands[IEEE80211_BAND_5GHZ].channels[priv->bands[IEEE80211_BAND_5GHZ].n_channels++];
+                else
+                        geo_ch = &priv->bands[IEEE80211_BAND_2GHZ].channels[priv->bands[IEEE80211_BAND_2GHZ].n_channels++];
 
-                geo_ch->freq = ieee80211chan2mhz(ch->channel);
-                geo_ch->chan = ch->channel;
-                geo_ch->power_level = ch->max_power_avg;
-                geo_ch->antenna_max = 0xff;
+                geo_ch->center_freq = ieee80211chan2mhz(ch->channel);
+                geo_ch->max_power = ch->max_power_avg;
+                geo_ch->max_antenna_gain = 0xff;
+                geo_ch->hw_value = ch->channel;
 
                 if (is_channel_valid(ch)) {
-                        geo_ch->flag = IEEE80211_CHAN_W_SCAN;
-                        if (ch->flags & EEPROM_CHANNEL_IBSS)
-                                geo_ch->flag |= IEEE80211_CHAN_W_IBSS;
+                        if (!(ch->flags & EEPROM_CHANNEL_IBSS))
+                                geo_ch->flags |= IEEE80211_CHAN_NO_IBSS;
 
-                        if (ch->flags & EEPROM_CHANNEL_ACTIVE)
-                                geo_ch->flag |= IEEE80211_CHAN_W_ACTIVE_SCAN;
+                        if (!(ch->flags & EEPROM_CHANNEL_ACTIVE))
+                                geo_ch->flags |= IEEE80211_CHAN_PASSIVE_SCAN;
 
                         if (ch->flags & EEPROM_CHANNEL_RADAR)
-                                geo_ch->flag |= IEEE80211_CHAN_W_RADAR_DETECT;
+                                geo_ch->flags |= IEEE80211_CHAN_RADAR;
 
                         if (ch->max_power_avg > priv->max_channel_txpower_limit)
                                 priv->max_channel_txpower_limit =
                                     ch->max_power_avg;
-                }
-
-                geo_ch->val = geo_ch->flag;
+                } else
+                        geo_ch->flags |= IEEE80211_CHAN_DISABLED;
         }
 
-        if ((modes[A].num_channels == 0) && priv->is_abg) {
+        if ((priv->bands[IEEE80211_BAND_5GHZ].n_channels == 0) && priv->is_abg) {
                 printk(KERN_INFO DRV_NAME
                        ": Incorrectly detected BG card as ABG.  Please send "
                        "your PCI ID 0x%04X:0x%04X to maintainer.\n",
@@ -5482,24 +5422,12 @@ static int iwl3945_init_geos(struct iwl3945_priv *priv)
 
         printk(KERN_INFO DRV_NAME
                ": Tunable channels: %d 802.11bg, %d 802.11a channels\n",
-               modes[G].num_channels, modes[A].num_channels);
-
-        /*
-         * NOTE:  We register these in preference of order -- the
-         * stack doesn't currently (as of 7.0.6 / Apr 24 '07) pick
-         * a phymode based on rates or AP capabilities but seems to
-         * configure it purely on if the channel being configured
-         * is supported by a mode -- and the first match is taken
-         */
+               priv->bands[IEEE80211_BAND_2GHZ].n_channels,
+               priv->bands[IEEE80211_BAND_5GHZ].n_channels);
 
-        if (modes[G].num_channels)
-                ieee80211_register_hwmode(priv->hw, &modes[G]);
-        if (modes[B].num_channels)
-                ieee80211_register_hwmode(priv->hw, &modes[B]);
-        if (modes[A].num_channels)
-                ieee80211_register_hwmode(priv->hw, &modes[A]);
+        priv->hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &priv->bands[IEEE80211_BAND_2GHZ];
+        priv->hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &priv->bands[IEEE80211_BAND_5GHZ];
 
-        priv->modes = modes;
         set_bit(STATUS_GEO_CONFIGURED, &priv->status);
 
         return 0;
@@ -5510,7 +5438,6 @@ static int iwl3945_init_geos(struct iwl3945_priv *priv)
  */
 static void iwl3945_free_geos(struct iwl3945_priv *priv)
 {
-        kfree(priv->modes);
         kfree(priv->ieee_channels);
         kfree(priv->ieee_rates);
         clear_bit(STATUS_GEO_CONFIGURED, &priv->status);
@@ -6519,7 +6446,7 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
         struct iwl3945_scan_cmd *scan;
         struct ieee80211_conf *conf = NULL;
         u8 direct_mask;
-        int phymode;
+        enum ieee80211_band band;
 
         conf = ieee80211_get_hw_conf(priv->hw);
 
@@ -6651,13 +6578,13 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
                 scan->flags = RXON_FLG_BAND_24G_MSK | RXON_FLG_AUTO_DETECT_MSK;
                 scan->tx_cmd.rate = IWL_RATE_1M_PLCP;
                 scan->good_CRC_th = 0;
-                phymode = MODE_IEEE80211G;
+                band = IEEE80211_BAND_2GHZ;
                 break;
 
         case 1:
                 scan->tx_cmd.rate = IWL_RATE_6M_PLCP;
                 scan->good_CRC_th = IWL_GOOD_CRC_TH;
-                phymode = MODE_IEEE80211A;
+                band = IEEE80211_BAND_5GHZ;
                 break;
 
         default:
@@ -6680,7 +6607,7 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
 
         scan->channel_count =
                 iwl3945_get_channels_for_scan(
-                        priv, phymode, 1, /* active */
+                        priv, band, 1, /* active */
                         direct_mask,
                         (void *)&scan->data[le16_to_cpu(scan->tx_cmd.len)]);
 
@@ -6825,7 +6752,7 @@ static void iwl3945_bg_post_associate(struct work_struct *data)
                 iwl3945_add_station(priv, iwl3945_broadcast_addr, 0, 0);
                 iwl3945_add_station(priv, priv->bssid, 0, 0);
                 iwl3945_sync_sta(priv, IWL_STA_ID,
-                                 (priv->phymode == MODE_IEEE80211A)?
+                                 (priv->band == IEEE80211_BAND_5GHZ) ?
                                  IWL_RATE_6M_PLCP : IWL_RATE_1M_PLCP,
                                  CMD_ASYNC);
                 iwl3945_rate_scale_init(priv->hw, IWL_STA_ID);
@@ -6841,9 +6768,8 @@ static void iwl3945_bg_post_associate(struct work_struct *data)
 
         iwl3945_sequence_reset(priv);
 
-#ifdef CONFIG_IWL3945_QOS
         iwl3945_activate_qos(priv, 0);
-#endif /* CONFIG_IWL3945_QOS */
+
         /* we have just associated, don't start scan too early */
         priv->next_scan_jiffies = jiffies + IWL_DELAY_NEXT_SCAN;
         mutex_unlock(&priv->mutex);
@@ -7020,7 +6946,7 @@ static int iwl3945_mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb,
         }
 
         IWL_DEBUG_TX("dev->xmit(%d bytes) at rate 0x%02x\n", skb->len,
-                     ctl->tx_rate);
+                     ctl->tx_rate->bitrate);
 
         if (iwl3945_tx_skb(priv, skb, ctl))
                 dev_kfree_skb_any(skb);
@@ -7079,7 +7005,7 @@ static int iwl3945_mac_config(struct ieee80211_hw *hw, struct ieee80211_conf *co
         int ret = 0;
 
         mutex_lock(&priv->mutex);
-        IWL_DEBUG_MAC80211("enter to channel %d\n", conf->channel);
+        IWL_DEBUG_MAC80211("enter to channel %d\n", conf->channel->hw_value);
 
         priv->add_radiotap = !!(conf->flags & IEEE80211_CONF_RADIOTAP);
 
@@ -7099,19 +7025,20 @@ static int iwl3945_mac_config(struct ieee80211_hw *hw, struct ieee80211_conf *co
 
         spin_lock_irqsave(&priv->lock, flags);
 
-        ch_info = iwl3945_get_channel_info(priv, conf->phymode, conf->channel);
+        ch_info = iwl3945_get_channel_info(priv, conf->channel->band,
+                                           conf->channel->hw_value);
         if (!is_channel_valid(ch_info)) {
                 IWL_DEBUG_SCAN("Channel %d [%d] is INVALID for this SKU.\n",
-                               conf->channel, conf->phymode);
+                               conf->channel->hw_value, conf->channel->band);
                 IWL_DEBUG_MAC80211("leave - invalid channel\n");
                 spin_unlock_irqrestore(&priv->lock, flags);
                 ret = -EINVAL;
                 goto out;
         }
 
-        iwl3945_set_rxon_channel(priv, conf->phymode, conf->channel);
+        iwl3945_set_rxon_channel(priv, conf->channel->band, conf->channel->hw_value);
 
-        iwl3945_set_flags_for_phymode(priv, conf->phymode);
+        iwl3945_set_flags_for_phymode(priv, conf->channel->band);
 
         /* The list of supported rates and rate mask can be different
          * for each phymode; since the phymode may have changed, reset
@@ -7487,10 +7414,8 @@ static int iwl3945_mac_conf_tx(struct ieee80211_hw *hw, int queue,
                            const struct ieee80211_tx_queue_params *params)
 {
         struct iwl3945_priv *priv = hw->priv;
-#ifdef CONFIG_IWL3945_QOS
         unsigned long flags;
         int q;
-#endif /* CONFIG_IWL3945_QOS */
 
         IWL_DEBUG_MAC80211("enter\n");
 
@@ -7504,7 +7429,6 @@ static int iwl3945_mac_conf_tx(struct ieee80211_hw *hw, int queue,
                 return 0;
         }
 
-#ifdef CONFIG_IWL3945_QOS
         if (!priv->qos_data.qos_enable) {
                 priv->qos_data.qos_active = 0;
                 IWL_DEBUG_MAC80211("leave - qos not enabled\n");
@@ -7518,7 +7442,7 @@ static int iwl3945_mac_conf_tx(struct ieee80211_hw *hw, int queue,
         priv->qos_data.def_qos_parm.ac[q].cw_max = cpu_to_le16(params->cw_max);
         priv->qos_data.def_qos_parm.ac[q].aifsn = params->aifs;
         priv->qos_data.def_qos_parm.ac[q].edca_txop =
-                        cpu_to_le16((params->burst_time * 100));
+                        cpu_to_le16((params->txop * 32));
 
         priv->qos_data.def_qos_parm.ac[q].reserved1 = 0;
         priv->qos_data.qos_active = 1;
@@ -7533,8 +7457,6 @@ static int iwl3945_mac_conf_tx(struct ieee80211_hw *hw, int queue,
 
         mutex_unlock(&priv->mutex);
 
-#endif /*CONFIG_IWL3945_QOS */
-
         IWL_DEBUG_MAC80211("leave\n");
         return 0;
 }
@@ -7599,9 +7521,8 @@ static void iwl3945_mac_reset_tsf(struct ieee80211_hw *hw)
         mutex_lock(&priv->mutex);
         IWL_DEBUG_MAC80211("enter\n");
 
-#ifdef CONFIG_IWL3945_QOS
         iwl3945_reset_qos(priv);
-#endif
+
         cancel_delayed_work(&priv->post_associate);
 
         spin_lock_irqsave(&priv->lock, flags);
@@ -7689,9 +7610,7 @@ static int iwl3945_mac_beacon_update(struct ieee80211_hw *hw, struct sk_buff *sk
         IWL_DEBUG_MAC80211("leave\n");
         spin_unlock_irqrestore(&priv->lock, flags);
 
-#ifdef CONFIG_IWL3945_QOS
         iwl3945_reset_qos(priv);
-#endif
 
         queue_work(priv->workqueue, &priv->post_associate.work);
 
@@ -7892,65 +7811,6 @@ static ssize_t store_filter_flags(struct device *d,
 static DEVICE_ATTR(filter_flags, S_IWUSR | S_IRUGO, show_filter_flags,
                    store_filter_flags);
 
-static ssize_t show_tune(struct device *d,
-                         struct device_attribute *attr, char *buf)
-{
-        struct iwl3945_priv *priv = (struct iwl3945_priv *)d->driver_data;
-
-        return sprintf(buf, "0x%04X\n",
-                       (priv->phymode << 8) |
-                        le16_to_cpu(priv->active_rxon.channel));
-}
-
-static void iwl3945_set_flags_for_phymode(struct iwl3945_priv *priv, u8 phymode);
-
-static ssize_t store_tune(struct device *d,
-                          struct device_attribute *attr,
-                          const char *buf, size_t count)
-{
-        struct iwl3945_priv *priv = (struct iwl3945_priv *)d->driver_data;
-        char *p = (char *)buf;
-        u16 tune = simple_strtoul(p, &p, 0);
-        u8 phymode = (tune >> 8) & 0xff;
-        u16 channel = tune & 0xff;
-
-        IWL_DEBUG_INFO("Tune request to:%d channel:%d\n", phymode, channel);
-
-        mutex_lock(&priv->mutex);
-        if ((le16_to_cpu(priv->staging_rxon.channel) != channel) ||
-            (priv->phymode != phymode)) {
-                const struct iwl3945_channel_info *ch_info;
-
-                ch_info = iwl3945_get_channel_info(priv, phymode, channel);
-                if (!ch_info) {
-                        IWL_WARNING("Requested invalid phymode/channel "
-                                    "combination: %d %d\n", phymode, channel);
-                        mutex_unlock(&priv->mutex);
-                        return -EINVAL;
-                }
-
-                /* Cancel any currently running scans... */
-                if (iwl3945_scan_cancel_timeout(priv, 100))
-                        IWL_WARNING("Could not cancel scan.\n");
-                else {
-                        IWL_DEBUG_INFO("Committing phymode and "
-                                       "rxon.channel = %d %d\n",
-                                       phymode, channel);
-
-                        iwl3945_set_rxon_channel(priv, phymode, channel);
-                        iwl3945_set_flags_for_phymode(priv, phymode);
-
-                        iwl3945_set_rate(priv);
-                        iwl3945_commit_rxon(priv);
-                }
-        }
-        mutex_unlock(&priv->mutex);
-
-        return count;
-}
-
-static DEVICE_ATTR(tune, S_IWUSR | S_IRUGO, show_tune, store_tune);
-
 #ifdef CONFIG_IWL3945_SPECTRUM_MEASUREMENT
 
 static ssize_t show_measurement(struct device *d,
@@ -8165,73 +8025,8 @@ static DEVICE_ATTR(power_level, S_IWUSR | S_IRUSR, show_power_level,
 static ssize_t show_channels(struct device *d,
                              struct device_attribute *attr, char *buf)
 {
-        struct iwl3945_priv *priv = dev_get_drvdata(d);
-        int len = 0, i;
-        struct ieee80211_channel *channels = NULL;
-        const struct ieee80211_hw_mode *hw_mode = NULL;
-        int count = 0;
-
-        if (!iwl3945_is_ready(priv))
-                return -EAGAIN;
-
-        hw_mode = iwl3945_get_hw_mode(priv, MODE_IEEE80211G);
-        if (!hw_mode)
-                hw_mode = iwl3945_get_hw_mode(priv, MODE_IEEE80211B);
-        if (hw_mode) {
-                channels = hw_mode->channels;
-                count = hw_mode->num_channels;
-        }
-
-        len +=
-            sprintf(&buf[len],
-                    "Displaying %d channels in 2.4GHz band "
-                    "(802.11bg):\n", count);
-
-        for (i = 0; i < count; i++)
-                len += sprintf(&buf[len], "%d: %ddBm: BSS%s%s, %s.\n",
-                               channels[i].chan,
-                               channels[i].power_level,
-                               channels[i].
-                               flag & IEEE80211_CHAN_W_RADAR_DETECT ?
-                               " (IEEE 802.11h required)" : "",
-                               (!(channels[i].flag & IEEE80211_CHAN_W_IBSS)
-                                || (channels[i].
-                                    flag &
-                                    IEEE80211_CHAN_W_RADAR_DETECT)) ? "" :
-                               ", IBSS",
-                               channels[i].
-                               flag & IEEE80211_CHAN_W_ACTIVE_SCAN ?
-                               "active/passive" : "passive only");
-
-        hw_mode = iwl3945_get_hw_mode(priv, MODE_IEEE80211A);
-        if (hw_mode) {
-                channels = hw_mode->channels;
-                count = hw_mode->num_channels;
-        } else {
-                channels = NULL;
-                count = 0;
-        }
-
-        len += sprintf(&buf[len], "Displaying %d channels in 5.2GHz band "
-                       "(802.11a):\n", count);
-
-        for (i = 0; i < count; i++)
-                len += sprintf(&buf[len], "%d: %ddBm: BSS%s%s, %s.\n",
-                               channels[i].chan,
-                               channels[i].power_level,
-                               channels[i].
-                               flag & IEEE80211_CHAN_W_RADAR_DETECT ?
-                               " (IEEE 802.11h required)" : "",
-                               (!(channels[i].flag & IEEE80211_CHAN_W_IBSS)
-                                || (channels[i].
-                                    flag &
-                                    IEEE80211_CHAN_W_RADAR_DETECT)) ? "" :
-                               ", IBSS",
-                               channels[i].
-                               flag & IEEE80211_CHAN_W_ACTIVE_SCAN ?
-                               "active/passive" : "passive only");
-
-        return len;
+        /* all this shit doesn't belong into sysfs anyway */
+        return 0;
 }
 
 static DEVICE_ATTR(channels, S_IRUSR, show_channels, NULL);
@@ -8411,7 +8206,6 @@ static struct attribute *iwl3945_sysfs_entries[] = {
         &dev_attr_statistics.attr,
         &dev_attr_status.attr,
         &dev_attr_temperature.attr,
-        &dev_attr_tune.attr,
         &dev_attr_tx_power.attr,
 
         NULL
@@ -8532,7 +8326,7 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
         priv->data_retry_limit = -1;
         priv->ieee_channels = NULL;
         priv->ieee_rates = NULL;
-        priv->phymode = -1;
+        priv->band = IEEE80211_BAND_2GHZ;
 
         err = pci_set_dma_mask(pdev, DMA_32BIT_MASK);
         if (!err)
@@ -8604,7 +8398,6 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
                 goto out_iounmap;
         }
 
-#ifdef CONFIG_IWL3945_QOS
         if (iwl3945_param_qos_enable)
                 priv->qos_data.qos_enable = 1;
 
@@ -8612,9 +8405,8 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
 
         priv->qos_data.qos_active = 0;
         priv->qos_data.qos_cap.val = 0;
-#endif /* CONFIG_IWL3945_QOS */
 
-        iwl3945_set_rxon_channel(priv, MODE_IEEE80211G, 6);
+        iwl3945_set_rxon_channel(priv, IEEE80211_BAND_2GHZ, 6);
         iwl3945_setup_deferred_work(priv);
         iwl3945_setup_rx_handlers(priv);
 
@@ -8665,7 +8457,6 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
                 IWL_ERROR("initializing geos failed: %d\n", err);
                 goto out_free_channel_map;
         }
-        iwl3945_reset_channel_flag(priv);
 
         iwl3945_rate_control_register(priv->hw);
         err = ieee80211_register_hw(priv->hw);
diff --git a/drivers/net/wireless/iwlwifi/iwl4965-base.c b/drivers/net/wireless/iwlwifi/iwl4965-base.c
index a23d4798653b..20d012d4f37e 100644
--- a/drivers/net/wireless/iwlwifi/iwl4965-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl4965-base.c
@@ -90,7 +90,7 @@ int iwl4965_param_amsdu_size_8K;   /* def: enable 8K amsdu size */
 #define VS
 #endif
 
-#define IWLWIFI_VERSION "1.2.23k" VD VS
+#define IWLWIFI_VERSION "1.2.26k" VD VS
 #define DRV_COPYRIGHT   "Copyright(c) 2003-2007 Intel Corporation"
 #define DRV_VERSION     IWLWIFI_VERSION
 
@@ -115,16 +115,10 @@ __le16 *ieee80211_get_qos_ctrl(struct ieee80211_hdr *hdr)
         return NULL;
 }
 
-static const struct ieee80211_hw_mode *iwl4965_get_hw_mode(
-                struct iwl4965_priv *priv, int mode)
+static const struct ieee80211_supported_band *iwl4965_get_hw_mode(
+                struct iwl4965_priv *priv, enum ieee80211_band band)
 {
-        int i;
-
-        for (i = 0; i < 3; i++)
-                if (priv->modes[i].mode == mode)
-                        return &priv->modes[i];
-
-        return NULL;
+        return priv->hw->wiphy->bands[band];
 }
 
 static int iwl4965_is_empty_essid(const char *essid, int essid_len)
@@ -205,7 +199,7 @@ static void iwl4965_print_hex_dump(int level, void *p, u32 len)
  * See more detailed info in iwl-4965-hw.h.
  ***************************************************/
 
-static int iwl4965_queue_space(const struct iwl4965_queue *q)
+int iwl4965_queue_space(const struct iwl4965_queue *q)
 {
         int s = q->read_ptr - q->write_ptr;
 
@@ -937,28 +931,29 @@ static int iwl4965_rxon_add_station(struct iwl4965_priv *priv,
  * NOTE:  Does not commit to the hardware; it sets appropriate bit fields
  * in the staging RXON flag structure based on the phymode
  */
-static int iwl4965_set_rxon_channel(struct iwl4965_priv *priv, u8 phymode,
+static int iwl4965_set_rxon_channel(struct iwl4965_priv *priv,
+                                    enum ieee80211_band band,
                                  u16 channel)
 {
-        if (!iwl4965_get_channel_info(priv, phymode, channel)) {
+        if (!iwl4965_get_channel_info(priv, band, channel)) {
                 IWL_DEBUG_INFO("Could not set channel to %d [%d]\n",
-                               channel, phymode);
+                               channel, band);
                 return -EINVAL;
         }
 
         if ((le16_to_cpu(priv->staging_rxon.channel) == channel) &&
-            (priv->phymode == phymode))
+            (priv->band == band))
                 return 0;
 
         priv->staging_rxon.channel = cpu_to_le16(channel);
-        if (phymode == MODE_IEEE80211A)
+        if (band == IEEE80211_BAND_5GHZ)
                 priv->staging_rxon.flags &= ~RXON_FLG_BAND_24G_MSK;
         else
                 priv->staging_rxon.flags |= RXON_FLG_BAND_24G_MSK;
 
-        priv->phymode = phymode;
+        priv->band = band;
 
-        IWL_DEBUG_INFO("Staging channel set to %d [%d]\n", channel, phymode);
+        IWL_DEBUG_INFO("Staging channel set to %d [%d]\n", channel, band);
 
         return 0;
 }
@@ -1898,24 +1893,20 @@ static u16 iwl4965_supported_rate_to_ie(u8 *ie, u16 supported_rate,
         return ret_rates;
 }
 
-#ifdef CONFIG_IWL4965_HT
-void static iwl4965_set_ht_capab(struct ieee80211_hw *hw,
-                             struct ieee80211_ht_cap *ht_cap,
-                             u8 use_current_config);
-#endif
-
 /**
  * iwl4965_fill_probe_req - fill in all required fields and IE for probe request
  */
 static u16 iwl4965_fill_probe_req(struct iwl4965_priv *priv,
-                              struct ieee80211_mgmt *frame,
-                              int left, int is_direct)
+                                  enum ieee80211_band band,
+                                  struct ieee80211_mgmt *frame,
+                                  int left, int is_direct)
 {
         int len = 0;
         u8 *pos = NULL;
         u16 active_rates, ret_rates, cck_rates, active_rate_basic;
 #ifdef CONFIG_IWL4965_HT
-        struct ieee80211_hw_mode *mode;
+        const struct ieee80211_supported_band *sband =
+                                                iwl4965_get_hw_mode(priv, band);
 #endif /* CONFIG_IWL4965_HT */
 
         /* Make sure there is enough space for the probe request,
@@ -2000,13 +1991,18 @@ static u16 iwl4965_fill_probe_req(struct iwl4965_priv *priv,
                 len += 2 + *pos;
 
 #ifdef CONFIG_IWL4965_HT
-        mode = priv->hw->conf.mode;
-        if (mode->ht_info.ht_supported) {
+        if (sband && sband->ht_info.ht_supported) {
+                struct ieee80211_ht_cap *ht_cap;
                 pos += (*pos) + 1;
                 *pos++ = WLAN_EID_HT_CAPABILITY;
                 *pos++ = sizeof(struct ieee80211_ht_cap);
-                iwl4965_set_ht_capab(priv->hw,
-                                (struct ieee80211_ht_cap *)pos, 0);
+                ht_cap = (struct ieee80211_ht_cap *)pos;
+                ht_cap->cap_info = cpu_to_le16(sband->ht_info.cap);
+                memcpy(ht_cap->supp_mcs_set, sband->ht_info.supp_mcs_set, 16);
+                ht_cap->ampdu_params_info =(sband->ht_info.ampdu_factor &
+                                            IEEE80211_HT_CAP_AMPDU_FACTOR) |
+                                            ((sband->ht_info.ampdu_density << 2) &
+                                            IEEE80211_HT_CAP_AMPDU_DENSITY);
                 len += 2 + sizeof(struct ieee80211_ht_cap);
         }
 #endif  /*CONFIG_IWL4965_HT */
@@ -2018,7 +2014,6 @@ static u16 iwl4965_fill_probe_req(struct iwl4965_priv *priv,
 /*
  * QoS  support
 */
-#ifdef CONFIG_IWL4965_QOS
 static int iwl4965_send_qos_params_command(struct iwl4965_priv *priv,
                                        struct iwl4965_qosparam_cmd *qos)
 {
@@ -2152,7 +2147,6 @@ static void iwl4965_activate_qos(struct iwl4965_priv *priv, u8 force)
         }
 }
 
-#endif /* CONFIG_IWL4965_QOS */
 /*
  * Power management (not Tx power!) functions
  */
@@ -2571,9 +2565,10 @@ static int iwl4965_set_rxon_hwcrypto(struct iwl4965_priv *priv, int hw_decrypt)
         return 0;
 }
 
-static void iwl4965_set_flags_for_phymode(struct iwl4965_priv *priv, u8 phymode)
+static void iwl4965_set_flags_for_phymode(struct iwl4965_priv *priv,
+                                          enum ieee80211_band band)
 {
-        if (phymode == MODE_IEEE80211A) {
+        if (band == IEEE80211_BAND_5GHZ) {
                 priv->staging_rxon.flags &=
                     ~(RXON_FLG_BAND_24G_MSK | RXON_FLG_AUTO_DETECT_MSK
                       | RXON_FLG_CCK_MSK);
@@ -2636,7 +2631,7 @@ static void iwl4965_connection_init_rx_config(struct iwl4965_priv *priv)
                 priv->staging_rxon.flags |= RXON_FLG_SHORT_PREAMBLE_MSK;
 #endif
 
-        ch_info = iwl4965_get_channel_info(priv, priv->phymode,
+        ch_info = iwl4965_get_channel_info(priv, priv->band,
                                        le16_to_cpu(priv->staging_rxon.channel));
 
         if (!ch_info)
@@ -2651,12 +2646,9 @@ static void iwl4965_connection_init_rx_config(struct iwl4965_priv *priv)
                 ch_info = &priv->channel_info[0];
 
         priv->staging_rxon.channel = cpu_to_le16(ch_info->channel);
-        if (is_channel_a_band(ch_info))
-                priv->phymode = MODE_IEEE80211A;
-        else
-                priv->phymode = MODE_IEEE80211G;
+        priv->band = ch_info->band;
 
-        iwl4965_set_flags_for_phymode(priv, priv->phymode);
+        iwl4965_set_flags_for_phymode(priv, priv->band);
 
         priv->staging_rxon.ofdm_basic_rates =
             (IWL_OFDM_RATES_MASK >> IWL_FIRST_OFDM_RATE) & 0xFF;
@@ -2678,7 +2670,7 @@ static int iwl4965_set_mode(struct iwl4965_priv *priv, int mode)
                 const struct iwl4965_channel_info *ch_info;
 
                 ch_info = iwl4965_get_channel_info(priv,
-                        priv->phymode,
+                        priv->band,
                         le16_to_cpu(priv->staging_rxon.channel));
 
                 if (!ch_info || !is_channel_ibss(ch_info)) {
@@ -2918,7 +2910,7 @@ static int iwl4965_tx_skb(struct iwl4965_priv *priv,
                 goto drop_unlock;
         }
 
-        if ((ctl->tx_rate & 0xFF) == IWL_INVALID_RATE) {
+        if ((ctl->tx_rate->hw_value & 0xFF) == IWL_INVALID_RATE) {
                 IWL_ERROR("ERROR: No TX rate available.\n");
                 goto drop_unlock;
         }
@@ -2972,11 +2964,10 @@ static int iwl4965_tx_skb(struct iwl4965_priv *priv,
                                 __constant_cpu_to_le16(IEEE80211_SCTL_FRAG));
                 seq_number += 0x10;
 #ifdef CONFIG_IWL4965_HT
-#ifdef CONFIG_IWL4965_HT_AGG
                 /* aggregation is on for this <sta,tid> */
-                if (ctl->flags & IEEE80211_TXCTL_HT_MPDU_AGG)
+                if (ctl->flags & IEEE80211_TXCTL_AMPDU)
                         txq_id = priv->stations[sta_id].tid[tid].agg.txq_id;
-#endif /* CONFIG_IWL4965_HT_AGG */
+                priv->stations[sta_id].tid[tid].tfds_in_queue++;
 #endif /* CONFIG_IWL4965_HT */
         }
 
@@ -3076,14 +3067,6 @@ static int iwl4965_tx_skb(struct iwl4965_priv *priv,
         out_cmd->cmd.tx.dram_lsb_ptr = cpu_to_le32(scratch_phys);
         out_cmd->cmd.tx.dram_msb_ptr = iwl_get_dma_hi_address(scratch_phys);
 
-#ifdef CONFIG_IWL4965_HT_AGG
-#ifdef CONFIG_IWL4965_HT
-        /* TODO: move this functionality to rate scaling */
-        iwl4965_tl_get_stats(priv, hdr);
-#endif /* CONFIG_IWL4965_HT_AGG */
-#endif /*CONFIG_IWL4965_HT */
-
-
         if (!ieee80211_get_morefrag(hdr)) {
                 txq->need_update = 1;
                 if (qc) {
@@ -3134,11 +3117,11 @@ drop:
 
 static void iwl4965_set_rate(struct iwl4965_priv *priv)
 {
-        const struct ieee80211_hw_mode *hw = NULL;
+        const struct ieee80211_supported_band *hw = NULL;
         struct ieee80211_rate *rate;
         int i;
 
-        hw = iwl4965_get_hw_mode(priv, priv->phymode);
+        hw = iwl4965_get_hw_mode(priv, priv->band);
         if (!hw) {
                 IWL_ERROR("Failed to set rate: unable to get hw mode\n");
                 return;
@@ -3147,24 +3130,10 @@ static void iwl4965_set_rate(struct iwl4965_priv *priv)
         priv->active_rate = 0;
         priv->active_rate_basic = 0;
 
-        IWL_DEBUG_RATE("Setting rates for 802.11%c\n",
-                       hw->mode == MODE_IEEE80211A ?
-                       'a' : ((hw->mode == MODE_IEEE80211B) ? 'b' : 'g'));
-
-        for (i = 0; i < hw->num_rates; i++) {
-                rate = &(hw->rates[i]);
-                if ((rate->val < IWL_RATE_COUNT) &&
-                    (rate->flags & IEEE80211_RATE_SUPPORTED)) {
-                        IWL_DEBUG_RATE("Adding rate index %d (plcp %d)%s\n",
-                                       rate->val, iwl4965_rates[rate->val].plcp,
-                                       (rate->flags & IEEE80211_RATE_BASIC) ?
-                                       "*" : "");
-                        priv->active_rate |= (1 << rate->val);
-                        if (rate->flags & IEEE80211_RATE_BASIC)
-                                priv->active_rate_basic |= (1 << rate->val);
-                } else
-                        IWL_DEBUG_RATE("Not adding rate %d (plcp %d)\n",
-                                       rate->val, iwl4965_rates[rate->val].plcp);
+        for (i = 0; i < hw->n_bitrates; i++) {
+                rate = &(hw->bitrates[i]);
+                if (rate->hw_value < IWL_RATE_COUNT)
+                        priv->active_rate |= (1 << rate->hw_value);
         }
 
         IWL_DEBUG_RATE("Set active_rate = %0x, active_rate_basic = %0x\n",
@@ -3528,10 +3497,10 @@ int iwl4965_tx_queue_reclaim(struct iwl4965_priv *priv, int txq_id, int index)
                 nfreed++;
         }
 
-        if (iwl4965_queue_space(q) > q->low_mark && (txq_id >= 0) &&
+/*      if (iwl4965_queue_space(q) > q->low_mark && (txq_id >= 0) &&
                         (txq_id != IWL_CMD_QUEUE_NUM) &&
                         priv->mac80211_registered)
-                ieee80211_wake_queue(priv->hw, txq_id);
+                ieee80211_wake_queue(priv->hw, txq_id); */
 
 
         return nfreed;
@@ -3550,7 +3519,6 @@ static int iwl4965_is_tx_success(u32 status)
  *
  ******************************************************************************/
 #ifdef CONFIG_IWL4965_HT
-#ifdef CONFIG_IWL4965_HT_AGG
 
 static inline int iwl4965_get_ra_sta_id(struct iwl4965_priv *priv,
                                     struct ieee80211_hdr *hdr)
@@ -3585,11 +3553,11 @@ static inline u32 iwl4965_get_scd_ssn(struct iwl4965_tx_resp *tx_resp)
  */
 static int iwl4965_tx_status_reply_tx(struct iwl4965_priv *priv,
                                       struct iwl4965_ht_agg *agg,
-                                      struct iwl4965_tx_resp *tx_resp,
+                                      struct iwl4965_tx_resp_agg *tx_resp,
                                       u16 start_idx)
 {
-        u32 status;
-        __le32 *frame_status = &tx_resp->status;
+        u16 status;
+        struct agg_tx_status *frame_status = &tx_resp->status;
         struct ieee80211_tx_status *tx_status = NULL;
         struct ieee80211_hdr *hdr = NULL;
         int i, sh;
@@ -3602,30 +3570,30 @@ static int iwl4965_tx_status_reply_tx(struct iwl4965_priv *priv,
         agg->frame_count = tx_resp->frame_count;
         agg->start_idx = start_idx;
         agg->rate_n_flags = le32_to_cpu(tx_resp->rate_n_flags);
-        agg->bitmap0 = agg->bitmap1 = 0;
+        agg->bitmap = 0;
 
         /* # frames attempted by Tx command */
         if (agg->frame_count == 1) {
                 /* Only one frame was attempted; no block-ack will arrive */
-                struct iwl4965_tx_queue *txq ;
-                status = le32_to_cpu(frame_status[0]);
+                status = le16_to_cpu(frame_status[0].status);
+                seq  = le16_to_cpu(frame_status[0].sequence);
+                idx = SEQ_TO_INDEX(seq);
+                txq_id = SEQ_TO_QUEUE(seq);
 
-                txq_id = agg->txq_id;
-                txq = &priv->txq[txq_id];
                 /* FIXME: code repetition */
-                IWL_DEBUG_TX_REPLY("FrameCnt = %d, StartIdx=%d \n",
-                                   agg->frame_count, agg->start_idx);
+                IWL_DEBUG_TX_REPLY("FrameCnt = %d, StartIdx=%d idx=%d\n",
+                                   agg->frame_count, agg->start_idx, idx);
 
-                tx_status = &(priv->txq[txq_id].txb[txq->q.read_ptr].status);
+                tx_status = &(priv->txq[txq_id].txb[idx].status);
                 tx_status->retry_count = tx_resp->failure_frame;
                 tx_status->queue_number = status & 0xff;
-                tx_status->queue_length = tx_resp->bt_kill_count;
-                tx_status->queue_length |= tx_resp->failure_rts;
-
+                tx_status->queue_length = tx_resp->failure_rts;
+                tx_status->control.flags &= ~IEEE80211_TXCTL_AMPDU;
                 tx_status->flags = iwl4965_is_tx_success(status)?
                         IEEE80211_TX_STATUS_ACK : 0;
+                /* FIXME Wrong Rate
                 tx_status->control.tx_rate =
-                                iwl4965_hw_get_rate_n_flags(tx_resp->rate_n_flags);
+                                iwl4965_hw_get_rate_n_flags(tx_resp->rate_n_flags); */
                 /* FIXME: code repetition end */
 
                 IWL_DEBUG_TX_REPLY("1 Frame 0x%x failure :%d\n",
@@ -3642,8 +3610,8 @@ static int iwl4965_tx_status_reply_tx(struct iwl4965_priv *priv,
                 /* Construct bit-map of pending frames within Tx window */
                 for (i = 0; i < agg->frame_count; i++) {
                         u16 sc;
-                        status = le32_to_cpu(frame_status[i]);
-                        seq  = status >> 16;
+                        status = le16_to_cpu(frame_status[i].status);
+                        seq  = le16_to_cpu(frame_status[i].sequence);
                         idx = SEQ_TO_INDEX(seq);
                         txq_id = SEQ_TO_QUEUE(seq);
 
@@ -3687,13 +3655,12 @@ static int iwl4965_tx_status_reply_tx(struct iwl4965_priv *priv,
                                            start, (u32)(bitmap & 0xFFFFFFFF));
                 }
 
-                agg->bitmap0 = bitmap & 0xFFFFFFFF;
-                agg->bitmap1 = bitmap >> 32;
+                agg->bitmap = bitmap;
                 agg->start_idx = start;
                 agg->rate_n_flags = le32_to_cpu(tx_resp->rate_n_flags);
-                IWL_DEBUG_TX_REPLY("Frames %d start_idx=%d bitmap=0x%x\n",
+                IWL_DEBUG_TX_REPLY("Frames %d start_idx=%d bitmap=0x%llx\n",
                                    agg->frame_count, agg->start_idx,
-                                   agg->bitmap0);
+                                   agg->bitmap);
 
                 if (bitmap)
                         agg->wait_for_ba = 1;
@@ -3701,7 +3668,6 @@ static int iwl4965_tx_status_reply_tx(struct iwl4965_priv *priv,
         return 0;
 }
 #endif
-#endif
 
 /**
  * iwl4965_rx_reply_tx - Handle standard (non-aggregation) Tx response
@@ -3718,9 +3684,9 @@ static void iwl4965_rx_reply_tx(struct iwl4965_priv *priv,
         struct iwl4965_tx_resp *tx_resp = (void *)&pkt->u.raw[0];
         u32  status = le32_to_cpu(tx_resp->status);
 #ifdef CONFIG_IWL4965_HT
-#ifdef CONFIG_IWL4965_HT_AGG
-        int tid, sta_id;
-#endif
+        int tid = MAX_TID_COUNT, sta_id = IWL_INVALID_STATION;
+        struct ieee80211_hdr *hdr;
+        __le16 *qc;
 #endif
 
         if ((index >= txq->q.n_bd) || (x2_queue_used(&txq->q, index) == 0)) {
@@ -3732,44 +3698,51 @@ static void iwl4965_rx_reply_tx(struct iwl4965_priv *priv,
         }
 
 #ifdef CONFIG_IWL4965_HT
-#ifdef CONFIG_IWL4965_HT_AGG
+        hdr = iwl4965_tx_queue_get_hdr(priv, txq_id, index);
+        qc = ieee80211_get_qos_ctrl(hdr);
+
+        if (qc)
+                tid = le16_to_cpu(*qc) & 0xf;
+
+        sta_id = iwl4965_get_ra_sta_id(priv, hdr);
+        if (txq->sched_retry && unlikely(sta_id == IWL_INVALID_STATION)) {
+                IWL_ERROR("Station not known\n");
+                return;
+        }
+
         if (txq->sched_retry) {
                 const u32 scd_ssn = iwl4965_get_scd_ssn(tx_resp);
-                struct ieee80211_hdr *hdr =
-                        iwl4965_tx_queue_get_hdr(priv, txq_id, index);
                 struct iwl4965_ht_agg *agg = NULL;
-                __le16 *qc = ieee80211_get_qos_ctrl(hdr);
-
-                if (qc == NULL) {
-                        IWL_ERROR("BUG_ON qc is null!!!!\n");
-                        return;
-                }
-
-                tid = le16_to_cpu(*qc) & 0xf;
 
-                sta_id = iwl4965_get_ra_sta_id(priv, hdr);
-                if (unlikely(sta_id == IWL_INVALID_STATION)) {
-                        IWL_ERROR("Station not known for\n");
+                if (!qc)
                         return;
-                }
 
                 agg = &priv->stations[sta_id].tid[tid].agg;
 
-                iwl4965_tx_status_reply_tx(priv, agg, tx_resp, index);
+                iwl4965_tx_status_reply_tx(priv, agg,
+                                (struct iwl4965_tx_resp_agg *)tx_resp, index);
 
                 if ((tx_resp->frame_count == 1) &&
                     !iwl4965_is_tx_success(status)) {
                         /* TODO: send BAR */
                 }
 
-                if ((txq->q.read_ptr != (scd_ssn & 0xff))) {
+                if (txq->q.read_ptr != (scd_ssn & 0xff)) {
+                        int freed;
                         index = iwl4965_queue_dec_wrap(scd_ssn & 0xff, txq->q.n_bd);
                         IWL_DEBUG_TX_REPLY("Retry scheduler reclaim scd_ssn "
                                            "%d index %d\n", scd_ssn , index);
-                        iwl4965_tx_queue_reclaim(priv, txq_id, index);
+                        freed = iwl4965_tx_queue_reclaim(priv, txq_id, index);
+                        priv->stations[sta_id].tid[tid].tfds_in_queue -= freed;
+
+                        if (iwl4965_queue_space(&txq->q) > txq->q.low_mark &&
+                            txq_id >= 0 && priv->mac80211_registered &&
+                            agg->state != IWL_EMPTYING_HW_QUEUE_DELBA)
+                                ieee80211_wake_queue(priv->hw, txq_id);
+
+                        iwl4965_check_empty_hw_queue(priv, sta_id, tid, txq_id);
                 }
         } else {
-#endif /* CONFIG_IWL4965_HT_AGG */
 #endif /* CONFIG_IWL4965_HT */
         tx_status = &(txq->txb[txq->q.read_ptr].status);
 
@@ -3781,21 +3754,27 @@ static void iwl4965_rx_reply_tx(struct iwl4965_priv *priv,
         tx_status->flags =
             iwl4965_is_tx_success(status) ? IEEE80211_TX_STATUS_ACK : 0;
 
-        tx_status->control.tx_rate =
-                iwl4965_hw_get_rate_n_flags(tx_resp->rate_n_flags);
-
         IWL_DEBUG_TX("Tx queue %d Status %s (0x%08x) rate_n_flags 0x%x "
                      "retries %d\n", txq_id, iwl4965_get_tx_fail_reason(status),
                      status, le32_to_cpu(tx_resp->rate_n_flags),
                      tx_resp->failure_frame);
 
         IWL_DEBUG_TX_REPLY("Tx queue reclaim %d\n", index);
-        if (index != -1)
-                iwl4965_tx_queue_reclaim(priv, txq_id, index);
+        if (index != -1) {
+                int freed = iwl4965_tx_queue_reclaim(priv, txq_id, index);
+#ifdef CONFIG_IWL4965_HT
+                if (tid != MAX_TID_COUNT)
+                        priv->stations[sta_id].tid[tid].tfds_in_queue -= freed;
+                if (iwl4965_queue_space(&txq->q) > txq->q.low_mark &&
+                        (txq_id >= 0) &&
+                        priv->mac80211_registered)
+                        ieee80211_wake_queue(priv->hw, txq_id);
+                if (tid != MAX_TID_COUNT)
+                        iwl4965_check_empty_hw_queue(priv, sta_id, tid, txq_id);
+#endif
+        }
 #ifdef CONFIG_IWL4965_HT
-#ifdef CONFIG_IWL4965_HT_AGG
         }
-#endif /* CONFIG_IWL4965_HT_AGG */
 #endif /* CONFIG_IWL4965_HT */
 
         if (iwl_check_bits(status, TX_ABORT_REQUIRED_MSK))
@@ -5170,7 +5149,7 @@ static void iwl4965_irq_tasklet(struct iwl4965_priv *priv)
                 /* Queue restart only if RF_KILL switch was set to "kill"
                  *   when we loaded driver, and is now set to "enable".
                  * After we're Alive, RF_KILL gets handled by
-                 *   iwl_rx_card_state_notif() */
+                 *   iwl4965_rx_card_state_notif() */
                 if (!hw_rf_kill && !test_bit(STATUS_ALIVE, &priv->status)) {
                         clear_bit(STATUS_RF_KILL_HW, &priv->status);
                         queue_work(priv->workqueue, &priv->restart);
@@ -5416,24 +5395,23 @@ static void iwl4965_init_band_reference(const struct iwl4965_priv *priv,
  * Based on band and channel number.
  */
 const struct iwl4965_channel_info *iwl4965_get_channel_info(const struct iwl4965_priv *priv,
-                                                    int phymode, u16 channel)
+                                                    enum ieee80211_band band, u16 channel)
 {
         int i;
 
-        switch (phymode) {
-        case MODE_IEEE80211A:
+        switch (band) {
+        case IEEE80211_BAND_5GHZ:
                 for (i = 14; i < priv->channel_count; i++) {
                         if (priv->channel_info[i].channel == channel)
                                 return &priv->channel_info[i];
                 }
                 break;
-
-        case MODE_IEEE80211B:
-        case MODE_IEEE80211G:
+        case IEEE80211_BAND_2GHZ:
                 if (channel >= 1 && channel <= 14)
                         return &priv->channel_info[channel - 1];
                 break;
-
+        default:
+                BUG();
         }
 
         return NULL;
@@ -5496,8 +5474,8 @@ static int iwl4965_init_channel_map(struct iwl4965_priv *priv)
                 /* Loop through each band adding each of the channels */
                 for (ch = 0; ch < eeprom_ch_count; ch++) {
                         ch_info->channel = eeprom_ch_index[ch];
-                        ch_info->phymode = (band == 1) ? MODE_IEEE80211B :
-                            MODE_IEEE80211A;
+                        ch_info->band = (band == 1) ? IEEE80211_BAND_2GHZ :
+                            IEEE80211_BAND_5GHZ;
 
                         /* permanently store EEPROM's channel regulatory flags
                          *   and max power in channel info database. */
@@ -5556,14 +5534,14 @@ static int iwl4965_init_channel_map(struct iwl4965_priv *priv)
 
         /* Two additional EEPROM bands for 2.4 and 5 GHz FAT channels */
         for (band = 6; band <= 7; band++) {
-                int phymode;
+                enum ieee80211_band ieeeband;
                 u8 fat_extension_chan;
 
                 iwl4965_init_band_reference(priv, band, &eeprom_ch_count,
                                         &eeprom_ch_info, &eeprom_ch_index);
 
                 /* EEPROM band 6 is 2.4, band 7 is 5 GHz */
-                phymode = (band == 6) ? MODE_IEEE80211B : MODE_IEEE80211A;
+                ieeeband = (band == 6) ? IEEE80211_BAND_2GHZ : IEEE80211_BAND_5GHZ;
 
                 /* Loop through each band adding each of the channels */
                 for (ch = 0; ch < eeprom_ch_count; ch++) {
@@ -5577,13 +5555,13 @@ static int iwl4965_init_channel_map(struct iwl4965_priv *priv)
                                 fat_extension_chan = HT_IE_EXT_CHANNEL_ABOVE;
 
                         /* Set up driver's info for lower half */
-                        iwl4965_set_fat_chan_info(priv, phymode,
+                        iwl4965_set_fat_chan_info(priv, ieeeband,
                                                   eeprom_ch_index[ch],
                                                   &(eeprom_ch_info[ch]),
                                                   fat_extension_chan);
 
                         /* Set up driver's info for upper half */
-                        iwl4965_set_fat_chan_info(priv, phymode,
+                        iwl4965_set_fat_chan_info(priv, ieeeband,
                                                   (eeprom_ch_index[ch] + 4),
                                                   &(eeprom_ch_info[ch]),
                                                   HT_IE_EXT_CHANNEL_BELOW);
@@ -5625,18 +5603,20 @@ static void iwl4965_free_channel_map(struct iwl4965_priv *priv)
 #define IWL_PASSIVE_DWELL_BASE      (100)
 #define IWL_CHANNEL_TUNE_TIME       5
 
-static inline u16 iwl4965_get_active_dwell_time(struct iwl4965_priv *priv, int phymode)
+static inline u16 iwl4965_get_active_dwell_time(struct iwl4965_priv *priv,
+                                                enum ieee80211_band band)
 {
-        if (phymode == MODE_IEEE80211A)
+        if (band == IEEE80211_BAND_5GHZ)
                 return IWL_ACTIVE_DWELL_TIME_52;
         else
                 return IWL_ACTIVE_DWELL_TIME_24;
 }
 
-static u16 iwl4965_get_passive_dwell_time(struct iwl4965_priv *priv, int phymode)
+static u16 iwl4965_get_passive_dwell_time(struct iwl4965_priv *priv,
+                                          enum ieee80211_band band)
 {
-        u16 active = iwl4965_get_active_dwell_time(priv, phymode);
-        u16 passive = (phymode != MODE_IEEE80211A) ?
+        u16 active = iwl4965_get_active_dwell_time(priv, band);
+        u16 passive = (band != IEEE80211_BAND_5GHZ) ?
             IWL_PASSIVE_DWELL_BASE + IWL_PASSIVE_DWELL_TIME_24 :
             IWL_PASSIVE_DWELL_BASE + IWL_PASSIVE_DWELL_TIME_52;
 
@@ -5656,28 +5636,29 @@ static u16 iwl4965_get_passive_dwell_time(struct iwl4965_priv *priv, int phymode
         return passive;
 }
 
-static int iwl4965_get_channels_for_scan(struct iwl4965_priv *priv, int phymode,
+static int iwl4965_get_channels_for_scan(struct iwl4965_priv *priv,
+                                         enum ieee80211_band band,
                                      u8 is_active, u8 direct_mask,
                                      struct iwl4965_scan_channel *scan_ch)
 {
         const struct ieee80211_channel *channels = NULL;
-        const struct ieee80211_hw_mode *hw_mode;
+        const struct ieee80211_supported_band *sband;
         const struct iwl4965_channel_info *ch_info;
         u16 passive_dwell = 0;
         u16 active_dwell = 0;
         int added, i;
 
-        hw_mode = iwl4965_get_hw_mode(priv, phymode);
-        if (!hw_mode)
+        sband = iwl4965_get_hw_mode(priv, band);
+        if (!sband)
                 return 0;
 
-        channels = hw_mode->channels;
+        channels = sband->channels;
 
-        active_dwell = iwl4965_get_active_dwell_time(priv, phymode);
-        passive_dwell = iwl4965_get_passive_dwell_time(priv, phymode);
+        active_dwell = iwl4965_get_active_dwell_time(priv, band);
+        passive_dwell = iwl4965_get_passive_dwell_time(priv, band);
 
-        for (i = 0, added = 0; i < hw_mode->num_channels; i++) {
-                if (channels[i].chan ==
+        for (i = 0, added = 0; i < sband->n_channels; i++) {
+                if (ieee80211_frequency_to_channel(channels[i].center_freq) ==
                     le16_to_cpu(priv->active_rxon.channel)) {
                         if (iwl4965_is_associated(priv)) {
                                 IWL_DEBUG_SCAN
@@ -5688,9 +5669,9 @@ static int iwl4965_get_channels_for_scan(struct iwl4965_priv *priv, int phymode,
                 } else if (priv->only_active_channel)
                         continue;
 
-                scan_ch->channel = channels[i].chan;
+                scan_ch->channel = ieee80211_frequency_to_channel(channels[i].center_freq);
 
-                ch_info = iwl4965_get_channel_info(priv, phymode,
+                ch_info = iwl4965_get_channel_info(priv, band,
                                          scan_ch->channel);
                 if (!is_channel_valid(ch_info)) {
                         IWL_DEBUG_SCAN("Channel %d is INVALID for this SKU.\n",
@@ -5699,7 +5680,7 @@ static int iwl4965_get_channels_for_scan(struct iwl4965_priv *priv, int phymode,
                 }
 
                 if (!is_active || is_channel_passive(ch_info) ||
-                    !(channels[i].flag & IEEE80211_CHAN_W_ACTIVE_SCAN))
+                    (channels[i].flags & IEEE80211_CHAN_PASSIVE_SCAN))
                         scan_ch->type = 0;      /* passive */
                 else
                         scan_ch->type = 1;      /* active */
@@ -5718,7 +5699,7 @@ static int iwl4965_get_channels_for_scan(struct iwl4965_priv *priv, int phymode,
                 /* scan_pwr_info->tpc.dsp_atten; */
 
                 /*scan_pwr_info->tpc.tx_gain; */
-                if (phymode == MODE_IEEE80211A)
+                if (band == IEEE80211_BAND_5GHZ)
                         scan_ch->tpc.tx_gain = ((1 << 5) | (3 << 3)) | 3;
                 else {
                         scan_ch->tpc.tx_gain = ((1 << 5) | (5 << 3));
@@ -5742,41 +5723,23 @@ static int iwl4965_get_channels_for_scan(struct iwl4965_priv *priv, int phymode,
         return added;
 }
 
-static void iwl4965_reset_channel_flag(struct iwl4965_priv *priv)
-{
-        int i, j;
-        for (i = 0; i < 3; i++) {
-                struct ieee80211_hw_mode *hw_mode = (void *)&priv->modes[i];
-                for (j = 0; j < hw_mode->num_channels; j++)
-                        hw_mode->channels[j].flag = hw_mode->channels[j].val;
-        }
-}
-
 static void iwl4965_init_hw_rates(struct iwl4965_priv *priv,
                               struct ieee80211_rate *rates)
 {
         int i;
 
         for (i = 0; i < IWL_RATE_COUNT; i++) {
-                rates[i].rate = iwl4965_rates[i].ieee * 5;
-                rates[i].val = i; /* Rate scaling will work on indexes */
-                rates[i].val2 = i;
-                rates[i].flags = IEEE80211_RATE_SUPPORTED;
-                /* Only OFDM have the bits-per-symbol set */
-                if ((i <= IWL_LAST_OFDM_RATE) && (i >= IWL_FIRST_OFDM_RATE))
-                        rates[i].flags |= IEEE80211_RATE_OFDM;
-                else {
+                rates[i].bitrate = iwl4965_rates[i].ieee * 5;
+                rates[i].hw_value = i; /* Rate scaling will work on indexes */
+                rates[i].hw_value_short = i;
+                rates[i].flags = 0;
+                if ((i > IWL_LAST_OFDM_RATE) || (i < IWL_FIRST_OFDM_RATE)) {
                         /*
-                         * If CCK 1M then set rate flag to CCK else CCK_2
-                         * which is CCK | PREAMBLE2
+                         * If CCK != 1M then set short preamble rate flag.
                          */
                         rates[i].flags |= (iwl4965_rates[i].plcp == 10) ?
-                                IEEE80211_RATE_CCK : IEEE80211_RATE_CCK_2;
+                                0 : IEEE80211_RATE_SHORT_PREAMBLE;
                 }
-
-                /* Set up which ones are basic rates... */
-                if (IWL_BASIC_RATES_MASK & (1 << i))
-                        rates[i].flags |= IEEE80211_RATE_BASIC;
         }
 }
 
@@ -5786,74 +5749,45 @@ static void iwl4965_init_hw_rates(struct iwl4965_priv *priv,
 static int iwl4965_init_geos(struct iwl4965_priv *priv)
 {
         struct iwl4965_channel_info *ch;
-        struct ieee80211_hw_mode *modes;
+        struct ieee80211_supported_band *band;
         struct ieee80211_channel *channels;
         struct ieee80211_channel *geo_ch;
         struct ieee80211_rate *rates;
         int i = 0;
-        enum {
-                A = 0,
-                B = 1,
-                G = 2,
-        };
-        int mode_count = 3;
 
-        if (priv->modes) {
+        if (priv->bands[IEEE80211_BAND_2GHZ].n_bitrates ||
+            priv->bands[IEEE80211_BAND_5GHZ].n_bitrates) {
                 IWL_DEBUG_INFO("Geography modes already initialized.\n");
                 set_bit(STATUS_GEO_CONFIGURED, &priv->status);
                 return 0;
         }
 
-        modes = kzalloc(sizeof(struct ieee80211_hw_mode) * mode_count,
-                        GFP_KERNEL);
-        if (!modes)
-                return -ENOMEM;
-
         channels = kzalloc(sizeof(struct ieee80211_channel) *
                            priv->channel_count, GFP_KERNEL);
-        if (!channels) {
-                kfree(modes);
+        if (!channels)
                 return -ENOMEM;
-        }
 
         rates = kzalloc((sizeof(struct ieee80211_rate) * (IWL_MAX_RATES + 1)),
                         GFP_KERNEL);
         if (!rates) {
-                kfree(modes);
                 kfree(channels);
                 return -ENOMEM;
         }
 
-        /* 0 = 802.11a
-         * 1 = 802.11b
-         * 2 = 802.11g
-         */
-
         /* 5.2GHz channels start after the 2.4GHz channels */
-        modes[A].mode = MODE_IEEE80211A;
-        modes[A].channels = &channels[ARRAY_SIZE(iwl4965_eeprom_band_1)];
-        modes[A].rates = rates;
-        modes[A].num_rates = 8; /* just OFDM */
-        modes[A].rates = &rates[4];
-        modes[A].num_channels = 0;
-#ifdef CONFIG_IWL4965_HT
-        iwl4965_init_ht_hw_capab(&modes[A].ht_info, MODE_IEEE80211A);
-#endif
+        band = &priv->bands[IEEE80211_BAND_5GHZ];
+        band->channels = &channels[ARRAY_SIZE(iwl4965_eeprom_band_1)];
+        band->bitrates = &rates[4];
+        band->n_bitrates = 8;   /* just OFDM */
 
-        modes[B].mode = MODE_IEEE80211B;
-        modes[B].channels = channels;
-        modes[B].rates = rates;
-        modes[B].num_rates = 4; /* just CCK */
-        modes[B].num_channels = 0;
-
-        modes[G].mode = MODE_IEEE80211G;
-        modes[G].channels = channels;
-        modes[G].rates = rates;
-        modes[G].num_rates = 12;        /* OFDM & CCK */
-        modes[G].num_channels = 0;
-#ifdef CONFIG_IWL4965_HT
-        iwl4965_init_ht_hw_capab(&modes[G].ht_info, MODE_IEEE80211G);
-#endif
+        iwl4965_init_ht_hw_capab(&band->ht_info, IEEE80211_BAND_5GHZ);
+
+        band = &priv->bands[IEEE80211_BAND_2GHZ];
+        band->channels = channels;
+        band->bitrates = rates;
+        band->n_bitrates = 12;  /* OFDM & CCK */
+
+        iwl4965_init_ht_hw_capab(&band->ht_info, IEEE80211_BAND_2GHZ);
 
         priv->ieee_channels = channels;
         priv->ieee_rates = rates;
@@ -5872,37 +5806,33 @@ static int iwl4965_init_geos(struct iwl4965_priv *priv)
                 }
 
                 if (is_channel_a_band(ch)) {
-                        geo_ch = &modes[A].channels[modes[A].num_channels++];
-                } else {
-                        geo_ch = &modes[B].channels[modes[B].num_channels++];
-                        modes[G].num_channels++;
-                }
+                        geo_ch = &priv->bands[IEEE80211_BAND_5GHZ].channels[priv->bands[IEEE80211_BAND_5GHZ].n_channels++];
+                } else
+                        geo_ch = &priv->bands[IEEE80211_BAND_2GHZ].channels[priv->bands[IEEE80211_BAND_2GHZ].n_channels++];
 
-                geo_ch->freq = ieee80211chan2mhz(ch->channel);
-                geo_ch->chan = ch->channel;
-                geo_ch->power_level = ch->max_power_avg;
-                geo_ch->antenna_max = 0xff;
+                geo_ch->center_freq = ieee80211chan2mhz(ch->channel);
+                geo_ch->max_power = ch->max_power_avg;
+                geo_ch->max_antenna_gain = 0xff;
+                geo_ch->hw_value = ch->channel;
 
                 if (is_channel_valid(ch)) {
-                        geo_ch->flag = IEEE80211_CHAN_W_SCAN;
-                        if (ch->flags & EEPROM_CHANNEL_IBSS)
-                                geo_ch->flag |= IEEE80211_CHAN_W_IBSS;
+                        if (!(ch->flags & EEPROM_CHANNEL_IBSS))
+                                geo_ch->flags |= IEEE80211_CHAN_NO_IBSS;
 
-                        if (ch->flags & EEPROM_CHANNEL_ACTIVE)
-                                geo_ch->flag |= IEEE80211_CHAN_W_ACTIVE_SCAN;
+                        if (!(ch->flags & EEPROM_CHANNEL_ACTIVE))
+                                geo_ch->flags |= IEEE80211_CHAN_PASSIVE_SCAN;
 
                         if (ch->flags & EEPROM_CHANNEL_RADAR)
-                                geo_ch->flag |= IEEE80211_CHAN_W_RADAR_DETECT;
+                                geo_ch->flags |= IEEE80211_CHAN_RADAR;
 
                         if (ch->max_power_avg > priv->max_channel_txpower_limit)
                                 priv->max_channel_txpower_limit =
                                     ch->max_power_avg;
-                }
-
-                geo_ch->val = geo_ch->flag;
+                } else
+                        geo_ch->flags |= IEEE80211_CHAN_DISABLED;
         }
 
-        if ((modes[A].num_channels == 0) && priv->is_abg) {
+        if ((priv->bands[IEEE80211_BAND_5GHZ].n_channels == 0) && priv->is_abg) {
                 printk(KERN_INFO DRV_NAME
                        ": Incorrectly detected BG card as ABG.  Please send "
                        "your PCI ID 0x%04X:0x%04X to maintainer.\n",
@@ -5912,24 +5842,12 @@ static int iwl4965_init_geos(struct iwl4965_priv *priv)
 
         printk(KERN_INFO DRV_NAME
                ": Tunable channels: %d 802.11bg, %d 802.11a channels\n",
-               modes[G].num_channels, modes[A].num_channels);
-
-        /*
-         * NOTE:  We register these in preference of order -- the
-         * stack doesn't currently (as of 7.0.6 / Apr 24 '07) pick
-         * a phymode based on rates or AP capabilities but seems to
-         * configure it purely on if the channel being configured
-         * is supported by a mode -- and the first match is taken
-         */
+               priv->bands[IEEE80211_BAND_2GHZ].n_channels,
+               priv->bands[IEEE80211_BAND_5GHZ].n_channels);
 
-        if (modes[G].num_channels)
-                ieee80211_register_hwmode(priv->hw, &modes[G]);
-        if (modes[B].num_channels)
-                ieee80211_register_hwmode(priv->hw, &modes[B]);
-        if (modes[A].num_channels)
-                ieee80211_register_hwmode(priv->hw, &modes[A]);
+        priv->hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &priv->bands[IEEE80211_BAND_2GHZ];
+        priv->hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &priv->bands[IEEE80211_BAND_5GHZ];
 
-        priv->modes = modes;
         set_bit(STATUS_GEO_CONFIGURED, &priv->status);
 
         return 0;
@@ -5940,7 +5858,6 @@ static int iwl4965_init_geos(struct iwl4965_priv *priv)
  */
 static void iwl4965_free_geos(struct iwl4965_priv *priv)
 {
-        kfree(priv->modes);
         kfree(priv->ieee_channels);
         kfree(priv->ieee_rates);
         clear_bit(STATUS_GEO_CONFIGURED, &priv->status);
@@ -6941,8 +6858,9 @@ static void iwl4965_bg_request_scan(struct work_struct *data)
         int rc = 0;
         struct iwl4965_scan_cmd *scan;
         struct ieee80211_conf *conf = NULL;
+        u16 cmd_len;
+        enum ieee80211_band band;
         u8 direct_mask;
-        int phymode;
 
         conf = ieee80211_get_hw_conf(priv->hw);
 
@@ -7051,18 +6969,10 @@ static void iwl4965_bg_request_scan(struct work_struct *data)
         } else
                 direct_mask = 0;
 
-        /* We don't build a direct scan probe request; the uCode will do
-         * that based on the direct_mask added to each channel entry */
-        scan->tx_cmd.len = cpu_to_le16(
-                iwl4965_fill_probe_req(priv, (struct ieee80211_mgmt *)scan->data,
-                        IWL_MAX_SCAN_SIZE - sizeof(*scan), 0));
         scan->tx_cmd.tx_flags = TX_CMD_FLG_SEQ_CTL_MSK;
         scan->tx_cmd.sta_id = priv->hw_setting.bcast_sta_id;
         scan->tx_cmd.stop_time.life_time = TX_CMD_LIFE_TIME_INFINITE;
 
-        /* flags + rate selection */
-
-        scan->tx_cmd.tx_flags |= cpu_to_le32(0x200);
 
         switch (priv->scan_bands) {
         case 2:
@@ -7072,7 +6982,7 @@ static void iwl4965_bg_request_scan(struct work_struct *data)
                                 RATE_MCS_ANT_B_MSK|RATE_MCS_CCK_MSK);
 
                 scan->good_CRC_th = 0;
-                phymode = MODE_IEEE80211G;
+                band = IEEE80211_BAND_2GHZ;
                 break;
 
         case 1:
@@ -7080,7 +6990,7 @@ static void iwl4965_bg_request_scan(struct work_struct *data)
                                 iwl4965_hw_set_rate_n_flags(IWL_RATE_6M_PLCP,
                                 RATE_MCS_ANT_B_MSK);
                 scan->good_CRC_th = IWL_GOOD_CRC_TH;
-                phymode = MODE_IEEE80211A;
+                band = IEEE80211_BAND_5GHZ;
                 break;
 
         default:
@@ -7088,6 +6998,13 @@ static void iwl4965_bg_request_scan(struct work_struct *data)
                 goto done;
         }
 
+        /* We don't build a direct scan probe request; the uCode will do
+         * that based on the direct_mask added to each channel entry */
+        cmd_len = iwl4965_fill_probe_req(priv, band,
+                                        (struct ieee80211_mgmt *)scan->data,
+                                        IWL_MAX_SCAN_SIZE - sizeof(*scan), 0);
+
+        scan->tx_cmd.len = cpu_to_le16(cmd_len);
         /* select Rx chains */
 
         /* Force use of chains B and C (0x6) for scan Rx.
@@ -7110,7 +7027,7 @@ static void iwl4965_bg_request_scan(struct work_struct *data)
 
         scan->channel_count =
                 iwl4965_get_channels_for_scan(
-                        priv, phymode, 1, /* active */
+                        priv, band, 1, /* active */
                         direct_mask,
                         (void *)&scan->data[le16_to_cpu(scan->tx_cmd.len)]);
 
@@ -7281,9 +7198,8 @@ static void iwl4965_bg_post_associate(struct work_struct *data)
         if (priv->iw_mode == IEEE80211_IF_TYPE_IBSS)
                 priv->assoc_station_added = 1;
 
-#ifdef CONFIG_IWL4965_QOS
         iwl4965_activate_qos(priv, 0);
-#endif /* CONFIG_IWL4965_QOS */
+
         /* we have just associated, don't start scan too early */
         priv->next_scan_jiffies = jiffies + IWL_DELAY_NEXT_SCAN;
         mutex_unlock(&priv->mutex);
@@ -7460,7 +7376,7 @@ static int iwl4965_mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb,
         }
 
         IWL_DEBUG_TX("dev->xmit(%d bytes) at rate 0x%02x\n", skb->len,
-                     ctl->tx_rate);
+                     ctl->tx_rate->bitrate);
 
         if (iwl4965_tx_skb(priv, skb, ctl))
                 dev_kfree_skb_any(skb);
@@ -7519,7 +7435,7 @@ static int iwl4965_mac_config(struct ieee80211_hw *hw, struct ieee80211_conf *co
         int ret = 0;
 
         mutex_lock(&priv->mutex);
-        IWL_DEBUG_MAC80211("enter to channel %d\n", conf->channel);
+        IWL_DEBUG_MAC80211("enter to channel %d\n", conf->channel->hw_value);
 
         priv->add_radiotap = !!(conf->flags & IEEE80211_CONF_RADIOTAP);
 
@@ -7539,10 +7455,9 @@ static int iwl4965_mac_config(struct ieee80211_hw *hw, struct ieee80211_conf *co
 
         spin_lock_irqsave(&priv->lock, flags);
 
-        ch_info = iwl4965_get_channel_info(priv, conf->phymode, conf->channel);
+        ch_info = iwl4965_get_channel_info(priv, conf->channel->band,
+                        ieee80211_frequency_to_channel(conf->channel->center_freq));
         if (!is_channel_valid(ch_info)) {
-                IWL_DEBUG_SCAN("Channel %d [%d] is INVALID for this SKU.\n",
-                               conf->channel, conf->phymode);
                 IWL_DEBUG_MAC80211("leave - invalid channel\n");
                 spin_unlock_irqrestore(&priv->lock, flags);
                 ret = -EINVAL;
@@ -7550,10 +7465,10 @@ static int iwl4965_mac_config(struct ieee80211_hw *hw, struct ieee80211_conf *co
         }
 
 #ifdef CONFIG_IWL4965_HT
-        /* if we are switching fron ht to 2.4 clear flags
+        /* if we are switching from ht to 2.4 clear flags
          * from any ht related info since 2.4 does not
          * support ht */
-        if ((le16_to_cpu(priv->staging_rxon.channel) != conf->channel)
+        if ((le16_to_cpu(priv->staging_rxon.channel) != conf->channel->hw_value)
 #ifdef IEEE80211_CONF_CHANNEL_SWITCH
             && !(conf->flags & IEEE80211_CONF_CHANNEL_SWITCH)
 #endif
@@ -7561,12 +7476,13 @@ static int iwl4965_mac_config(struct ieee80211_hw *hw, struct ieee80211_conf *co
                 priv->staging_rxon.flags = 0;
 #endif /* CONFIG_IWL4965_HT */
 
-        iwl4965_set_rxon_channel(priv, conf->phymode, conf->channel);
+        iwl4965_set_rxon_channel(priv, conf->channel->band,
+                ieee80211_frequency_to_channel(conf->channel->center_freq));
 
-        iwl4965_set_flags_for_phymode(priv, conf->phymode);
+        iwl4965_set_flags_for_phymode(priv, conf->channel->band);
 
         /* The list of supported rates and rate mask can be different
-         * for each phymode; since the phymode may have changed, reset
+         * for each band; since the band may have changed, reset
          * the rate mask to what mac80211 lists */
         iwl4965_set_rate(priv);
 
@@ -7658,9 +7574,7 @@ static void iwl4965_config_ap(struct iwl4965_priv *priv)
                 /* restore RXON assoc */
                 priv->staging_rxon.filter_flags |= RXON_FILTER_ASSOC_MSK;
                 iwl4965_commit_rxon(priv);
-#ifdef CONFIG_IWL4965_QOS
                 iwl4965_activate_qos(priv, 1);
-#endif
                 iwl4965_rxon_add_station(priv, iwl4965_broadcast_addr, 0);
         }
         iwl4965_send_beacon_cmd(priv);
@@ -7836,7 +7750,7 @@ static void iwl4965_bss_info_changed(struct ieee80211_hw *hw,
         }
 
         if (changes & BSS_CHANGED_ERP_CTS_PROT) {
-                if (bss_conf->use_cts_prot && (priv->phymode != MODE_IEEE80211A))
+                if (bss_conf->use_cts_prot && (priv->band != IEEE80211_BAND_5GHZ))
                         priv->staging_rxon.flags |= RXON_FLG_TGG_PROTECT_MSK;
                 else
                         priv->staging_rxon.flags &= ~RXON_FLG_TGG_PROTECT_MSK;
@@ -7974,10 +7888,8 @@ static int iwl4965_mac_conf_tx(struct ieee80211_hw *hw, int queue,
                            const struct ieee80211_tx_queue_params *params)
 {
         struct iwl4965_priv *priv = hw->priv;
-#ifdef CONFIG_IWL4965_QOS
         unsigned long flags;
         int q;
-#endif /* CONFIG_IWL4965_QOS */
 
         IWL_DEBUG_MAC80211("enter\n");
 
@@ -7991,7 +7903,6 @@ static int iwl4965_mac_conf_tx(struct ieee80211_hw *hw, int queue,
                 return 0;
         }
 
-#ifdef CONFIG_IWL4965_QOS
         if (!priv->qos_data.qos_enable) {
                 priv->qos_data.qos_active = 0;
                 IWL_DEBUG_MAC80211("leave - qos not enabled\n");
@@ -8005,7 +7916,7 @@ static int iwl4965_mac_conf_tx(struct ieee80211_hw *hw, int queue,
         priv->qos_data.def_qos_parm.ac[q].cw_max = cpu_to_le16(params->cw_max);
         priv->qos_data.def_qos_parm.ac[q].aifsn = params->aifs;
         priv->qos_data.def_qos_parm.ac[q].edca_txop =
-                        cpu_to_le16((params->burst_time * 100));
+                        cpu_to_le16((params->txop * 32));
 
         priv->qos_data.def_qos_parm.ac[q].reserved1 = 0;
         priv->qos_data.qos_active = 1;
@@ -8020,8 +7931,6 @@ static int iwl4965_mac_conf_tx(struct ieee80211_hw *hw, int queue,
 
         mutex_unlock(&priv->mutex);
 
-#endif /*CONFIG_IWL4965_QOS */
-
         IWL_DEBUG_MAC80211("leave\n");
         return 0;
 }
@@ -8091,23 +8000,9 @@ static void iwl4965_mac_reset_tsf(struct ieee80211_hw *hw)
         spin_lock_irqsave(&priv->lock, flags);
         memset(&priv->current_ht_config, 0, sizeof(struct iwl_ht_info));
         spin_unlock_irqrestore(&priv->lock, flags);
-#ifdef CONFIG_IWL4965_HT_AGG
-/*      if (priv->lq_mngr.agg_ctrl.granted_ba)
-                iwl4965_turn_off_agg(priv, TID_ALL_SPECIFIED);*/
-
-        memset(&(priv->lq_mngr.agg_ctrl), 0, sizeof(struct iwl4965_agg_control));
-        priv->lq_mngr.agg_ctrl.tid_traffic_load_threshold = 10;
-        priv->lq_mngr.agg_ctrl.ba_timeout = 5000;
-        priv->lq_mngr.agg_ctrl.auto_agg = 1;
-
-        if (priv->lq_mngr.agg_ctrl.auto_agg)
-                priv->lq_mngr.agg_ctrl.requested_ba = TID_ALL_ENABLED;
-#endif /*CONFIG_IWL4965_HT_AGG */
 #endif /* CONFIG_IWL4965_HT */
 
-#ifdef CONFIG_IWL4965_QOS
         iwl4965_reset_qos(priv);
-#endif
 
         cancel_delayed_work(&priv->post_associate);
 
@@ -8196,9 +8091,7 @@ static int iwl4965_mac_beacon_update(struct ieee80211_hw *hw, struct sk_buff *sk
         IWL_DEBUG_MAC80211("leave\n");
         spin_unlock_irqrestore(&priv->lock, flags);
 
-#ifdef CONFIG_IWL4965_QOS
         iwl4965_reset_qos(priv);
-#endif
 
         queue_work(priv->workqueue, &priv->post_associate.work);
 
@@ -8281,28 +8174,6 @@ static int iwl4965_mac_conf_ht(struct ieee80211_hw *hw,
         return 0;
 }
 
-static void iwl4965_set_ht_capab(struct ieee80211_hw *hw,
-                        struct ieee80211_ht_cap *ht_cap,
-                        u8 use_current_config)
-{
-        struct ieee80211_conf *conf = &hw->conf;
-        struct ieee80211_hw_mode *mode = conf->mode;
-
-        if (use_current_config) {
-                ht_cap->cap_info = cpu_to_le16(conf->ht_conf.cap);
-                memcpy(ht_cap->supp_mcs_set,
-                                conf->ht_conf.supp_mcs_set, 16);
-        } else {
-                ht_cap->cap_info = cpu_to_le16(mode->ht_info.cap);
-                memcpy(ht_cap->supp_mcs_set,
-                                mode->ht_info.supp_mcs_set, 16);
-        }
-        ht_cap->ampdu_params_info =
-                (mode->ht_info.ampdu_factor & IEEE80211_HT_CAP_AMPDU_FACTOR) |
-                ((mode->ht_info.ampdu_density << 2) &
-                                        IEEE80211_HT_CAP_AMPDU_DENSITY);
-}
-
 #endif /*CONFIG_IWL4965_HT*/
 
 /*****************************************************************************
@@ -8497,65 +8368,6 @@ static ssize_t store_filter_flags(struct device *d,
 static DEVICE_ATTR(filter_flags, S_IWUSR | S_IRUGO, show_filter_flags,
                    store_filter_flags);
 
-static ssize_t show_tune(struct device *d,
-                         struct device_attribute *attr, char *buf)
-{
-        struct iwl4965_priv *priv = (struct iwl4965_priv *)d->driver_data;
-
-        return sprintf(buf, "0x%04X\n",
-                       (priv->phymode << 8) |
-                        le16_to_cpu(priv->active_rxon.channel));
-}
-
-static void iwl4965_set_flags_for_phymode(struct iwl4965_priv *priv, u8 phymode);
-
-static ssize_t store_tune(struct device *d,
-                          struct device_attribute *attr,
-                          const char *buf, size_t count)
-{
-        struct iwl4965_priv *priv = (struct iwl4965_priv *)d->driver_data;
-        char *p = (char *)buf;
-        u16 tune = simple_strtoul(p, &p, 0);
-        u8 phymode = (tune >> 8) & 0xff;
-        u16 channel = tune & 0xff;
-
-        IWL_DEBUG_INFO("Tune request to:%d channel:%d\n", phymode, channel);
-
-        mutex_lock(&priv->mutex);
-        if ((le16_to_cpu(priv->staging_rxon.channel) != channel) ||
-            (priv->phymode != phymode)) {
-                const struct iwl4965_channel_info *ch_info;
-
-                ch_info = iwl4965_get_channel_info(priv, phymode, channel);
-                if (!ch_info) {
-                        IWL_WARNING("Requested invalid phymode/channel "
-                                    "combination: %d %d\n", phymode, channel);
-                        mutex_unlock(&priv->mutex);
-                        return -EINVAL;
-                }
-
-                /* Cancel any currently running scans... */
-                if (iwl4965_scan_cancel_timeout(priv, 100))
-                        IWL_WARNING("Could not cancel scan.\n");
-                else {
-                        IWL_DEBUG_INFO("Committing phymode and "
-                                       "rxon.channel = %d %d\n",
-                                       phymode, channel);
-
-                        iwl4965_set_rxon_channel(priv, phymode, channel);
-                        iwl4965_set_flags_for_phymode(priv, phymode);
-
-                        iwl4965_set_rate(priv);
-                        iwl4965_commit_rxon(priv);
-                }
-        }
-        mutex_unlock(&priv->mutex);
-
-        return count;
-}
-
-static DEVICE_ATTR(tune, S_IWUSR | S_IRUGO, show_tune, store_tune);
-
 #ifdef CONFIG_IWL4965_SPECTRUM_MEASUREMENT
 
 static ssize_t show_measurement(struct device *d,
@@ -8745,73 +8557,8 @@ static DEVICE_ATTR(power_level, S_IWUSR | S_IRUSR, show_power_level,
 static ssize_t show_channels(struct device *d,
                              struct device_attribute *attr, char *buf)
 {
-        struct iwl4965_priv *priv = dev_get_drvdata(d);
-        int len = 0, i;
-        struct ieee80211_channel *channels = NULL;
-        const struct ieee80211_hw_mode *hw_mode = NULL;
-        int count = 0;
-
-        if (!iwl4965_is_ready(priv))
-                return -EAGAIN;
-
-        hw_mode = iwl4965_get_hw_mode(priv, MODE_IEEE80211G);
-        if (!hw_mode)
-                hw_mode = iwl4965_get_hw_mode(priv, MODE_IEEE80211B);
-        if (hw_mode) {
-                channels = hw_mode->channels;
-                count = hw_mode->num_channels;
-        }
-
-        len +=
-            sprintf(&buf[len],
-                    "Displaying %d channels in 2.4GHz band "
-                    "(802.11bg):\n", count);
-
-        for (i = 0; i < count; i++)
-                len += sprintf(&buf[len], "%d: %ddBm: BSS%s%s, %s.\n",
-                               channels[i].chan,
-                               channels[i].power_level,
-                               channels[i].
-                               flag & IEEE80211_CHAN_W_RADAR_DETECT ?
-                               " (IEEE 802.11h required)" : "",
-                               (!(channels[i].flag & IEEE80211_CHAN_W_IBSS)
-                                || (channels[i].
-                                    flag &
-                                    IEEE80211_CHAN_W_RADAR_DETECT)) ? "" :
-                               ", IBSS",
-                               channels[i].
-                               flag & IEEE80211_CHAN_W_ACTIVE_SCAN ?
-                               "active/passive" : "passive only");
-
-        hw_mode = iwl4965_get_hw_mode(priv, MODE_IEEE80211A);
-        if (hw_mode) {
-                channels = hw_mode->channels;
-                count = hw_mode->num_channels;
-        } else {
-                channels = NULL;
-                count = 0;
-        }
-
-        len += sprintf(&buf[len], "Displaying %d channels in 5.2GHz band "
-                       "(802.11a):\n", count);
-
-        for (i = 0; i < count; i++)
-                len += sprintf(&buf[len], "%d: %ddBm: BSS%s%s, %s.\n",
-                               channels[i].chan,
-                               channels[i].power_level,
-                               channels[i].
-                               flag & IEEE80211_CHAN_W_RADAR_DETECT ?
-                               " (IEEE 802.11h required)" : "",
-                               (!(channels[i].flag & IEEE80211_CHAN_W_IBSS)
-                                || (channels[i].
-                                    flag &
-                                    IEEE80211_CHAN_W_RADAR_DETECT)) ? "" :
-                               ", IBSS",
-                               channels[i].
-                               flag & IEEE80211_CHAN_W_ACTIVE_SCAN ?
-                               "active/passive" : "passive only");
-
-        return len;
+        /* all this shit doesn't belong into sysfs anyway */
+        return 0;
 }
 
 static DEVICE_ATTR(channels, S_IRUSR, show_channels, NULL);
@@ -8990,7 +8737,6 @@ static struct attribute *iwl4965_sysfs_entries[] = {
         &dev_attr_statistics.attr,
         &dev_attr_status.attr,
         &dev_attr_temperature.attr,
-        &dev_attr_tune.attr,
         &dev_attr_tx_power.attr,
 
         NULL
@@ -9021,10 +8767,6 @@ static struct ieee80211_ops iwl4965_hw_ops = {
 #ifdef CONFIG_IWL4965_HT
         .conf_ht = iwl4965_mac_conf_ht,
         .ampdu_action = iwl4965_mac_ampdu_action,
-#ifdef CONFIG_IWL4965_HT_AGG
-        .ht_tx_agg_start = iwl4965_mac_ht_tx_agg_start,
-        .ht_tx_agg_stop = iwl4965_mac_ht_tx_agg_stop,
-#endif  /* CONFIG_IWL4965_HT_AGG */
 #endif  /* CONFIG_IWL4965_HT */
         .hw_scan = iwl4965_mac_hw_scan
 };
@@ -9093,10 +8835,8 @@ static int iwl4965_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
         /* Default value; 4 EDCA QOS priorities */
         hw->queues = 4;
 #ifdef CONFIG_IWL4965_HT
-#ifdef CONFIG_IWL4965_HT_AGG
         /* Enhanced value; more queues, to support 11n aggregation */
         hw->queues = 16;
-#endif /* CONFIG_IWL4965_HT_AGG */
 #endif /* CONFIG_IWL4965_HT */
 
         spin_lock_init(&priv->lock);
@@ -9124,7 +8864,7 @@ static int iwl4965_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
         priv->data_retry_limit = -1;
         priv->ieee_channels = NULL;
         priv->ieee_rates = NULL;
-        priv->phymode = -1;
+        priv->band = IEEE80211_BAND_2GHZ;
 
         err = pci_set_dma_mask(pdev, DMA_32BIT_MASK);
         if (!err)
@@ -9180,7 +8920,6 @@ static int iwl4965_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
                 goto out_iounmap;
         }
 
-#ifdef CONFIG_IWL4965_QOS
         if (iwl4965_param_qos_enable)
                 priv->qos_data.qos_enable = 1;
 
@@ -9188,9 +8927,8 @@ static int iwl4965_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
 
         priv->qos_data.qos_active = 0;
         priv->qos_data.qos_cap.val = 0;
-#endif /* CONFIG_IWL4965_QOS */
 
-        iwl4965_set_rxon_channel(priv, MODE_IEEE80211G, 6);
+        iwl4965_set_rxon_channel(priv, IEEE80211_BAND_2GHZ, 6);
         iwl4965_setup_deferred_work(priv);
         iwl4965_setup_rx_handlers(priv);
 
@@ -9241,7 +8979,6 @@ static int iwl4965_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
                 IWL_ERROR("initializing geos failed: %d\n", err);
                 goto out_free_channel_map;
         }
-        iwl4965_reset_channel_flag(priv);
 
         iwl4965_rate_control_register(priv->hw);
         err = ieee80211_register_hw(priv->hw);
diff --git a/drivers/net/wireless/libertas/assoc.c b/drivers/net/wireless/libertas/assoc.c
index 87e145ffe8f1..75f6191e718d 100644
--- a/drivers/net/wireless/libertas/assoc.c
+++ b/drivers/net/wireless/libertas/assoc.c
@@ -181,17 +181,6 @@ int lbs_update_channel(struct lbs_private *priv)
         return ret;
 }
 
-void lbs_sync_channel(struct work_struct *work)
-{
-        struct lbs_private *priv = container_of(work, struct lbs_private,
-                sync_channel);
-
-        lbs_deb_enter(LBS_DEB_ASSOC);
-        if (lbs_update_channel(priv))
-                lbs_pr_info("Channel synchronization failed.");
-        lbs_deb_leave(LBS_DEB_ASSOC);
-}
-
 static int assoc_helper_channel(struct lbs_private *priv,
                                 struct assoc_request * assoc_req)
 {
@@ -413,11 +402,10 @@ static int should_deauth_infrastructure(struct lbs_private *priv,
 {
         int ret = 0;
 
-        lbs_deb_enter(LBS_DEB_ASSOC);
-
         if (priv->connect_status != LBS_CONNECTED)
                 return 0;
 
+        lbs_deb_enter(LBS_DEB_ASSOC);
         if (test_bit(ASSOC_FLAG_SSID, &assoc_req->flags)) {
                 lbs_deb_assoc("Deauthenticating due to new SSID\n");
                 ret = 1;
@@ -456,7 +444,7 @@ static int should_deauth_infrastructure(struct lbs_private *priv,
 
 out:
         lbs_deb_leave_args(LBS_DEB_ASSOC, "ret %d", ret);
-        return 0;
+        return ret;
 }
 
 
@@ -643,9 +631,7 @@ void lbs_association_worker(struct work_struct *work)
                 }
 
                 if (success) {
-                        lbs_deb_assoc("ASSOC: associated to '%s', %s\n",
-                                escape_essid(priv->curbssparams.ssid,
-                                             priv->curbssparams.ssid_len),
+                        lbs_deb_assoc("associated to %s\n",
                                 print_mac(mac, priv->curbssparams.bssid));
                         lbs_prepare_and_send_command(priv,
                                 CMD_802_11_RSSI,
diff --git a/drivers/net/wireless/libertas/assoc.h b/drivers/net/wireless/libertas/assoc.h
index 08372bbf3761..d489cf4cc1e2 100644
--- a/drivers/net/wireless/libertas/assoc.h
+++ b/drivers/net/wireless/libertas/assoc.h
@@ -7,6 +7,5 @@
 
 void lbs_association_worker(struct work_struct *work);
 struct assoc_request *lbs_get_association_request(struct lbs_private *priv);
-void lbs_sync_channel(struct work_struct *work);
 
 #endif /* _LBS_ASSOC_H */
diff --git a/drivers/net/wireless/libertas/cmd.c b/drivers/net/wireless/libertas/cmd.c
index b3c1acbcc655..3f9074df91e4 100644
--- a/drivers/net/wireless/libertas/cmd.c
+++ b/drivers/net/wireless/libertas/cmd.c
@@ -1153,9 +1153,9 @@ static void lbs_submit_command(struct lbs_private *priv,
             command == CMD_802_11_AUTHENTICATE)
                 timeo = 10 * HZ;
 
-        lbs_deb_host("DNLD_CMD: command 0x%04x, seq %d, size %d, jiffies %lu\n",
+        lbs_deb_cmd("DNLD_CMD: command 0x%04x, seq %d, size %d, jiffies %lu\n",
                      command, le16_to_cpu(cmd->seqnum), cmdsize, jiffies);
-        lbs_deb_hex(LBS_DEB_HOST, "DNLD_CMD", (void *) cmdnode->cmdbuf, cmdsize);
+        lbs_deb_hex(LBS_DEB_CMD, "DNLD_CMD", (void *) cmdnode->cmdbuf, cmdsize);
 
         ret = priv->hw_host_to_card(priv, MVMS_CMD, (u8 *) cmd, cmdsize);
 
@@ -1164,9 +1164,7 @@ static void lbs_submit_command(struct lbs_private *priv,
                 /* Let the timer kick in and retry, and potentially reset
                    the whole thing if the condition persists */
                 timeo = HZ;
-        } else
-                lbs_deb_cmd("DNLD_CMD: sent command 0x%04x, jiffies %lu\n",
-                            command, jiffies);
+        }
 
         /* Setup the timer after transmit command */
         mod_timer(&priv->command_timer, jiffies + timeo);
@@ -1185,7 +1183,7 @@ static int lbs_cmd_mac_control(struct lbs_private *priv,
         cmd->size = cpu_to_le16(sizeof(struct cmd_ds_mac_control) + S_DS_GEN);
         mac->action = cpu_to_le16(priv->currentpacketfilter);
 
-        lbs_deb_cmd("MAC_CONTROL: action 0x%x, size %d\n",
+        lbs_deb_cmd("MAC_CONTROL: action 0x%04x, size %d\n",
                     le16_to_cpu(mac->action), le16_to_cpu(cmd->size));
 
         lbs_deb_leave(LBS_DEB_CMD);
@@ -1741,9 +1739,9 @@ int lbs_execute_next_command(struct lbs_private *priv)
         unsigned long flags;
         int ret = 0;
 
-        // Debug group is LBS_DEB_THREAD and not LBS_DEB_HOST, because the
-        // only caller to us is lbs_thread() and we get even when a
-        // data packet is received
+        /* Debug group is LBS_DEB_THREAD and not LBS_DEB_HOST, because the
+         * only caller to us is lbs_thread() and we get even when a
+         * data packet is received */
         lbs_deb_enter(LBS_DEB_THREAD);
 
         spin_lock_irqsave(&priv->driver_lock, flags);
@@ -2043,15 +2041,8 @@ int lbs_cmd_copyback(struct lbs_private *priv, unsigned long extra,
         struct cmd_header *buf = (void *)extra;
         uint16_t copy_len;
 
-        lbs_deb_enter(LBS_DEB_CMD);
-
         copy_len = min(le16_to_cpu(buf->size), le16_to_cpu(resp->size));
-        lbs_deb_cmd("Copying back %u bytes; command response was %u bytes, "
-                    "copy back buffer was %u bytes\n", copy_len,
-                    le16_to_cpu(resp->size), le16_to_cpu(buf->size));
         memcpy(buf, resp, copy_len);
-
-        lbs_deb_leave(LBS_DEB_CMD);
         return 0;
 }
 EXPORT_SYMBOL_GPL(lbs_cmd_copyback);
diff --git a/drivers/net/wireless/libertas/cmdresp.c b/drivers/net/wireless/libertas/cmdresp.c
index 159216a91903..a0a5dbe81b3b 100644
--- a/drivers/net/wireless/libertas/cmdresp.c
+++ b/drivers/net/wireless/libertas/cmdresp.c
@@ -74,7 +74,7 @@ void lbs_mac_event_disconnected(struct lbs_private *priv)
                 lbs_deb_cmd("disconnected, so exit PS mode\n");
                 lbs_ps_wakeup(priv, 0);
         }
-        lbs_deb_leave(LBS_DEB_CMD);
+        lbs_deb_leave(LBS_DEB_ASSOC);
 }
 
 /**
@@ -568,9 +568,9 @@ int lbs_process_rx_command(struct lbs_private *priv)
         respcmd = le16_to_cpu(resp->command);
         result = le16_to_cpu(resp->result);
 
-        lbs_deb_host("CMD_RESP: response 0x%04x, seq %d, size %d, jiffies %lu\n",
+        lbs_deb_cmd("CMD_RESP: response 0x%04x, seq %d, size %d, jiffies %lu\n",
                      respcmd, le16_to_cpu(resp->seqnum), priv->upld_len, jiffies);
-        lbs_deb_hex(LBS_DEB_HOST, "CMD_RESP", (void *) resp, priv->upld_len);
+        lbs_deb_hex(LBS_DEB_CMD, "CMD_RESP", (void *) resp, priv->upld_len);
 
         if (resp->seqnum != resp->seqnum) {
                 lbs_pr_info("Received CMD_RESP with invalid sequence %d (expected %d)\n",
diff --git a/drivers/net/wireless/libertas/debugfs.c b/drivers/net/wireless/libertas/debugfs.c
index fd67b770dd78..b600f2439b57 100644
--- a/drivers/net/wireless/libertas/debugfs.c
+++ b/drivers/net/wireless/libertas/debugfs.c
@@ -315,7 +315,7 @@ static ssize_t lbs_setuserscan(struct file *file,
 
         lbs_scan_networks(priv, scan_cfg, 1);
         wait_event_interruptible(priv->cmd_pending,
-                                 priv->surpriseremoved || !priv->last_scanned_channel);
+                                 priv->surpriseremoved || !priv->scan_channel);
 
         if (priv->surpriseremoved)
                 goto out_scan_cfg;
diff --git a/drivers/net/wireless/libertas/dev.h b/drivers/net/wireless/libertas/dev.h
index 5a69f2b60865..fd1fcc748010 100644
--- a/drivers/net/wireless/libertas/dev.h
+++ b/drivers/net/wireless/libertas/dev.h
@@ -143,9 +143,12 @@ struct lbs_private {
         wait_queue_head_t waitq;
         struct workqueue_struct *work_thread;
 
+        /** Scanning */
         struct delayed_work scan_work;
         struct delayed_work assoc_work;
         struct work_struct sync_channel;
+        /* remember which channel was scanned last, != 0 if currently scanning */
+        int scan_channel;
 
         /** Hardware access */
         int (*hw_host_to_card) (struct lbs_private *priv, u8 type, u8 *payload, u16 nb);
@@ -321,7 +324,6 @@ struct lbs_private {
         struct cmd_ds_802_11_get_log logmsg;
 
         u32 monitormode;
-        int last_scanned_channel;
         u8 fw_ready;
 };
 
diff --git a/drivers/net/wireless/libertas/join.c b/drivers/net/wireless/libertas/join.c
index 2d4508048b68..56e64a697c37 100644
--- a/drivers/net/wireless/libertas/join.c
+++ b/drivers/net/wireless/libertas/join.c
@@ -99,23 +99,6 @@ static void lbs_set_basic_rate_flags(u8 *rates, size_t len)
 }
 
 /**
- *  @brief Unsets the MSB on basic rates
- *
- * Scan through an array and unset the MSB for basic data rates.
- *
- *  @param rates     buffer of data rates
- *  @param len       size of buffer
- */
-void lbs_unset_basic_rate_flags(u8 *rates, size_t len)
-{
-        int i;
-
-        for (i = 0; i < len; i++)
-                rates[i] &= 0x7f;
-}
-
-
-/**
  *  @brief Associate to a specific BSS discovered in a scan
  *
  *  @param priv      A pointer to struct lbs_private structure
@@ -769,9 +752,6 @@ int lbs_ret_80211_associate(struct lbs_private *priv,
         priv->curbssparams.ssid_len = bss->ssid_len;
         memcpy(priv->curbssparams.bssid, bss->bssid, ETH_ALEN);
 
-        lbs_deb_assoc("ASSOC_RESP: currentpacketfilter is 0x%x\n",
-                priv->currentpacketfilter);
-
         priv->SNR[TYPE_RXPD][TYPE_AVG] = 0;
         priv->NF[TYPE_RXPD][TYPE_AVG] = 0;
 
diff --git a/drivers/net/wireless/libertas/join.h b/drivers/net/wireless/libertas/join.h
index c617d071f781..792c64fe3514 100644
--- a/drivers/net/wireless/libertas/join.h
+++ b/drivers/net/wireless/libertas/join.h
@@ -48,6 +48,4 @@ int lbs_send_deauthentication(struct lbs_private *priv);
 
 int lbs_associate(struct lbs_private *priv, struct assoc_request *assoc_req);
 
-void lbs_unset_basic_rate_flags(u8 *rates, size_t len);
-
 #endif
diff --git a/drivers/net/wireless/libertas/main.c b/drivers/net/wireless/libertas/main.c
index 4d4e2f3b66ac..2e5bac826c48 100644
--- a/drivers/net/wireless/libertas/main.c
+++ b/drivers/net/wireless/libertas/main.c
@@ -985,6 +985,18 @@ out:
         lbs_deb_leave(LBS_DEB_CMD);
 }
 
+static void lbs_sync_channel_worker(struct work_struct *work)
+{
+        struct lbs_private *priv = container_of(work, struct lbs_private,
+                sync_channel);
+
+        lbs_deb_enter(LBS_DEB_MAIN);
+        if (lbs_update_channel(priv))
+                lbs_pr_info("Channel synchronization failed.");
+        lbs_deb_leave(LBS_DEB_MAIN);
+}
+
+
 static int lbs_init_adapter(struct lbs_private *priv)
 {
         size_t bufsize;
@@ -1128,7 +1140,7 @@ struct lbs_private *lbs_add_card(void *card, struct device *dmdev)
         priv->work_thread = create_singlethread_workqueue("lbs_worker");
         INIT_DELAYED_WORK(&priv->assoc_work, lbs_association_worker);
         INIT_DELAYED_WORK(&priv->scan_work, lbs_scan_worker);
-        INIT_WORK(&priv->sync_channel, lbs_sync_channel);
+        INIT_WORK(&priv->sync_channel, lbs_sync_channel_worker);
 
         sprintf(priv->mesh_ssid, "mesh");
         priv->mesh_ssid_len = 4;
diff --git a/drivers/net/wireless/libertas/scan.c b/drivers/net/wireless/libertas/scan.c
index 69f94c92b32d..7d4f3afa8cc5 100644
--- a/drivers/net/wireless/libertas/scan.c
+++ b/drivers/net/wireless/libertas/scan.c
@@ -73,6 +73,23 @@ static const u8 bcastmac[ETH_ALEN] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
 /*                                                                   */
 /*********************************************************************/
 
+/**
+ *  @brief Unsets the MSB on basic rates
+ *
+ * Scan through an array and unset the MSB for basic data rates.
+ *
+ *  @param rates     buffer of data rates
+ *  @param len       size of buffer
+ */
+static void lbs_unset_basic_rate_flags(u8 *rates, size_t len)
+{
+        int i;
+
+        for (i = 0; i < len; i++)
+                rates[i] &= 0x7f;
+}
+
+
 static inline void clear_bss_descriptor (struct bss_descriptor * bss)
 {
         /* Don't blow away ->list, just BSS data */
@@ -595,13 +612,13 @@ int lbs_scan_networks(struct lbs_private *priv,
         }
 
         /* Prepare to continue an interrupted scan */
-        lbs_deb_scan("chan_count %d, last_scanned_channel %d\n",
-                     chan_count, priv->last_scanned_channel);
+        lbs_deb_scan("chan_count %d, scan_channel %d\n",
+                     chan_count, priv->scan_channel);
         curr_chans = chan_list;
         /* advance channel list by already-scanned-channels */
-        if (priv->last_scanned_channel > 0) {
-                curr_chans += priv->last_scanned_channel;
-                chan_count -= priv->last_scanned_channel;
+        if (priv->scan_channel > 0) {
+                curr_chans += priv->scan_channel;
+                chan_count -= priv->scan_channel;
         }
 
         /* Send scan command(s)
@@ -627,10 +644,10 @@ int lbs_scan_networks(struct lbs_private *priv,
                     !full_scan &&
                     !priv->surpriseremoved) {
                         /* -1 marks just that we're currently scanning */
-                        if (priv->last_scanned_channel < 0)
-                                priv->last_scanned_channel = to_scan;
+                        if (priv->scan_channel < 0)
+                                priv->scan_channel = to_scan;
                         else
-                                priv->last_scanned_channel += to_scan;
+                                priv->scan_channel += to_scan;
                         cancel_delayed_work(&priv->scan_work);
                         queue_delayed_work(priv->work_thread, &priv->scan_work,
                                 msecs_to_jiffies(300));
@@ -654,7 +671,7 @@ int lbs_scan_networks(struct lbs_private *priv,
 #endif
 
 out2:
-        priv->last_scanned_channel = 0;
+        priv->scan_channel = 0;
 
 out:
         if (priv->connect_status == LBS_CONNECTED) {
@@ -1376,7 +1393,7 @@ int lbs_set_scan(struct net_device *dev, struct iw_request_info *info,
                 queue_delayed_work(priv->work_thread, &priv->scan_work,
                         msecs_to_jiffies(50));
         /* set marker that currently a scan is taking place */
-        priv->last_scanned_channel = -1;
+        priv->scan_channel = -1;
 
         if (priv->surpriseremoved)
                 return -EIO;
@@ -1410,7 +1427,7 @@ int lbs_get_scan(struct net_device *dev, struct iw_request_info *info,
         lbs_deb_enter(LBS_DEB_SCAN);
 
         /* iwlist should wait until the current scan is finished */
-        if (priv->last_scanned_channel)
+        if (priv->scan_channel)
                 return -EAGAIN;
 
         /* Update RSSI if current BSS is a locally created ad-hoc BSS */
diff --git a/drivers/net/wireless/p54.h b/drivers/net/wireless/p54.h
index 744c866066c5..06d2c67f4c81 100644
--- a/drivers/net/wireless/p54.h
+++ b/drivers/net/wireless/p54.h
@@ -64,10 +64,6 @@ struct p54_common {
         unsigned int tx_hdr_len;
         void *cached_vdcf;
         unsigned int fw_var;
-        /* FIXME: this channels/modes/rates stuff sucks */
-        struct ieee80211_channel channels[14];
-        struct ieee80211_rate rates[12];
-        struct ieee80211_hw_mode modes[2];
         struct ieee80211_tx_queue_stats tx_stats;
 };
 
diff --git a/drivers/net/wireless/p54common.c b/drivers/net/wireless/p54common.c
index 5cda49aff3a8..84cc000e71aa 100644
--- a/drivers/net/wireless/p54common.c
+++ b/drivers/net/wireless/p54common.c
@@ -27,6 +27,46 @@ MODULE_DESCRIPTION("Softmac Prism54 common code");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("prism54common");
 
+static struct ieee80211_rate p54_rates[] = {
+        { .bitrate = 10, .hw_value = 0, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
+        { .bitrate = 20, .hw_value = 1, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
+        { .bitrate = 55, .hw_value = 2, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
+        { .bitrate = 110, .hw_value = 3, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
+        { .bitrate = 60, .hw_value = 4, },
+        { .bitrate = 90, .hw_value = 5, },
+        { .bitrate = 120, .hw_value = 6, },
+        { .bitrate = 180, .hw_value = 7, },
+        { .bitrate = 240, .hw_value = 8, },
+        { .bitrate = 360, .hw_value = 9, },
+        { .bitrate = 480, .hw_value = 10, },
+        { .bitrate = 540, .hw_value = 11, },
+};
+
+static struct ieee80211_channel p54_channels[] = {
+        { .center_freq = 2412, .hw_value = 1, },
+        { .center_freq = 2417, .hw_value = 2, },
+        { .center_freq = 2422, .hw_value = 3, },
+        { .center_freq = 2427, .hw_value = 4, },
+        { .center_freq = 2432, .hw_value = 5, },
+        { .center_freq = 2437, .hw_value = 6, },
+        { .center_freq = 2442, .hw_value = 7, },
+        { .center_freq = 2447, .hw_value = 8, },
+        { .center_freq = 2452, .hw_value = 9, },
+        { .center_freq = 2457, .hw_value = 10, },
+        { .center_freq = 2462, .hw_value = 11, },
+        { .center_freq = 2467, .hw_value = 12, },
+        { .center_freq = 2472, .hw_value = 13, },
+        { .center_freq = 2484, .hw_value = 14, },
+};
+
+static struct ieee80211_supported_band band_2GHz = {
+        .channels = p54_channels,
+        .n_channels = ARRAY_SIZE(p54_channels),
+        .bitrates = p54_rates,
+        .n_bitrates = ARRAY_SIZE(p54_rates),
+};
+
+
 void p54_parse_firmware(struct ieee80211_hw *dev, const struct firmware *fw)
 {
         struct p54_common *priv = dev->priv;
@@ -251,6 +291,10 @@ int p54_parse_eeprom(struct ieee80211_hw *dev, void *eeprom, int len)
                 case PDR_END:
                         i = len;
                         break;
+                default:
+                        printk(KERN_INFO "p54: unknown eeprom code : 0x%x\n",
+                                le16_to_cpu(entry->code));
+                        break;
                 }
 
                 entry = (void *)entry + (entry_len + 1)*2;
@@ -308,10 +352,10 @@ static void p54_rx_data(struct ieee80211_hw *dev, struct sk_buff *skb)
         u16 freq = le16_to_cpu(hdr->freq);
 
         rx_status.ssi = hdr->rssi;
-        rx_status.rate = hdr->rate & 0x1f; /* report short preambles & CCK too */
-        rx_status.channel = freq == 2484 ? 14 : (freq - 2407)/5;
+        /* XX correct? */
+        rx_status.rate_idx = hdr->rate & 0xf;
         rx_status.freq = freq;
-        rx_status.phymode = MODE_IEEE80211G;
+        rx_status.band = IEEE80211_BAND_2GHZ;
         rx_status.antenna = hdr->antenna;
         rx_status.mactime = le64_to_cpu(hdr->timestamp);
         rx_status.flag |= RX_FLAG_TSFT;
@@ -349,7 +393,7 @@ static void p54_rx_frame_sent(struct ieee80211_hw *dev, struct sk_buff *skb)
         while (entry != (struct sk_buff *)&priv->tx_queue) {
                 range = (struct memrecord *)&entry->cb;
                 if (range->start_addr == addr) {
-                        struct ieee80211_tx_status status = {{0}};
+                        struct ieee80211_tx_status status;
                         struct p54_control_hdr *entry_hdr;
                         struct p54_tx_control_allocdata *entry_data;
                         int pad = 0;
@@ -365,6 +409,7 @@ static void p54_rx_frame_sent(struct ieee80211_hw *dev, struct sk_buff *skb)
                                 kfree_skb(entry);
                                 break;
                         }
+                        memset(&status, 0, sizeof(status));
                         memcpy(&status.control, range->control,
                                sizeof(status.control));
                         kfree(range->control);
@@ -547,7 +592,9 @@ static int p54_tx(struct ieee80211_hw *dev, struct sk_buff *skb,
         txhdr->padding2 = 0;
 
         /* TODO: add support for alternate retry TX rates */
-        rate = control->tx_rate;
+        rate = control->tx_rate->hw_value;
+        if (control->flags & IEEE80211_TXCTL_SHORT_PREAMBLE)
+                rate |= 0x10;
         if (control->flags & IEEE80211_TXCTL_USE_RTS_CTS)
                 rate |= 0x40;
         else if (control->flags & IEEE80211_TXCTL_USE_CTS_PROTECT)
@@ -717,13 +764,12 @@ static int p54_set_leds(struct ieee80211_hw *dev, int mode, int link, int act)
         return 0;
 }
 
-#define P54_SET_QUEUE(queue, ai_fs, cw_min, cw_max, burst)      \
+#define P54_SET_QUEUE(queue, ai_fs, cw_min, cw_max, _txop)      \
 do {                                                            \
         queue.aifs = cpu_to_le16(ai_fs);                        \
         queue.cwmin = cpu_to_le16(cw_min);                      \
         queue.cwmax = cpu_to_le16(cw_max);                      \
-        queue.txop = (burst == 0) ?                             \
-                0 : cpu_to_le16((burst * 100) / 32 + 1);        \
+        queue.txop = cpu_to_le16(_txop);                        \
 } while(0)
 
 static void p54_init_vdcf(struct ieee80211_hw *dev)
@@ -741,10 +787,10 @@ static void p54_init_vdcf(struct ieee80211_hw *dev)
 
         vdcf = (struct p54_tx_control_vdcf *) hdr->data;
 
-        P54_SET_QUEUE(vdcf->queue[0], 0x0002, 0x0003, 0x0007, 0x000f);
-        P54_SET_QUEUE(vdcf->queue[1], 0x0002, 0x0007, 0x000f, 0x001e);
-        P54_SET_QUEUE(vdcf->queue[2], 0x0002, 0x000f, 0x03ff, 0x0014);
-        P54_SET_QUEUE(vdcf->queue[3], 0x0007, 0x000f, 0x03ff, 0x0000);
+        P54_SET_QUEUE(vdcf->queue[0], 0x0002, 0x0003, 0x0007, 47);
+        P54_SET_QUEUE(vdcf->queue[1], 0x0002, 0x0007, 0x000f, 94);
+        P54_SET_QUEUE(vdcf->queue[2], 0x0003, 0x000f, 0x03ff, 0);
+        P54_SET_QUEUE(vdcf->queue[3], 0x0007, 0x000f, 0x03ff, 0);
 }
 
 static void p54_set_vdcf(struct ieee80211_hw *dev)
@@ -849,7 +895,7 @@ static int p54_config(struct ieee80211_hw *dev, struct ieee80211_conf *conf)
 {
         int ret;
 
-        ret = p54_set_freq(dev, cpu_to_le16(conf->freq));
+        ret = p54_set_freq(dev, cpu_to_le16(conf->channel->center_freq));
         p54_set_vdcf(dev);
         return ret;
 }
@@ -897,7 +943,7 @@ static int p54_conf_tx(struct ieee80211_hw *dev, int queue,
 
         if ((params) && !((queue < 0) || (queue > 4))) {
                 P54_SET_QUEUE(vdcf->queue[queue], params->aifs,
-                        params->cw_min, params->cw_max, params->burst_time);
+                        params->cw_min, params->cw_max, params->txop);
         } else
                 return -EINVAL;
 
@@ -944,7 +990,6 @@ struct ieee80211_hw *p54_init_common(size_t priv_data_len)
 {
         struct ieee80211_hw *dev;
         struct p54_common *priv;
-        int i;
 
         dev = ieee80211_alloc_hw(priv_data_len, &p54_ops);
         if (!dev)
@@ -953,18 +998,7 @@ struct ieee80211_hw *p54_init_common(size_t priv_data_len)
         priv = dev->priv;
         priv->mode = IEEE80211_IF_TYPE_INVALID;
         skb_queue_head_init(&priv->tx_queue);
-        memcpy(priv->channels, p54_channels, sizeof(p54_channels));
-        memcpy(priv->rates, p54_rates, sizeof(p54_rates));
-        priv->modes[1].mode = MODE_IEEE80211B;
-        priv->modes[1].num_rates = 4;
-        priv->modes[1].rates = priv->rates;
-        priv->modes[1].num_channels = ARRAY_SIZE(p54_channels);
-        priv->modes[1].channels = priv->channels;
-        priv->modes[0].mode = MODE_IEEE80211G;
-        priv->modes[0].num_rates = ARRAY_SIZE(p54_rates);
-        priv->modes[0].rates = priv->rates;
-        priv->modes[0].num_channels = ARRAY_SIZE(p54_channels);
-        priv->modes[0].channels = priv->channels;
+        dev->wiphy->bands[IEEE80211_BAND_2GHZ] = &band_2GHz;
         dev->flags = IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING | /* not sure */
                     IEEE80211_HW_RX_INCLUDES_FCS;
         dev->channel_change_time = 1000;        /* TODO: find actual value */
@@ -986,14 +1020,6 @@ struct ieee80211_hw *p54_init_common(size_t priv_data_len)
 
         p54_init_vdcf(dev);
 
-        for (i = 0; i < 2; i++) {
-                if (ieee80211_register_hwmode(dev, &priv->modes[i])) {
-                        kfree(priv->cached_vdcf);
-                        ieee80211_free_hw(dev);
-                        return NULL;
-                }
-        }
-
         return dev;
 }
 EXPORT_SYMBOL_GPL(p54_init_common);
diff --git a/drivers/net/wireless/p54common.h b/drivers/net/wireless/p54common.h
index a721334e20d9..dc9f4cef585e 100644
--- a/drivers/net/wireless/p54common.h
+++ b/drivers/net/wireless/p54common.h
@@ -251,79 +251,4 @@ struct p54_tx_control_vdcf {
         __le16 frameburst;
 } __attribute__ ((packed));
 
-static const struct ieee80211_rate p54_rates[] = {
-        { .rate = 10,
-          .val = 0,
-          .val2 = 0x10,
-          .flags = IEEE80211_RATE_CCK_2 },
-        { .rate = 20,
-          .val = 1,
-          .val2 = 0x11,
-          .flags = IEEE80211_RATE_CCK_2 },
-        { .rate = 55,
-          .val = 2,
-          .val2 = 0x12,
-          .flags = IEEE80211_RATE_CCK_2 },
-        { .rate = 110,
-          .val = 3,
-          .val2 = 0x13,
-          .flags = IEEE80211_RATE_CCK_2 },
-        { .rate = 60,
-          .val = 4,
-          .flags = IEEE80211_RATE_OFDM },
-        { .rate = 90,
-          .val = 5,
-          .flags = IEEE80211_RATE_OFDM },
-        { .rate = 120,
-          .val = 6,
-          .flags = IEEE80211_RATE_OFDM },
-        { .rate = 180,
-          .val = 7,
-          .flags = IEEE80211_RATE_OFDM },
-        { .rate = 240,
-          .val = 8,
-          .flags = IEEE80211_RATE_OFDM },
-        { .rate = 360,
-          .val = 9,
-          .flags = IEEE80211_RATE_OFDM },
-        { .rate = 480,
-          .val = 10,
-          .flags = IEEE80211_RATE_OFDM },
-        { .rate = 540,
-          .val = 11,
-          .flags = IEEE80211_RATE_OFDM },
-};
-
-// TODO: just generate this..
-static const struct ieee80211_channel p54_channels[] = {
-        { .chan = 1,
-          .freq = 2412},
-        { .chan = 2,
-          .freq = 2417},
-        { .chan = 3,
-          .freq = 2422},
-        { .chan = 4,
-          .freq = 2427},
-        { .chan = 5,
-          .freq = 2432},
-        { .chan = 6,
-          .freq = 2437},
-        { .chan = 7,
-          .freq = 2442},
-        { .chan = 8,
-          .freq = 2447},
-        { .chan = 9,
-          .freq = 2452},
-        { .chan = 10,
-          .freq = 2457},
-        { .chan = 11,
-          .freq = 2462},
-        { .chan = 12,
-          .freq = 2467},
-        { .chan = 13,
-          .freq = 2472},
-        { .chan = 14,
-          .freq = 2484}
-};
-
 #endif /* PRISM54COMMON_H */
diff --git a/drivers/net/wireless/prism54/isl_ioctl.c b/drivers/net/wireless/prism54/isl_ioctl.c
index 1b595a6525f4..2d91a56d6a39 100644
--- a/drivers/net/wireless/prism54/isl_ioctl.c
+++ b/drivers/net/wireless/prism54/isl_ioctl.c
@@ -165,7 +165,7 @@ prism54_update_stats(struct work_struct *work)
         struct obj_bss bss, *bss2;
         union oid_res_t r;
 
-        down(&priv->stats_sem);
+        mutex_lock(&priv->stats_lock);
 
 /* Noise floor.
  * I'm not sure if the unit is dBm.
@@ -207,7 +207,7 @@ prism54_update_stats(struct work_struct *work)
         mgt_get_request(priv, DOT11_OID_MPDUTXFAILED, 0, NULL, &r);
         priv->local_iwstatistics.discard.retries = r.u;
 
-        up(&priv->stats_sem);
+        mutex_unlock(&priv->stats_lock);
 
         return;
 }
@@ -218,12 +218,12 @@ prism54_get_wireless_stats(struct net_device *ndev)
         islpci_private *priv = netdev_priv(ndev);
 
         /* If the stats are being updated return old data */
-        if (down_trylock(&priv->stats_sem) == 0) {
+        if (mutex_trylock(&priv->stats_lock) == 0) {
                 memcpy(&priv->iwstatistics, &priv->local_iwstatistics,
                        sizeof (struct iw_statistics));
                 /* They won't be marked updated for the next time */
                 priv->local_iwstatistics.qual.updated = 0;
-                up(&priv->stats_sem);
+                mutex_unlock(&priv->stats_lock);
         } else
                 priv->iwstatistics.qual.updated = 0;
 
@@ -1780,7 +1780,7 @@ prism54_set_raw(struct net_device *ndev, struct iw_request_info *info,
 void
 prism54_acl_init(struct islpci_acl *acl)
 {
-        sema_init(&acl->sem, 1);
+        mutex_init(&acl->lock);
         INIT_LIST_HEAD(&acl->mac_list);
         acl->size = 0;
         acl->policy = MAC_POLICY_OPEN;
@@ -1792,10 +1792,10 @@ prism54_clear_mac(struct islpci_acl *acl)
         struct list_head *ptr, *next;
         struct mac_entry *entry;
 
-        down(&acl->sem);
+        mutex_lock(&acl->lock);
 
         if (acl->size == 0) {
-                up(&acl->sem);
+                mutex_unlock(&acl->lock);
                 return;
         }
 
@@ -1806,7 +1806,7 @@ prism54_clear_mac(struct islpci_acl *acl)
                 kfree(entry);
         }
         acl->size = 0;
-        up(&acl->sem);
+        mutex_unlock(&acl->lock);
 }
 
 void
@@ -1833,13 +1833,13 @@ prism54_add_mac(struct net_device *ndev, struct iw_request_info *info,
 
         memcpy(entry->addr, addr->sa_data, ETH_ALEN);
 
-        if (down_interruptible(&acl->sem)) {
+        if (mutex_lock_interruptible(&acl->lock)) {
                 kfree(entry);
                 return -ERESTARTSYS;
         }
         list_add_tail(&entry->_list, &acl->mac_list);
         acl->size++;
-        up(&acl->sem);
+        mutex_unlock(&acl->lock);
 
         return 0;
 }
@@ -1856,18 +1856,18 @@ prism54_del_mac(struct net_device *ndev, struct iw_request_info *info,
         if (addr->sa_family != ARPHRD_ETHER)
                 return -EOPNOTSUPP;
 
-        if (down_interruptible(&acl->sem))
+        if (mutex_lock_interruptible(&acl->lock))
                 return -ERESTARTSYS;
         list_for_each_entry(entry, &acl->mac_list, _list) {
                 if (memcmp(entry->addr, addr->sa_data, ETH_ALEN) == 0) {
                         list_del(&entry->_list);
                         acl->size--;
                         kfree(entry);
-                        up(&acl->sem);
+                        mutex_unlock(&acl->lock);
                         return 0;
                 }
         }
-        up(&acl->sem);
+        mutex_unlock(&acl->lock);
         return -EINVAL;
 }
 
@@ -1882,7 +1882,7 @@ prism54_get_mac(struct net_device *ndev, struct iw_request_info *info,
 
         dwrq->length = 0;
 
-        if (down_interruptible(&acl->sem))
+        if (mutex_lock_interruptible(&acl->lock))
                 return -ERESTARTSYS;
 
         list_for_each_entry(entry, &acl->mac_list, _list) {
@@ -1891,7 +1891,7 @@ prism54_get_mac(struct net_device *ndev, struct iw_request_info *info,
                 dwrq->length++;
                 dst++;
         }
-        up(&acl->sem);
+        mutex_unlock(&acl->lock);
         return 0;
 }
 
@@ -1955,11 +1955,11 @@ prism54_mac_accept(struct islpci_acl *acl, char *mac)
         struct mac_entry *entry;
         int res = 0;
 
-        if (down_interruptible(&acl->sem))
+        if (mutex_lock_interruptible(&acl->lock))
                 return -ERESTARTSYS;
 
         if (acl->policy == MAC_POLICY_OPEN) {
-                up(&acl->sem);
+                mutex_unlock(&acl->lock);
                 return 1;
         }
 
@@ -1970,7 +1970,7 @@ prism54_mac_accept(struct islpci_acl *acl, char *mac)
                 }
         }
         res = (acl->policy == MAC_POLICY_ACCEPT) ? !res : res;
-        up(&acl->sem);
+        mutex_unlock(&acl->lock);
 
         return res;
 }
@@ -2114,7 +2114,7 @@ prism54_wpa_bss_ie_add(islpci_private *priv, u8 *bssid,
         if (wpa_ie_len > MAX_WPA_IE_LEN)
                 wpa_ie_len = MAX_WPA_IE_LEN;
 
-        down(&priv->wpa_sem);
+        mutex_lock(&priv->wpa_lock);
 
         /* try to use existing entry */
         list_for_each(ptr, &priv->bss_wpa_list) {
@@ -2165,7 +2165,7 @@ prism54_wpa_bss_ie_add(islpci_private *priv, u8 *bssid,
                 kfree(bss);
         }
 
-        up(&priv->wpa_sem);
+        mutex_unlock(&priv->wpa_lock);
 }
 
 static size_t
@@ -2175,7 +2175,7 @@ prism54_wpa_bss_ie_get(islpci_private *priv, u8 *bssid, u8 *wpa_ie)
         struct islpci_bss_wpa_ie *bss = NULL;
         size_t len = 0;
 
-        down(&priv->wpa_sem);
+        mutex_lock(&priv->wpa_lock);
 
         list_for_each(ptr, &priv->bss_wpa_list) {
                 bss = list_entry(ptr, struct islpci_bss_wpa_ie, list);
@@ -2187,7 +2187,7 @@ prism54_wpa_bss_ie_get(islpci_private *priv, u8 *bssid, u8 *wpa_ie)
                 len = bss->wpa_ie_len;
                 memcpy(wpa_ie, bss->wpa_ie, len);
         }
-        up(&priv->wpa_sem);
+        mutex_unlock(&priv->wpa_lock);
 
         return len;
 }
@@ -2196,7 +2196,7 @@ void
 prism54_wpa_bss_ie_init(islpci_private *priv)
 {
         INIT_LIST_HEAD(&priv->bss_wpa_list);
-        sema_init(&priv->wpa_sem, 1);
+        mutex_init(&priv->wpa_lock);
 }
 
 void
diff --git a/drivers/net/wireless/prism54/islpci_dev.c b/drivers/net/wireless/prism54/islpci_dev.c
index dbb538ccb4ec..eb7c1c6bcd8a 100644
--- a/drivers/net/wireless/prism54/islpci_dev.c
+++ b/drivers/net/wireless/prism54/islpci_dev.c
@@ -864,7 +864,7 @@ islpci_setup(struct pci_dev *pdev)
         mutex_init(&priv->mgmt_lock);
         priv->mgmt_received = NULL;
         init_waitqueue_head(&priv->mgmt_wqueue);
-        sema_init(&priv->stats_sem, 1);
+        mutex_init(&priv->stats_lock);
         spin_lock_init(&priv->slock);
 
         /* init state machine with off#1 state */
diff --git a/drivers/net/wireless/prism54/islpci_dev.h b/drivers/net/wireless/prism54/islpci_dev.h
index 4e0182ce835b..8e55a5fcffae 100644
--- a/drivers/net/wireless/prism54/islpci_dev.h
+++ b/drivers/net/wireless/prism54/islpci_dev.h
@@ -55,7 +55,7 @@ struct islpci_acl {
    enum { MAC_POLICY_OPEN=0, MAC_POLICY_ACCEPT=1, MAC_POLICY_REJECT=2 } policy;
    struct list_head mac_list;  /* a list of mac_entry */
    int size;   /* size of queue */
-   struct semaphore sem;   /* accessed in ioctls and trap_work */
+   struct mutex lock;   /* accessed in ioctls and trap_work */
 };
 
 struct islpci_membuf {
@@ -88,7 +88,7 @@ typedef struct {
 
         /* Take care of the wireless stats */
         struct work_struct stats_work;
-        struct semaphore stats_sem;
+        struct mutex stats_lock;
         /* remember when we last updated the stats */
         unsigned long stats_timestamp;
         /* The first is accessed under semaphore locking.
@@ -178,7 +178,7 @@ typedef struct {
         int wpa; /* WPA mode enabled */
         struct list_head bss_wpa_list;
         int num_bss_wpa;
-        struct semaphore wpa_sem;
+        struct mutex wpa_lock;
         u8 wpa_ie[MAX_WPA_IE_LEN];
         size_t wpa_ie_len;
 
diff --git a/drivers/net/wireless/rt2x00/Kconfig b/drivers/net/wireless/rt2x00/Kconfig
index da05b1faf60d..d5240aa06233 100644
--- a/drivers/net/wireless/rt2x00/Kconfig
+++ b/drivers/net/wireless/rt2x00/Kconfig
@@ -5,29 +5,29 @@ config RT2X00
           This will enable the experimental support for the Ralink drivers,
           developed in the rt2x00 project <http://rt2x00.serialmonkey.com>.
 
-          These drivers will make use of the Devicescape ieee80211 stack.
+          These drivers will make use of the mac80211 stack.
 
           When building one of the individual drivers, the rt2x00 library
           will also be created. That library (when the driver is built as
           a module) will be called "rt2x00lib.ko".
 
+if RT2X00
+
 config RT2X00_LIB
         tristate
-        depends on RT2X00
 
 config RT2X00_LIB_PCI
         tristate
-        depends on RT2X00
         select RT2X00_LIB
 
 config RT2X00_LIB_USB
         tristate
-        depends on RT2X00
         select RT2X00_LIB
 
 config RT2X00_LIB_FIRMWARE
         boolean
         depends on RT2X00_LIB
+        select CRC_CCITT
         select CRC_ITU_T
         select FW_LOADER
 
@@ -37,9 +37,17 @@ config RT2X00_LIB_RFKILL
         select RFKILL
         select INPUT_POLLDEV
 
+config RT2X00_LIB_LEDS
+        boolean
+        depends on RT2X00_LIB
+        select NEW_LEDS
+        select LEDS_CLASS
+        select LEDS_TRIGGERS
+        select MAC80211_LEDS
+
 config RT2400PCI
         tristate "Ralink rt2400 pci/pcmcia support"
-        depends on RT2X00 && PCI
+        depends on PCI
         select RT2X00_LIB_PCI
         select EEPROM_93CX6
         ---help---
@@ -56,9 +64,16 @@ config RT2400PCI_RFKILL
           hardware button to control the radio state.
           This feature depends on the RF switch subsystem rfkill.
 
+config RT2400PCI_LEDS
+        bool "RT2400 leds support"
+        depends on RT2400PCI
+        select RT2X00_LIB_LEDS
+        ---help---
+          This adds support for led triggers provided my mac80211.
+
 config RT2500PCI
         tristate "Ralink rt2500 pci/pcmcia support"
-        depends on RT2X00 && PCI
+        depends on PCI
         select RT2X00_LIB_PCI
         select EEPROM_93CX6
         ---help---
@@ -75,9 +90,16 @@ config RT2500PCI_RFKILL
           hardware button to control the radio state.
           This feature depends on the RF switch subsystem rfkill.
 
+config RT2500PCI_LEDS
+        bool "RT2500 leds support"
+        depends on RT2500PCI
+        select RT2X00_LIB_LEDS
+        ---help---
+          This adds support for led triggers provided my mac80211.
+
 config RT61PCI
         tristate "Ralink rt61 pci/pcmcia support"
-        depends on RT2X00 && PCI
+        depends on PCI
         select RT2X00_LIB_PCI
         select RT2X00_LIB_FIRMWARE
         select EEPROM_93CX6
@@ -95,18 +117,32 @@ config RT61PCI_RFKILL
           hardware button to control the radio state.
           This feature depends on the RF switch subsystem rfkill.
 
+config RT61PCI_LEDS
+        bool "RT61 leds support"
+        depends on RT61PCI
+        select RT2X00_LIB_LEDS
+        ---help---
+          This adds support for led triggers provided my mac80211.
+
 config RT2500USB
         tristate "Ralink rt2500 usb support"
-        depends on RT2X00 && USB
+        depends on USB
         select RT2X00_LIB_USB
         ---help---
           This is an experimental driver for the Ralink rt2500 wireless chip.
 
           When compiled as a module, this driver will be called "rt2500usb.ko".
 
+config RT2500USB_LEDS
+        bool "RT2500 leds support"
+        depends on RT2500USB
+        select RT2X00_LIB_LEDS
+        ---help---
+          This adds support for led triggers provided my mac80211.
+
 config RT73USB
         tristate "Ralink rt73 usb support"
-        depends on RT2X00 && USB
+        depends on USB
         select RT2X00_LIB_USB
         select RT2X00_LIB_FIRMWARE
         ---help---
@@ -114,6 +150,13 @@ config RT73USB
 
           When compiled as a module, this driver will be called "rt73usb.ko".
 
+config RT73USB_LEDS
+        bool "RT73 leds support"
+        depends on RT73USB
+        select RT2X00_LIB_LEDS
+        ---help---
+          This adds support for led triggers provided my mac80211.
+
 config RT2X00_LIB_DEBUGFS
         bool "Ralink debugfs support"
         depends on RT2X00_LIB && MAC80211_DEBUGFS
@@ -128,3 +171,4 @@ config RT2X00_DEBUG
         ---help---
           Enable debugging output for all rt2x00 modules
 
+endif
diff --git a/drivers/net/wireless/rt2x00/Makefile b/drivers/net/wireless/rt2x00/Makefile
index 30d654a42eea..1087dbcf1a04 100644
--- a/drivers/net/wireless/rt2x00/Makefile
+++ b/drivers/net/wireless/rt2x00/Makefile
@@ -1,22 +1,17 @@
-rt2x00lib-objs := rt2x00dev.o rt2x00mac.o rt2x00config.o
+rt2x00lib-y                             += rt2x00dev.o
+rt2x00lib-y                             += rt2x00mac.o
+rt2x00lib-y                             += rt2x00config.o
+rt2x00lib-y                             += rt2x00queue.o
+rt2x00lib-$(CONFIG_RT2X00_LIB_DEBUGFS)  += rt2x00debug.o
+rt2x00lib-$(CONFIG_RT2X00_LIB_RFKILL)   += rt2x00rfkill.o
+rt2x00lib-$(CONFIG_RT2X00_LIB_FIRMWARE) += rt2x00firmware.o
+rt2x00lib-$(CONFIG_RT2X00_LIB_LEDS)     += rt2x00leds.o
 
-ifeq ($(CONFIG_RT2X00_LIB_DEBUGFS),y)
-        rt2x00lib-objs += rt2x00debug.o
-endif
-
-ifeq ($(CONFIG_RT2X00_LIB_RFKILL),y)
-        rt2x00lib-objs += rt2x00rfkill.o
-endif
-
-ifeq ($(CONFIG_RT2X00_LIB_FIRMWARE),y)
-        rt2x00lib-objs += rt2x00firmware.o
-endif
-
-obj-$(CONFIG_RT2X00_LIB)        += rt2x00lib.o
-obj-$(CONFIG_RT2X00_LIB_PCI)    += rt2x00pci.o
-obj-$(CONFIG_RT2X00_LIB_USB)    += rt2x00usb.o
-obj-$(CONFIG_RT2400PCI)         += rt2400pci.o
-obj-$(CONFIG_RT2500PCI)         += rt2500pci.o
-obj-$(CONFIG_RT61PCI)           += rt61pci.o
-obj-$(CONFIG_RT2500USB)         += rt2500usb.o
-obj-$(CONFIG_RT73USB)           += rt73usb.o
+obj-$(CONFIG_RT2X00_LIB)                += rt2x00lib.o
+obj-$(CONFIG_RT2X00_LIB_PCI)            += rt2x00pci.o
+obj-$(CONFIG_RT2X00_LIB_USB)            += rt2x00usb.o
+obj-$(CONFIG_RT2400PCI)                 += rt2400pci.o
+obj-$(CONFIG_RT2500PCI)                 += rt2500pci.o
+obj-$(CONFIG_RT61PCI)                   += rt61pci.o
+obj-$(CONFIG_RT2500USB)                 += rt2500usb.o
+obj-$(CONFIG_RT73USB)                   += rt73usb.o
diff --git a/drivers/net/wireless/rt2x00/rt2400pci.c b/drivers/net/wireless/rt2x00/rt2400pci.c
index c69f85ed7669..460ef2fb5104 100644
--- a/drivers/net/wireless/rt2x00/rt2400pci.c
+++ b/drivers/net/wireless/rt2x00/rt2400pci.c
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2007 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2008 rt2x00 SourceForge Project
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
@@ -243,53 +243,77 @@ static int rt2400pci_rfkill_poll(struct rt2x00_dev *rt2x00dev)
 #define rt2400pci_rfkill_poll   NULL
 #endif /* CONFIG_RT2400PCI_RFKILL */
 
-/*
- * Configuration handlers.
- */
-static void rt2400pci_config_mac_addr(struct rt2x00_dev *rt2x00dev,
-                                      __le32 *mac)
+#ifdef CONFIG_RT2400PCI_LEDS
+static void rt2400pci_led_brightness(struct led_classdev *led_cdev,
+                                     enum led_brightness brightness)
 {
-        rt2x00pci_register_multiwrite(rt2x00dev, CSR3, mac,
-                                      (2 * sizeof(__le32)));
-}
+        struct rt2x00_led *led =
+            container_of(led_cdev, struct rt2x00_led, led_dev);
+        unsigned int enabled = brightness != LED_OFF;
+        unsigned int activity =
+            led->rt2x00dev->led_flags & LED_SUPPORT_ACTIVITY;
+        u32 reg;
 
-static void rt2400pci_config_bssid(struct rt2x00_dev *rt2x00dev,
-                                   __le32 *bssid)
-{
-        rt2x00pci_register_multiwrite(rt2x00dev, CSR5, bssid,
-                                      (2 * sizeof(__le32)));
+        rt2x00pci_register_read(led->rt2x00dev, LEDCSR, &reg);
+
+        if (led->type == LED_TYPE_RADIO || led->type == LED_TYPE_ASSOC) {
+                rt2x00_set_field32(&reg, LEDCSR_LINK, enabled);
+                rt2x00_set_field32(&reg, LEDCSR_ACTIVITY, enabled && activity);
+        }
+
+        rt2x00pci_register_write(led->rt2x00dev, LEDCSR, reg);
 }
+#else
+#define rt2400pci_led_brightness        NULL
+#endif /* CONFIG_RT2400PCI_LEDS */
 
-static void rt2400pci_config_type(struct rt2x00_dev *rt2x00dev, const int type,
-                                  const int tsf_sync)
+/*
+ * Configuration handlers.
+ */
+static void rt2400pci_config_intf(struct rt2x00_dev *rt2x00dev,
+                                  struct rt2x00_intf *intf,
+                                  struct rt2x00intf_conf *conf,
+                                  const unsigned int flags)
 {
+        unsigned int bcn_preload;
         u32 reg;
 
-        rt2x00pci_register_write(rt2x00dev, CSR14, 0);
+        if (flags & CONFIG_UPDATE_TYPE) {
+                rt2x00pci_register_write(rt2x00dev, CSR14, 0);
 
-        /*
-         * Enable beacon config
-         */
-        rt2x00pci_register_read(rt2x00dev, BCNCSR1, &reg);
-        rt2x00_set_field32(&reg, BCNCSR1_PRELOAD,
-                           PREAMBLE + get_duration(IEEE80211_HEADER, 20));
-        rt2x00pci_register_write(rt2x00dev, BCNCSR1, reg);
+                /*
+                 * Enable beacon config
+                 */
+                bcn_preload = PREAMBLE + get_duration(IEEE80211_HEADER, 20);
+                rt2x00pci_register_read(rt2x00dev, BCNCSR1, &reg);
+                rt2x00_set_field32(&reg, BCNCSR1_PRELOAD, bcn_preload);
+                rt2x00pci_register_write(rt2x00dev, BCNCSR1, reg);
 
-        /*
-         * Enable synchronisation.
-         */
-        rt2x00pci_register_read(rt2x00dev, CSR14, &reg);
-        rt2x00_set_field32(&reg, CSR14_TSF_COUNT, 1);
-        rt2x00_set_field32(&reg, CSR14_TBCN, (tsf_sync == TSF_SYNC_BEACON));
-        rt2x00_set_field32(&reg, CSR14_BEACON_GEN, 0);
-        rt2x00_set_field32(&reg, CSR14_TSF_SYNC, tsf_sync);
-        rt2x00pci_register_write(rt2x00dev, CSR14, reg);
+                /*
+                 * Enable synchronisation.
+                 */
+                rt2x00pci_register_read(rt2x00dev, CSR14, &reg);
+                rt2x00_set_field32(&reg, CSR14_TSF_COUNT, 1);
+                rt2x00_set_field32(&reg, CSR14_TBCN,
+                                   (conf->sync == TSF_SYNC_BEACON));
+                rt2x00_set_field32(&reg, CSR14_BEACON_GEN, 0);
+                rt2x00_set_field32(&reg, CSR14_TSF_SYNC, conf->sync);
+                rt2x00pci_register_write(rt2x00dev, CSR14, reg);
+        }
+
+        if (flags & CONFIG_UPDATE_MAC)
+                rt2x00pci_register_multiwrite(rt2x00dev, CSR3,
+                                              conf->mac, sizeof(conf->mac));
+
+        if (flags & CONFIG_UPDATE_BSSID)
+                rt2x00pci_register_multiwrite(rt2x00dev, CSR5,
+                                              conf->bssid, sizeof(conf->bssid));
 }
 
-static void rt2400pci_config_preamble(struct rt2x00_dev *rt2x00dev,
-                                      const int short_preamble,
-                                      const int ack_timeout,
-                                      const int ack_consume_time)
+static int rt2400pci_config_preamble(struct rt2x00_dev *rt2x00dev,
+                                     const int short_preamble,
+                                     const int ack_timeout,
+                                     const int ack_consume_time)
 {
         int preamble_mask;
         u32 reg;
@@ -327,6 +351,8 @@ static void rt2400pci_config_preamble(struct rt2x00_dev *rt2x00dev,
         rt2x00_set_field32(&reg, ARCSR5_SERVICE, 0x84);
         rt2x00_set_field32(&reg, ARCSR2_LENGTH, get_duration(ACK_SIZE, 110));
         rt2x00pci_register_write(rt2x00dev, ARCSR5, reg);
+
+        return 0;
 }
 
 static void rt2400pci_config_phymode(struct rt2x00_dev *rt2x00dev,
@@ -481,8 +507,8 @@ static void rt2400pci_config_duration(struct rt2x00_dev *rt2x00dev,
 }
 
 static void rt2400pci_config(struct rt2x00_dev *rt2x00dev,
-                             const unsigned int flags,
-                             struct rt2x00lib_conf *libconf)
+                             struct rt2x00lib_conf *libconf,
+                             const unsigned int flags)
 {
         if (flags & CONFIG_UPDATE_PHYMODE)
                 rt2400pci_config_phymode(rt2x00dev, libconf->basic_rates);
@@ -498,45 +524,17 @@ static void rt2400pci_config(struct rt2x00_dev *rt2x00dev,
 }
 
 static void rt2400pci_config_cw(struct rt2x00_dev *rt2x00dev,
-                                struct ieee80211_tx_queue_params *params)
+                                const int cw_min, const int cw_max)
 {
         u32 reg;
 
         rt2x00pci_register_read(rt2x00dev, CSR11, &reg);
-        rt2x00_set_field32(&reg, CSR11_CWMIN, params->cw_min);
-        rt2x00_set_field32(&reg, CSR11_CWMAX, params->cw_max);
+        rt2x00_set_field32(&reg, CSR11_CWMIN, cw_min);
+        rt2x00_set_field32(&reg, CSR11_CWMAX, cw_max);
         rt2x00pci_register_write(rt2x00dev, CSR11, reg);
 }
 
 /*
- * LED functions.
- */
-static void rt2400pci_enable_led(struct rt2x00_dev *rt2x00dev)
-{
-        u32 reg;
-
-        rt2x00pci_register_read(rt2x00dev, LEDCSR, &reg);
-
-        rt2x00_set_field32(&reg, LEDCSR_ON_PERIOD, 70);
-        rt2x00_set_field32(&reg, LEDCSR_OFF_PERIOD, 30);
-        rt2x00_set_field32(&reg, LEDCSR_LINK,
-                           (rt2x00dev->led_mode != LED_MODE_ASUS));
-        rt2x00_set_field32(&reg, LEDCSR_ACTIVITY,
-                           (rt2x00dev->led_mode != LED_MODE_TXRX_ACTIVITY));
-        rt2x00pci_register_write(rt2x00dev, LEDCSR, reg);
-}
-
-static void rt2400pci_disable_led(struct rt2x00_dev *rt2x00dev)
-{
-        u32 reg;
-
-        rt2x00pci_register_read(rt2x00dev, LEDCSR, &reg);
-        rt2x00_set_field32(&reg, LEDCSR_LINK, 0);
-        rt2x00_set_field32(&reg, LEDCSR_ACTIVITY, 0);
-        rt2x00pci_register_write(rt2x00dev, LEDCSR, reg);
-}
-
-/*
  * Link tuning
  */
 static void rt2400pci_link_stats(struct rt2x00_dev *rt2x00dev,
@@ -593,90 +591,94 @@ static void rt2400pci_link_tuner(struct rt2x00_dev *rt2x00dev)
  * Initialization functions.
  */
 static void rt2400pci_init_rxentry(struct rt2x00_dev *rt2x00dev,
-                                   struct data_entry *entry)
+                                   struct queue_entry *entry)
 {
-        __le32 *rxd = entry->priv;
+        struct queue_entry_priv_pci_rx *priv_rx = entry->priv_data;
         u32 word;
 
-        rt2x00_desc_read(rxd, 2, &word);
-        rt2x00_set_field32(&word, RXD_W2_BUFFER_LENGTH, entry->ring->data_size);
-        rt2x00_desc_write(rxd, 2, word);
+        rt2x00_desc_read(priv_rx->desc, 2, &word);
+        rt2x00_set_field32(&word, RXD_W2_BUFFER_LENGTH,
+                           entry->queue->data_size);
+        rt2x00_desc_write(priv_rx->desc, 2, word);
 
-        rt2x00_desc_read(rxd, 1, &word);
-        rt2x00_set_field32(&word, RXD_W1_BUFFER_ADDRESS, entry->data_dma);
-        rt2x00_desc_write(rxd, 1, word);
+        rt2x00_desc_read(priv_rx->desc, 1, &word);
+        rt2x00_set_field32(&word, RXD_W1_BUFFER_ADDRESS, priv_rx->data_dma);
+        rt2x00_desc_write(priv_rx->desc, 1, word);
 
-        rt2x00_desc_read(rxd, 0, &word);
+        rt2x00_desc_read(priv_rx->desc, 0, &word);
         rt2x00_set_field32(&word, RXD_W0_OWNER_NIC, 1);
-        rt2x00_desc_write(rxd, 0, word);
+        rt2x00_desc_write(priv_rx->desc, 0, word);
 }
 
 static void rt2400pci_init_txentry(struct rt2x00_dev *rt2x00dev,
-                                   struct data_entry *entry)
+                                   struct queue_entry *entry)
 {
-        __le32 *txd = entry->priv;
+        struct queue_entry_priv_pci_tx *priv_tx = entry->priv_data;
         u32 word;
 
-        rt2x00_desc_read(txd, 1, &word);
-        rt2x00_set_field32(&word, TXD_W1_BUFFER_ADDRESS, entry->data_dma);
-        rt2x00_desc_write(txd, 1, word);
+        rt2x00_desc_read(priv_tx->desc, 1, &word);
+        rt2x00_set_field32(&word, TXD_W1_BUFFER_ADDRESS, priv_tx->data_dma);
+        rt2x00_desc_write(priv_tx->desc, 1, word);
 
-        rt2x00_desc_read(txd, 2, &word);
-        rt2x00_set_field32(&word, TXD_W2_BUFFER_LENGTH, entry->ring->data_size);
-        rt2x00_desc_write(txd, 2, word);
+        rt2x00_desc_read(priv_tx->desc, 2, &word);
+        rt2x00_set_field32(&word, TXD_W2_BUFFER_LENGTH,
+                           entry->queue->data_size);
+        rt2x00_desc_write(priv_tx->desc, 2, word);
 
-        rt2x00_desc_read(txd, 0, &word);
+        rt2x00_desc_read(priv_tx->desc, 0, &word);
         rt2x00_set_field32(&word, TXD_W0_VALID, 0);
         rt2x00_set_field32(&word, TXD_W0_OWNER_NIC, 0);
-        rt2x00_desc_write(txd, 0, word);
+        rt2x00_desc_write(priv_tx->desc, 0, word);
 }
 
-static int rt2400pci_init_rings(struct rt2x00_dev *rt2x00dev)
+static int rt2400pci_init_queues(struct rt2x00_dev *rt2x00dev)
 {
+        struct queue_entry_priv_pci_rx *priv_rx;
+        struct queue_entry_priv_pci_tx *priv_tx;
         u32 reg;
 
         /*
          * Initialize registers.
          */
         rt2x00pci_register_read(rt2x00dev, TXCSR2, &reg);
-        rt2x00_set_field32(&reg, TXCSR2_TXD_SIZE,
-                           rt2x00dev->tx[IEEE80211_TX_QUEUE_DATA0].desc_size);
-        rt2x00_set_field32(&reg, TXCSR2_NUM_TXD,
-                           rt2x00dev->tx[IEEE80211_TX_QUEUE_DATA1].stats.limit);
-        rt2x00_set_field32(&reg, TXCSR2_NUM_ATIM,
-                           rt2x00dev->bcn[1].stats.limit);
-        rt2x00_set_field32(&reg, TXCSR2_NUM_PRIO,
-                           rt2x00dev->tx[IEEE80211_TX_QUEUE_DATA0].stats.limit);
+        rt2x00_set_field32(&reg, TXCSR2_TXD_SIZE, rt2x00dev->tx[0].desc_size);
+        rt2x00_set_field32(&reg, TXCSR2_NUM_TXD, rt2x00dev->tx[1].limit);
+        rt2x00_set_field32(&reg, TXCSR2_NUM_ATIM, rt2x00dev->bcn[1].limit);
+        rt2x00_set_field32(&reg, TXCSR2_NUM_PRIO, rt2x00dev->tx[0].limit);
         rt2x00pci_register_write(rt2x00dev, TXCSR2, reg);
 
+        priv_tx = rt2x00dev->tx[1].entries[0].priv_data;
         rt2x00pci_register_read(rt2x00dev, TXCSR3, &reg);
         rt2x00_set_field32(&reg, TXCSR3_TX_RING_REGISTER,
-                           rt2x00dev->tx[IEEE80211_TX_QUEUE_DATA1].data_dma);
+                           priv_tx->desc_dma);
         rt2x00pci_register_write(rt2x00dev, TXCSR3, reg);
 
+        priv_tx = rt2x00dev->tx[0].entries[0].priv_data;
         rt2x00pci_register_read(rt2x00dev, TXCSR5, &reg);
         rt2x00_set_field32(&reg, TXCSR5_PRIO_RING_REGISTER,
-                           rt2x00dev->tx[IEEE80211_TX_QUEUE_DATA0].data_dma);
+                           priv_tx->desc_dma);
         rt2x00pci_register_write(rt2x00dev, TXCSR5, reg);
 
+        priv_tx = rt2x00dev->bcn[1].entries[0].priv_data;
         rt2x00pci_register_read(rt2x00dev, TXCSR4, &reg);
         rt2x00_set_field32(&reg, TXCSR4_ATIM_RING_REGISTER,
-                           rt2x00dev->bcn[1].data_dma);
+                           priv_tx->desc_dma);
         rt2x00pci_register_write(rt2x00dev, TXCSR4, reg);
 
+        priv_tx = rt2x00dev->bcn[0].entries[0].priv_data;
         rt2x00pci_register_read(rt2x00dev, TXCSR6, &reg);
         rt2x00_set_field32(&reg, TXCSR6_BEACON_RING_REGISTER,
-                           rt2x00dev->bcn[0].data_dma);
+                           priv_tx->desc_dma);
         rt2x00pci_register_write(rt2x00dev, TXCSR6, reg);
 
         rt2x00pci_register_read(rt2x00dev, RXCSR1, &reg);
         rt2x00_set_field32(&reg, RXCSR1_RXD_SIZE, rt2x00dev->rx->desc_size);
-        rt2x00_set_field32(&reg, RXCSR1_NUM_RXD, rt2x00dev->rx->stats.limit);
+        rt2x00_set_field32(&reg, RXCSR1_NUM_RXD, rt2x00dev->rx->limit);
         rt2x00pci_register_write(rt2x00dev, RXCSR1, reg);
 
+        priv_rx = rt2x00dev->rx->entries[0].priv_data;
         rt2x00pci_register_read(rt2x00dev, RXCSR2, &reg);
-        rt2x00_set_field32(&reg, RXCSR2_RX_RING_REGISTER,
-                           rt2x00dev->rx->data_dma);
+        rt2x00_set_field32(&reg, RXCSR2_RX_RING_REGISTER, priv_tx->desc_dma);
         rt2x00pci_register_write(rt2x00dev, RXCSR2, reg);
 
         return 0;
@@ -702,6 +704,11 @@ static int rt2400pci_init_registers(struct rt2x00_dev *rt2x00dev)
                            (rt2x00dev->rx->data_size / 128));
         rt2x00pci_register_write(rt2x00dev, CSR9, reg);
 
+        rt2x00pci_register_read(rt2x00dev, LEDCSR, &reg);
+        rt2x00_set_field32(&reg, LEDCSR_ON_PERIOD, 70);
+        rt2x00_set_field32(&reg, LEDCSR_OFF_PERIOD, 30);
+        rt2x00pci_register_write(rt2x00dev, LEDCSR, reg);
+
         rt2x00pci_register_write(rt2x00dev, CNT3, 0x3f080000);
 
         rt2x00pci_register_read(rt2x00dev, ARCSR0, &reg);
@@ -795,19 +802,15 @@ continue_csr_init:
         rt2400pci_bbp_write(rt2x00dev, 30, 0x21);
         rt2400pci_bbp_write(rt2x00dev, 31, 0x00);
 
-        DEBUG(rt2x00dev, "Start initialization from EEPROM...\n");
         for (i = 0; i < EEPROM_BBP_SIZE; i++) {
                 rt2x00_eeprom_read(rt2x00dev, EEPROM_BBP_START + i, &eeprom);
 
                 if (eeprom != 0xffff && eeprom != 0x0000) {
                         reg_id = rt2x00_get_field16(eeprom, EEPROM_BBP_REG_ID);
                         value = rt2x00_get_field16(eeprom, EEPROM_BBP_VALUE);
-                        DEBUG(rt2x00dev, "BBP: 0x%02x, value: 0x%02x.\n",
-                              reg_id, value);
                         rt2400pci_bbp_write(rt2x00dev, reg_id, value);
                 }
         }
-        DEBUG(rt2x00dev, "...End initialization from EEPROM.\n");
 
         return 0;
 }
@@ -859,7 +862,7 @@ static int rt2400pci_enable_radio(struct rt2x00_dev *rt2x00dev)
         /*
          * Initialize all registers.
          */
-        if (rt2400pci_init_rings(rt2x00dev) ||
+        if (rt2400pci_init_queues(rt2x00dev) ||
             rt2400pci_init_registers(rt2x00dev) ||
             rt2400pci_init_bbp(rt2x00dev)) {
                 ERROR(rt2x00dev, "Register initialization failed.\n");
@@ -871,11 +874,6 @@ static int rt2400pci_enable_radio(struct rt2x00_dev *rt2x00dev)
          */
         rt2400pci_toggle_irq(rt2x00dev, STATE_RADIO_IRQ_ON);
 
-        /*
-         * Enable LED
-         */
-        rt2400pci_enable_led(rt2x00dev);
-
         return 0;
 }
 
@@ -883,11 +881,6 @@ static void rt2400pci_disable_radio(struct rt2x00_dev *rt2x00dev)
 {
         u32 reg;
 
-        /*
-         * Disable LED
-         */
-        rt2400pci_disable_led(rt2x00dev);
-
         rt2x00pci_register_write(rt2x00dev, PWRCSR0, 0);
 
         /*
@@ -986,10 +979,10 @@ static int rt2400pci_set_device_state(struct rt2x00_dev *rt2x00dev,
  */
 static void rt2400pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
                                     struct sk_buff *skb,
-                                    struct txdata_entry_desc *desc,
+                                    struct txentry_desc *txdesc,
                                     struct ieee80211_tx_control *control)
 {
-        struct skb_desc *skbdesc = get_skb_desc(skb);
+        struct skb_frame_desc *skbdesc = get_skb_frame_desc(skb);
         __le32 *txd = skbdesc->desc;
         u32 word;
 
@@ -1001,19 +994,19 @@ static void rt2400pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
         rt2x00_desc_write(txd, 2, word);
 
         rt2x00_desc_read(txd, 3, &word);
-        rt2x00_set_field32(&word, TXD_W3_PLCP_SIGNAL, desc->signal);
+        rt2x00_set_field32(&word, TXD_W3_PLCP_SIGNAL, txdesc->signal);
         rt2x00_set_field32(&word, TXD_W3_PLCP_SIGNAL_REGNUM, 5);
         rt2x00_set_field32(&word, TXD_W3_PLCP_SIGNAL_BUSY, 1);
-        rt2x00_set_field32(&word, TXD_W3_PLCP_SERVICE, desc->service);
+        rt2x00_set_field32(&word, TXD_W3_PLCP_SERVICE, txdesc->service);
         rt2x00_set_field32(&word, TXD_W3_PLCP_SERVICE_REGNUM, 6);
         rt2x00_set_field32(&word, TXD_W3_PLCP_SERVICE_BUSY, 1);
         rt2x00_desc_write(txd, 3, word);
 
         rt2x00_desc_read(txd, 4, &word);
-        rt2x00_set_field32(&word, TXD_W4_PLCP_LENGTH_LOW, desc->length_low);
+        rt2x00_set_field32(&word, TXD_W4_PLCP_LENGTH_LOW, txdesc->length_low);
         rt2x00_set_field32(&word, TXD_W3_PLCP_LENGTH_LOW_REGNUM, 8);
         rt2x00_set_field32(&word, TXD_W3_PLCP_LENGTH_LOW_BUSY, 1);
-        rt2x00_set_field32(&word, TXD_W4_PLCP_LENGTH_HIGH, desc->length_high);
+        rt2x00_set_field32(&word, TXD_W4_PLCP_LENGTH_HIGH, txdesc->length_high);
         rt2x00_set_field32(&word, TXD_W3_PLCP_LENGTH_HIGH_REGNUM, 7);
         rt2x00_set_field32(&word, TXD_W3_PLCP_LENGTH_HIGH_BUSY, 1);
         rt2x00_desc_write(txd, 4, word);
@@ -1022,14 +1015,14 @@ static void rt2400pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
         rt2x00_set_field32(&word, TXD_W0_OWNER_NIC, 1);
         rt2x00_set_field32(&word, TXD_W0_VALID, 1);
         rt2x00_set_field32(&word, TXD_W0_MORE_FRAG,
-                           test_bit(ENTRY_TXD_MORE_FRAG, &desc->flags));
+                           test_bit(ENTRY_TXD_MORE_FRAG, &txdesc->flags));
         rt2x00_set_field32(&word, TXD_W0_ACK,
-                           test_bit(ENTRY_TXD_ACK, &desc->flags));
+                           test_bit(ENTRY_TXD_ACK, &txdesc->flags));
         rt2x00_set_field32(&word, TXD_W0_TIMESTAMP,
-                           test_bit(ENTRY_TXD_REQ_TIMESTAMP, &desc->flags));
+                           test_bit(ENTRY_TXD_REQ_TIMESTAMP, &txdesc->flags));
         rt2x00_set_field32(&word, TXD_W0_RTS,
-                           test_bit(ENTRY_TXD_RTS_FRAME, &desc->flags));
-        rt2x00_set_field32(&word, TXD_W0_IFS, desc->ifs);
+                           test_bit(ENTRY_TXD_RTS_FRAME, &txdesc->flags));
+        rt2x00_set_field32(&word, TXD_W0_IFS, txdesc->ifs);
         rt2x00_set_field32(&word, TXD_W0_RETRY_MODE,
                            !!(control->flags &
                               IEEE80211_TXCTL_LONG_RETRY_LIMIT));
@@ -1040,11 +1033,11 @@ static void rt2400pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
  * TX data initialization
  */
 static void rt2400pci_kick_tx_queue(struct rt2x00_dev *rt2x00dev,
-                                    unsigned int queue)
+                                    const unsigned int queue)
 {
         u32 reg;
 
-        if (queue == IEEE80211_TX_QUEUE_BEACON) {
+        if (queue == RT2X00_BCN_QUEUE_BEACON) {
                 rt2x00pci_register_read(rt2x00dev, CSR14, &reg);
                 if (!rt2x00_get_field32(reg, CSR14_BEACON_GEN)) {
                         rt2x00_set_field32(&reg, CSR14_BEACON_GEN, 1);
@@ -1059,56 +1052,56 @@ static void rt2400pci_kick_tx_queue(struct rt2x00_dev *rt2x00dev,
         rt2x00_set_field32(&reg, TXCSR0_KICK_TX,
                            (queue == IEEE80211_TX_QUEUE_DATA1));
         rt2x00_set_field32(&reg, TXCSR0_KICK_ATIM,
-                           (queue == IEEE80211_TX_QUEUE_AFTER_BEACON));
+                           (queue == RT2X00_BCN_QUEUE_ATIM));
         rt2x00pci_register_write(rt2x00dev, TXCSR0, reg);
 }
 
 /*
  * RX control handlers
  */
-static void rt2400pci_fill_rxdone(struct data_entry *entry,
-                                  struct rxdata_entry_desc *desc)
+static void rt2400pci_fill_rxdone(struct queue_entry *entry,
+                                  struct rxdone_entry_desc *rxdesc)
 {
-        __le32 *rxd = entry->priv;
+        struct queue_entry_priv_pci_rx *priv_rx = entry->priv_data;
         u32 word0;
         u32 word2;
 
-        rt2x00_desc_read(rxd, 0, &word0);
-        rt2x00_desc_read(rxd, 2, &word2);
+        rt2x00_desc_read(priv_rx->desc, 0, &word0);
+        rt2x00_desc_read(priv_rx->desc, 2, &word2);
 
-        desc->flags = 0;
+        rxdesc->flags = 0;
         if (rt2x00_get_field32(word0, RXD_W0_CRC_ERROR))
-                desc->flags |= RX_FLAG_FAILED_FCS_CRC;
+                rxdesc->flags |= RX_FLAG_FAILED_FCS_CRC;
         if (rt2x00_get_field32(word0, RXD_W0_PHYSICAL_ERROR))
-                desc->flags |= RX_FLAG_FAILED_PLCP_CRC;
+                rxdesc->flags |= RX_FLAG_FAILED_PLCP_CRC;
 
         /*
          * Obtain the status about this packet.
          */
-        desc->signal = rt2x00_get_field32(word2, RXD_W2_SIGNAL);
-        desc->rssi = rt2x00_get_field32(word2, RXD_W2_RSSI) -
-            entry->ring->rt2x00dev->rssi_offset;
-        desc->ofdm = 0;
-        desc->size = rt2x00_get_field32(word0, RXD_W0_DATABYTE_COUNT);
-        desc->my_bss = !!rt2x00_get_field32(word0, RXD_W0_MY_BSS);
+        rxdesc->signal = rt2x00_get_field32(word2, RXD_W2_SIGNAL);
+        rxdesc->rssi = rt2x00_get_field32(word2, RXD_W2_RSSI) -
+            entry->queue->rt2x00dev->rssi_offset;
+        rxdesc->ofdm = 0;
+        rxdesc->size = rt2x00_get_field32(word0, RXD_W0_DATABYTE_COUNT);
+        rxdesc->my_bss = !!rt2x00_get_field32(word0, RXD_W0_MY_BSS);
 }
 
 /*
  * Interrupt functions.
  */
-static void rt2400pci_txdone(struct rt2x00_dev *rt2x00dev, const int queue)
+static void rt2400pci_txdone(struct rt2x00_dev *rt2x00dev,
+                             const enum ieee80211_tx_queue queue_idx)
 {
-        struct data_ring *ring = rt2x00lib_get_ring(rt2x00dev, queue);
-        struct data_entry *entry;
-        __le32 *txd;
+        struct data_queue *queue = rt2x00queue_get_queue(rt2x00dev, queue_idx);
+        struct queue_entry_priv_pci_tx *priv_tx;
+        struct queue_entry *entry;
+        struct txdone_entry_desc txdesc;
         u32 word;
-        int tx_status;
-        int retry;
 
-        while (!rt2x00_ring_empty(ring)) {
-                entry = rt2x00_get_data_entry_done(ring);
-                txd = entry->priv;
-                rt2x00_desc_read(txd, 0, &word);
+        while (!rt2x00queue_empty(queue)) {
+                entry = rt2x00queue_get_entry(queue, Q_INDEX_DONE);
+                priv_tx = entry->priv_data;
+                rt2x00_desc_read(priv_tx->desc, 0, &word);
 
                 if (rt2x00_get_field32(word, TXD_W0_OWNER_NIC) ||
                     !rt2x00_get_field32(word, TXD_W0_VALID))
@@ -1117,10 +1110,10 @@ static void rt2400pci_txdone(struct rt2x00_dev *rt2x00dev, const int queue)
                 /*
                  * Obtain the status about this packet.
                  */
-                tx_status = rt2x00_get_field32(word, TXD_W0_RESULT);
-                retry = rt2x00_get_field32(word, TXD_W0_RETRY_COUNT);
+                txdesc.status = rt2x00_get_field32(word, TXD_W0_RESULT);
+                txdesc.retry = rt2x00_get_field32(word, TXD_W0_RETRY_COUNT);
 
-                rt2x00pci_txdone(rt2x00dev, entry, tx_status, retry);
+                rt2x00pci_txdone(rt2x00dev, entry, &txdesc);
         }
 }
 
@@ -1164,7 +1157,7 @@ static irqreturn_t rt2400pci_interrupt(int irq, void *dev_instance)
          * 3 - Atim ring transmit done interrupt.
          */
         if (rt2x00_get_field32(reg, CSR7_TXDONE_ATIMRING))
-                rt2400pci_txdone(rt2x00dev, IEEE80211_TX_QUEUE_AFTER_BEACON);
+                rt2400pci_txdone(rt2x00dev, RT2X00_BCN_QUEUE_ATIM);
 
         /*
          * 4 - Priority ring transmit done interrupt.
@@ -1272,8 +1265,24 @@ static int rt2400pci_init_eeprom(struct rt2x00_dev *rt2x00dev)
         /*
          * Store led mode, for correct led behaviour.
          */
-        rt2x00dev->led_mode =
-            rt2x00_get_field16(eeprom, EEPROM_ANTENNA_LED_MODE);
+#ifdef CONFIG_RT2400PCI_LEDS
+        value = rt2x00_get_field16(eeprom, EEPROM_ANTENNA_LED_MODE);
+
+        switch (value) {
+        case LED_MODE_ASUS:
+        case LED_MODE_ALPHA:
+        case LED_MODE_DEFAULT:
+                rt2x00dev->led_flags = LED_SUPPORT_RADIO;
+                break;
+        case LED_MODE_TXRX_ACTIVITY:
+                rt2x00dev->led_flags =
+                    LED_SUPPORT_RADIO | LED_SUPPORT_ACTIVITY;
+                break;
+        case LED_MODE_SIGNAL_STRENGTH:
+                rt2x00dev->led_flags = LED_SUPPORT_RADIO;
+                break;
+        }
+#endif /* CONFIG_RT2400PCI_LEDS */
 
         /*
          * Detect if this device has an hardware controlled radio.
@@ -1343,8 +1352,8 @@ static void rt2400pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
         /*
          * Initialize hw_mode information.
          */
-        spec->num_modes = 1;
-        spec->num_rates = 4;
+        spec->supported_bands = SUPPORT_BAND_2GHZ;
+        spec->supported_rates = SUPPORT_RATE_CCK;
         spec->tx_power_a = NULL;
         spec->tx_power_bg = txpower;
         spec->tx_power_default = DEFAULT_TXPOWER;
@@ -1374,9 +1383,9 @@ static int rt2400pci_probe_hw(struct rt2x00_dev *rt2x00dev)
         rt2400pci_probe_hw_mode(rt2x00dev);
 
         /*
-         * This device requires the beacon ring
+         * This device requires the atim queue
          */
-        __set_bit(DRIVER_REQUIRE_BEACON_RING, &rt2x00dev->flags);
+        __set_bit(DRIVER_REQUIRE_ATIM_QUEUE, &rt2x00dev->flags);
 
         /*
          * Set the rssi offset.
@@ -1481,7 +1490,8 @@ static int rt2400pci_conf_tx(struct ieee80211_hw *hw,
         /*
          * Write configuration to register.
          */
-        rt2400pci_config_cw(rt2x00dev, &rt2x00dev->tx->tx_params);
+        rt2400pci_config_cw(rt2x00dev,
+                            rt2x00dev->tx->cw_min, rt2x00dev->tx->cw_max);
 
         return 0;
 }
@@ -1500,12 +1510,48 @@ static u64 rt2400pci_get_tsf(struct ieee80211_hw *hw)
         return tsf;
 }
 
-static void rt2400pci_reset_tsf(struct ieee80211_hw *hw)
+static int rt2400pci_beacon_update(struct ieee80211_hw *hw, struct sk_buff *skb,
+                                   struct ieee80211_tx_control *control)
 {
         struct rt2x00_dev *rt2x00dev = hw->priv;
+        struct rt2x00_intf *intf = vif_to_intf(control->vif);
+        struct queue_entry_priv_pci_tx *priv_tx;
+        struct skb_frame_desc *skbdesc;
+
+        if (unlikely(!intf->beacon))
+                return -ENOBUFS;
+
+        priv_tx = intf->beacon->priv_data;
+
+        /*
+         * Fill in skb descriptor
+         */
+        skbdesc = get_skb_frame_desc(skb);
+        memset(skbdesc, 0, sizeof(*skbdesc));
+        skbdesc->flags |= FRAME_DESC_DRIVER_GENERATED;
+        skbdesc->data = skb->data;
+        skbdesc->data_len = skb->len;
+        skbdesc->desc = priv_tx->desc;
+        skbdesc->desc_len = intf->beacon->queue->desc_size;
+        skbdesc->entry = intf->beacon;
 
-        rt2x00pci_register_write(rt2x00dev, CSR16, 0);
-        rt2x00pci_register_write(rt2x00dev, CSR17, 0);
+        /*
+         * mac80211 doesn't provide the control->queue variable
+         * for beacons. Set our own queue identification so
+         * it can be used during descriptor initialization.
+         */
+        control->queue = RT2X00_BCN_QUEUE_BEACON;
+        rt2x00lib_write_tx_desc(rt2x00dev, skb, control);
+
+        /*
+         * Enable beacon generation.
+         * Write entire beacon with descriptor to register,
+         * and kick the beacon generator.
+         */
+        memcpy(priv_tx->data, skb->data, skb->len);
+        rt2x00dev->ops->lib->kick_tx_queue(rt2x00dev, control->queue);
+
+        return 0;
 }
 
 static int rt2400pci_tx_last_beacon(struct ieee80211_hw *hw)
@@ -1532,8 +1578,7 @@ static const struct ieee80211_ops rt2400pci_mac80211_ops = {
         .conf_tx                = rt2400pci_conf_tx,
         .get_tx_stats           = rt2x00mac_get_tx_stats,
         .get_tsf                = rt2400pci_get_tsf,
-        .reset_tsf              = rt2400pci_reset_tsf,
-        .beacon_update          = rt2x00pci_beacon_update,
+        .beacon_update          = rt2400pci_beacon_update,
         .tx_last_beacon         = rt2400pci_tx_last_beacon,
 };
 
@@ -1549,23 +1594,54 @@ static const struct rt2x00lib_ops rt2400pci_rt2x00_ops = {
         .link_stats             = rt2400pci_link_stats,
         .reset_tuner            = rt2400pci_reset_tuner,
         .link_tuner             = rt2400pci_link_tuner,
+        .led_brightness         = rt2400pci_led_brightness,
         .write_tx_desc          = rt2400pci_write_tx_desc,
         .write_tx_data          = rt2x00pci_write_tx_data,
         .kick_tx_queue          = rt2400pci_kick_tx_queue,
         .fill_rxdone            = rt2400pci_fill_rxdone,
-        .config_mac_addr        = rt2400pci_config_mac_addr,
-        .config_bssid           = rt2400pci_config_bssid,
-        .config_type            = rt2400pci_config_type,
+        .config_intf            = rt2400pci_config_intf,
         .config_preamble        = rt2400pci_config_preamble,
         .config                 = rt2400pci_config,
 };
 
+static const struct data_queue_desc rt2400pci_queue_rx = {
+        .entry_num              = RX_ENTRIES,
+        .data_size              = DATA_FRAME_SIZE,
+        .desc_size              = RXD_DESC_SIZE,
+        .priv_size              = sizeof(struct queue_entry_priv_pci_rx),
+};
+
+static const struct data_queue_desc rt2400pci_queue_tx = {
+        .entry_num              = TX_ENTRIES,
+        .data_size              = DATA_FRAME_SIZE,
+        .desc_size              = TXD_DESC_SIZE,
+        .priv_size              = sizeof(struct queue_entry_priv_pci_tx),
+};
+
+static const struct data_queue_desc rt2400pci_queue_bcn = {
+        .entry_num              = BEACON_ENTRIES,
+        .data_size              = MGMT_FRAME_SIZE,
+        .desc_size              = TXD_DESC_SIZE,
+        .priv_size              = sizeof(struct queue_entry_priv_pci_tx),
+};
+
+static const struct data_queue_desc rt2400pci_queue_atim = {
+        .entry_num              = ATIM_ENTRIES,
+        .data_size              = DATA_FRAME_SIZE,
+        .desc_size              = TXD_DESC_SIZE,
+        .priv_size              = sizeof(struct queue_entry_priv_pci_tx),
+};
+
 static const struct rt2x00_ops rt2400pci_ops = {
         .name           = KBUILD_MODNAME,
-        .rxd_size       = RXD_DESC_SIZE,
-        .txd_size       = TXD_DESC_SIZE,
+        .max_sta_intf   = 1,
+        .max_ap_intf    = 1,
         .eeprom_size    = EEPROM_SIZE,
         .rf_size        = RF_SIZE,
+        .rx             = &rt2400pci_queue_rx,
+        .tx             = &rt2400pci_queue_tx,
+        .bcn            = &rt2400pci_queue_bcn,
+        .atim           = &rt2400pci_queue_atim,
         .lib            = &rt2400pci_rt2x00_ops,
         .hw             = &rt2400pci_mac80211_ops,
 #ifdef CONFIG_RT2X00_LIB_DEBUGFS
diff --git a/drivers/net/wireless/rt2x00/rt2400pci.h b/drivers/net/wireless/rt2x00/rt2400pci.h
index 369aac6d0336..da178d44660e 100644
--- a/drivers/net/wireless/rt2x00/rt2400pci.h
+++ b/drivers/net/wireless/rt2x00/rt2400pci.h
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2007 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2008 rt2x00 SourceForge Project
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
@@ -923,13 +923,13 @@
 #define RXD_W7_RESERVED                 FIELD32(0xffffffff)
 
 /*
- * Macro's for converting txpower from EEPROM to dscape value
- * and from dscape value to register value.
+ * Macro's for converting txpower from EEPROM to mac80211 value
+ * and from mac80211 value to register value.
  * NOTE: Logics in rt2400pci for txpower are reversed
  * compared to the other rt2x00 drivers. A higher txpower
  * value means that the txpower must be lowered. This is
  * important when converting the value coming from the
- * dscape stack to the rt2400 acceptable value.
+ * mac80211 stack to the rt2400 acceptable value.
  */
 #define MIN_TXPOWER     31
 #define MAX_TXPOWER     62
diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c
index 91e87b53374f..ffcd996df064 100644
--- a/drivers/net/wireless/rt2x00/rt2500pci.c
+++ b/drivers/net/wireless/rt2x00/rt2500pci.c
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2007 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2008 rt2x00 SourceForge Project
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
@@ -243,57 +243,80 @@ static int rt2500pci_rfkill_poll(struct rt2x00_dev *rt2x00dev)
 #define rt2500pci_rfkill_poll   NULL
 #endif /* CONFIG_RT2500PCI_RFKILL */
 
-/*
- * Configuration handlers.
- */
-static void rt2500pci_config_mac_addr(struct rt2x00_dev *rt2x00dev,
-                                      __le32 *mac)
+#ifdef CONFIG_RT2500PCI_LEDS
+static void rt2500pci_led_brightness(struct led_classdev *led_cdev,
+                                     enum led_brightness brightness)
 {
-        rt2x00pci_register_multiwrite(rt2x00dev, CSR3, mac,
-                                      (2 * sizeof(__le32)));
-}
+        struct rt2x00_led *led =
+            container_of(led_cdev, struct rt2x00_led, led_dev);
+        unsigned int enabled = brightness != LED_OFF;
+        unsigned int activity =
+            led->rt2x00dev->led_flags & LED_SUPPORT_ACTIVITY;
+        u32 reg;
 
-static void rt2500pci_config_bssid(struct rt2x00_dev *rt2x00dev,
-                                   __le32 *bssid)
-{
-        rt2x00pci_register_multiwrite(rt2x00dev, CSR5, bssid,
-                                      (2 * sizeof(__le32)));
+        rt2x00pci_register_read(led->rt2x00dev, LEDCSR, &reg);
+
+        if (led->type == LED_TYPE_RADIO || led->type == LED_TYPE_ASSOC) {
+                rt2x00_set_field32(&reg, LEDCSR_LINK, enabled);
+                rt2x00_set_field32(&reg, LEDCSR_ACTIVITY, enabled && activity);
+        }
+
+        rt2x00pci_register_write(led->rt2x00dev, LEDCSR, reg);
 }
+#else
+#define rt2500pci_led_brightness        NULL
+#endif /* CONFIG_RT2500PCI_LEDS */
 
-static void rt2500pci_config_type(struct rt2x00_dev *rt2x00dev, const int type,
-                                  const int tsf_sync)
+/*
+ * Configuration handlers.
+ */
+static void rt2500pci_config_intf(struct rt2x00_dev *rt2x00dev,
+                                  struct rt2x00_intf *intf,
+                                  struct rt2x00intf_conf *conf,
+                                  const unsigned int flags)
 {
+        struct data_queue *queue =
+            rt2x00queue_get_queue(rt2x00dev, RT2X00_BCN_QUEUE_BEACON);
+        unsigned int bcn_preload;
         u32 reg;
 
-        rt2x00pci_register_write(rt2x00dev, CSR14, 0);
+        if (flags & CONFIG_UPDATE_TYPE) {
+                rt2x00pci_register_write(rt2x00dev, CSR14, 0);
 
-        /*
-         * Enable beacon config
-         */
-        rt2x00pci_register_read(rt2x00dev, BCNCSR1, &reg);
-        rt2x00_set_field32(&reg, BCNCSR1_PRELOAD,
-                           PREAMBLE + get_duration(IEEE80211_HEADER, 20));
-        rt2x00_set_field32(&reg, BCNCSR1_BEACON_CWMIN,
-                           rt2x00lib_get_ring(rt2x00dev,
-                                              IEEE80211_TX_QUEUE_BEACON)
-                           ->tx_params.cw_min);
-        rt2x00pci_register_write(rt2x00dev, BCNCSR1, reg);
+                /*
+                 * Enable beacon config
+                 */
+                bcn_preload = PREAMBLE + get_duration(IEEE80211_HEADER, 20);
+                rt2x00pci_register_read(rt2x00dev, BCNCSR1, &reg);
+                rt2x00_set_field32(&reg, BCNCSR1_PRELOAD, bcn_preload);
+                rt2x00_set_field32(&reg, BCNCSR1_BEACON_CWMIN, queue->cw_min);
+                rt2x00pci_register_write(rt2x00dev, BCNCSR1, reg);
 
-        /*
-         * Enable synchronisation.
-         */
-        rt2x00pci_register_read(rt2x00dev, CSR14, &reg);
-        rt2x00_set_field32(&reg, CSR14_TSF_COUNT, 1);
-        rt2x00_set_field32(&reg, CSR14_TBCN, (tsf_sync == TSF_SYNC_BEACON));
-        rt2x00_set_field32(&reg, CSR14_BEACON_GEN, 0);
-        rt2x00_set_field32(&reg, CSR14_TSF_SYNC, tsf_sync);
-        rt2x00pci_register_write(rt2x00dev, CSR14, reg);
+                /*
+                 * Enable synchronisation.
+                 */
+                rt2x00pci_register_read(rt2x00dev, CSR14, &reg);
+                rt2x00_set_field32(&reg, CSR14_TSF_COUNT, 1);
+                rt2x00_set_field32(&reg, CSR14_TBCN,
+                                   (conf->sync == TSF_SYNC_BEACON));
+                rt2x00_set_field32(&reg, CSR14_BEACON_GEN, 0);
+                rt2x00_set_field32(&reg, CSR14_TSF_SYNC, conf->sync);
+                rt2x00pci_register_write(rt2x00dev, CSR14, reg);
+        }
+
+        if (flags & CONFIG_UPDATE_MAC)
+                rt2x00pci_register_multiwrite(rt2x00dev, CSR3,
+                                              conf->mac, sizeof(conf->mac));
+
+        if (flags & CONFIG_UPDATE_BSSID)
+                rt2x00pci_register_multiwrite(rt2x00dev, CSR5,
+                                              conf->bssid, sizeof(conf->bssid));
 }
 
-static void rt2500pci_config_preamble(struct rt2x00_dev *rt2x00dev,
-                                      const int short_preamble,
-                                      const int ack_timeout,
-                                      const int ack_consume_time)
+static int rt2500pci_config_preamble(struct rt2x00_dev *rt2x00dev,
+                                     const int short_preamble,
+                                     const int ack_timeout,
+                                     const int ack_consume_time)
 {
         int preamble_mask;
         u32 reg;
@@ -331,6 +354,8 @@ static void rt2500pci_config_preamble(struct rt2x00_dev *rt2x00dev,
         rt2x00_set_field32(&reg, ARCSR5_SERVICE, 0x84);
         rt2x00_set_field32(&reg, ARCSR2_LENGTH, get_duration(ACK_SIZE, 110));
         rt2x00pci_register_write(rt2x00dev, ARCSR5, reg);
+
+        return 0;
 }
 
 static void rt2500pci_config_phymode(struct rt2x00_dev *rt2x00dev,
@@ -530,8 +555,8 @@ static void rt2500pci_config_duration(struct rt2x00_dev *rt2x00dev,
 }
 
 static void rt2500pci_config(struct rt2x00_dev *rt2x00dev,
-                             const unsigned int flags,
-                             struct rt2x00lib_conf *libconf)
+                             struct rt2x00lib_conf *libconf,
+                             const unsigned int flags)
 {
         if (flags & CONFIG_UPDATE_PHYMODE)
                 rt2500pci_config_phymode(rt2x00dev, libconf->basic_rates);
@@ -548,34 +573,6 @@ static void rt2500pci_config(struct rt2x00_dev *rt2x00dev,
 }
 
 /*
- * LED functions.
- */
-static void rt2500pci_enable_led(struct rt2x00_dev *rt2x00dev)
-{
-        u32 reg;
-
-        rt2x00pci_register_read(rt2x00dev, LEDCSR, &reg);
-
-        rt2x00_set_field32(&reg, LEDCSR_ON_PERIOD, 70);
-        rt2x00_set_field32(&reg, LEDCSR_OFF_PERIOD, 30);
-        rt2x00_set_field32(&reg, LEDCSR_LINK,
-                           (rt2x00dev->led_mode != LED_MODE_ASUS));
-        rt2x00_set_field32(&reg, LEDCSR_ACTIVITY,
-                           (rt2x00dev->led_mode != LED_MODE_TXRX_ACTIVITY));
-        rt2x00pci_register_write(rt2x00dev, LEDCSR, reg);
-}
-
-static void rt2500pci_disable_led(struct rt2x00_dev *rt2x00dev)
-{
-        u32 reg;
-
-        rt2x00pci_register_read(rt2x00dev, LEDCSR, &reg);
-        rt2x00_set_field32(&reg, LEDCSR_LINK, 0);
-        rt2x00_set_field32(&reg, LEDCSR_ACTIVITY, 0);
-        rt2x00pci_register_write(rt2x00dev, LEDCSR, reg);
-}
-
-/*
  * Link tuning
  */
 static void rt2500pci_link_stats(struct rt2x00_dev *rt2x00dev,
@@ -610,9 +607,10 @@ static void rt2500pci_link_tuner(struct rt2x00_dev *rt2x00dev)
         /*
          * To prevent collisions with MAC ASIC on chipsets
          * up to version C the link tuning should halt after 20
-         * seconds.
+         * seconds while being associated.
          */
         if (rt2x00_rev(&rt2x00dev->chip) < RT2560_VERSION_D &&
+            rt2x00dev->intf_associated &&
             rt2x00dev->link.count > 20)
                 return;
 
@@ -620,9 +618,12 @@ static void rt2500pci_link_tuner(struct rt2x00_dev *rt2x00dev)
 
         /*
          * Chipset versions C and lower should directly continue
-         * to the dynamic CCA tuning.
+         * to the dynamic CCA tuning. Chipset version D and higher
+         * should go straight to dynamic CCA tuning when they
+         * are not associated.
          */
-        if (rt2x00_rev(&rt2x00dev->chip) < RT2560_VERSION_D)
+        if (rt2x00_rev(&rt2x00dev->chip) < RT2560_VERSION_D ||
+            !rt2x00dev->intf_associated)
                 goto dynamic_cca_tune;
 
         /*
@@ -684,82 +685,84 @@ dynamic_cca_tune:
  * Initialization functions.
  */
 static void rt2500pci_init_rxentry(struct rt2x00_dev *rt2x00dev,
-                                   struct data_entry *entry)
+                                   struct queue_entry *entry)
 {
-        __le32 *rxd = entry->priv;
+        struct queue_entry_priv_pci_rx *priv_rx = entry->priv_data;
         u32 word;
 
-        rt2x00_desc_read(rxd, 1, &word);
-        rt2x00_set_field32(&word, RXD_W1_BUFFER_ADDRESS, entry->data_dma);
-        rt2x00_desc_write(rxd, 1, word);
+        rt2x00_desc_read(priv_rx->desc, 1, &word);
+        rt2x00_set_field32(&word, RXD_W1_BUFFER_ADDRESS, priv_rx->data_dma);
+        rt2x00_desc_write(priv_rx->desc, 1, word);
 
-        rt2x00_desc_read(rxd, 0, &word);
+        rt2x00_desc_read(priv_rx->desc, 0, &word);
         rt2x00_set_field32(&word, RXD_W0_OWNER_NIC, 1);
-        rt2x00_desc_write(rxd, 0, word);
+        rt2x00_desc_write(priv_rx->desc, 0, word);
 }
 
 static void rt2500pci_init_txentry(struct rt2x00_dev *rt2x00dev,
-                                   struct data_entry *entry)
+                                   struct queue_entry *entry)
 {
-        __le32 *txd = entry->priv;
+        struct queue_entry_priv_pci_tx *priv_tx = entry->priv_data;
         u32 word;
 
-        rt2x00_desc_read(txd, 1, &word);
-        rt2x00_set_field32(&word, TXD_W1_BUFFER_ADDRESS, entry->data_dma);
-        rt2x00_desc_write(txd, 1, word);
+        rt2x00_desc_read(priv_tx->desc, 1, &word);
+        rt2x00_set_field32(&word, TXD_W1_BUFFER_ADDRESS, priv_tx->data_dma);
+        rt2x00_desc_write(priv_tx->desc, 1, word);
 
-        rt2x00_desc_read(txd, 0, &word);
+        rt2x00_desc_read(priv_tx->desc, 0, &word);
         rt2x00_set_field32(&word, TXD_W0_VALID, 0);
         rt2x00_set_field32(&word, TXD_W0_OWNER_NIC, 0);
-        rt2x00_desc_write(txd, 0, word);
+        rt2x00_desc_write(priv_tx->desc, 0, word);
 }
 
-static int rt2500pci_init_rings(struct rt2x00_dev *rt2x00dev)
+static int rt2500pci_init_queues(struct rt2x00_dev *rt2x00dev)
 {
+        struct queue_entry_priv_pci_rx *priv_rx;
+        struct queue_entry_priv_pci_tx *priv_tx;
         u32 reg;
 
         /*
          * Initialize registers.
          */
         rt2x00pci_register_read(rt2x00dev, TXCSR2, &reg);
-        rt2x00_set_field32(&reg, TXCSR2_TXD_SIZE,
-                           rt2x00dev->tx[IEEE80211_TX_QUEUE_DATA0].desc_size);
-        rt2x00_set_field32(&reg, TXCSR2_NUM_TXD,
-                           rt2x00dev->tx[IEEE80211_TX_QUEUE_DATA1].stats.limit);
-        rt2x00_set_field32(&reg, TXCSR2_NUM_ATIM,
-                           rt2x00dev->bcn[1].stats.limit);
-        rt2x00_set_field32(&reg, TXCSR2_NUM_PRIO,
-                           rt2x00dev->tx[IEEE80211_TX_QUEUE_DATA0].stats.limit);
+        rt2x00_set_field32(&reg, TXCSR2_TXD_SIZE, rt2x00dev->tx[0].desc_size);
+        rt2x00_set_field32(&reg, TXCSR2_NUM_TXD, rt2x00dev->tx[1].limit);
+        rt2x00_set_field32(&reg, TXCSR2_NUM_ATIM, rt2x00dev->bcn[1].limit);
+        rt2x00_set_field32(&reg, TXCSR2_NUM_PRIO, rt2x00dev->tx[0].limit);
         rt2x00pci_register_write(rt2x00dev, TXCSR2, reg);
 
+        priv_tx = rt2x00dev->tx[1].entries[0].priv_data;
         rt2x00pci_register_read(rt2x00dev, TXCSR3, &reg);
         rt2x00_set_field32(&reg, TXCSR3_TX_RING_REGISTER,
-                           rt2x00dev->tx[IEEE80211_TX_QUEUE_DATA1].data_dma);
+                           priv_tx->desc_dma);
         rt2x00pci_register_write(rt2x00dev, TXCSR3, reg);
 
+        priv_tx = rt2x00dev->tx[0].entries[0].priv_data;
         rt2x00pci_register_read(rt2x00dev, TXCSR5, &reg);
         rt2x00_set_field32(&reg, TXCSR5_PRIO_RING_REGISTER,
-                           rt2x00dev->tx[IEEE80211_TX_QUEUE_DATA0].data_dma);
+                           priv_tx->desc_dma);
         rt2x00pci_register_write(rt2x00dev, TXCSR5, reg);
 
+        priv_tx = rt2x00dev->bcn[1].entries[0].priv_data;
         rt2x00pci_register_read(rt2x00dev, TXCSR4, &reg);
         rt2x00_set_field32(&reg, TXCSR4_ATIM_RING_REGISTER,
-                           rt2x00dev->bcn[1].data_dma);
+                           priv_tx->desc_dma);
         rt2x00pci_register_write(rt2x00dev, TXCSR4, reg);
 
+        priv_tx = rt2x00dev->bcn[0].entries[0].priv_data;
         rt2x00pci_register_read(rt2x00dev, TXCSR6, &reg);
         rt2x00_set_field32(&reg, TXCSR6_BEACON_RING_REGISTER,
-                           rt2x00dev->bcn[0].data_dma);
+                           priv_tx->desc_dma);
         rt2x00pci_register_write(rt2x00dev, TXCSR6, reg);
 
         rt2x00pci_register_read(rt2x00dev, RXCSR1, &reg);
         rt2x00_set_field32(&reg, RXCSR1_RXD_SIZE, rt2x00dev->rx->desc_size);
-        rt2x00_set_field32(&reg, RXCSR1_NUM_RXD, rt2x00dev->rx->stats.limit);
+        rt2x00_set_field32(&reg, RXCSR1_NUM_RXD, rt2x00dev->rx->limit);
         rt2x00pci_register_write(rt2x00dev, RXCSR1, reg);
 
+        priv_rx = rt2x00dev->rx->entries[0].priv_data;
         rt2x00pci_register_read(rt2x00dev, RXCSR2, &reg);
-        rt2x00_set_field32(&reg, RXCSR2_RX_RING_REGISTER,
-                           rt2x00dev->rx->data_dma);
+        rt2x00_set_field32(&reg, RXCSR2_RX_RING_REGISTER, priv_tx->desc_dma);
         rt2x00pci_register_write(rt2x00dev, RXCSR2, reg);
 
         return 0;
@@ -792,6 +795,11 @@ static int rt2500pci_init_registers(struct rt2x00_dev *rt2x00dev)
         rt2x00_set_field32(&reg, CSR11_CW_SELECT, 0);
         rt2x00pci_register_write(rt2x00dev, CSR11, reg);
 
+        rt2x00pci_register_read(rt2x00dev, LEDCSR, &reg);
+        rt2x00_set_field32(&reg, LEDCSR_ON_PERIOD, 70);
+        rt2x00_set_field32(&reg, LEDCSR_OFF_PERIOD, 30);
+        rt2x00pci_register_write(rt2x00dev, LEDCSR, reg);
+
         rt2x00pci_register_write(rt2x00dev, CNT3, 0);
 
         rt2x00pci_register_read(rt2x00dev, TXCSR8, &reg);
@@ -947,19 +955,15 @@ continue_csr_init:
         rt2500pci_bbp_write(rt2x00dev, 61, 0x6d);
         rt2500pci_bbp_write(rt2x00dev, 62, 0x10);
 
-        DEBUG(rt2x00dev, "Start initialization from EEPROM...\n");
         for (i = 0; i < EEPROM_BBP_SIZE; i++) {
                 rt2x00_eeprom_read(rt2x00dev, EEPROM_BBP_START + i, &eeprom);
 
                 if (eeprom != 0xffff && eeprom != 0x0000) {
                         reg_id = rt2x00_get_field16(eeprom, EEPROM_BBP_REG_ID);
                         value = rt2x00_get_field16(eeprom, EEPROM_BBP_VALUE);
-                        DEBUG(rt2x00dev, "BBP: 0x%02x, value: 0x%02x.\n",
-                              reg_id, value);
                         rt2500pci_bbp_write(rt2x00dev, reg_id, value);
                 }
         }
-        DEBUG(rt2x00dev, "...End initialization from EEPROM.\n");
 
         return 0;
 }
@@ -1011,7 +1015,7 @@ static int rt2500pci_enable_radio(struct rt2x00_dev *rt2x00dev)
         /*
          * Initialize all registers.
          */
-        if (rt2500pci_init_rings(rt2x00dev) ||
+        if (rt2500pci_init_queues(rt2x00dev) ||
             rt2500pci_init_registers(rt2x00dev) ||
             rt2500pci_init_bbp(rt2x00dev)) {
                 ERROR(rt2x00dev, "Register initialization failed.\n");
@@ -1023,11 +1027,6 @@ static int rt2500pci_enable_radio(struct rt2x00_dev *rt2x00dev)
          */
         rt2500pci_toggle_irq(rt2x00dev, STATE_RADIO_IRQ_ON);
 
-        /*
-         * Enable LED
-         */
-        rt2500pci_enable_led(rt2x00dev);
-
         return 0;
 }
 
@@ -1035,11 +1034,6 @@ static void rt2500pci_disable_radio(struct rt2x00_dev *rt2x00dev)
 {
         u32 reg;
 
-        /*
-         * Disable LED
-         */
-        rt2500pci_disable_led(rt2x00dev);
-
         rt2x00pci_register_write(rt2x00dev, PWRCSR0, 0);
 
         /*
@@ -1138,10 +1132,10 @@ static int rt2500pci_set_device_state(struct rt2x00_dev *rt2x00dev,
  */
 static void rt2500pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
                                     struct sk_buff *skb,
-                                    struct txdata_entry_desc *desc,
+                                    struct txentry_desc *txdesc,
                                     struct ieee80211_tx_control *control)
 {
-        struct skb_desc *skbdesc = get_skb_desc(skb);
+        struct skb_frame_desc *skbdesc = get_skb_frame_desc(skb);
         __le32 *txd = skbdesc->desc;
         u32 word;
 
@@ -1150,36 +1144,36 @@ static void rt2500pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
          */
         rt2x00_desc_read(txd, 2, &word);
         rt2x00_set_field32(&word, TXD_W2_IV_OFFSET, IEEE80211_HEADER);
-        rt2x00_set_field32(&word, TXD_W2_AIFS, desc->aifs);
-        rt2x00_set_field32(&word, TXD_W2_CWMIN, desc->cw_min);
-        rt2x00_set_field32(&word, TXD_W2_CWMAX, desc->cw_max);
+        rt2x00_set_field32(&word, TXD_W2_AIFS, txdesc->aifs);
+        rt2x00_set_field32(&word, TXD_W2_CWMIN, txdesc->cw_min);
+        rt2x00_set_field32(&word, TXD_W2_CWMAX, txdesc->cw_max);
         rt2x00_desc_write(txd, 2, word);
 
         rt2x00_desc_read(txd, 3, &word);
-        rt2x00_set_field32(&word, TXD_W3_PLCP_SIGNAL, desc->signal);
-        rt2x00_set_field32(&word, TXD_W3_PLCP_SERVICE, desc->service);
-        rt2x00_set_field32(&word, TXD_W3_PLCP_LENGTH_LOW, desc->length_low);
-        rt2x00_set_field32(&word, TXD_W3_PLCP_LENGTH_HIGH, desc->length_high);
+        rt2x00_set_field32(&word, TXD_W3_PLCP_SIGNAL, txdesc->signal);
+        rt2x00_set_field32(&word, TXD_W3_PLCP_SERVICE, txdesc->service);
+        rt2x00_set_field32(&word, TXD_W3_PLCP_LENGTH_LOW, txdesc->length_low);
+        rt2x00_set_field32(&word, TXD_W3_PLCP_LENGTH_HIGH, txdesc->length_high);
         rt2x00_desc_write(txd, 3, word);
 
         rt2x00_desc_read(txd, 10, &word);
         rt2x00_set_field32(&word, TXD_W10_RTS,
-                           test_bit(ENTRY_TXD_RTS_FRAME, &desc->flags));
+                           test_bit(ENTRY_TXD_RTS_FRAME, &txdesc->flags));
         rt2x00_desc_write(txd, 10, word);
 
         rt2x00_desc_read(txd, 0, &word);
         rt2x00_set_field32(&word, TXD_W0_OWNER_NIC, 1);
         rt2x00_set_field32(&word, TXD_W0_VALID, 1);
         rt2x00_set_field32(&word, TXD_W0_MORE_FRAG,
-                           test_bit(ENTRY_TXD_MORE_FRAG, &desc->flags));
+                           test_bit(ENTRY_TXD_MORE_FRAG, &txdesc->flags));
         rt2x00_set_field32(&word, TXD_W0_ACK,
-                           test_bit(ENTRY_TXD_ACK, &desc->flags));
+                           test_bit(ENTRY_TXD_ACK, &txdesc->flags));
         rt2x00_set_field32(&word, TXD_W0_TIMESTAMP,
-                           test_bit(ENTRY_TXD_REQ_TIMESTAMP, &desc->flags));
+                           test_bit(ENTRY_TXD_REQ_TIMESTAMP, &txdesc->flags));
         rt2x00_set_field32(&word, TXD_W0_OFDM,
-                           test_bit(ENTRY_TXD_OFDM_RATE, &desc->flags));
+                           test_bit(ENTRY_TXD_OFDM_RATE, &txdesc->flags));
         rt2x00_set_field32(&word, TXD_W0_CIPHER_OWNER, 1);
-        rt2x00_set_field32(&word, TXD_W0_IFS, desc->ifs);
+        rt2x00_set_field32(&word, TXD_W0_IFS, txdesc->ifs);
         rt2x00_set_field32(&word, TXD_W0_RETRY_MODE,
                            !!(control->flags &
                               IEEE80211_TXCTL_LONG_RETRY_LIMIT));
@@ -1192,11 +1186,11 @@ static void rt2500pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
  * TX data initialization
  */
 static void rt2500pci_kick_tx_queue(struct rt2x00_dev *rt2x00dev,
-                                    unsigned int queue)
+                                    const unsigned int queue)
 {
         u32 reg;
 
-        if (queue == IEEE80211_TX_QUEUE_BEACON) {
+        if (queue == RT2X00_BCN_QUEUE_BEACON) {
                 rt2x00pci_register_read(rt2x00dev, CSR14, &reg);
                 if (!rt2x00_get_field32(reg, CSR14_BEACON_GEN)) {
                         rt2x00_set_field32(&reg, CSR14_BEACON_GEN, 1);
@@ -1211,53 +1205,53 @@ static void rt2500pci_kick_tx_queue(struct rt2x00_dev *rt2x00dev,
         rt2x00_set_field32(&reg, TXCSR0_KICK_TX,
                            (queue == IEEE80211_TX_QUEUE_DATA1));
         rt2x00_set_field32(&reg, TXCSR0_KICK_ATIM,
-                           (queue == IEEE80211_TX_QUEUE_AFTER_BEACON));
+                           (queue == RT2X00_BCN_QUEUE_ATIM));
         rt2x00pci_register_write(rt2x00dev, TXCSR0, reg);
 }
 
 /*
  * RX control handlers
  */
-static void rt2500pci_fill_rxdone(struct data_entry *entry,
-                                  struct rxdata_entry_desc *desc)
+static void rt2500pci_fill_rxdone(struct queue_entry *entry,
+                                  struct rxdone_entry_desc *rxdesc)
 {
-        __le32 *rxd = entry->priv;
+        struct queue_entry_priv_pci_rx *priv_rx = entry->priv_data;
         u32 word0;
         u32 word2;
 
-        rt2x00_desc_read(rxd, 0, &word0);
-        rt2x00_desc_read(rxd, 2, &word2);
+        rt2x00_desc_read(priv_rx->desc, 0, &word0);
+        rt2x00_desc_read(priv_rx->desc, 2, &word2);
 
-        desc->flags = 0;
+        rxdesc->flags = 0;
         if (rt2x00_get_field32(word0, RXD_W0_CRC_ERROR))
-                desc->flags |= RX_FLAG_FAILED_FCS_CRC;
+                rxdesc->flags |= RX_FLAG_FAILED_FCS_CRC;
         if (rt2x00_get_field32(word0, RXD_W0_PHYSICAL_ERROR))
-                desc->flags |= RX_FLAG_FAILED_PLCP_CRC;
-
-        desc->signal = rt2x00_get_field32(word2, RXD_W2_SIGNAL);
-        desc->rssi = rt2x00_get_field32(word2, RXD_W2_RSSI) -
-            entry->ring->rt2x00dev->rssi_offset;
-        desc->ofdm = rt2x00_get_field32(word0, RXD_W0_OFDM);
-        desc->size = rt2x00_get_field32(word0, RXD_W0_DATABYTE_COUNT);
-        desc->my_bss = !!rt2x00_get_field32(word0, RXD_W0_MY_BSS);
+                rxdesc->flags |= RX_FLAG_FAILED_PLCP_CRC;
+
+        rxdesc->signal = rt2x00_get_field32(word2, RXD_W2_SIGNAL);
+        rxdesc->rssi = rt2x00_get_field32(word2, RXD_W2_RSSI) -
+            entry->queue->rt2x00dev->rssi_offset;
+        rxdesc->ofdm = rt2x00_get_field32(word0, RXD_W0_OFDM);
+        rxdesc->size = rt2x00_get_field32(word0, RXD_W0_DATABYTE_COUNT);
+        rxdesc->my_bss = !!rt2x00_get_field32(word0, RXD_W0_MY_BSS);
 }
 
 /*
  * Interrupt functions.
  */
-static void rt2500pci_txdone(struct rt2x00_dev *rt2x00dev, const int queue)
+static void rt2500pci_txdone(struct rt2x00_dev *rt2x00dev,
+                             const enum ieee80211_tx_queue queue_idx)
 {
-        struct data_ring *ring = rt2x00lib_get_ring(rt2x00dev, queue);
-        struct data_entry *entry;
-        __le32 *txd;
+        struct data_queue *queue = rt2x00queue_get_queue(rt2x00dev, queue_idx);
+        struct queue_entry_priv_pci_tx *priv_tx;
+        struct queue_entry *entry;
+        struct txdone_entry_desc txdesc;
         u32 word;
-        int tx_status;
-        int retry;
 
-        while (!rt2x00_ring_empty(ring)) {
-                entry = rt2x00_get_data_entry_done(ring);
-                txd = entry->priv;
-                rt2x00_desc_read(txd, 0, &word);
+        while (!rt2x00queue_empty(queue)) {
+                entry = rt2x00queue_get_entry(queue, Q_INDEX_DONE);
+                priv_tx = entry->priv_data;
+                rt2x00_desc_read(priv_tx->desc, 0, &word);
 
                 if (rt2x00_get_field32(word, TXD_W0_OWNER_NIC) ||
                     !rt2x00_get_field32(word, TXD_W0_VALID))
@@ -1266,10 +1260,10 @@ static void rt2500pci_txdone(struct rt2x00_dev *rt2x00dev, const int queue)
                 /*
                  * Obtain the status about this packet.
                  */
-                tx_status = rt2x00_get_field32(word, TXD_W0_RESULT);
-                retry = rt2x00_get_field32(word, TXD_W0_RETRY_COUNT);
+                txdesc.status = rt2x00_get_field32(word, TXD_W0_RESULT);
+                txdesc.retry = rt2x00_get_field32(word, TXD_W0_RETRY_COUNT);
 
-                rt2x00pci_txdone(rt2x00dev, entry, tx_status, retry);
+                rt2x00pci_txdone(rt2x00dev, entry, &txdesc);
         }
 }
 
@@ -1313,7 +1307,7 @@ static irqreturn_t rt2500pci_interrupt(int irq, void *dev_instance)
          * 3 - Atim ring transmit done interrupt.
          */
         if (rt2x00_get_field32(reg, CSR7_TXDONE_ATIMRING))
-                rt2500pci_txdone(rt2x00dev, IEEE80211_TX_QUEUE_AFTER_BEACON);
+                rt2500pci_txdone(rt2x00dev, RT2X00_BCN_QUEUE_ATIM);
 
         /*
          * 4 - Priority ring transmit done interrupt.
@@ -1442,8 +1436,24 @@ static int rt2500pci_init_eeprom(struct rt2x00_dev *rt2x00dev)
         /*
          * Store led mode, for correct led behaviour.
          */
-        rt2x00dev->led_mode =
-            rt2x00_get_field16(eeprom, EEPROM_ANTENNA_LED_MODE);
+#ifdef CONFIG_RT2500PCI_LEDS
+        value = rt2x00_get_field16(eeprom, EEPROM_ANTENNA_LED_MODE);
+
+        switch (value) {
+        case LED_MODE_ASUS:
+        case LED_MODE_ALPHA:
+        case LED_MODE_DEFAULT:
+                rt2x00dev->led_flags = LED_SUPPORT_RADIO;
+                break;
+        case LED_MODE_TXRX_ACTIVITY:
+                rt2x00dev->led_flags =
+                    LED_SUPPORT_RADIO | LED_SUPPORT_ACTIVITY;
+                break;
+        case LED_MODE_SIGNAL_STRENGTH:
+                rt2x00dev->led_flags = LED_SUPPORT_RADIO;
+                break;
+        }
+#endif /* CONFIG_RT2500PCI_LEDS */
 
         /*
          * Detect if this device has an hardware controlled radio.
@@ -1656,8 +1666,8 @@ static void rt2500pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
         /*
          * Initialize hw_mode information.
          */
-        spec->num_modes = 2;
-        spec->num_rates = 12;
+        spec->supported_bands = SUPPORT_BAND_2GHZ;
+        spec->supported_rates = SUPPORT_RATE_CCK | SUPPORT_RATE_OFDM;
         spec->tx_power_a = NULL;
         spec->tx_power_bg = txpower;
         spec->tx_power_default = DEFAULT_TXPOWER;
@@ -1678,9 +1688,9 @@ static void rt2500pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
                 spec->num_channels = ARRAY_SIZE(rf_vals_bg_2525e);
                 spec->channels = rf_vals_bg_2525e;
         } else if (rt2x00_rf(&rt2x00dev->chip, RF5222)) {
+                spec->supported_bands |= SUPPORT_BAND_5GHZ;
                 spec->num_channels = ARRAY_SIZE(rf_vals_5222);
                 spec->channels = rf_vals_5222;
-                spec->num_modes = 3;
         }
 }
 
@@ -1705,9 +1715,9 @@ static int rt2500pci_probe_hw(struct rt2x00_dev *rt2x00dev)
         rt2500pci_probe_hw_mode(rt2x00dev);
 
         /*
-         * This device requires the beacon ring
+         * This device requires the atim queue
          */
-        __set_bit(DRIVER_REQUIRE_BEACON_RING, &rt2x00dev->flags);
+        __set_bit(DRIVER_REQUIRE_ATIM_QUEUE, &rt2x00dev->flags);
 
         /*
          * Set the rssi offset.
@@ -1811,12 +1821,48 @@ static u64 rt2500pci_get_tsf(struct ieee80211_hw *hw)
         return tsf;
 }
 
-static void rt2500pci_reset_tsf(struct ieee80211_hw *hw)
+static int rt2500pci_beacon_update(struct ieee80211_hw *hw, struct sk_buff *skb,
+                                   struct ieee80211_tx_control *control)
 {
         struct rt2x00_dev *rt2x00dev = hw->priv;
+        struct rt2x00_intf *intf = vif_to_intf(control->vif);
+        struct queue_entry_priv_pci_tx *priv_tx;
+        struct skb_frame_desc *skbdesc;
+
+        if (unlikely(!intf->beacon))
+                return -ENOBUFS;
+
+        priv_tx = intf->beacon->priv_data;
+
+        /*
+         * Fill in skb descriptor
+         */
+        skbdesc = get_skb_frame_desc(skb);
+        memset(skbdesc, 0, sizeof(*skbdesc));
+        skbdesc->flags |= FRAME_DESC_DRIVER_GENERATED;
+        skbdesc->data = skb->data;
+        skbdesc->data_len = skb->len;
+        skbdesc->desc = priv_tx->desc;
+        skbdesc->desc_len = intf->beacon->queue->desc_size;
+        skbdesc->entry = intf->beacon;
 
-        rt2x00pci_register_write(rt2x00dev, CSR16, 0);
-        rt2x00pci_register_write(rt2x00dev, CSR17, 0);
+        /*
+         * mac80211 doesn't provide the control->queue variable
+         * for beacons. Set our own queue identification so
+         * it can be used during descriptor initialization.
+         */
+        control->queue = RT2X00_BCN_QUEUE_BEACON;
+        rt2x00lib_write_tx_desc(rt2x00dev, skb, control);
+
+        /*
+         * Enable beacon generation.
+         * Write entire beacon with descriptor to register,
+         * and kick the beacon generator.
+         */
+        memcpy(priv_tx->data, skb->data, skb->len);
+        rt2x00dev->ops->lib->kick_tx_queue(rt2x00dev, control->queue);
+
+        return 0;
 }
 
 static int rt2500pci_tx_last_beacon(struct ieee80211_hw *hw)
@@ -1843,8 +1889,7 @@ static const struct ieee80211_ops rt2500pci_mac80211_ops = {
         .conf_tx                = rt2x00mac_conf_tx,
         .get_tx_stats           = rt2x00mac_get_tx_stats,
         .get_tsf                = rt2500pci_get_tsf,
-        .reset_tsf              = rt2500pci_reset_tsf,
-        .beacon_update          = rt2x00pci_beacon_update,
+        .beacon_update          = rt2500pci_beacon_update,
         .tx_last_beacon         = rt2500pci_tx_last_beacon,
 };
 
@@ -1860,23 +1905,54 @@ static const struct rt2x00lib_ops rt2500pci_rt2x00_ops = {
         .link_stats             = rt2500pci_link_stats,
         .reset_tuner            = rt2500pci_reset_tuner,
         .link_tuner             = rt2500pci_link_tuner,
+        .led_brightness         = rt2500pci_led_brightness,
         .write_tx_desc          = rt2500pci_write_tx_desc,
         .write_tx_data          = rt2x00pci_write_tx_data,
         .kick_tx_queue          = rt2500pci_kick_tx_queue,
         .fill_rxdone            = rt2500pci_fill_rxdone,
-        .config_mac_addr        = rt2500pci_config_mac_addr,
-        .config_bssid           = rt2500pci_config_bssid,
-        .config_type            = rt2500pci_config_type,
+        .config_intf            = rt2500pci_config_intf,
         .config_preamble        = rt2500pci_config_preamble,
         .config                 = rt2500pci_config,
 };
 
+static const struct data_queue_desc rt2500pci_queue_rx = {
+        .entry_num              = RX_ENTRIES,
+        .data_size              = DATA_FRAME_SIZE,
+        .desc_size              = RXD_DESC_SIZE,
+        .priv_size              = sizeof(struct queue_entry_priv_pci_rx),
+};
+
+static const struct data_queue_desc rt2500pci_queue_tx = {
+        .entry_num              = TX_ENTRIES,
+        .data_size              = DATA_FRAME_SIZE,
+        .desc_size              = TXD_DESC_SIZE,
+        .priv_size              = sizeof(struct queue_entry_priv_pci_tx),
+};
+
+static const struct data_queue_desc rt2500pci_queue_bcn = {
+        .entry_num              = BEACON_ENTRIES,
+        .data_size              = MGMT_FRAME_SIZE,
+        .desc_size              = TXD_DESC_SIZE,
+        .priv_size              = sizeof(struct queue_entry_priv_pci_tx),
+};
+
+static const struct data_queue_desc rt2500pci_queue_atim = {
+        .entry_num              = ATIM_ENTRIES,
+        .data_size              = DATA_FRAME_SIZE,
+        .desc_size              = TXD_DESC_SIZE,
+        .priv_size              = sizeof(struct queue_entry_priv_pci_tx),
+};
+
 static const struct rt2x00_ops rt2500pci_ops = {
         .name           = KBUILD_MODNAME,
-        .rxd_size       = RXD_DESC_SIZE,
-        .txd_size       = TXD_DESC_SIZE,
+        .max_sta_intf   = 1,
+        .max_ap_intf    = 1,
         .eeprom_size    = EEPROM_SIZE,
         .rf_size        = RF_SIZE,
+        .rx             = &rt2500pci_queue_rx,
+        .tx             = &rt2500pci_queue_tx,
+        .bcn            = &rt2500pci_queue_bcn,
+        .atim           = &rt2500pci_queue_atim,
         .lib            = &rt2500pci_rt2x00_ops,
         .hw             = &rt2500pci_mac80211_ops,
 #ifdef CONFIG_RT2X00_LIB_DEBUGFS
diff --git a/drivers/net/wireless/rt2x00/rt2500pci.h b/drivers/net/wireless/rt2x00/rt2500pci.h
index 92ba0902d107..13899550465a 100644
--- a/drivers/net/wireless/rt2x00/rt2500pci.h
+++ b/drivers/net/wireless/rt2x00/rt2500pci.h
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2007 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2008 rt2x00 SourceForge Project
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
@@ -1213,8 +1213,8 @@
 #define RXD_W10_DROP                    FIELD32(0x00000001)
 
 /*
- * Macro's for converting txpower from EEPROM to dscape value
- * and from dscape value to register value.
+ * Macro's for converting txpower from EEPROM to mac80211 value
+ * and from mac80211 value to register value.
  */
 #define MIN_TXPOWER     0
 #define MAX_TXPOWER     31
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c
index 638c3d243108..9f59db91cfc2 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2007 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2008 rt2x00 SourceForge Project
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
@@ -282,73 +282,98 @@ static const struct rt2x00debug rt2500usb_rt2x00debug = {
 };
 #endif /* CONFIG_RT2X00_LIB_DEBUGFS */
 
-/*
- * Configuration handlers.
- */
-static void rt2500usb_config_mac_addr(struct rt2x00_dev *rt2x00dev,
-                                      __le32 *mac)
+#ifdef CONFIG_RT2500USB_LEDS
+static void rt2500usb_led_brightness(struct led_classdev *led_cdev,
+                                     enum led_brightness brightness)
 {
-        rt2500usb_register_multiwrite(rt2x00dev, MAC_CSR2, mac,
-                                      (3 * sizeof(__le16)));
-}
+        struct rt2x00_led *led =
+            container_of(led_cdev, struct rt2x00_led, led_dev);
+        unsigned int enabled = brightness != LED_OFF;
+        unsigned int activity =
+            led->rt2x00dev->led_flags & LED_SUPPORT_ACTIVITY;
 
-static void rt2500usb_config_bssid(struct rt2x00_dev *rt2x00dev,
-                                   __le32 *bssid)
-{
-        rt2500usb_register_multiwrite(rt2x00dev, MAC_CSR5, bssid,
-                                      (3 * sizeof(__le16)));
+        if (in_atomic()) {
+                NOTICE(led->rt2x00dev,
+                       "Ignoring LED brightness command for led %d", led->type);
+                return;
+        }
+
+        if (led->type == LED_TYPE_RADIO || led->type == LED_TYPE_ASSOC) {
+                rt2x00_set_field16(&led->rt2x00dev->led_mcu_reg,
+                                   MAC_CSR20_LINK, enabled);
+                rt2x00_set_field16(&led->rt2x00dev->led_mcu_reg,
+                                   MAC_CSR20_ACTIVITY, enabled && activity);
+        }
+
+        rt2500usb_register_write(led->rt2x00dev, MAC_CSR20,
+                                 led->rt2x00dev->led_mcu_reg);
 }
+#else
+#define rt2500usb_led_brightness        NULL
+#endif /* CONFIG_RT2500USB_LEDS */
 
-static void rt2500usb_config_type(struct rt2x00_dev *rt2x00dev, const int type,
-                                  const int tsf_sync)
+/*
+ * Configuration handlers.
+ */
+static void rt2500usb_config_intf(struct rt2x00_dev *rt2x00dev,
+                                  struct rt2x00_intf *intf,
+                                  struct rt2x00intf_conf *conf,
+                                  const unsigned int flags)
 {
+        unsigned int bcn_preload;
         u16 reg;
 
-        rt2500usb_register_write(rt2x00dev, TXRX_CSR19, 0);
+        if (flags & CONFIG_UPDATE_TYPE) {
+                rt2500usb_register_write(rt2x00dev, TXRX_CSR19, 0);
 
-        /*
-         * Enable beacon config
-         */
-        rt2500usb_register_read(rt2x00dev, TXRX_CSR20, &reg);
-        rt2x00_set_field16(&reg, TXRX_CSR20_OFFSET,
-                           (PREAMBLE + get_duration(IEEE80211_HEADER, 20)) >> 6);
-        if (type == IEEE80211_IF_TYPE_STA)
-                rt2x00_set_field16(&reg, TXRX_CSR20_BCN_EXPECT_WINDOW, 0);
-        else
-                rt2x00_set_field16(&reg, TXRX_CSR20_BCN_EXPECT_WINDOW, 2);
-        rt2500usb_register_write(rt2x00dev, TXRX_CSR20, reg);
+                /*
+                 * Enable beacon config
+                 */
+                bcn_preload = PREAMBLE + get_duration(IEEE80211_HEADER, 20);
+                rt2500usb_register_read(rt2x00dev, TXRX_CSR20, &reg);
+                rt2x00_set_field16(&reg, TXRX_CSR20_OFFSET, bcn_preload >> 6);
+                rt2x00_set_field16(&reg, TXRX_CSR20_BCN_EXPECT_WINDOW,
+                                   2 * (conf->type != IEEE80211_IF_TYPE_STA));
+                rt2500usb_register_write(rt2x00dev, TXRX_CSR20, reg);
 
-        /*
-         * Enable synchronisation.
-         */
-        rt2500usb_register_read(rt2x00dev, TXRX_CSR18, &reg);
-        rt2x00_set_field16(&reg, TXRX_CSR18_OFFSET, 0);
-        rt2500usb_register_write(rt2x00dev, TXRX_CSR18, reg);
+                /*
+                 * Enable synchronisation.
+                 */
+                rt2500usb_register_read(rt2x00dev, TXRX_CSR18, &reg);
+                rt2x00_set_field16(&reg, TXRX_CSR18_OFFSET, 0);
+                rt2500usb_register_write(rt2x00dev, TXRX_CSR18, reg);
+
+                rt2500usb_register_read(rt2x00dev, TXRX_CSR19, &reg);
+                rt2x00_set_field16(&reg, TXRX_CSR19_TSF_COUNT, 1);
+                rt2x00_set_field16(&reg, TXRX_CSR19_TBCN,
+                                   (conf->sync == TSF_SYNC_BEACON));
+                rt2x00_set_field16(&reg, TXRX_CSR19_BEACON_GEN, 0);
+                rt2x00_set_field16(&reg, TXRX_CSR19_TSF_SYNC, conf->sync);
+                rt2500usb_register_write(rt2x00dev, TXRX_CSR19, reg);
+        }
 
-        rt2500usb_register_read(rt2x00dev, TXRX_CSR19, &reg);
-        rt2x00_set_field16(&reg, TXRX_CSR19_TSF_COUNT, 1);
-        rt2x00_set_field16(&reg, TXRX_CSR19_TBCN,
-                           (tsf_sync == TSF_SYNC_BEACON));
-        rt2x00_set_field16(&reg, TXRX_CSR19_BEACON_GEN, 0);
-        rt2x00_set_field16(&reg, TXRX_CSR19_TSF_SYNC, tsf_sync);
-        rt2500usb_register_write(rt2x00dev, TXRX_CSR19, reg);
+        if (flags & CONFIG_UPDATE_MAC)
+                rt2500usb_register_multiwrite(rt2x00dev, MAC_CSR2, conf->mac,
+                                              (3 * sizeof(__le16)));
+
+        if (flags & CONFIG_UPDATE_BSSID)
+                rt2500usb_register_multiwrite(rt2x00dev, MAC_CSR5, conf->bssid,
+                                              (3 * sizeof(__le16)));
 }
 
-static void rt2500usb_config_preamble(struct rt2x00_dev *rt2x00dev,
-                                      const int short_preamble,
-                                      const int ack_timeout,
-                                      const int ack_consume_time)
+static int rt2500usb_config_preamble(struct rt2x00_dev *rt2x00dev,
+                                     const int short_preamble,
+                                     const int ack_timeout,
+                                     const int ack_consume_time)
 {
         u16 reg;
 
         /*
-         * When in atomic context, reschedule and let rt2x00lib
-         * call this function again.
+         * When in atomic context, we should let rt2x00lib
+         * try this configuration again later.
          */
-        if (in_atomic()) {
-                queue_work(rt2x00dev->hw->workqueue, &rt2x00dev->config_work);
-                return;
-        }
+        if (in_atomic())
+                return -EAGAIN;
 
         rt2500usb_register_read(rt2x00dev, TXRX_CSR1, &reg);
         rt2x00_set_field16(&reg, TXRX_CSR1_ACK_TIMEOUT, ack_timeout);
@@ -358,21 +383,14 @@ static void rt2500usb_config_preamble(struct rt2x00_dev *rt2x00dev,
         rt2x00_set_field16(&reg, TXRX_CSR10_AUTORESPOND_PREAMBLE,
                            !!short_preamble);
         rt2500usb_register_write(rt2x00dev, TXRX_CSR10, reg);
+
+        return 0;
 }
 
 static void rt2500usb_config_phymode(struct rt2x00_dev *rt2x00dev,
-                                     const int phymode,
                                      const int basic_rate_mask)
 {
         rt2500usb_register_write(rt2x00dev, TXRX_CSR11, basic_rate_mask);
-
-        if (phymode == HWMODE_B) {
-                rt2500usb_register_write(rt2x00dev, MAC_CSR11, 0x000b);
-                rt2500usb_register_write(rt2x00dev, MAC_CSR12, 0x0040);
-        } else {
-                rt2500usb_register_write(rt2x00dev, MAC_CSR11, 0x0005);
-                rt2500usb_register_write(rt2x00dev, MAC_CSR12, 0x016c);
-        }
 }
 
 static void rt2500usb_config_channel(struct rt2x00_dev *rt2x00dev,
@@ -510,6 +528,8 @@ static void rt2500usb_config_duration(struct rt2x00_dev *rt2x00dev,
         u16 reg;
 
         rt2500usb_register_write(rt2x00dev, MAC_CSR10, libconf->slot_time);
+        rt2500usb_register_write(rt2x00dev, MAC_CSR11, libconf->sifs);
+        rt2500usb_register_write(rt2x00dev, MAC_CSR12, libconf->eifs);
 
         rt2500usb_register_read(rt2x00dev, TXRX_CSR18, &reg);
         rt2x00_set_field16(&reg, TXRX_CSR18_INTERVAL,
@@ -518,12 +538,11 @@ static void rt2500usb_config_duration(struct rt2x00_dev *rt2x00dev,
 }
 
 static void rt2500usb_config(struct rt2x00_dev *rt2x00dev,
-                             const unsigned int flags,
-                             struct rt2x00lib_conf *libconf)
+                             struct rt2x00lib_conf *libconf,
+                             const unsigned int flags)
 {
         if (flags & CONFIG_UPDATE_PHYMODE)
-                rt2500usb_config_phymode(rt2x00dev, libconf->phymode,
-                                         libconf->basic_rates);
+                rt2500usb_config_phymode(rt2x00dev, libconf->basic_rates);
         if (flags & CONFIG_UPDATE_CHANNEL)
                 rt2500usb_config_channel(rt2x00dev, &libconf->rf,
                                          libconf->conf->power_level);
@@ -537,36 +556,6 @@ static void rt2500usb_config(struct rt2x00_dev *rt2x00dev,
 }
 
 /*
- * LED functions.
- */
-static void rt2500usb_enable_led(struct rt2x00_dev *rt2x00dev)
-{
-        u16 reg;
-
-        rt2500usb_register_read(rt2x00dev, MAC_CSR21, &reg);
-        rt2x00_set_field16(&reg, MAC_CSR21_ON_PERIOD, 70);
-        rt2x00_set_field16(&reg, MAC_CSR21_OFF_PERIOD, 30);
-        rt2500usb_register_write(rt2x00dev, MAC_CSR21, reg);
-
-        rt2500usb_register_read(rt2x00dev, MAC_CSR20, &reg);
-        rt2x00_set_field16(&reg, MAC_CSR20_LINK,
-                           (rt2x00dev->led_mode != LED_MODE_ASUS));
-        rt2x00_set_field16(&reg, MAC_CSR20_ACTIVITY,
-                           (rt2x00dev->led_mode != LED_MODE_TXRX_ACTIVITY));
-        rt2500usb_register_write(rt2x00dev, MAC_CSR20, reg);
-}
-
-static void rt2500usb_disable_led(struct rt2x00_dev *rt2x00dev)
-{
-        u16 reg;
-
-        rt2500usb_register_read(rt2x00dev, MAC_CSR20, &reg);
-        rt2x00_set_field16(&reg, MAC_CSR20_LINK, 0);
-        rt2x00_set_field16(&reg, MAC_CSR20_ACTIVITY, 0);
-        rt2500usb_register_write(rt2x00dev, MAC_CSR20, reg);
-}
-
-/*
  * Link tuning
  */
 static void rt2500usb_link_stats(struct rt2x00_dev *rt2x00dev,
@@ -626,6 +615,24 @@ static void rt2500usb_link_tuner(struct rt2x00_dev *rt2x00dev)
         u8 low_bound;
 
         /*
+         * Read current r17 value, as well as the sensitivity values
+         * for the r17 register.
+         */
+        rt2500usb_bbp_read(rt2x00dev, 17, &r17);
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_BBPTUNE_R17, &r17_sens);
+
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_BBPTUNE_VGC, &vgc_bound);
+        up_bound = rt2x00_get_field16(vgc_bound, EEPROM_BBPTUNE_VGCUPPER);
+        low_bound = rt2x00_get_field16(vgc_bound, EEPROM_BBPTUNE_VGCLOWER);
+
+        /*
+         * If we are not associated, we should go straight to the
+         * dynamic CCA tuning.
+         */
+        if (!rt2x00dev->intf_associated)
+                goto dynamic_cca_tune;
+
+        /*
          * Determine the BBP tuning threshold and correctly
          * set BBP 24, 25 and 61.
          */
@@ -651,13 +658,6 @@ static void rt2500usb_link_tuner(struct rt2x00_dev *rt2x00dev)
         rt2500usb_bbp_write(rt2x00dev, 61, r61);
 
         /*
-         * Read current r17 value, as well as the sensitivity values
-         * for the r17 register.
-         */
-        rt2500usb_bbp_read(rt2x00dev, 17, &r17);
-        rt2x00_eeprom_read(rt2x00dev, EEPROM_BBPTUNE_R17, &r17_sens);
-
-        /*
          * A too low RSSI will cause too much false CCA which will
          * then corrupt the R17 tuning. To remidy this the tuning should
          * be stopped (While making sure the R17 value will not exceed limits)
@@ -692,14 +692,9 @@ static void rt2500usb_link_tuner(struct rt2x00_dev *rt2x00dev)
          * Leave short or middle distance condition, restore r17
          * to the dynamic tuning range.
          */
-        rt2x00_eeprom_read(rt2x00dev, EEPROM_BBPTUNE_VGC, &vgc_bound);
-        vgc_bound = rt2x00_get_field16(vgc_bound, EEPROM_BBPTUNE_VGCUPPER);
-
         low_bound = 0x32;
-        if (rssi >= -77)
-                up_bound = vgc_bound;
-        else
-                up_bound = vgc_bound - (-77 - rssi);
+        if (rssi < -77)
+                up_bound -= (-77 - rssi);
 
         if (up_bound < low_bound)
                 up_bound = low_bound;
@@ -707,7 +702,16 @@ static void rt2500usb_link_tuner(struct rt2x00_dev *rt2x00dev)
         if (r17 > up_bound) {
                 rt2500usb_bbp_write(rt2x00dev, 17, up_bound);
                 rt2x00dev->link.vgc_level = up_bound;
-        } else if (rt2x00dev->link.qual.false_cca > 512 && r17 < up_bound) {
+                return;
+        }
+
+dynamic_cca_tune:
+
+        /*
+         * R17 is inside the dynamic tuning range,
+         * start tuning the link based on the false cca counter.
+         */
+        if (rt2x00dev->link.qual.false_cca > 512 && r17 < up_bound) {
                 rt2500usb_bbp_write(rt2x00dev, 17, ++r17);
                 rt2x00dev->link.vgc_level = r17;
         } else if (rt2x00dev->link.qual.false_cca < 100 && r17 > low_bound) {
@@ -747,6 +751,11 @@ static int rt2500usb_init_registers(struct rt2x00_dev *rt2x00dev)
         rt2x00_set_field16(&reg, MAC_CSR1_HOST_READY, 0);
         rt2500usb_register_write(rt2x00dev, MAC_CSR1, reg);
 
+        rt2500usb_register_read(rt2x00dev, MAC_CSR21, &reg);
+        rt2x00_set_field16(&reg, MAC_CSR21_ON_PERIOD, 70);
+        rt2x00_set_field16(&reg, MAC_CSR21_OFF_PERIOD, 30);
+        rt2500usb_register_write(rt2x00dev, MAC_CSR21, reg);
+
         rt2500usb_register_read(rt2x00dev, TXRX_CSR5, &reg);
         rt2x00_set_field16(&reg, TXRX_CSR5_BBP_ID0, 13);
         rt2x00_set_field16(&reg, TXRX_CSR5_BBP_ID0_VALID, 1);
@@ -878,19 +887,15 @@ continue_csr_init:
         rt2500usb_bbp_write(rt2x00dev, 62, 0x10);
         rt2500usb_bbp_write(rt2x00dev, 75, 0xff);
 
-        DEBUG(rt2x00dev, "Start initialization from EEPROM...\n");
         for (i = 0; i < EEPROM_BBP_SIZE; i++) {
                 rt2x00_eeprom_read(rt2x00dev, EEPROM_BBP_START + i, &eeprom);
 
                 if (eeprom != 0xffff && eeprom != 0x0000) {
                         reg_id = rt2x00_get_field16(eeprom, EEPROM_BBP_REG_ID);
                         value = rt2x00_get_field16(eeprom, EEPROM_BBP_VALUE);
-                        DEBUG(rt2x00dev, "BBP: 0x%02x, value: 0x%02x.\n",
-                              reg_id, value);
                         rt2500usb_bbp_write(rt2x00dev, reg_id, value);
                 }
         }
-        DEBUG(rt2x00dev, "...End initialization from EEPROM.\n");
 
         return 0;
 }
@@ -920,21 +925,11 @@ static int rt2500usb_enable_radio(struct rt2x00_dev *rt2x00dev)
                 return -EIO;
         }
 
-        /*
-         * Enable LED
-         */
-        rt2500usb_enable_led(rt2x00dev);
-
         return 0;
 }
 
 static void rt2500usb_disable_radio(struct rt2x00_dev *rt2x00dev)
 {
-        /*
-         * Disable LED
-         */
-        rt2500usb_disable_led(rt2x00dev);
-
         rt2500usb_register_write(rt2x00dev, MAC_CSR13, 0x2121);
         rt2500usb_register_write(rt2x00dev, MAC_CSR14, 0x2121);
 
@@ -1027,10 +1022,10 @@ static int rt2500usb_set_device_state(struct rt2x00_dev *rt2x00dev,
  */
 static void rt2500usb_write_tx_desc(struct rt2x00_dev *rt2x00dev,
                                     struct sk_buff *skb,
-                                    struct txdata_entry_desc *desc,
+                                    struct txentry_desc *txdesc,
                                     struct ieee80211_tx_control *control)
 {
-        struct skb_desc *skbdesc = get_skb_desc(skb);
+        struct skb_frame_desc *skbdesc = get_skb_frame_desc(skb);
         __le32 *txd = skbdesc->desc;
         u32 word;
 
@@ -1039,31 +1034,31 @@ static void rt2500usb_write_tx_desc(struct rt2x00_dev *rt2x00dev,
          */
         rt2x00_desc_read(txd, 1, &word);
         rt2x00_set_field32(&word, TXD_W1_IV_OFFSET, IEEE80211_HEADER);
-        rt2x00_set_field32(&word, TXD_W1_AIFS, desc->aifs);
-        rt2x00_set_field32(&word, TXD_W1_CWMIN, desc->cw_min);
-        rt2x00_set_field32(&word, TXD_W1_CWMAX, desc->cw_max);
+        rt2x00_set_field32(&word, TXD_W1_AIFS, txdesc->aifs);
+        rt2x00_set_field32(&word, TXD_W1_CWMIN, txdesc->cw_min);
+        rt2x00_set_field32(&word, TXD_W1_CWMAX, txdesc->cw_max);
         rt2x00_desc_write(txd, 1, word);
 
         rt2x00_desc_read(txd, 2, &word);
-        rt2x00_set_field32(&word, TXD_W2_PLCP_SIGNAL, desc->signal);
-        rt2x00_set_field32(&word, TXD_W2_PLCP_SERVICE, desc->service);
-        rt2x00_set_field32(&word, TXD_W2_PLCP_LENGTH_LOW, desc->length_low);
-        rt2x00_set_field32(&word, TXD_W2_PLCP_LENGTH_HIGH, desc->length_high);
+        rt2x00_set_field32(&word, TXD_W2_PLCP_SIGNAL, txdesc->signal);
+        rt2x00_set_field32(&word, TXD_W2_PLCP_SERVICE, txdesc->service);
+        rt2x00_set_field32(&word, TXD_W2_PLCP_LENGTH_LOW, txdesc->length_low);
+        rt2x00_set_field32(&word, TXD_W2_PLCP_LENGTH_HIGH, txdesc->length_high);
         rt2x00_desc_write(txd, 2, word);
 
         rt2x00_desc_read(txd, 0, &word);
         rt2x00_set_field32(&word, TXD_W0_RETRY_LIMIT, control->retry_limit);
         rt2x00_set_field32(&word, TXD_W0_MORE_FRAG,
-                           test_bit(ENTRY_TXD_MORE_FRAG, &desc->flags));
+                           test_bit(ENTRY_TXD_MORE_FRAG, &txdesc->flags));
         rt2x00_set_field32(&word, TXD_W0_ACK,
-                           test_bit(ENTRY_TXD_ACK, &desc->flags));
+                           test_bit(ENTRY_TXD_ACK, &txdesc->flags));
         rt2x00_set_field32(&word, TXD_W0_TIMESTAMP,
-                           test_bit(ENTRY_TXD_REQ_TIMESTAMP, &desc->flags));
+                           test_bit(ENTRY_TXD_REQ_TIMESTAMP, &txdesc->flags));
         rt2x00_set_field32(&word, TXD_W0_OFDM,
-                           test_bit(ENTRY_TXD_OFDM_RATE, &desc->flags));
+                           test_bit(ENTRY_TXD_OFDM_RATE, &txdesc->flags));
         rt2x00_set_field32(&word, TXD_W0_NEW_SEQ,
                            !!(control->flags & IEEE80211_TXCTL_FIRST_FRAGMENT));
-        rt2x00_set_field32(&word, TXD_W0_IFS, desc->ifs);
+        rt2x00_set_field32(&word, TXD_W0_IFS, txdesc->ifs);
         rt2x00_set_field32(&word, TXD_W0_DATABYTE_COUNT, skbdesc->data_len);
         rt2x00_set_field32(&word, TXD_W0_CIPHER, CIPHER_NONE);
         rt2x00_desc_write(txd, 0, word);
@@ -1088,11 +1083,11 @@ static int rt2500usb_get_tx_data_len(struct rt2x00_dev *rt2x00dev,
  * TX data initialization
  */
 static void rt2500usb_kick_tx_queue(struct rt2x00_dev *rt2x00dev,
-                                    unsigned int queue)
+                                    const unsigned int queue)
 {
         u16 reg;
 
-        if (queue != IEEE80211_TX_QUEUE_BEACON)
+        if (queue != RT2X00_BCN_QUEUE_BEACON)
                 return;
 
         rt2500usb_register_read(rt2x00dev, TXRX_CSR19, &reg);
@@ -1114,42 +1109,61 @@ static void rt2500usb_kick_tx_queue(struct rt2x00_dev *rt2x00dev,
 /*
  * RX control handlers
  */
-static void rt2500usb_fill_rxdone(struct data_entry *entry,
-                                  struct rxdata_entry_desc *desc)
+static void rt2500usb_fill_rxdone(struct queue_entry *entry,
+                                  struct rxdone_entry_desc *rxdesc)
 {
-        struct skb_desc *skbdesc = get_skb_desc(entry->skb);
-        struct urb *urb = entry->priv;
-        __le32 *rxd = (__le32 *)(entry->skb->data +
-                                 (urb->actual_length - entry->ring->desc_size));
+        struct queue_entry_priv_usb_rx *priv_rx = entry->priv_data;
+        struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
+        __le32 *rxd =
+            (__le32 *)(entry->skb->data +
+                       (priv_rx->urb->actual_length - entry->queue->desc_size));
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)entry->skb->data;
+        int header_size = ieee80211_get_hdrlen(le16_to_cpu(hdr->frame_control));
         u32 word0;
         u32 word1;
 
         rt2x00_desc_read(rxd, 0, &word0);
         rt2x00_desc_read(rxd, 1, &word1);
 
-        desc->flags = 0;
+        rxdesc->flags = 0;
         if (rt2x00_get_field32(word0, RXD_W0_CRC_ERROR))
-                desc->flags |= RX_FLAG_FAILED_FCS_CRC;
+                rxdesc->flags |= RX_FLAG_FAILED_FCS_CRC;
         if (rt2x00_get_field32(word0, RXD_W0_PHYSICAL_ERROR))
-                desc->flags |= RX_FLAG_FAILED_PLCP_CRC;
+                rxdesc->flags |= RX_FLAG_FAILED_PLCP_CRC;
 
         /*
          * Obtain the status about this packet.
          */
-        desc->signal = rt2x00_get_field32(word1, RXD_W1_SIGNAL);
-        desc->rssi = rt2x00_get_field32(word1, RXD_W1_RSSI) -
-            entry->ring->rt2x00dev->rssi_offset;
-        desc->ofdm = rt2x00_get_field32(word0, RXD_W0_OFDM);
-        desc->size = rt2x00_get_field32(word0, RXD_W0_DATABYTE_COUNT);
-        desc->my_bss = !!rt2x00_get_field32(word0, RXD_W0_MY_BSS);
+        rxdesc->signal = rt2x00_get_field32(word1, RXD_W1_SIGNAL);
+        rxdesc->rssi = rt2x00_get_field32(word1, RXD_W1_RSSI) -
+            entry->queue->rt2x00dev->rssi_offset;
+        rxdesc->ofdm = rt2x00_get_field32(word0, RXD_W0_OFDM);
+        rxdesc->size = rt2x00_get_field32(word0, RXD_W0_DATABYTE_COUNT);
+        rxdesc->my_bss = !!rt2x00_get_field32(word0, RXD_W0_MY_BSS);
+
+        /*
+         * The data behind the ieee80211 header must be
+         * aligned on a 4 byte boundary.
+         */
+        if (header_size % 4 == 0) {
+                skb_push(entry->skb, 2);
+                memmove(entry->skb->data, entry->skb->data + 2,
+                        entry->skb->len - 2);
+        }
 
         /*
-         * Set descriptor and data pointer.
+         * Set descriptor pointer.
          */
-        skbdesc->desc = entry->skb->data + desc->size;
-        skbdesc->desc_len = entry->ring->desc_size;
         skbdesc->data = entry->skb->data;
-        skbdesc->data_len = desc->size;
+        skbdesc->data_len = rxdesc->size;
+        skbdesc->desc = entry->skb->data + rxdesc->size;
+        skbdesc->desc_len = entry->queue->desc_size;
+
+        /*
+         * Remove descriptor from skb buffer and trim the whole thing
+         * down to only contain data.
+         */
+        skb_trim(entry->skb, rxdesc->size);
 }
 
 /*
@@ -1157,10 +1171,10 @@ static void rt2500usb_fill_rxdone(struct data_entry *entry,
  */
 static void rt2500usb_beacondone(struct urb *urb)
 {
-        struct data_entry *entry = (struct data_entry *)urb->context;
-        struct data_ring *ring = entry->ring;
+        struct queue_entry *entry = (struct queue_entry *)urb->context;
+        struct queue_entry_priv_usb_bcn *priv_bcn = entry->priv_data;
 
-        if (!test_bit(DEVICE_ENABLED_RADIO, &ring->rt2x00dev->flags))
+        if (!test_bit(DEVICE_ENABLED_RADIO, &entry->queue->rt2x00dev->flags))
                 return;
 
         /*
@@ -1169,18 +1183,11 @@ static void rt2500usb_beacondone(struct urb *urb)
          * Otherwise we should free the sk_buffer, the device
          * should be doing the rest of the work now.
          */
-        if (ring->index == 1) {
-                rt2x00_ring_index_done_inc(ring);
-                entry = rt2x00_get_data_entry(ring);
-                usb_submit_urb(entry->priv, GFP_ATOMIC);
-                rt2x00_ring_index_inc(ring);
-        } else if (ring->index_done == 1) {
-                entry = rt2x00_get_data_entry_done(ring);
-                if (entry->skb) {
-                        dev_kfree_skb(entry->skb);
-                        entry->skb = NULL;
-                }
-                rt2x00_ring_index_done_inc(ring);
+        if (priv_bcn->guardian_urb == urb) {
+                usb_submit_urb(priv_bcn->urb, GFP_ATOMIC);
+        } else if (priv_bcn->urb == urb) {
+                dev_kfree_skb(entry->skb);
+                entry->skb = NULL;
         }
 }
 
@@ -1191,6 +1198,7 @@ static int rt2500usb_validate_eeprom(struct rt2x00_dev *rt2x00dev)
 {
         u16 word;
         u8 *mac;
+        u8 bbp;
 
         rt2x00usb_eeprom_read(rt2x00dev, rt2x00dev->eeprom, EEPROM_SIZE);
 
@@ -1245,9 +1253,17 @@ static int rt2500usb_validate_eeprom(struct rt2x00_dev *rt2x00dev)
                 EEPROM(rt2x00dev, "BBPtune: 0x%04x\n", word);
         }
 
+        /*
+         * Switch lower vgc bound to current BBP R17 value,
+         * lower the value a bit for better quality.
+         */
+        rt2500usb_bbp_read(rt2x00dev, 17, &bbp);
+        bbp -= 6;
+
         rt2x00_eeprom_read(rt2x00dev, EEPROM_BBPTUNE_VGC, &word);
         if (word == 0xffff) {
                 rt2x00_set_field16(&word, EEPROM_BBPTUNE_VGCUPPER, 0x40);
+                rt2x00_set_field16(&word, EEPROM_BBPTUNE_VGCLOWER, bbp);
                 rt2x00_eeprom_write(rt2x00dev, EEPROM_BBPTUNE_VGC, word);
                 EEPROM(rt2x00dev, "BBPtune vgc: 0x%04x\n", word);
         }
@@ -1258,6 +1274,9 @@ static int rt2500usb_validate_eeprom(struct rt2x00_dev *rt2x00dev)
                 rt2x00_set_field16(&word, EEPROM_BBPTUNE_R17_HIGH, 0x41);
                 rt2x00_eeprom_write(rt2x00dev, EEPROM_BBPTUNE_R17, word);
                 EEPROM(rt2x00dev, "BBPtune r17: 0x%04x\n", word);
+        } else {
+                rt2x00_set_field16(&word, EEPROM_BBPTUNE_VGCLOWER, bbp);
+                rt2x00_eeprom_write(rt2x00dev, EEPROM_BBPTUNE_VGC, word);
         }
 
         rt2x00_eeprom_read(rt2x00dev, EEPROM_BBPTUNE_R24, &word);
@@ -1342,8 +1361,31 @@ static int rt2500usb_init_eeprom(struct rt2x00_dev *rt2x00dev)
         /*
          * Store led mode, for correct led behaviour.
          */
-        rt2x00dev->led_mode =
-            rt2x00_get_field16(eeprom, EEPROM_ANTENNA_LED_MODE);
+#ifdef CONFIG_RT2500USB_LEDS
+        value = rt2x00_get_field16(eeprom, EEPROM_ANTENNA_LED_MODE);
+
+        switch (value) {
+        case LED_MODE_ASUS:
+        case LED_MODE_ALPHA:
+        case LED_MODE_DEFAULT:
+                rt2x00dev->led_flags = LED_SUPPORT_RADIO;
+                break;
+        case LED_MODE_TXRX_ACTIVITY:
+                rt2x00dev->led_flags =
+                    LED_SUPPORT_RADIO | LED_SUPPORT_ACTIVITY;
+                break;
+        case LED_MODE_SIGNAL_STRENGTH:
+                rt2x00dev->led_flags = LED_SUPPORT_RADIO;
+                break;
+        }
+
+        /*
+         * Store the current led register value, we need it later
+         * in set_brightness but that is called in irq context which
+         * means we can't use rt2500usb_register_read() at that time.
+         */
+        rt2500usb_register_read(rt2x00dev, MAC_CSR20, &rt2x00dev->led_mcu_reg);
+#endif /* CONFIG_RT2500USB_LEDS */
 
         /*
          * Check if the BBP tuning should be disabled.
@@ -1550,8 +1592,8 @@ static void rt2500usb_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
         /*
          * Initialize hw_mode information.
          */
-        spec->num_modes = 2;
-        spec->num_rates = 12;
+        spec->supported_bands = SUPPORT_BAND_2GHZ;
+        spec->supported_rates = SUPPORT_RATE_CCK | SUPPORT_RATE_OFDM;
         spec->tx_power_a = NULL;
         spec->tx_power_bg = txpower;
         spec->tx_power_default = DEFAULT_TXPOWER;
@@ -1572,9 +1614,9 @@ static void rt2500usb_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
                 spec->num_channels = ARRAY_SIZE(rf_vals_bg_2525e);
                 spec->channels = rf_vals_bg_2525e;
         } else if (rt2x00_rf(&rt2x00dev->chip, RF5222)) {
+                spec->supported_bands |= SUPPORT_BAND_5GHZ;
                 spec->num_channels = ARRAY_SIZE(rf_vals_5222);
                 spec->channels = rf_vals_5222;
-                spec->num_modes = 3;
         }
 }
 
@@ -1599,9 +1641,10 @@ static int rt2500usb_probe_hw(struct rt2x00_dev *rt2x00dev)
         rt2500usb_probe_hw_mode(rt2x00dev);
 
         /*
-         * This device requires the beacon ring
+         * This device requires the atim queue
          */
-        __set_bit(DRIVER_REQUIRE_BEACON_RING, &rt2x00dev->flags);
+        __set_bit(DRIVER_REQUIRE_ATIM_QUEUE, &rt2x00dev->flags);
+        __set_bit(DRIVER_REQUIRE_BEACON_GUARD, &rt2x00dev->flags);
 
         /*
          * Set the rssi offset.
@@ -1691,48 +1734,42 @@ static int rt2500usb_beacon_update(struct ieee80211_hw *hw,
                                    struct ieee80211_tx_control *control)
 {
         struct rt2x00_dev *rt2x00dev = hw->priv;
-        struct usb_device *usb_dev =
-            interface_to_usbdev(rt2x00dev_usb(rt2x00dev));
-        struct skb_desc *desc;
-        struct data_ring *ring;
-        struct data_entry *beacon;
-        struct data_entry *guardian;
+        struct usb_device *usb_dev = rt2x00dev_usb_dev(rt2x00dev);
+        struct rt2x00_intf *intf = vif_to_intf(control->vif);
+        struct queue_entry_priv_usb_bcn *priv_bcn;
+        struct skb_frame_desc *skbdesc;
         int pipe = usb_sndbulkpipe(usb_dev, 1);
         int length;
 
-        /*
-         * Just in case the ieee80211 doesn't set this,
-         * but we need this queue set for the descriptor
-         * initialization.
-         */
-        control->queue = IEEE80211_TX_QUEUE_BEACON;
-        ring = rt2x00lib_get_ring(rt2x00dev, control->queue);
+        if (unlikely(!intf->beacon))
+                return -ENOBUFS;
 
-        /*
-         * Obtain 2 entries, one for the guardian byte,
-         * the second for the actual beacon.
-         */
-        guardian = rt2x00_get_data_entry(ring);
-        rt2x00_ring_index_inc(ring);
-        beacon = rt2x00_get_data_entry(ring);
+        priv_bcn = intf->beacon->priv_data;
 
         /*
          * Add the descriptor in front of the skb.
          */
-        skb_push(skb, ring->desc_size);
-        memset(skb->data, 0, ring->desc_size);
+        skb_push(skb, intf->beacon->queue->desc_size);
+        memset(skb->data, 0, intf->beacon->queue->desc_size);
 
         /*
          * Fill in skb descriptor
          */
-        desc = get_skb_desc(skb);
-        desc->desc_len = ring->desc_size;
-        desc->data_len = skb->len - ring->desc_size;
-        desc->desc = skb->data;
-        desc->data = skb->data + ring->desc_size;
-        desc->ring = ring;
-        desc->entry = beacon;
+        skbdesc = get_skb_frame_desc(skb);
+        memset(skbdesc, 0, sizeof(*skbdesc));
+        skbdesc->flags |= FRAME_DESC_DRIVER_GENERATED;
+        skbdesc->data = skb->data + intf->beacon->queue->desc_size;
+        skbdesc->data_len = skb->len - intf->beacon->queue->desc_size;
+        skbdesc->desc = skb->data;
+        skbdesc->desc_len = intf->beacon->queue->desc_size;
+        skbdesc->entry = intf->beacon;
 
+        /*
+         * mac80211 doesn't provide the control->queue variable
+         * for beacons. Set our own queue identification so
+         * it can be used during descriptor initialization.
+         */
+        control->queue = RT2X00_BCN_QUEUE_BEACON;
         rt2x00lib_write_tx_desc(rt2x00dev, skb, control);
 
         /*
@@ -1742,27 +1779,29 @@ static int rt2500usb_beacon_update(struct ieee80211_hw *hw,
          */
         length = rt2500usb_get_tx_data_len(rt2x00dev, skb);
 
-        usb_fill_bulk_urb(beacon->priv, usb_dev, pipe,
-                          skb->data, length, rt2500usb_beacondone, beacon);
+        usb_fill_bulk_urb(priv_bcn->urb, usb_dev, pipe,
+                          skb->data, length, rt2500usb_beacondone,
+                          intf->beacon);
 
         /*
          * Second we need to create the guardian byte.
          * We only need a single byte, so lets recycle
          * the 'flags' field we are not using for beacons.
          */
-        guardian->flags = 0;
-        usb_fill_bulk_urb(guardian->priv, usb_dev, pipe,
-                          &guardian->flags, 1, rt2500usb_beacondone, guardian);
+        priv_bcn->guardian_data = 0;
+        usb_fill_bulk_urb(priv_bcn->guardian_urb, usb_dev, pipe,
+                          &priv_bcn->guardian_data, 1, rt2500usb_beacondone,
+                          intf->beacon);
 
         /*
          * Send out the guardian byte.
          */
-        usb_submit_urb(guardian->priv, GFP_ATOMIC);
+        usb_submit_urb(priv_bcn->guardian_urb, GFP_ATOMIC);
 
         /*
          * Enable beacon generation.
          */
-        rt2500usb_kick_tx_queue(rt2x00dev, IEEE80211_TX_QUEUE_BEACON);
+        rt2500usb_kick_tx_queue(rt2x00dev, control->queue);
 
         return 0;
 }
@@ -1793,24 +1832,55 @@ static const struct rt2x00lib_ops rt2500usb_rt2x00_ops = {
         .link_stats             = rt2500usb_link_stats,
         .reset_tuner            = rt2500usb_reset_tuner,
         .link_tuner             = rt2500usb_link_tuner,
+        .led_brightness         = rt2500usb_led_brightness,
         .write_tx_desc          = rt2500usb_write_tx_desc,
         .write_tx_data          = rt2x00usb_write_tx_data,
         .get_tx_data_len        = rt2500usb_get_tx_data_len,
         .kick_tx_queue          = rt2500usb_kick_tx_queue,
         .fill_rxdone            = rt2500usb_fill_rxdone,
-        .config_mac_addr        = rt2500usb_config_mac_addr,
-        .config_bssid           = rt2500usb_config_bssid,
-        .config_type            = rt2500usb_config_type,
+        .config_intf            = rt2500usb_config_intf,
         .config_preamble        = rt2500usb_config_preamble,
         .config                 = rt2500usb_config,
 };
 
+static const struct data_queue_desc rt2500usb_queue_rx = {
+        .entry_num              = RX_ENTRIES,
+        .data_size              = DATA_FRAME_SIZE,
+        .desc_size              = RXD_DESC_SIZE,
+        .priv_size              = sizeof(struct queue_entry_priv_usb_rx),
+};
+
+static const struct data_queue_desc rt2500usb_queue_tx = {
+        .entry_num              = TX_ENTRIES,
+        .data_size              = DATA_FRAME_SIZE,
+        .desc_size              = TXD_DESC_SIZE,
+        .priv_size              = sizeof(struct queue_entry_priv_usb_tx),
+};
+
+static const struct data_queue_desc rt2500usb_queue_bcn = {
+        .entry_num              = BEACON_ENTRIES,
+        .data_size              = MGMT_FRAME_SIZE,
+        .desc_size              = TXD_DESC_SIZE,
+        .priv_size              = sizeof(struct queue_entry_priv_usb_bcn),
+};
+
+static const struct data_queue_desc rt2500usb_queue_atim = {
+        .entry_num              = ATIM_ENTRIES,
+        .data_size              = DATA_FRAME_SIZE,
+        .desc_size              = TXD_DESC_SIZE,
+        .priv_size              = sizeof(struct queue_entry_priv_usb_tx),
+};
+
 static const struct rt2x00_ops rt2500usb_ops = {
         .name           = KBUILD_MODNAME,
-        .rxd_size       = RXD_DESC_SIZE,
-        .txd_size       = TXD_DESC_SIZE,
+        .max_sta_intf   = 1,
+        .max_ap_intf    = 1,
         .eeprom_size    = EEPROM_SIZE,
         .rf_size        = RF_SIZE,
+        .rx             = &rt2500usb_queue_rx,
+        .tx             = &rt2500usb_queue_tx,
+        .bcn            = &rt2500usb_queue_bcn,
+        .atim           = &rt2500usb_queue_atim,
         .lib            = &rt2500usb_rt2x00_ops,
         .hw             = &rt2500usb_mac80211_ops,
 #ifdef CONFIG_RT2X00_LIB_DEBUGFS
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.h b/drivers/net/wireless/rt2x00/rt2500usb.h
index 9e0433722e3d..a37a068d0c71 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.h
+++ b/drivers/net/wireless/rt2x00/rt2500usb.h
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2007 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2008 rt2x00 SourceForge Project
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
@@ -135,7 +135,7 @@
  * Misc MAC_CSR registers.
  * MAC_CSR9: Timer control.
  * MAC_CSR10: Slot time.
- * MAC_CSR11: IFS.
+ * MAC_CSR11: SIFS.
  * MAC_CSR12: EIFS.
  * MAC_CSR13: Power mode0.
  * MAC_CSR14: Power mode1.
@@ -686,6 +686,7 @@
  */
 #define EEPROM_BBPTUNE_VGC              0x0034
 #define EEPROM_BBPTUNE_VGCUPPER         FIELD16(0x00ff)
+#define EEPROM_BBPTUNE_VGCLOWER         FIELD16(0xff00)
 
 /*
  * EEPROM BBP R17 Tuning.
@@ -786,8 +787,8 @@
 #define RXD_W3_EIV                      FIELD32(0xffffffff)
 
 /*
- * Macro's for converting txpower from EEPROM to dscape value
- * and from dscape value to register value.
+ * Macro's for converting txpower from EEPROM to mac80211 value
+ * and from mac80211 value to register value.
  */
 #define MIN_TXPOWER     0
 #define MAX_TXPOWER     31
diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
index 05927b908f80..fd65fccbdae7 100644
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2007 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2008 rt2x00 SourceForge Project
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
@@ -27,23 +27,24 @@
 #define RT2X00_H
 
 #include <linux/bitops.h>
-#include <linux/prefetch.h>
 #include <linux/skbuff.h>
 #include <linux/workqueue.h>
 #include <linux/firmware.h>
+#include <linux/leds.h>
 #include <linux/mutex.h>
 #include <linux/etherdevice.h>
 
 #include <net/mac80211.h>
 
 #include "rt2x00debug.h"
+#include "rt2x00leds.h"
 #include "rt2x00reg.h"
-#include "rt2x00ring.h"
+#include "rt2x00queue.h"
 
 /*
  * Module information.
  */
-#define DRV_VERSION     "2.0.14"
+#define DRV_VERSION     "2.1.3"
 #define DRV_PROJECT     "http://rt2x00.serialmonkey.com"
 
 /*
@@ -91,26 +92,6 @@
         DEBUG_PRINTK(__dev, KERN_DEBUG, "EEPROM recovery", __msg, ##__args)
 
 /*
- * Ring sizes.
- * Ralink PCI devices demand the Frame size to be a multiple of 128 bytes.
- * DATA_FRAME_SIZE is used for TX, RX, ATIM and PRIO rings.
- * MGMT_FRAME_SIZE is used for the BEACON ring.
- */
-#define DATA_FRAME_SIZE 2432
-#define MGMT_FRAME_SIZE 256
-
-/*
- * Number of entries in a packet ring.
- * PCI devices only need 1 Beacon entry,
- * but USB devices require a second because they
- * have to send a Guardian byte first.
- */
-#define RX_ENTRIES      12
-#define TX_ENTRIES      12
-#define ATIM_ENTRIES    1
-#define BEACON_ENTRIES  2
-
-/*
  * Standard timing and size defines.
  * These values should follow the ieee80211 specifications.
  */
@@ -364,20 +345,22 @@ static inline int rt2x00_update_ant_rssi(struct link *link, int rssi)
 
 /*
  * Interface structure
- * Configuration details about the current interface.
+ * Per interface configuration details, this structure
+ * is allocated as the private data for ieee80211_vif.
  */
-struct interface {
+struct rt2x00_intf {
         /*
-         * Interface identification. The value is assigned
-         * to us by the 80211 stack, and is used to request
-         * new beacons.
+         * All fields within the rt2x00_intf structure
+         * must be protected with a spinlock.
          */
-        struct ieee80211_vif *id;
+        spinlock_t lock;
 
         /*
-         * Current working type (IEEE80211_IF_TYPE_*).
+         * BSS configuration. Copied from the structure
+         * passed to us through the bss_info_changed()
+         * callback funtion.
          */
-        int type;
+        struct ieee80211_bss_conf conf;
 
         /*
          * MAC of the device.
@@ -388,42 +371,59 @@ struct interface {
          * BBSID of the AP to associate with.
          */
         u8 bssid[ETH_ALEN];
-};
 
-static inline int is_interface_present(struct interface *intf)
-{
-        return !!intf->id;
-}
+        /*
+         * Entry in the beacon queue which belongs to
+         * this interface. Each interface has its own
+         * dedicated beacon entry.
+         */
+        struct queue_entry *beacon;
+
+        /*
+         * Actions that needed rescheduling.
+         */
+        unsigned int delayed_flags;
+#define DELAYED_UPDATE_BEACON           0x00000001
+#define DELAYED_CONFIG_PREAMBLE         0x00000002
+};
 
-static inline int is_interface_type(struct interface *intf, int type)
+static inline struct rt2x00_intf* vif_to_intf(struct ieee80211_vif *vif)
 {
-        return intf->type == type;
+        return (struct rt2x00_intf *)vif->drv_priv;
 }
 
-/*
+/**
+ * struct hw_mode_spec: Hardware specifications structure
+ *
  * Details about the supported modes, rates and channels
  * of a particular chipset. This is used by rt2x00lib
  * to build the ieee80211_hw_mode array for mac80211.
+ *
+ * @supported_bands: Bitmask contained the supported bands (2.4GHz, 5.2GHz).
+ * @supported_rates: Rate types which are supported (CCK, OFDM).
+ * @num_channels: Number of supported channels. This is used as array size
+ *      for @tx_power_a, @tx_power_bg and @channels.
+ * channels: Device/chipset specific channel values (See &struct rf_channel).
+ * @tx_power_a: TX power values for all 5.2GHz channels (may be NULL).
+ * @tx_power_bg: TX power values for all 2.4GHz channels (may be NULL).
+ * @tx_power_default: Default TX power value to use when either
+ *      @tx_power_a or @tx_power_bg is missing.
  */
 struct hw_mode_spec {
-        /*
-         * Number of modes, rates and channels.
-         */
-        int num_modes;
-        int num_rates;
-        int num_channels;
+        unsigned int supported_bands;
+#define SUPPORT_BAND_2GHZ       0x00000001
+#define SUPPORT_BAND_5GHZ       0x00000002
+
+        unsigned int supported_rates;
+#define SUPPORT_RATE_CCK        0x00000001
+#define SUPPORT_RATE_OFDM       0x00000002
+
+        unsigned int num_channels;
+        const struct rf_channel *channels;
 
-        /*
-         * txpower values.
-         */
         const u8 *tx_power_a;
         const u8 *tx_power_bg;
         u8 tx_power_default;
-
-        /*
-         * Device/chipset specific value.
-         */
-        const struct rf_channel *channels;
 };
 
 /*
@@ -439,7 +439,7 @@ struct rt2x00lib_conf {
 
         struct antenna_setup ant;
 
-        int phymode;
+        enum ieee80211_band band;
 
         int basic_rates;
         int slot_time;
@@ -451,6 +451,37 @@ struct rt2x00lib_conf {
 };
 
 /*
+ * Configuration structure wrapper around the
+ * rt2x00 interface configuration handler.
+ */
+struct rt2x00intf_conf {
+        /*
+         * Interface type
+         */
+        enum ieee80211_if_types type;
+
+        /*
+         * TSF sync value, this is dependant on the operation type.
+         */
+        enum tsf_sync sync;
+
+        /*
+         * The MAC and BSSID addressess are simple array of bytes,
+         * these arrays are little endian, so when sending the addressess
+         * to the drivers, copy the it into a endian-signed variable.
+         *
+         * Note that all devices (except rt2500usb) have 32 bits
+         * register word sizes. This means that whatever variable we
+         * pass _must_ be a multiple of 32 bits. Otherwise the device
+         * might not accept what we are sending to it.
+         * This will also make it easier for the driver to write
+         * the data to the device.
+         */
+        __le32 mac[2];
+        __le32 bssid[2];
+};
+
+/*
  * rt2x00lib callback functions.
  */
 struct rt2x00lib_ops {
@@ -474,12 +505,12 @@ struct rt2x00lib_ops {
         void (*uninitialize) (struct rt2x00_dev *rt2x00dev);
 
         /*
-         * Ring initialization handlers
+         * queue initialization handlers
          */
         void (*init_rxentry) (struct rt2x00_dev *rt2x00dev,
-                              struct data_entry *entry);
+                              struct queue_entry *entry);
         void (*init_txentry) (struct rt2x00_dev *rt2x00dev,
-                              struct data_entry *entry);
+                              struct queue_entry *entry);
 
         /*
          * Radio control handlers.
@@ -491,41 +522,48 @@ struct rt2x00lib_ops {
                             struct link_qual *qual);
         void (*reset_tuner) (struct rt2x00_dev *rt2x00dev);
         void (*link_tuner) (struct rt2x00_dev *rt2x00dev);
+        void (*led_brightness) (struct led_classdev *led_cdev,
+                                enum led_brightness brightness);
 
         /*
          * TX control handlers
          */
         void (*write_tx_desc) (struct rt2x00_dev *rt2x00dev,
                                struct sk_buff *skb,
-                               struct txdata_entry_desc *desc,
+                               struct txentry_desc *txdesc,
                                struct ieee80211_tx_control *control);
         int (*write_tx_data) (struct rt2x00_dev *rt2x00dev,
-                              struct data_ring *ring, struct sk_buff *skb,
+                              struct data_queue *queue, struct sk_buff *skb,
                               struct ieee80211_tx_control *control);
         int (*get_tx_data_len) (struct rt2x00_dev *rt2x00dev,
                                 struct sk_buff *skb);
         void (*kick_tx_queue) (struct rt2x00_dev *rt2x00dev,
-                               unsigned int queue);
+                               const unsigned int queue);
 
         /*
          * RX control handlers
          */
-        void (*fill_rxdone) (struct data_entry *entry,
-                             struct rxdata_entry_desc *desc);
+        void (*fill_rxdone) (struct queue_entry *entry,
+                             struct rxdone_entry_desc *rxdesc);
 
         /*
          * Configuration handlers.
          */
-        void (*config_mac_addr) (struct rt2x00_dev *rt2x00dev, __le32 *mac);
-        void (*config_bssid) (struct rt2x00_dev *rt2x00dev, __le32 *bssid);
-        void (*config_type) (struct rt2x00_dev *rt2x00dev, const int type,
-                                                           const int tsf_sync);
-        void (*config_preamble) (struct rt2x00_dev *rt2x00dev,
-                                 const int short_preamble,
-                                 const int ack_timeout,
-                                 const int ack_consume_time);
-        void (*config) (struct rt2x00_dev *rt2x00dev, const unsigned int flags,
-                        struct rt2x00lib_conf *libconf);
+        void (*config_intf) (struct rt2x00_dev *rt2x00dev,
+                             struct rt2x00_intf *intf,
+                             struct rt2x00intf_conf *conf,
+                             const unsigned int flags);
+#define CONFIG_UPDATE_TYPE              ( 1 << 1 )
+#define CONFIG_UPDATE_MAC               ( 1 << 2 )
+#define CONFIG_UPDATE_BSSID             ( 1 << 3 )
+
+        int (*config_preamble) (struct rt2x00_dev *rt2x00dev,
+                                const int short_preamble,
+                                const int ack_timeout,
+                                const int ack_consume_time);
+        void (*config) (struct rt2x00_dev *rt2x00dev,
+                        struct rt2x00lib_conf *libconf,
+                        const unsigned int flags);
 #define CONFIG_UPDATE_PHYMODE           ( 1 << 1 )
 #define CONFIG_UPDATE_CHANNEL           ( 1 << 2 )
 #define CONFIG_UPDATE_TXPOWER           ( 1 << 3 )
@@ -540,10 +578,14 @@ struct rt2x00lib_ops {
  */
 struct rt2x00_ops {
         const char *name;
-        const unsigned int rxd_size;
-        const unsigned int txd_size;
+        const unsigned int max_sta_intf;
+        const unsigned int max_ap_intf;
         const unsigned int eeprom_size;
         const unsigned int rf_size;
+        const struct data_queue_desc *rx;
+        const struct data_queue_desc *tx;
+        const struct data_queue_desc *bcn;
+        const struct data_queue_desc *atim;
         const struct rt2x00lib_ops *lib;
         const struct ieee80211_ops *hw;
 #ifdef CONFIG_RT2X00_LIB_DEBUGFS
@@ -569,8 +611,12 @@ enum rt2x00_flags {
         /*
          * Driver features
          */
+        DRIVER_SUPPORT_MIXED_INTERFACES,
         DRIVER_REQUIRE_FIRMWARE,
-        DRIVER_REQUIRE_BEACON_RING,
+        DRIVER_REQUIRE_FIRMWARE_CRC_ITU_T,
+        DRIVER_REQUIRE_FIRMWARE_CCITT,
+        DRIVER_REQUIRE_BEACON_GUARD,
+        DRIVER_REQUIRE_ATIM_QUEUE,
 
         /*
          * Driver configuration
@@ -582,7 +628,6 @@ enum rt2x00_flags {
         CONFIG_EXTERNAL_LNA_BG,
         CONFIG_DOUBLE_ANTENNA,
         CONFIG_DISABLE_LINK_TUNING,
-        CONFIG_SHORT_PREAMBLE,
 };
 
 /*
@@ -597,8 +642,10 @@ struct rt2x00_dev {
          * macro's should be used for correct typecasting.
          */
         void *dev;
-#define rt2x00dev_pci(__dev)    ( (struct pci_dev*)(__dev)->dev )
-#define rt2x00dev_usb(__dev)    ( (struct usb_interface*)(__dev)->dev )
+#define rt2x00dev_pci(__dev)    ( (struct pci_dev *)(__dev)->dev )
+#define rt2x00dev_usb(__dev)    ( (struct usb_interface *)(__dev)->dev )
+#define rt2x00dev_usb_dev(__dev)\
+        ( (struct usb_device *)interface_to_usbdev(rt2x00dev_usb(__dev)) )
 
         /*
          * Callback functions.
@@ -609,11 +656,8 @@ struct rt2x00_dev {
          * IEEE80211 control structure.
          */
         struct ieee80211_hw *hw;
-        struct ieee80211_hw_mode *hwmodes;
-        unsigned int curr_hwmode;
-#define HWMODE_B        0
-#define HWMODE_G        1
-#define HWMODE_A        2
+        struct ieee80211_supported_band bands[IEEE80211_NUM_BANDS];
+        enum ieee80211_band curr_band;
 
         /*
          * rfkill structure for RF state switching support.
@@ -633,6 +677,19 @@ struct rt2x00_dev {
 #endif /* CONFIG_RT2X00_LIB_DEBUGFS */
 
         /*
+         * LED structure for changing the LED status
+         * by mac8011 or the kernel.
+         */
+#ifdef CONFIG_RT2X00_LIB_LEDS
+        unsigned int led_flags;
+        struct rt2x00_trigger trigger_qual;
+        struct rt2x00_led led_radio;
+        struct rt2x00_led led_assoc;
+        struct rt2x00_led led_qual;
+        u16 led_mcu_reg;
+#endif /* CONFIG_RT2X00_LIB_LEDS */
+
+        /*
          * Device flags.
          * In these flags the current status and some
          * of the device capabilities are stored.
@@ -658,11 +715,13 @@ struct rt2x00_dev {
 
         /*
          * Register pointers
-         * csr_addr: Base register address. (PCI)
-         * csr_cache: CSR cache for usb_control_msg. (USB)
+         * csr.base: CSR base register address. (PCI)
+         * csr.cache: CSR cache for usb_control_msg. (USB)
          */
-        void __iomem *csr_addr;
-        void *csr_cache;
+        union csr {
+                void __iomem *base;
+                void *cache;
+        } csr;
 
         /*
          * Mutex to protect register accesses on USB devices.
@@ -684,9 +743,14 @@ struct rt2x00_dev {
         unsigned int packet_filter;
 
         /*
-         * Interface configuration.
+         * Interface details:
+         *  - Open ap interface count.
+         *  - Open sta interface count.
+         *  - Association count.
          */
-        struct interface interface;
+        unsigned int intf_ap_count;
+        unsigned int intf_sta_count;
+        unsigned int intf_associated;
 
         /*
          * Link quality
@@ -719,16 +783,6 @@ struct rt2x00_dev {
         u16 tx_power;
 
         /*
-         * LED register (for rt61pci & rt73usb).
-         */
-        u16 led_reg;
-
-        /*
-         * Led mode (LED_MODE_*)
-         */
-        u8 led_mode;
-
-        /*
          * Rssi <-> Dbm offset
          */
         u8 rssi_offset;
@@ -752,19 +806,18 @@ struct rt2x00_dev {
         /*
          * Scheduled work.
          */
-        struct work_struct beacon_work;
+        struct work_struct intf_work;
         struct work_struct filter_work;
-        struct work_struct config_work;
 
         /*
-         * Data ring arrays for RX, TX and Beacon.
-         * The Beacon array also contains the Atim ring
+         * Data queue arrays for RX, TX and Beacon.
+         * The Beacon array also contains the Atim queue
          * if that is supported by the device.
          */
-        int data_rings;
-        struct data_ring *rx;
-        struct data_ring *tx;
-        struct data_ring *bcn;
+        int data_queues;
+        struct data_queue *rx;
+        struct data_queue *tx;
+        struct data_queue *bcn;
 
         /*
          * Firmware image.
@@ -773,37 +826,6 @@ struct rt2x00_dev {
 };
 
 /*
- * For-each loop for the ring array.
- * All rings have been allocated as a single array,
- * this means we can create a very simply loop macro
- * that is capable of looping through all rings.
- * ring_end(), txring_end() and ring_loop() are helper macro's which
- * should not be used directly. Instead the following should be used:
- * ring_for_each() - Loops through all rings (RX, TX, Beacon & Atim)
- * txring_for_each() - Loops through TX data rings (TX only)
- * txringall_for_each() - Loops through all TX rings (TX, Beacon & Atim)
- */
-#define ring_end(__dev) \
-        &(__dev)->rx[(__dev)->data_rings]
-
-#define txring_end(__dev) \
-        &(__dev)->tx[(__dev)->hw->queues]
-
-#define ring_loop(__entry, __start, __end)                      \
-        for ((__entry) = (__start);                             \
-             prefetch(&(__entry)[1]), (__entry) != (__end);     \
-             (__entry) = &(__entry)[1])
-
-#define ring_for_each(__dev, __entry) \
-        ring_loop(__entry, (__dev)->rx, ring_end(__dev))
-
-#define txring_for_each(__dev, __entry) \
-        ring_loop(__entry, (__dev)->tx, txring_end(__dev))
-
-#define txringall_for_each(__dev, __entry) \
-        ring_loop(__entry, (__dev)->tx, ring_end(__dev))
-
-/*
  * Generic RF access.
  * The RF is being accessed by word index.
  */
@@ -895,20 +917,43 @@ static inline u16 get_duration_res(const unsigned int size, const u8 rate)
         return ((size * 8 * 10) % rate);
 }
 
-/*
- * Library functions.
+/**
+ * rt2x00queue_get_queue - Convert mac80211 queue index to rt2x00 queue
+ * @rt2x00dev: Pointer to &struct rt2x00_dev.
+ * @queue: mac80211/rt2x00 queue index
+ *      (see &enum ieee80211_tx_queue and &enum rt2x00_bcn_queue).
+ */
+struct data_queue *rt2x00queue_get_queue(struct rt2x00_dev *rt2x00dev,
+                                         const unsigned int queue);
+
+/**
+ * rt2x00queue_get_entry - Get queue entry where the given index points to.
+ * @rt2x00dev: Pointer to &struct rt2x00_dev.
+ * @index: Index identifier for obtaining the correct index.
  */
-struct data_ring *rt2x00lib_get_ring(struct rt2x00_dev *rt2x00dev,
-                                     const unsigned int queue);
+struct queue_entry *rt2x00queue_get_entry(struct data_queue *queue,
+                                          enum queue_index index);
+
+/**
+ * rt2x00queue_index_inc - Index incrementation function
+ * @queue: Queue (&struct data_queue) to perform the action on.
+ * @action: Index type (&enum queue_index) to perform the action on.
+ *
+ * This function will increase the requested index on the queue,
+ * it will grab the appropriate locks and handle queue overflow events by
+ * resetting the index to the start of the queue.
+ */
+void rt2x00queue_index_inc(struct data_queue *queue, enum queue_index index);
+
 
 /*
  * Interrupt context handlers.
  */
 void rt2x00lib_beacondone(struct rt2x00_dev *rt2x00dev);
-void rt2x00lib_txdone(struct data_entry *entry,
-                      const int status, const int retry);
-void rt2x00lib_rxdone(struct data_entry *entry, struct sk_buff *skb,
-                      struct rxdata_entry_desc *desc);
+void rt2x00lib_txdone(struct queue_entry *entry,
+                      struct txdone_entry_desc *txdesc);
+void rt2x00lib_rxdone(struct queue_entry *entry,
+                      struct rxdone_entry_desc *rxdesc);
 
 /*
  * TX descriptor initializer
diff --git a/drivers/net/wireless/rt2x00/rt2x00config.c b/drivers/net/wireless/rt2x00/rt2x00config.c
index 07adc576db49..69959124d25d 100644
--- a/drivers/net/wireless/rt2x00/rt2x00config.c
+++ b/drivers/net/wireless/rt2x00/rt2x00config.c
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2007 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2008 rt2x00 SourceForge Project
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
@@ -29,64 +29,89 @@
 #include "rt2x00.h"
 #include "rt2x00lib.h"
 
-
-/*
- * The MAC and BSSID addressess are simple array of bytes,
- * these arrays are little endian, so when sending the addressess
- * to the drivers, copy the it into a endian-signed variable.
- *
- * Note that all devices (except rt2500usb) have 32 bits
- * register word sizes. This means that whatever variable we
- * pass _must_ be a multiple of 32 bits. Otherwise the device
- * might not accept what we are sending to it.
- * This will also make it easier for the driver to write
- * the data to the device.
- *
- * Also note that when NULL is passed as address the
- * we will send 00:00:00:00:00 to the device to clear the address.
- * This will prevent the device being confused when it wants
- * to ACK frames or consideres itself associated.
- */
-void rt2x00lib_config_mac_addr(struct rt2x00_dev *rt2x00dev, u8 *mac)
-{
-        __le32 reg[2];
-
-        memset(&reg, 0, sizeof(reg));
-        if (mac)
-                memcpy(&reg, mac, ETH_ALEN);
-
-        rt2x00dev->ops->lib->config_mac_addr(rt2x00dev, &reg[0]);
-}
-
-void rt2x00lib_config_bssid(struct rt2x00_dev *rt2x00dev, u8 *bssid)
+void rt2x00lib_config_intf(struct rt2x00_dev *rt2x00dev,
+                           struct rt2x00_intf *intf,
+                           enum ieee80211_if_types type,
+                           u8 *mac, u8 *bssid)
 {
-        __le32 reg[2];
-
-        memset(&reg, 0, sizeof(reg));
-        if (bssid)
-                memcpy(&reg, bssid, ETH_ALEN);
-
-        rt2x00dev->ops->lib->config_bssid(rt2x00dev, &reg[0]);
-}
+        struct rt2x00intf_conf conf;
+        unsigned int flags = 0;
 
-void rt2x00lib_config_type(struct rt2x00_dev *rt2x00dev, const int type)
-{
-        int tsf_sync;
+        conf.type = type;
 
         switch (type) {
         case IEEE80211_IF_TYPE_IBSS:
         case IEEE80211_IF_TYPE_AP:
-                tsf_sync = TSF_SYNC_BEACON;
+                conf.sync = TSF_SYNC_BEACON;
                 break;
         case IEEE80211_IF_TYPE_STA:
-                tsf_sync = TSF_SYNC_INFRA;
+                conf.sync = TSF_SYNC_INFRA;
                 break;
         default:
-                tsf_sync = TSF_SYNC_NONE;
+                conf.sync = TSF_SYNC_NONE;
                 break;
         }
 
-        rt2x00dev->ops->lib->config_type(rt2x00dev, type, tsf_sync);
+        /*
+         * Note that when NULL is passed as address we will send
+         * 00:00:00:00:00 to the device to clear the address.
+         * This will prevent the device being confused when it wants
+         * to ACK frames or consideres itself associated.
+         */
+        memset(&conf.mac, 0, sizeof(conf.mac));
+        if (mac)
+                memcpy(&conf.mac, mac, ETH_ALEN);
+
+        memset(&conf.bssid, 0, sizeof(conf.bssid));
+        if (bssid)
+                memcpy(&conf.bssid, bssid, ETH_ALEN);
+
+        flags |= CONFIG_UPDATE_TYPE;
+        if (mac || (!rt2x00dev->intf_ap_count && !rt2x00dev->intf_sta_count))
+                flags |= CONFIG_UPDATE_MAC;
+        if (bssid || (!rt2x00dev->intf_ap_count && !rt2x00dev->intf_sta_count))
+                flags |= CONFIG_UPDATE_BSSID;
+
+        rt2x00dev->ops->lib->config_intf(rt2x00dev, intf, &conf, flags);
+}
+
+void rt2x00lib_config_preamble(struct rt2x00_dev *rt2x00dev,
+                               struct rt2x00_intf *intf,
+                               const unsigned int short_preamble)
+{
+        int retval;
+        int ack_timeout;
+        int ack_consume_time;
+
+        ack_timeout = PLCP + get_duration(ACK_SIZE, 10);
+        ack_consume_time = SIFS + PLCP + get_duration(ACK_SIZE, 10);
+
+        if (rt2x00dev->hw->conf.flags & IEEE80211_CONF_SHORT_SLOT_TIME)
+                ack_timeout += SHORT_DIFS;
+        else
+                ack_timeout += DIFS;
+
+        if (short_preamble) {
+                ack_timeout += SHORT_PREAMBLE;
+                ack_consume_time += SHORT_PREAMBLE;
+        } else {
+                ack_timeout += PREAMBLE;
+                ack_consume_time += PREAMBLE;
+        }
+
+        retval = rt2x00dev->ops->lib->config_preamble(rt2x00dev,
+                                                      short_preamble,
+                                                      ack_timeout,
+                                                      ack_consume_time);
+
+        spin_lock(&intf->lock);
+
+        if (retval) {
+                intf->delayed_flags |= DELAYED_CONFIG_PREAMBLE;
+                queue_work(rt2x00dev->hw->workqueue, &rt2x00dev->intf_work);
+        }
+
+        spin_unlock(&intf->lock);
 }
 
 void rt2x00lib_config_antenna(struct rt2x00_dev *rt2x00dev,
@@ -113,7 +138,7 @@ void rt2x00lib_config_antenna(struct rt2x00_dev *rt2x00dev,
          * The latter is required since we need to recalibrate the
          * noise-sensitivity ratio for the new setup.
          */
-        rt2x00dev->ops->lib->config(rt2x00dev, CONFIG_UPDATE_ANTENNA, &libconf);
+        rt2x00dev->ops->lib->config(rt2x00dev, &libconf, CONFIG_UPDATE_ANTENNA);
         rt2x00lib_reset_link_tuner(rt2x00dev);
 
         rt2x00dev->link.ant.active.rx = libconf.ant.rx;
@@ -127,7 +152,7 @@ void rt2x00lib_config(struct rt2x00_dev *rt2x00dev,
                       struct ieee80211_conf *conf, const int force_config)
 {
         struct rt2x00lib_conf libconf;
-        struct ieee80211_hw_mode *mode;
+        struct ieee80211_supported_band *band;
         struct ieee80211_rate *rate;
         struct antenna_setup *default_ant = &rt2x00dev->default_ant;
         struct antenna_setup *active_ant = &rt2x00dev->link.ant.active;
@@ -147,9 +172,9 @@ void rt2x00lib_config(struct rt2x00_dev *rt2x00dev,
          * Check which configuration options have been
          * updated and should be send to the device.
          */
-        if (rt2x00dev->rx_status.phymode != conf->phymode)
+        if (rt2x00dev->rx_status.band != conf->channel->band)
                 flags |= CONFIG_UPDATE_PHYMODE;
-        if (rt2x00dev->rx_status.channel != conf->channel)
+        if (rt2x00dev->rx_status.freq != conf->channel->center_freq)
                 flags |= CONFIG_UPDATE_CHANNEL;
         if (rt2x00dev->tx_power != conf->power_level)
                 flags |= CONFIG_UPDATE_TXPOWER;
@@ -204,33 +229,16 @@ config:
         memset(&libconf, 0, sizeof(libconf));
 
         if (flags & CONFIG_UPDATE_PHYMODE) {
-                switch (conf->phymode) {
-                case MODE_IEEE80211A:
-                        libconf.phymode = HWMODE_A;
-                        break;
-                case MODE_IEEE80211B:
-                        libconf.phymode = HWMODE_B;
-                        break;
-                case MODE_IEEE80211G:
-                        libconf.phymode = HWMODE_G;
-                        break;
-                default:
-                        ERROR(rt2x00dev,
-                              "Attempt to configure unsupported mode (%d)"
-                              "Defaulting to 802.11b", conf->phymode);
-                        libconf.phymode = HWMODE_B;
-                }
-
-                mode = &rt2x00dev->hwmodes[libconf.phymode];
-                rate = &mode->rates[mode->num_rates - 1];
-
-                libconf.basic_rates =
-                    DEVICE_GET_RATE_FIELD(rate->val, RATEMASK) & DEV_BASIC_RATEMASK;
+                band = &rt2x00dev->bands[conf->channel->band];
+                rate = &band->bitrates[band->n_bitrates - 1];
+
+                libconf.band = conf->channel->band;
+                libconf.basic_rates = rt2x00_get_rate(rate->hw_value)->ratemask;
         }
 
         if (flags & CONFIG_UPDATE_CHANNEL) {
                 memcpy(&libconf.rf,
-                       &rt2x00dev->spec.channels[conf->channel_val],
+                       &rt2x00dev->spec.channels[conf->channel->hw_value],
                        sizeof(libconf.rf));
         }
 
@@ -266,7 +274,7 @@ config:
         /*
          * Start configuration.
          */
-        rt2x00dev->ops->lib->config(rt2x00dev, flags, &libconf);
+        rt2x00dev->ops->lib->config(rt2x00dev, &libconf, flags);
 
         /*
          * Some configuration changes affect the link quality
@@ -276,12 +284,11 @@ config:
                 rt2x00lib_reset_link_tuner(rt2x00dev);
 
         if (flags & CONFIG_UPDATE_PHYMODE) {
-                rt2x00dev->curr_hwmode = libconf.phymode;
-                rt2x00dev->rx_status.phymode = conf->phymode;
+                rt2x00dev->curr_band = conf->channel->band;
+                rt2x00dev->rx_status.band = conf->channel->band;
         }
 
-        rt2x00dev->rx_status.freq = conf->freq;
-        rt2x00dev->rx_status.channel = conf->channel;
+        rt2x00dev->rx_status.freq = conf->channel->center_freq;
         rt2x00dev->tx_power = conf->power_level;
 
         if (flags & CONFIG_UPDATE_ANTENNA) {
diff --git a/drivers/net/wireless/rt2x00/rt2x00debug.c b/drivers/net/wireless/rt2x00/rt2x00debug.c
index b44a9f4b9b7f..21af11a97334 100644
--- a/drivers/net/wireless/rt2x00/rt2x00debug.c
+++ b/drivers/net/wireless/rt2x00/rt2x00debug.c
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2007 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2008 rt2x00 SourceForge Project
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
@@ -33,7 +33,7 @@
 #include "rt2x00lib.h"
 #include "rt2x00dump.h"
 
-#define PRINT_LINE_LEN_MAX 32
+#define MAX_LINE_LENGTH 64
 
 struct rt2x00debug_intf {
         /*
@@ -60,8 +60,9 @@ struct rt2x00debug_intf {
          *     - eeprom offset/value files
          *     - bbp offset/value files
          *     - rf offset/value files
-         *   - frame dump folder
+         *   - queue folder
          *     - frame dump file
+         *     - queue stats file
          */
         struct dentry *driver_folder;
         struct dentry *driver_entry;
@@ -76,8 +77,9 @@ struct rt2x00debug_intf {
         struct dentry *bbp_val_entry;
         struct dentry *rf_off_entry;
         struct dentry *rf_val_entry;
-        struct dentry *frame_folder;
-        struct dentry *frame_dump_entry;
+        struct dentry *queue_folder;
+        struct dentry *queue_frame_dump_entry;
+        struct dentry *queue_stats_entry;
 
         /*
          * The frame dump file only allows a single reader,
@@ -116,7 +118,7 @@ void rt2x00debug_dump_frame(struct rt2x00_dev *rt2x00dev,
                             struct sk_buff *skb)
 {
         struct rt2x00debug_intf *intf = rt2x00dev->debugfs_intf;
-        struct skb_desc *desc = get_skb_desc(skb);
+        struct skb_frame_desc *desc = get_skb_frame_desc(skb);
         struct sk_buff *skbcopy;
         struct rt2x00dump_hdr *dump_hdr;
         struct timeval timestamp;
@@ -147,7 +149,7 @@ void rt2x00debug_dump_frame(struct rt2x00_dev *rt2x00dev,
         dump_hdr->chip_rf = cpu_to_le16(rt2x00dev->chip.rf);
         dump_hdr->chip_rev = cpu_to_le32(rt2x00dev->chip.rev);
         dump_hdr->type = cpu_to_le16(desc->frame_type);
-        dump_hdr->ring_index = desc->ring->queue_idx;
+        dump_hdr->queue_index = desc->entry->queue->qid;
         dump_hdr->entry_index = desc->entry->entry_idx;
         dump_hdr->timestamp_sec = cpu_to_le32(timestamp.tv_sec);
         dump_hdr->timestamp_usec = cpu_to_le32(timestamp.tv_usec);
@@ -186,7 +188,7 @@ static int rt2x00debug_file_release(struct inode *inode, struct file *file)
         return 0;
 }
 
-static int rt2x00debug_open_ring_dump(struct inode *inode, struct file *file)
+static int rt2x00debug_open_queue_dump(struct inode *inode, struct file *file)
 {
         struct rt2x00debug_intf *intf = inode->i_private;
         int retval;
@@ -203,7 +205,7 @@ static int rt2x00debug_open_ring_dump(struct inode *inode, struct file *file)
         return 0;
 }
 
-static int rt2x00debug_release_ring_dump(struct inode *inode, struct file *file)
+static int rt2x00debug_release_queue_dump(struct inode *inode, struct file *file)
 {
         struct rt2x00debug_intf *intf = inode->i_private;
 
@@ -214,10 +216,10 @@ static int rt2x00debug_release_ring_dump(struct inode *inode, struct file *file)
         return rt2x00debug_file_release(inode, file);
 }
 
-static ssize_t rt2x00debug_read_ring_dump(struct file *file,
-                                          char __user *buf,
-                                          size_t length,
-                                          loff_t *offset)
+static ssize_t rt2x00debug_read_queue_dump(struct file *file,
+                                           char __user *buf,
+                                           size_t length,
+                                           loff_t *offset)
 {
         struct rt2x00debug_intf *intf = file->private_data;
         struct sk_buff *skb;
@@ -248,8 +250,8 @@ exit:
         return status;
 }
 
-static unsigned int rt2x00debug_poll_ring_dump(struct file *file,
-                                               poll_table *wait)
+static unsigned int rt2x00debug_poll_queue_dump(struct file *file,
+                                                poll_table *wait)
 {
         struct rt2x00debug_intf *intf = file->private_data;
 
@@ -261,12 +263,67 @@ static unsigned int rt2x00debug_poll_ring_dump(struct file *file,
         return 0;
 }
 
-static const struct file_operations rt2x00debug_fop_ring_dump = {
+static const struct file_operations rt2x00debug_fop_queue_dump = {
         .owner          = THIS_MODULE,
-        .read           = rt2x00debug_read_ring_dump,
-        .poll           = rt2x00debug_poll_ring_dump,
-        .open           = rt2x00debug_open_ring_dump,
-        .release        = rt2x00debug_release_ring_dump,
+        .read           = rt2x00debug_read_queue_dump,
+        .poll           = rt2x00debug_poll_queue_dump,
+        .open           = rt2x00debug_open_queue_dump,
+        .release        = rt2x00debug_release_queue_dump,
+};
+
+static ssize_t rt2x00debug_read_queue_stats(struct file *file,
+                                            char __user *buf,
+                                            size_t length,
+                                            loff_t *offset)
+{
+        struct rt2x00debug_intf *intf = file->private_data;
+        struct data_queue *queue;
+        unsigned int lines = 1 + intf->rt2x00dev->data_queues;
+        size_t size;
+        char *data;
+        char *temp;
+
+        if (*offset)
+                return 0;
+
+        data = kzalloc(lines * MAX_LINE_LENGTH, GFP_KERNEL);
+        if (!data)
+                return -ENOMEM;
+
+        temp = data +
+            sprintf(data, "qid\tcount\tlimit\tlength\tindex\tdone\tcrypto\n");
+
+        queue_for_each(intf->rt2x00dev, queue) {
+                spin_lock(&queue->lock);
+
+                temp += sprintf(temp, "%d\t%d\t%d\t%d\t%d\t%d\t%d\n", queue->qid,
+                                queue->count, queue->limit, queue->length,
+                                queue->index[Q_INDEX],
+                                queue->index[Q_INDEX_DONE],
+                                queue->index[Q_INDEX_CRYPTO]);
+
+                spin_unlock(&queue->lock);
+        }
+
+        size = strlen(data);
+        size = min(size, length);
+
+        if (copy_to_user(buf, data, size)) {
+                kfree(data);
+                return -EFAULT;
+        }
+
+        kfree(data);
+
+        *offset += size;
+        return size;
+}
+
+static const struct file_operations rt2x00debug_fop_queue_stats = {
+        .owner          = THIS_MODULE,
+        .read           = rt2x00debug_read_queue_stats,
+        .open           = rt2x00debug_file_open,
+        .release        = rt2x00debug_file_release,
 };
 
 #define RT2X00DEBUGFS_OPS_READ(__name, __format, __type)        \
@@ -386,7 +443,7 @@ static struct dentry *rt2x00debug_create_file_driver(const char *name,
 {
         char *data;
 
-        data = kzalloc(3 * PRINT_LINE_LEN_MAX, GFP_KERNEL);
+        data = kzalloc(3 * MAX_LINE_LENGTH, GFP_KERNEL);
         if (!data)
                 return NULL;
 
@@ -409,7 +466,7 @@ static struct dentry *rt2x00debug_create_file_chipset(const char *name,
         const struct rt2x00debug *debug = intf->debug;
         char *data;
 
-        data = kzalloc(8 * PRINT_LINE_LEN_MAX, GFP_KERNEL);
+        data = kzalloc(8 * MAX_LINE_LENGTH, GFP_KERNEL);
         if (!data)
                 return NULL;
 
@@ -496,20 +553,24 @@ void rt2x00debug_register(struct rt2x00_dev *rt2x00dev)
 
 #undef RT2X00DEBUGFS_CREATE_REGISTER_ENTRY
 
-        intf->frame_folder =
-            debugfs_create_dir("frame", intf->driver_folder);
-        if (IS_ERR(intf->frame_folder))
+        intf->queue_folder =
+            debugfs_create_dir("queue", intf->driver_folder);
+        if (IS_ERR(intf->queue_folder))
                 goto exit;
 
-        intf->frame_dump_entry =
-            debugfs_create_file("dump", S_IRUGO, intf->frame_folder,
-                                intf, &rt2x00debug_fop_ring_dump);
-        if (IS_ERR(intf->frame_dump_entry))
+        intf->queue_frame_dump_entry =
+            debugfs_create_file("dump", S_IRUGO, intf->queue_folder,
+                                intf, &rt2x00debug_fop_queue_dump);
+        if (IS_ERR(intf->queue_frame_dump_entry))
                 goto exit;
 
         skb_queue_head_init(&intf->frame_dump_skbqueue);
         init_waitqueue_head(&intf->frame_dump_waitqueue);
 
+        intf->queue_stats_entry =
+            debugfs_create_file("queue", S_IRUGO, intf->queue_folder,
+                                intf, &rt2x00debug_fop_queue_stats);
+
         return;
 
 exit:
@@ -528,8 +589,9 @@ void rt2x00debug_deregister(struct rt2x00_dev *rt2x00dev)
 
         skb_queue_purge(&intf->frame_dump_skbqueue);
 
-        debugfs_remove(intf->frame_dump_entry);
-        debugfs_remove(intf->frame_folder);
+        debugfs_remove(intf->queue_stats_entry);
+        debugfs_remove(intf->queue_frame_dump_entry);
+        debugfs_remove(intf->queue_folder);
         debugfs_remove(intf->rf_val_entry);
         debugfs_remove(intf->rf_off_entry);
         debugfs_remove(intf->bbp_val_entry);
diff --git a/drivers/net/wireless/rt2x00/rt2x00debug.h b/drivers/net/wireless/rt2x00/rt2x00debug.h
index d37efbd09c41..c4ce895aa1c7 100644
--- a/drivers/net/wireless/rt2x00/rt2x00debug.h
+++ b/drivers/net/wireless/rt2x00/rt2x00debug.h
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2007 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2008 rt2x00 SourceForge Project
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index 0d51f478bcdf..b3a639aa0540 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2007 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2008 rt2x00 SourceForge Project
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
@@ -31,34 +31,6 @@
 #include "rt2x00dump.h"
 
 /*
- * Ring handler.
- */
-struct data_ring *rt2x00lib_get_ring(struct rt2x00_dev *rt2x00dev,
-                                     const unsigned int queue)
-{
-        int beacon = test_bit(DRIVER_REQUIRE_BEACON_RING, &rt2x00dev->flags);
-
-        /*
-         * Check if we are requesting a reqular TX ring,
-         * or if we are requesting a Beacon or Atim ring.
-         * For Atim rings, we should check if it is supported.
-         */
-        if (queue < rt2x00dev->hw->queues && rt2x00dev->tx)
-                return &rt2x00dev->tx[queue];
-
-        if (!rt2x00dev->bcn || !beacon)
-                return NULL;
-
-        if (queue == IEEE80211_TX_QUEUE_BEACON)
-                return &rt2x00dev->bcn[0];
-        else if (queue == IEEE80211_TX_QUEUE_AFTER_BEACON)
-                return &rt2x00dev->bcn[1];
-
-        return NULL;
-}
-EXPORT_SYMBOL_GPL(rt2x00lib_get_ring);
-
-/*
  * Link tuning handlers
  */
 void rt2x00lib_reset_link_tuner(struct rt2x00_dev *rt2x00dev)
@@ -113,46 +85,6 @@ static void rt2x00lib_stop_link_tuner(struct rt2x00_dev *rt2x00dev)
 }
 
 /*
- * Ring initialization
- */
-static void rt2x00lib_init_rxrings(struct rt2x00_dev *rt2x00dev)
-{
-        struct data_ring *ring = rt2x00dev->rx;
-        unsigned int i;
-
-        if (!rt2x00dev->ops->lib->init_rxentry)
-                return;
-
-        if (ring->data_addr)
-                memset(ring->data_addr, 0, rt2x00_get_ring_size(ring));
-
-        for (i = 0; i < ring->stats.limit; i++)
-                rt2x00dev->ops->lib->init_rxentry(rt2x00dev, &ring->entry[i]);
-
-        rt2x00_ring_index_clear(ring);
-}
-
-static void rt2x00lib_init_txrings(struct rt2x00_dev *rt2x00dev)
-{
-        struct data_ring *ring;
-        unsigned int i;
-
-        if (!rt2x00dev->ops->lib->init_txentry)
-                return;
-
-        txringall_for_each(rt2x00dev, ring) {
-                if (ring->data_addr)
-                        memset(ring->data_addr, 0, rt2x00_get_ring_size(ring));
-
-                for (i = 0; i < ring->stats.limit; i++)
-                        rt2x00dev->ops->lib->init_txentry(rt2x00dev,
-                                                          &ring->entry[i]);
-
-                rt2x00_ring_index_clear(ring);
-        }
-}
-
-/*
  * Radio control handlers.
  */
 int rt2x00lib_enable_radio(struct rt2x00_dev *rt2x00dev)
@@ -168,10 +100,10 @@ int rt2x00lib_enable_radio(struct rt2x00_dev *rt2x00dev)
                 return 0;
 
         /*
-         * Initialize all data rings.
+         * Initialize all data queues.
          */
-        rt2x00lib_init_rxrings(rt2x00dev);
-        rt2x00lib_init_txrings(rt2x00dev);
+        rt2x00queue_init_rx(rt2x00dev);
+        rt2x00queue_init_tx(rt2x00dev);
 
         /*
          * Enable radio.
@@ -204,12 +136,10 @@ void rt2x00lib_disable_radio(struct rt2x00_dev *rt2x00dev)
         /*
          * Stop all scheduled work.
          */
-        if (work_pending(&rt2x00dev->beacon_work))
-                cancel_work_sync(&rt2x00dev->beacon_work);
+        if (work_pending(&rt2x00dev->intf_work))
+                cancel_work_sync(&rt2x00dev->intf_work);
         if (work_pending(&rt2x00dev->filter_work))
                 cancel_work_sync(&rt2x00dev->filter_work);
-        if (work_pending(&rt2x00dev->config_work))
-                cancel_work_sync(&rt2x00dev->config_work);
 
         /*
          * Stop the TX queues.
@@ -241,7 +171,7 @@ void rt2x00lib_toggle_rx(struct rt2x00_dev *rt2x00dev, enum dev_state state)
          * When we are enabling the RX, we should also start the link tuner.
          */
         if (state == STATE_RADIO_RX_ON &&
-            is_interface_present(&rt2x00dev->interface))
+            (rt2x00dev->intf_ap_count || rt2x00dev->intf_sta_count))
                 rt2x00lib_start_link_tuner(rt2x00dev);
 }
 
@@ -449,6 +379,11 @@ static void rt2x00lib_link_tuner(struct work_struct *work)
         rt2x00lib_precalculate_link_signal(&rt2x00dev->link.qual);
 
         /*
+         * Send a signal to the led to update the led signal strength.
+         */
+        rt2x00leds_led_quality(rt2x00dev, rt2x00dev->link.qual.avg_rssi);
+
+        /*
          * Evaluate antenna setup, make this the last step since this could
          * possibly reset some statistics.
          */
@@ -469,10 +404,10 @@ static void rt2x00lib_packetfilter_scheduled(struct work_struct *work)
         unsigned int filter = rt2x00dev->packet_filter;
 
         /*
-         * Since we had stored the filter inside interface.filter,
+         * Since we had stored the filter inside rt2x00dev->packet_filter,
          * we should now clear that field. Otherwise the driver will
          * assume nothing has changed (*total_flags will be compared
-         * to interface.filter to determine if any action is required).
+         * to rt2x00dev->packet_filter to determine if any action is required).
          */
         rt2x00dev->packet_filter = 0;
 
@@ -480,45 +415,72 @@ static void rt2x00lib_packetfilter_scheduled(struct work_struct *work)
                                              filter, &filter, 0, NULL);
 }
 
-static void rt2x00lib_configuration_scheduled(struct work_struct *work)
+static void rt2x00lib_intf_scheduled_iter(void *data, u8 *mac,
+                                          struct ieee80211_vif *vif)
 {
-        struct rt2x00_dev *rt2x00dev =
-            container_of(work, struct rt2x00_dev, config_work);
-        struct ieee80211_bss_conf bss_conf;
+        struct rt2x00_dev *rt2x00dev = data;
+        struct rt2x00_intf *intf = vif_to_intf(vif);
+        struct sk_buff *skb;
+        struct ieee80211_tx_control control;
+        struct ieee80211_bss_conf conf;
+        int delayed_flags;
 
-        bss_conf.use_short_preamble =
-                test_bit(CONFIG_SHORT_PREAMBLE, &rt2x00dev->flags);
+        /*
+         * Copy all data we need during this action under the protection
+         * of a spinlock. Otherwise race conditions might occur which results
+         * into an invalid configuration.
+         */
+        spin_lock(&intf->lock);
+
+        memcpy(&conf, &intf->conf, sizeof(conf));
+        delayed_flags = intf->delayed_flags;
+        intf->delayed_flags = 0;
+
+        spin_unlock(&intf->lock);
+
+        if (delayed_flags & DELAYED_UPDATE_BEACON) {
+                skb = ieee80211_beacon_get(rt2x00dev->hw, vif, &control);
+                if (skb) {
+                        rt2x00dev->ops->hw->beacon_update(rt2x00dev->hw, skb,
+                                                          &control);
+                        dev_kfree_skb(skb);
+                }
+        }
+
+        if (delayed_flags & DELAYED_CONFIG_PREAMBLE)
+                rt2x00lib_config_preamble(rt2x00dev, intf,
+                                          intf->conf.use_short_preamble);
+}
+
+static void rt2x00lib_intf_scheduled(struct work_struct *work)
+{
+        struct rt2x00_dev *rt2x00dev =
+            container_of(work, struct rt2x00_dev, intf_work);
 
         /*
-         * FIXME: shouldn't invoke it this way because all other contents
-         *        of bss_conf is invalid.
+         * Iterate over each interface and perform the
+         * requested configurations.
          */
-        rt2x00mac_bss_info_changed(rt2x00dev->hw, rt2x00dev->interface.id,
-                                   &bss_conf, BSS_CHANGED_ERP_PREAMBLE);
+        ieee80211_iterate_active_interfaces(rt2x00dev->hw,
+                                            rt2x00lib_intf_scheduled_iter,
+                                            rt2x00dev);
 }
 
 /*
  * Interrupt context handlers.
  */
-static void rt2x00lib_beacondone_scheduled(struct work_struct *work)
+static void rt2x00lib_beacondone_iter(void *data, u8 *mac,
+                                      struct ieee80211_vif *vif)
 {
-        struct rt2x00_dev *rt2x00dev =
-            container_of(work, struct rt2x00_dev, beacon_work);
-        struct data_ring *ring =
-            rt2x00lib_get_ring(rt2x00dev, IEEE80211_TX_QUEUE_BEACON);
-        struct data_entry *entry = rt2x00_get_data_entry(ring);
-        struct sk_buff *skb;
+        struct rt2x00_intf *intf = vif_to_intf(vif);
 
-        skb = ieee80211_beacon_get(rt2x00dev->hw,
-                                   rt2x00dev->interface.id,
-                                   &entry->tx_status.control);
-        if (!skb)
+        if (vif->type != IEEE80211_IF_TYPE_AP &&
+            vif->type != IEEE80211_IF_TYPE_IBSS)
                 return;
 
-        rt2x00dev->ops->hw->beacon_update(rt2x00dev->hw, skb,
-                                          &entry->tx_status.control);
-
-        dev_kfree_skb(skb);
+        spin_lock(&intf->lock);
+        intf->delayed_flags |= DELAYED_UPDATE_BEACON;
+        spin_unlock(&intf->lock);
 }
 
 void rt2x00lib_beacondone(struct rt2x00_dev *rt2x00dev)
@@ -526,89 +488,107 @@ void rt2x00lib_beacondone(struct rt2x00_dev *rt2x00dev)
         if (!test_bit(DEVICE_ENABLED_RADIO, &rt2x00dev->flags))
                 return;
 
-        queue_work(rt2x00dev->hw->workqueue, &rt2x00dev->beacon_work);
+        ieee80211_iterate_active_interfaces(rt2x00dev->hw,
+                                            rt2x00lib_beacondone_iter,
+                                            rt2x00dev);
+
+        queue_work(rt2x00dev->hw->workqueue, &rt2x00dev->intf_work);
 }
 EXPORT_SYMBOL_GPL(rt2x00lib_beacondone);
 
-void rt2x00lib_txdone(struct data_entry *entry,
-                      const int status, const int retry)
+void rt2x00lib_txdone(struct queue_entry *entry,
+                      struct txdone_entry_desc *txdesc)
 {
-        struct rt2x00_dev *rt2x00dev = entry->ring->rt2x00dev;
-        struct ieee80211_tx_status *tx_status = &entry->tx_status;
-        struct ieee80211_low_level_stats *stats = &rt2x00dev->low_level_stats;
-        int success = !!(status == TX_SUCCESS || status == TX_SUCCESS_RETRY);
-        int fail = !!(status == TX_FAIL_RETRY || status == TX_FAIL_INVALID ||
-                      status == TX_FAIL_OTHER);
+        struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
+        struct skb_frame_desc *skbdesc;
+        struct ieee80211_tx_status tx_status;
+        int success = !!(txdesc->status == TX_SUCCESS ||
+                         txdesc->status == TX_SUCCESS_RETRY);
+        int fail = !!(txdesc->status == TX_FAIL_RETRY ||
+                      txdesc->status == TX_FAIL_INVALID ||
+                      txdesc->status == TX_FAIL_OTHER);
 
         /*
          * Update TX statistics.
          */
-        tx_status->flags = 0;
-        tx_status->ack_signal = 0;
-        tx_status->excessive_retries = (status == TX_FAIL_RETRY);
-        tx_status->retry_count = retry;
         rt2x00dev->link.qual.tx_success += success;
-        rt2x00dev->link.qual.tx_failed += retry + fail;
+        rt2x00dev->link.qual.tx_failed += txdesc->retry + fail;
+
+        /*
+         * Initialize TX status
+         */
+        tx_status.flags = 0;
+        tx_status.ack_signal = 0;
+        tx_status.excessive_retries = (txdesc->status == TX_FAIL_RETRY);
+        tx_status.retry_count = txdesc->retry;
+        memcpy(&tx_status.control, txdesc->control, sizeof(txdesc->control));
 
-        if (!(tx_status->control.flags & IEEE80211_TXCTL_NO_ACK)) {
+        if (!(tx_status.control.flags & IEEE80211_TXCTL_NO_ACK)) {
                 if (success)
-                        tx_status->flags |= IEEE80211_TX_STATUS_ACK;
+                        tx_status.flags |= IEEE80211_TX_STATUS_ACK;
                 else
-                        stats->dot11ACKFailureCount++;
+                        rt2x00dev->low_level_stats.dot11ACKFailureCount++;
         }
 
-        tx_status->queue_length = entry->ring->stats.limit;
-        tx_status->queue_number = tx_status->control.queue;
+        tx_status.queue_length = entry->queue->limit;
+        tx_status.queue_number = tx_status.control.queue;
 
-        if (tx_status->control.flags & IEEE80211_TXCTL_USE_RTS_CTS) {
+        if (tx_status.control.flags & IEEE80211_TXCTL_USE_RTS_CTS) {
                 if (success)
-                        stats->dot11RTSSuccessCount++;
+                        rt2x00dev->low_level_stats.dot11RTSSuccessCount++;
                 else
-                        stats->dot11RTSFailureCount++;
+                        rt2x00dev->low_level_stats.dot11RTSFailureCount++;
         }
 
         /*
-         * Send the tx_status to mac80211 & debugfs.
-         * mac80211 will clean up the skb structure.
+         * Send the tx_status to debugfs. Only send the status report
+         * to mac80211 when the frame originated from there. If this was
+         * a extra frame coming through a mac80211 library call (RTS/CTS)
+         * then we should not send the status report back.
+         * If send to mac80211, mac80211 will clean up the skb structure,
+         * otherwise we have to do it ourself.
          */
-        get_skb_desc(entry->skb)->frame_type = DUMP_FRAME_TXDONE;
+        skbdesc = get_skb_frame_desc(entry->skb);
+        skbdesc->frame_type = DUMP_FRAME_TXDONE;
+
         rt2x00debug_dump_frame(rt2x00dev, entry->skb);
-        ieee80211_tx_status_irqsafe(rt2x00dev->hw, entry->skb, tx_status);
+
+        if (!(skbdesc->flags & FRAME_DESC_DRIVER_GENERATED))
+                ieee80211_tx_status_irqsafe(rt2x00dev->hw,
+                                            entry->skb, &tx_status);
+        else
+                dev_kfree_skb(entry->skb);
         entry->skb = NULL;
 }
 EXPORT_SYMBOL_GPL(rt2x00lib_txdone);
 
-void rt2x00lib_rxdone(struct data_entry *entry, struct sk_buff *skb,
-                      struct rxdata_entry_desc *desc)
+void rt2x00lib_rxdone(struct queue_entry *entry,
+                      struct rxdone_entry_desc *rxdesc)
 {
-        struct rt2x00_dev *rt2x00dev = entry->ring->rt2x00dev;
+        struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
         struct ieee80211_rx_status *rx_status = &rt2x00dev->rx_status;
-        struct ieee80211_hw_mode *mode;
-        struct ieee80211_rate *rate;
+        struct ieee80211_supported_band *sband;
         struct ieee80211_hdr *hdr;
+        const struct rt2x00_rate *rate;
         unsigned int i;
-        int val = 0;
+        int idx = -1;
         u16 fc;
 
         /*
          * Update RX statistics.
          */
-        mode = &rt2x00dev->hwmodes[rt2x00dev->curr_hwmode];
-        for (i = 0; i < mode->num_rates; i++) {
-                rate = &mode->rates[i];
+        sband = &rt2x00dev->bands[rt2x00dev->curr_band];
+        for (i = 0; i < sband->n_bitrates; i++) {
+                rate = rt2x00_get_rate(sband->bitrates[i].hw_value);
 
                 /*
                  * When frame was received with an OFDM bitrate,
                  * the signal is the PLCP value. If it was received with
-                 * a CCK bitrate the signal is the rate in 0.5kbit/s.
+                 * a CCK bitrate the signal is the rate in 100kbit/s.
                  */
-                if (!desc->ofdm)
-                        val = DEVICE_GET_RATE_FIELD(rate->val, RATE);
-                else
-                        val = DEVICE_GET_RATE_FIELD(rate->val, PLCP);
-
-                if (val == desc->signal) {
-                        val = rate->val;
+                if ((rxdesc->ofdm && rate->plcp == rxdesc->signal) ||
+                    (!rxdesc->ofdm && rate->bitrate == rxdesc->signal)) {
+                        idx = i;
                         break;
                 }
         }
@@ -616,26 +596,28 @@ void rt2x00lib_rxdone(struct data_entry *entry, struct sk_buff *skb,
         /*
          * Only update link status if this is a beacon frame carrying our bssid.
          */
-        hdr = (struct ieee80211_hdr*)skb->data;
+        hdr = (struct ieee80211_hdr *)entry->skb->data;
         fc = le16_to_cpu(hdr->frame_control);
-        if (is_beacon(fc) && desc->my_bss)
-                rt2x00lib_update_link_stats(&rt2x00dev->link, desc->rssi);
+        if (is_beacon(fc) && rxdesc->my_bss)
+                rt2x00lib_update_link_stats(&rt2x00dev->link, rxdesc->rssi);
 
         rt2x00dev->link.qual.rx_success++;
 
-        rx_status->rate = val;
+        rx_status->rate_idx = idx;
         rx_status->signal =
-            rt2x00lib_calculate_link_signal(rt2x00dev, desc->rssi);
-        rx_status->ssi = desc->rssi;
-        rx_status->flag = desc->flags;
+            rt2x00lib_calculate_link_signal(rt2x00dev, rxdesc->rssi);
+        rx_status->ssi = rxdesc->rssi;
+        rx_status->flag = rxdesc->flags;
         rx_status->antenna = rt2x00dev->link.ant.active.rx;
 
         /*
-         * Send frame to mac80211 & debugfs
+         * Send frame to mac80211 & debugfs.
+         * mac80211 will clean up the skb structure.
          */
-        get_skb_desc(skb)->frame_type = DUMP_FRAME_RXDONE;
-        rt2x00debug_dump_frame(rt2x00dev, skb);
-        ieee80211_rx_irqsafe(rt2x00dev->hw, skb, rx_status);
+        get_skb_frame_desc(entry->skb)->frame_type = DUMP_FRAME_RXDONE;
+        rt2x00debug_dump_frame(rt2x00dev, entry->skb);
+        ieee80211_rx_irqsafe(rt2x00dev->hw, entry->skb, rx_status);
+        entry->skb = NULL;
 }
 EXPORT_SYMBOL_GPL(rt2x00lib_rxdone);
 
@@ -646,83 +628,69 @@ void rt2x00lib_write_tx_desc(struct rt2x00_dev *rt2x00dev,
                              struct sk_buff *skb,
                              struct ieee80211_tx_control *control)
 {
-        struct txdata_entry_desc desc;
-        struct skb_desc *skbdesc = get_skb_desc(skb);
-        struct ieee80211_hdr *ieee80211hdr = skbdesc->data;
+        struct txentry_desc txdesc;
+        struct skb_frame_desc *skbdesc = get_skb_frame_desc(skb);
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+        const struct rt2x00_rate *rate;
         int tx_rate;
-        int bitrate;
         int length;
         int duration;
         int residual;
         u16 frame_control;
         u16 seq_ctrl;
 
-        memset(&desc, 0, sizeof(desc));
-
-        desc.cw_min = skbdesc->ring->tx_params.cw_min;
-        desc.cw_max = skbdesc->ring->tx_params.cw_max;
-        desc.aifs = skbdesc->ring->tx_params.aifs;
+        memset(&txdesc, 0, sizeof(txdesc));
 
-        /*
-         * Identify queue
-         */
-        if (control->queue < rt2x00dev->hw->queues)
-                desc.queue = control->queue;
-        else if (control->queue == IEEE80211_TX_QUEUE_BEACON ||
-                 control->queue == IEEE80211_TX_QUEUE_AFTER_BEACON)
-                desc.queue = QUEUE_MGMT;
-        else
-                desc.queue = QUEUE_OTHER;
+        txdesc.queue = skbdesc->entry->queue->qid;
+        txdesc.cw_min = skbdesc->entry->queue->cw_min;
+        txdesc.cw_max = skbdesc->entry->queue->cw_max;
+        txdesc.aifs = skbdesc->entry->queue->aifs;
 
         /*
          * Read required fields from ieee80211 header.
          */
-        frame_control = le16_to_cpu(ieee80211hdr->frame_control);
-        seq_ctrl = le16_to_cpu(ieee80211hdr->seq_ctrl);
+        frame_control = le16_to_cpu(hdr->frame_control);
+        seq_ctrl = le16_to_cpu(hdr->seq_ctrl);
 
-        tx_rate = control->tx_rate;
+        tx_rate = control->tx_rate->hw_value;
 
         /*
          * Check whether this frame is to be acked
          */
         if (!(control->flags & IEEE80211_TXCTL_NO_ACK))
-                __set_bit(ENTRY_TXD_ACK, &desc.flags);
+                __set_bit(ENTRY_TXD_ACK, &txdesc.flags);
 
         /*
          * Check if this is a RTS/CTS frame
          */
         if (is_rts_frame(frame_control) || is_cts_frame(frame_control)) {
-                __set_bit(ENTRY_TXD_BURST, &desc.flags);
+                __set_bit(ENTRY_TXD_BURST, &txdesc.flags);
                 if (is_rts_frame(frame_control)) {
-                        __set_bit(ENTRY_TXD_RTS_FRAME, &desc.flags);
-                        __set_bit(ENTRY_TXD_ACK, &desc.flags);
+                        __set_bit(ENTRY_TXD_RTS_FRAME, &txdesc.flags);
+                        __set_bit(ENTRY_TXD_ACK, &txdesc.flags);
                 } else
-                        __clear_bit(ENTRY_TXD_ACK, &desc.flags);
+                        __clear_bit(ENTRY_TXD_ACK, &txdesc.flags);
                 if (control->rts_cts_rate)
-                        tx_rate = control->rts_cts_rate;
+                        tx_rate = control->rts_cts_rate->hw_value;
         }
 
-        /*
-         * Check for OFDM
-         */
-        if (DEVICE_GET_RATE_FIELD(tx_rate, RATEMASK) & DEV_OFDM_RATEMASK)
-                __set_bit(ENTRY_TXD_OFDM_RATE, &desc.flags);
+        rate = rt2x00_get_rate(tx_rate);
 
         /*
          * Check if more fragments are pending
          */
-        if (ieee80211_get_morefrag(ieee80211hdr)) {
-                __set_bit(ENTRY_TXD_BURST, &desc.flags);
-                __set_bit(ENTRY_TXD_MORE_FRAG, &desc.flags);
+        if (ieee80211_get_morefrag(hdr)) {
+                __set_bit(ENTRY_TXD_BURST, &txdesc.flags);
+                __set_bit(ENTRY_TXD_MORE_FRAG, &txdesc.flags);
         }
 
         /*
          * Beacons and probe responses require the tsf timestamp
          * to be inserted into the frame.
          */
-        if (control->queue == IEEE80211_TX_QUEUE_BEACON ||
+        if (control->queue == RT2X00_BCN_QUEUE_BEACON ||
             is_probe_resp(frame_control))
-                __set_bit(ENTRY_TXD_REQ_TIMESTAMP, &desc.flags);
+                __set_bit(ENTRY_TXD_REQ_TIMESTAMP, &txdesc.flags);
 
         /*
          * Determine with what IFS priority this frame should be send.
@@ -730,30 +698,30 @@ void rt2x00lib_write_tx_desc(struct rt2x00_dev *rt2x00dev,
          * or this fragment came after RTS/CTS.
          */
         if ((seq_ctrl & IEEE80211_SCTL_FRAG) > 0 ||
-            test_bit(ENTRY_TXD_RTS_FRAME, &desc.flags))
-                desc.ifs = IFS_SIFS;
+            test_bit(ENTRY_TXD_RTS_FRAME, &txdesc.flags))
+                txdesc.ifs = IFS_SIFS;
         else
-                desc.ifs = IFS_BACKOFF;
+                txdesc.ifs = IFS_BACKOFF;
 
         /*
          * PLCP setup
          * Length calculation depends on OFDM/CCK rate.
          */
-        desc.signal = DEVICE_GET_RATE_FIELD(tx_rate, PLCP);
-        desc.service = 0x04;
+        txdesc.signal = rate->plcp;
+        txdesc.service = 0x04;
 
-        length = skbdesc->data_len + FCS_LEN;
-        if (test_bit(ENTRY_TXD_OFDM_RATE, &desc.flags)) {
-                desc.length_high = (length >> 6) & 0x3f;
-                desc.length_low = length & 0x3f;
-        } else {
-                bitrate = DEVICE_GET_RATE_FIELD(tx_rate, RATE);
+        length = skb->len + FCS_LEN;
+        if (rate->flags & DEV_RATE_OFDM) {
+                __set_bit(ENTRY_TXD_OFDM_RATE, &txdesc.flags);
 
+                txdesc.length_high = (length >> 6) & 0x3f;
+                txdesc.length_low = length & 0x3f;
+        } else {
                 /*
                  * Convert length to microseconds.
                  */
-                residual = get_duration_res(length, bitrate);
-                duration = get_duration(length, bitrate);
+                residual = get_duration_res(length, rate->bitrate);
+                duration = get_duration(length, rate->bitrate);
 
                 if (residual != 0) {
                         duration++;
@@ -761,28 +729,27 @@ void rt2x00lib_write_tx_desc(struct rt2x00_dev *rt2x00dev,
                         /*
                          * Check if we need to set the Length Extension
                          */
-                        if (bitrate == 110 && residual <= 30)
-                                desc.service |= 0x80;
+                        if (rate->bitrate == 110 && residual <= 30)
+                                txdesc.service |= 0x80;
                 }
 
-                desc.length_high = (duration >> 8) & 0xff;
-                desc.length_low = duration & 0xff;
+                txdesc.length_high = (duration >> 8) & 0xff;
+                txdesc.length_low = duration & 0xff;
 
                 /*
                  * When preamble is enabled we should set the
                  * preamble bit for the signal.
                  */
-                if (DEVICE_GET_RATE_FIELD(tx_rate, PREAMBLE))
-                        desc.signal |= 0x08;
+                if (rt2x00_get_rate_preamble(tx_rate))
+                        txdesc.signal |= 0x08;
         }
 
-        rt2x00dev->ops->lib->write_tx_desc(rt2x00dev, skb, &desc, control);
+        rt2x00dev->ops->lib->write_tx_desc(rt2x00dev, skb, &txdesc, control);
 
         /*
-         * Update ring entry.
+         * Update queue entry.
          */
         skbdesc->entry->skb = skb;
-        memcpy(&skbdesc->entry->tx_status.control, control, sizeof(*control));
 
         /*
          * The frame has been completely initialized and ready
@@ -798,133 +765,167 @@ EXPORT_SYMBOL_GPL(rt2x00lib_write_tx_desc);
 /*
  * Driver initialization handlers.
  */
+const struct rt2x00_rate rt2x00_supported_rates[12] = {
+        {
+                .flags = DEV_RATE_CCK,
+                .bitrate = 10,
+                .ratemask = DEV_RATEMASK_1MB,
+                .plcp = 0x00,
+        },
+        {
+                .flags = DEV_RATE_CCK | DEV_RATE_SHORT_PREAMBLE,
+                .bitrate = 20,
+                .ratemask = DEV_RATEMASK_2MB,
+                .plcp = 0x01,
+        },
+        {
+                .flags = DEV_RATE_CCK | DEV_RATE_SHORT_PREAMBLE,
+                .bitrate = 55,
+                .ratemask = DEV_RATEMASK_5_5MB,
+                .plcp = 0x02,
+        },
+        {
+                .flags = DEV_RATE_CCK | DEV_RATE_SHORT_PREAMBLE,
+                .bitrate = 110,
+                .ratemask = DEV_RATEMASK_11MB,
+                .plcp = 0x03,
+        },
+        {
+                .flags = DEV_RATE_OFDM,
+                .bitrate = 60,
+                .ratemask = DEV_RATEMASK_6MB,
+                .plcp = 0x0b,
+        },
+        {
+                .flags = DEV_RATE_OFDM,
+                .bitrate = 90,
+                .ratemask = DEV_RATEMASK_9MB,
+                .plcp = 0x0f,
+        },
+        {
+                .flags = DEV_RATE_OFDM,
+                .bitrate = 120,
+                .ratemask = DEV_RATEMASK_12MB,
+                .plcp = 0x0a,
+        },
+        {
+                .flags = DEV_RATE_OFDM,
+                .bitrate = 180,
+                .ratemask = DEV_RATEMASK_18MB,
+                .plcp = 0x0e,
+        },
+        {
+                .flags = DEV_RATE_OFDM,
+                .bitrate = 240,
+                .ratemask = DEV_RATEMASK_24MB,
+                .plcp = 0x09,
+        },
+        {
+                .flags = DEV_RATE_OFDM,
+                .bitrate = 360,
+                .ratemask = DEV_RATEMASK_36MB,
+                .plcp = 0x0d,
+        },
+        {
+                .flags = DEV_RATE_OFDM,
+                .bitrate = 480,
+                .ratemask = DEV_RATEMASK_48MB,
+                .plcp = 0x08,
+        },
+        {
+                .flags = DEV_RATE_OFDM,
+                .bitrate = 540,
+                .ratemask = DEV_RATEMASK_54MB,
+                .plcp = 0x0c,
+        },
+};
+
 static void rt2x00lib_channel(struct ieee80211_channel *entry,
                               const int channel, const int tx_power,
                               const int value)
 {
-        entry->chan = channel;
-        if (channel <= 14)
-                entry->freq = 2407 + (5 * channel);
-        else
-                entry->freq = 5000 + (5 * channel);
-        entry->val = value;
-        entry->flag =
-            IEEE80211_CHAN_W_IBSS |
-            IEEE80211_CHAN_W_ACTIVE_SCAN |
-            IEEE80211_CHAN_W_SCAN;
-        entry->power_level = tx_power;
-        entry->antenna_max = 0xff;
+        entry->center_freq = ieee80211_channel_to_frequency(channel);
+        entry->hw_value = value;
+        entry->max_power = tx_power;
+        entry->max_antenna_gain = 0xff;
 }
 
 static void rt2x00lib_rate(struct ieee80211_rate *entry,
-                           const int rate, const int mask,
-                           const int plcp, const int flags)
+                           const u16 index, const struct rt2x00_rate *rate)
 {
-        entry->rate = rate;
-        entry->val =
-            DEVICE_SET_RATE_FIELD(rate, RATE) |
-            DEVICE_SET_RATE_FIELD(mask, RATEMASK) |
-            DEVICE_SET_RATE_FIELD(plcp, PLCP);
-        entry->flags = flags;
-        entry->val2 = entry->val;
-        if (entry->flags & IEEE80211_RATE_PREAMBLE2)
-                entry->val2 |= DEVICE_SET_RATE_FIELD(1, PREAMBLE);
-        entry->min_rssi_ack = 0;
-        entry->min_rssi_ack_delta = 0;
+        entry->flags = 0;
+        entry->bitrate = rate->bitrate;
+        entry->hw_value = rt2x00_create_rate_hw_value(index, 0);
+        entry->hw_value_short = entry->hw_value;
+
+        if (rate->flags & DEV_RATE_SHORT_PREAMBLE) {
+                entry->flags |= IEEE80211_RATE_SHORT_PREAMBLE;
+                entry->hw_value_short |= rt2x00_create_rate_hw_value(index, 1);
+        }
 }
 
 static int rt2x00lib_probe_hw_modes(struct rt2x00_dev *rt2x00dev,
                                     struct hw_mode_spec *spec)
 {
         struct ieee80211_hw *hw = rt2x00dev->hw;
-        struct ieee80211_hw_mode *hwmodes;
         struct ieee80211_channel *channels;
         struct ieee80211_rate *rates;
+        unsigned int num_rates;
         unsigned int i;
         unsigned char tx_power;
 
-        hwmodes = kzalloc(sizeof(*hwmodes) * spec->num_modes, GFP_KERNEL);
-        if (!hwmodes)
-                goto exit;
+        num_rates = 0;
+        if (spec->supported_rates & SUPPORT_RATE_CCK)
+                num_rates += 4;
+        if (spec->supported_rates & SUPPORT_RATE_OFDM)
+                num_rates += 8;
 
         channels = kzalloc(sizeof(*channels) * spec->num_channels, GFP_KERNEL);
         if (!channels)
-                goto exit_free_modes;
+                return -ENOMEM;
 
-        rates = kzalloc(sizeof(*rates) * spec->num_rates, GFP_KERNEL);
+        rates = kzalloc(sizeof(*rates) * num_rates, GFP_KERNEL);
         if (!rates)
                 goto exit_free_channels;
 
         /*
          * Initialize Rate list.
          */
-        rt2x00lib_rate(&rates[0], 10, DEV_RATEMASK_1MB,
-                       0x00, IEEE80211_RATE_CCK);
-        rt2x00lib_rate(&rates[1], 20, DEV_RATEMASK_2MB,
-                       0x01, IEEE80211_RATE_CCK_2);
-        rt2x00lib_rate(&rates[2], 55, DEV_RATEMASK_5_5MB,
-                       0x02, IEEE80211_RATE_CCK_2);
-        rt2x00lib_rate(&rates[3], 110, DEV_RATEMASK_11MB,
-                       0x03, IEEE80211_RATE_CCK_2);
-
-        if (spec->num_rates > 4) {
-                rt2x00lib_rate(&rates[4], 60, DEV_RATEMASK_6MB,
-                               0x0b, IEEE80211_RATE_OFDM);
-                rt2x00lib_rate(&rates[5], 90, DEV_RATEMASK_9MB,
-                               0x0f, IEEE80211_RATE_OFDM);
-                rt2x00lib_rate(&rates[6], 120, DEV_RATEMASK_12MB,
-                               0x0a, IEEE80211_RATE_OFDM);
-                rt2x00lib_rate(&rates[7], 180, DEV_RATEMASK_18MB,
-                               0x0e, IEEE80211_RATE_OFDM);
-                rt2x00lib_rate(&rates[8], 240, DEV_RATEMASK_24MB,
-                               0x09, IEEE80211_RATE_OFDM);
-                rt2x00lib_rate(&rates[9], 360, DEV_RATEMASK_36MB,
-                               0x0d, IEEE80211_RATE_OFDM);
-                rt2x00lib_rate(&rates[10], 480, DEV_RATEMASK_48MB,
-                               0x08, IEEE80211_RATE_OFDM);
-                rt2x00lib_rate(&rates[11], 540, DEV_RATEMASK_54MB,
-                               0x0c, IEEE80211_RATE_OFDM);
-        }
+        for (i = 0; i < num_rates; i++)
+                rt2x00lib_rate(&rates[i], i, rt2x00_get_rate(i));
 
         /*
          * Initialize Channel list.
          */
         for (i = 0; i < spec->num_channels; i++) {
-                if (spec->channels[i].channel <= 14)
-                        tx_power = spec->tx_power_bg[i];
-                else if (spec->tx_power_a)
-                        tx_power = spec->tx_power_a[i];
-                else
-                        tx_power = spec->tx_power_default;
+                if (spec->channels[i].channel <= 14) {
+                        if (spec->tx_power_bg)
+                                tx_power = spec->tx_power_bg[i];
+                        else
+                                tx_power = spec->tx_power_default;
+                } else {
+                        if (spec->tx_power_a)
+                                tx_power = spec->tx_power_a[i];
+                        else
+                                tx_power = spec->tx_power_default;
+                }
 
                 rt2x00lib_channel(&channels[i],
                                   spec->channels[i].channel, tx_power, i);
         }
 
         /*
-         * Intitialize 802.11b
-         * Rates: CCK.
-         * Channels: OFDM.
-         */
-        if (spec->num_modes > HWMODE_B) {
-                hwmodes[HWMODE_B].mode = MODE_IEEE80211B;
-                hwmodes[HWMODE_B].num_channels = 14;
-                hwmodes[HWMODE_B].num_rates = 4;
-                hwmodes[HWMODE_B].channels = channels;
-                hwmodes[HWMODE_B].rates = rates;
-        }
-
-        /*
-         * Intitialize 802.11g
+         * Intitialize 802.11b, 802.11g
          * Rates: CCK, OFDM.
-         * Channels: OFDM.
-         */
-        if (spec->num_modes > HWMODE_G) {
-                hwmodes[HWMODE_G].mode = MODE_IEEE80211G;
-                hwmodes[HWMODE_G].num_channels = 14;
-                hwmodes[HWMODE_G].num_rates = spec->num_rates;
-                hwmodes[HWMODE_G].channels = channels;
-                hwmodes[HWMODE_G].rates = rates;
+         * Channels: 2.4 GHz
+         */
+        if (spec->supported_bands & SUPPORT_BAND_2GHZ) {
+                rt2x00dev->bands[IEEE80211_BAND_2GHZ].n_channels = 14;
+                rt2x00dev->bands[IEEE80211_BAND_2GHZ].n_bitrates = num_rates;
+                rt2x00dev->bands[IEEE80211_BAND_2GHZ].channels = channels;
+                rt2x00dev->bands[IEEE80211_BAND_2GHZ].bitrates = rates;
+                hw->wiphy->bands[IEEE80211_BAND_2GHZ] =
+                    &rt2x00dev->bands[IEEE80211_BAND_2GHZ];
         }
 
         /*
@@ -932,40 +933,21 @@ static int rt2x00lib_probe_hw_modes(struct rt2x00_dev *rt2x00dev,
          * Rates: OFDM.
          * Channels: OFDM, UNII, HiperLAN2.
          */
-        if (spec->num_modes > HWMODE_A) {
-                hwmodes[HWMODE_A].mode = MODE_IEEE80211A;
-                hwmodes[HWMODE_A].num_channels = spec->num_channels - 14;
-                hwmodes[HWMODE_A].num_rates = spec->num_rates - 4;
-                hwmodes[HWMODE_A].channels = &channels[14];
-                hwmodes[HWMODE_A].rates = &rates[4];
+        if (spec->supported_bands & SUPPORT_BAND_5GHZ) {
+                rt2x00dev->bands[IEEE80211_BAND_5GHZ].n_channels =
+                    spec->num_channels - 14;
+                rt2x00dev->bands[IEEE80211_BAND_5GHZ].n_bitrates =
+                    num_rates - 4;
+                rt2x00dev->bands[IEEE80211_BAND_5GHZ].channels = &channels[14];
+                rt2x00dev->bands[IEEE80211_BAND_5GHZ].bitrates = &rates[4];
+                hw->wiphy->bands[IEEE80211_BAND_5GHZ] =
+                    &rt2x00dev->bands[IEEE80211_BAND_5GHZ];
         }
 
-        if (spec->num_modes > HWMODE_G &&
-            ieee80211_register_hwmode(hw, &hwmodes[HWMODE_G]))
-                goto exit_free_rates;
-
-        if (spec->num_modes > HWMODE_B &&
-            ieee80211_register_hwmode(hw, &hwmodes[HWMODE_B]))
-                goto exit_free_rates;
-
-        if (spec->num_modes > HWMODE_A &&
-            ieee80211_register_hwmode(hw, &hwmodes[HWMODE_A]))
-                goto exit_free_rates;
-
-        rt2x00dev->hwmodes = hwmodes;
-
         return 0;
 
-exit_free_rates:
-        kfree(rates);
-
-exit_free_channels:
+ exit_free_channels:
         kfree(channels);
-
-exit_free_modes:
-        kfree(hwmodes);
-
-exit:
         ERROR(rt2x00dev, "Allocation ieee80211 modes failed.\n");
         return -ENOMEM;
 }
@@ -975,11 +957,11 @@ static void rt2x00lib_remove_hw(struct rt2x00_dev *rt2x00dev)
         if (test_bit(DEVICE_REGISTERED_HW, &rt2x00dev->flags))
                 ieee80211_unregister_hw(rt2x00dev->hw);
 
-        if (likely(rt2x00dev->hwmodes)) {
-                kfree(rt2x00dev->hwmodes->channels);
-                kfree(rt2x00dev->hwmodes->rates);
-                kfree(rt2x00dev->hwmodes);
-                rt2x00dev->hwmodes = NULL;
+        if (likely(rt2x00dev->hw->wiphy->bands[IEEE80211_BAND_2GHZ])) {
+                kfree(rt2x00dev->hw->wiphy->bands[IEEE80211_BAND_2GHZ]->channels);
+                kfree(rt2x00dev->hw->wiphy->bands[IEEE80211_BAND_2GHZ]->bitrates);
+                rt2x00dev->hw->wiphy->bands[IEEE80211_BAND_2GHZ] = NULL;
+                rt2x00dev->hw->wiphy->bands[IEEE80211_BAND_5GHZ] = NULL;
         }
 }
 
@@ -1012,86 +994,6 @@ static int rt2x00lib_probe_hw(struct rt2x00_dev *rt2x00dev)
 /*
  * Initialization/uninitialization handlers.
  */
-static int rt2x00lib_alloc_entries(struct data_ring *ring,
-                                   const u16 max_entries, const u16 data_size,
-                                   const u16 desc_size)
-{
-        struct data_entry *entry;
-        unsigned int i;
-
-        ring->stats.limit = max_entries;
-        ring->data_size = data_size;
-        ring->desc_size = desc_size;
-
-        /*
-         * Allocate all ring entries.
-         */
-        entry = kzalloc(ring->stats.limit * sizeof(*entry), GFP_KERNEL);
-        if (!entry)
-                return -ENOMEM;
-
-        for (i = 0; i < ring->stats.limit; i++) {
-                entry[i].flags = 0;
-                entry[i].ring = ring;
-                entry[i].skb = NULL;
-                entry[i].entry_idx = i;
-        }
-
-        ring->entry = entry;
-
-        return 0;
-}
-
-static int rt2x00lib_alloc_ring_entries(struct rt2x00_dev *rt2x00dev)
-{
-        struct data_ring *ring;
-
-        /*
-         * Allocate the RX ring.
-         */
-        if (rt2x00lib_alloc_entries(rt2x00dev->rx, RX_ENTRIES, DATA_FRAME_SIZE,
-                                    rt2x00dev->ops->rxd_size))
-                return -ENOMEM;
-
-        /*
-         * First allocate the TX rings.
-         */
-        txring_for_each(rt2x00dev, ring) {
-                if (rt2x00lib_alloc_entries(ring, TX_ENTRIES, DATA_FRAME_SIZE,
-                                            rt2x00dev->ops->txd_size))
-                        return -ENOMEM;
-        }
-
-        if (!test_bit(DRIVER_REQUIRE_BEACON_RING, &rt2x00dev->flags))
-                return 0;
-
-        /*
-         * Allocate the BEACON ring.
-         */
-        if (rt2x00lib_alloc_entries(&rt2x00dev->bcn[0], BEACON_ENTRIES,
-                                    MGMT_FRAME_SIZE, rt2x00dev->ops->txd_size))
-                return -ENOMEM;
-
-        /*
-         * Allocate the Atim ring.
-         */
-        if (rt2x00lib_alloc_entries(&rt2x00dev->bcn[1], ATIM_ENTRIES,
-                                    DATA_FRAME_SIZE, rt2x00dev->ops->txd_size))
-                return -ENOMEM;
-
-        return 0;
-}
-
-static void rt2x00lib_free_ring_entries(struct rt2x00_dev *rt2x00dev)
-{
-        struct data_ring *ring;
-
-        ring_for_each(rt2x00dev, ring) {
-                kfree(ring->entry);
-                ring->entry = NULL;
-        }
-}
-
 static void rt2x00lib_uninitialize(struct rt2x00_dev *rt2x00dev)
 {
         if (!__test_and_clear_bit(DEVICE_INITIALIZED, &rt2x00dev->flags))
@@ -1108,9 +1010,9 @@ static void rt2x00lib_uninitialize(struct rt2x00_dev *rt2x00dev)
         rt2x00dev->ops->lib->uninitialize(rt2x00dev);
 
         /*
-         * Free allocated ring entries.
+         * Free allocated queue entries.
          */
-        rt2x00lib_free_ring_entries(rt2x00dev);
+        rt2x00queue_uninitialize(rt2x00dev);
 }
 
 static int rt2x00lib_initialize(struct rt2x00_dev *rt2x00dev)
@@ -1121,13 +1023,11 @@ static int rt2x00lib_initialize(struct rt2x00_dev *rt2x00dev)
                 return 0;
 
         /*
-         * Allocate all ring entries.
+         * Allocate all queue entries.
          */
-        status = rt2x00lib_alloc_ring_entries(rt2x00dev);
-        if (status) {
-                ERROR(rt2x00dev, "Ring entries allocation failed.\n");
+        status = rt2x00queue_initialize(rt2x00dev);
+        if (status)
                 return status;
-        }
 
         /*
          * Initialize the device.
@@ -1143,15 +1043,12 @@ static int rt2x00lib_initialize(struct rt2x00_dev *rt2x00dev)
          */
         status = rt2x00rfkill_register(rt2x00dev);
         if (status)
-                goto exit_unitialize;
+                goto exit;
 
         return 0;
 
-exit_unitialize:
-        rt2x00lib_uninitialize(rt2x00dev);
-
 exit:
-        rt2x00lib_free_ring_entries(rt2x00dev);
+        rt2x00lib_uninitialize(rt2x00dev);
 
         return status;
 }
@@ -1167,11 +1064,9 @@ int rt2x00lib_start(struct rt2x00_dev *rt2x00dev)
          * If this is the first interface which is added,
          * we should load the firmware now.
          */
-        if (test_bit(DRIVER_REQUIRE_FIRMWARE, &rt2x00dev->flags)) {
-                retval = rt2x00lib_load_firmware(rt2x00dev);
-                if (retval)
-                        return retval;
-        }
+        retval = rt2x00lib_load_firmware(rt2x00dev);
+        if (retval)
+                return retval;
 
         /*
          * Initialize the device.
@@ -1189,6 +1084,10 @@ int rt2x00lib_start(struct rt2x00_dev *rt2x00dev)
                 return retval;
         }
 
+        rt2x00dev->intf_ap_count = 0;
+        rt2x00dev->intf_sta_count = 0;
+        rt2x00dev->intf_associated = 0;
+
         __set_bit(DEVICE_STARTED, &rt2x00dev->flags);
 
         return 0;
@@ -1205,74 +1104,25 @@ void rt2x00lib_stop(struct rt2x00_dev *rt2x00dev)
          */
         rt2x00lib_disable_radio(rt2x00dev);
 
+        rt2x00dev->intf_ap_count = 0;
+        rt2x00dev->intf_sta_count = 0;
+        rt2x00dev->intf_associated = 0;
+
         __clear_bit(DEVICE_STARTED, &rt2x00dev->flags);
 }
 
 /*
  * driver allocation handlers.
  */
-static int rt2x00lib_alloc_rings(struct rt2x00_dev *rt2x00dev)
+int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev)
 {
-        struct data_ring *ring;
-        unsigned int index;
-
-        /*
-         * We need the following rings:
-         * RX: 1
-         * TX: hw->queues
-         * Beacon: 1 (if required)
-         * Atim: 1 (if required)
-         */
-        rt2x00dev->data_rings = 1 + rt2x00dev->hw->queues +
-            (2 * test_bit(DRIVER_REQUIRE_BEACON_RING, &rt2x00dev->flags));
-
-        ring = kzalloc(rt2x00dev->data_rings * sizeof(*ring), GFP_KERNEL);
-        if (!ring) {
-                ERROR(rt2x00dev, "Ring allocation failed.\n");
-                return -ENOMEM;
-        }
-
-        /*
-         * Initialize pointers
-         */
-        rt2x00dev->rx = ring;
-        rt2x00dev->tx = &rt2x00dev->rx[1];
-        if (test_bit(DRIVER_REQUIRE_BEACON_RING, &rt2x00dev->flags))
-                rt2x00dev->bcn = &rt2x00dev->tx[rt2x00dev->hw->queues];
+        int retval = -ENOMEM;
 
         /*
-         * Initialize ring parameters.
-         * RX: queue_idx = 0
-         * TX: queue_idx = IEEE80211_TX_QUEUE_DATA0 + index
-         * TX: cw_min: 2^5 = 32.
-         * TX: cw_max: 2^10 = 1024.
+         * Make room for rt2x00_intf inside the per-interface
+         * structure ieee80211_vif.
          */
-        rt2x00dev->rx->rt2x00dev = rt2x00dev;
-        rt2x00dev->rx->queue_idx = 0;
-
-        index = IEEE80211_TX_QUEUE_DATA0;
-        txring_for_each(rt2x00dev, ring) {
-                ring->rt2x00dev = rt2x00dev;
-                ring->queue_idx = index++;
-                ring->tx_params.aifs = 2;
-                ring->tx_params.cw_min = 5;
-                ring->tx_params.cw_max = 10;
-        }
-
-        return 0;
-}
-
-static void rt2x00lib_free_rings(struct rt2x00_dev *rt2x00dev)
-{
-        kfree(rt2x00dev->rx);
-        rt2x00dev->rx = NULL;
-        rt2x00dev->tx = NULL;
-        rt2x00dev->bcn = NULL;
-}
-
-int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev)
-{
-        int retval = -ENOMEM;
+        rt2x00dev->hw->vif_data_size = sizeof(struct rt2x00_intf);
 
         /*
          * Let the driver probe the device to detect the capabilities.
@@ -1286,20 +1136,14 @@ int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev)
         /*
          * Initialize configuration work.
          */
-        INIT_WORK(&rt2x00dev->beacon_work, rt2x00lib_beacondone_scheduled);
+        INIT_WORK(&rt2x00dev->intf_work, rt2x00lib_intf_scheduled);
         INIT_WORK(&rt2x00dev->filter_work, rt2x00lib_packetfilter_scheduled);
-        INIT_WORK(&rt2x00dev->config_work, rt2x00lib_configuration_scheduled);
         INIT_DELAYED_WORK(&rt2x00dev->link.work, rt2x00lib_link_tuner);
 
         /*
-         * Reset current working type.
-         */
-        rt2x00dev->interface.type = IEEE80211_IF_TYPE_INVALID;
-
-        /*
-         * Allocate ring array.
+         * Allocate queue array.
          */
-        retval = rt2x00lib_alloc_rings(rt2x00dev);
+        retval = rt2x00queue_allocate(rt2x00dev);
         if (retval)
                 goto exit;
 
@@ -1313,6 +1157,11 @@ int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev)
         }
 
         /*
+         * Register LED.
+         */
+        rt2x00leds_register(rt2x00dev);
+
+        /*
          * Allocatie rfkill.
          */
         retval = rt2x00rfkill_allocate(rt2x00dev);
@@ -1360,6 +1209,11 @@ void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev)
         rt2x00rfkill_free(rt2x00dev);
 
         /*
+         * Free LED.
+         */
+        rt2x00leds_unregister(rt2x00dev);
+
+        /*
          * Free ieee80211_hw memory.
          */
         rt2x00lib_remove_hw(rt2x00dev);
@@ -1370,9 +1224,9 @@ void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev)
         rt2x00lib_free_firmware(rt2x00dev);
 
         /*
-         * Free ring structures.
+         * Free queue structures.
          */
-        rt2x00lib_free_rings(rt2x00dev);
+        rt2x00queue_free(rt2x00dev);
 }
 EXPORT_SYMBOL_GPL(rt2x00lib_remove_dev);
 
@@ -1400,6 +1254,7 @@ int rt2x00lib_suspend(struct rt2x00_dev *rt2x00dev, pm_message_t state)
          */
         rt2x00lib_stop(rt2x00dev);
         rt2x00lib_uninitialize(rt2x00dev);
+        rt2x00leds_suspend(rt2x00dev);
         rt2x00debug_deregister(rt2x00dev);
 
 exit:
@@ -1414,17 +1269,39 @@ exit:
 }
 EXPORT_SYMBOL_GPL(rt2x00lib_suspend);
 
+static void rt2x00lib_resume_intf(void *data, u8 *mac,
+                                  struct ieee80211_vif *vif)
+{
+        struct rt2x00_dev *rt2x00dev = data;
+        struct rt2x00_intf *intf = vif_to_intf(vif);
+
+        spin_lock(&intf->lock);
+
+        rt2x00lib_config_intf(rt2x00dev, intf,
+                              vif->type, intf->mac, intf->bssid);
+
+
+        /*
+         * Master or Ad-hoc mode require a new beacon update.
+         */
+        if (vif->type == IEEE80211_IF_TYPE_AP ||
+            vif->type == IEEE80211_IF_TYPE_IBSS)
+                intf->delayed_flags |= DELAYED_UPDATE_BEACON;
+
+        spin_unlock(&intf->lock);
+}
+
 int rt2x00lib_resume(struct rt2x00_dev *rt2x00dev)
 {
-        struct interface *intf = &rt2x00dev->interface;
         int retval;
 
         NOTICE(rt2x00dev, "Waking up.\n");
 
         /*
-         * Open the debugfs entry.
+         * Open the debugfs entry and restore led handling.
          */
         rt2x00debug_register(rt2x00dev);
+        rt2x00leds_resume(rt2x00dev);
 
         /*
          * Only continue if mac80211 had open interfaces.
@@ -1446,9 +1323,12 @@ int rt2x00lib_resume(struct rt2x00_dev *rt2x00dev)
         if (!rt2x00dev->hw->conf.radio_enabled)
                 rt2x00lib_disable_radio(rt2x00dev);
 
-        rt2x00lib_config_mac_addr(rt2x00dev, intf->mac);
-        rt2x00lib_config_bssid(rt2x00dev, intf->bssid);
-        rt2x00lib_config_type(rt2x00dev, intf->type);
+        /*
+         * Iterator over each active interface to
+         * reconfigure the hardware.
+         */
+        ieee80211_iterate_active_interfaces(rt2x00dev->hw,
+                                            rt2x00lib_resume_intf, rt2x00dev);
 
         /*
          * We are ready again to receive requests from mac80211.
@@ -1464,12 +1344,11 @@ int rt2x00lib_resume(struct rt2x00_dev *rt2x00dev)
         ieee80211_start_queues(rt2x00dev->hw);
 
         /*
-         * When in Master or Ad-hoc mode,
-         * restart Beacon transmitting by faking a beacondone event.
+         * During interface iteration we might have changed the
+         * delayed_flags, time to handles the event by calling
+         * the work handler directly.
          */
-        if (intf->type == IEEE80211_IF_TYPE_AP ||
-            intf->type == IEEE80211_IF_TYPE_IBSS)
-                rt2x00lib_beacondone(rt2x00dev);
+        rt2x00lib_intf_scheduled(&rt2x00dev->intf_work);
 
         return 0;
 
diff --git a/drivers/net/wireless/rt2x00/rt2x00dump.h b/drivers/net/wireless/rt2x00/rt2x00dump.h
index 99f3f367adce..7169c222a486 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dump.h
+++ b/drivers/net/wireless/rt2x00/rt2x00dump.h
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2007 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2008 rt2x00 SourceForge Project
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
@@ -93,8 +93,8 @@ enum rt2x00_dump_type {
  * @chip_rf: RF chipset
  * @chip_rev: Chipset revision
  * @type: The frame type (&rt2x00_dump_type)
- * @ring_index: The index number of the data ring.
- * @entry_index: The index number of the entry inside the data ring.
+ * @queue_index: The index number of the data queue.
+ * @entry_index: The index number of the entry inside the data queue.
  * @timestamp_sec: Timestamp - seconds
  * @timestamp_usec: Timestamp - microseconds
  */
@@ -111,7 +111,7 @@ struct rt2x00dump_hdr {
         __le32 chip_rev;
 
         __le16 type;
-        __u8 ring_index;
+        __u8 queue_index;
         __u8 entry_index;
 
         __le32 timestamp_sec;
diff --git a/drivers/net/wireless/rt2x00/rt2x00firmware.c b/drivers/net/wireless/rt2x00/rt2x00firmware.c
index 0a475e4e2442..4f9fe56f4f2e 100644
--- a/drivers/net/wireless/rt2x00/rt2x00firmware.c
+++ b/drivers/net/wireless/rt2x00/rt2x00firmware.c
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2007 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2008 rt2x00 SourceForge Project
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
@@ -23,6 +23,7 @@
         Abstract: rt2x00 firmware loading routines.
  */
 
+#include <linux/crc-ccitt.h>
 #include <linux/crc-itu-t.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
@@ -37,7 +38,6 @@ static int rt2x00lib_request_firmware(struct rt2x00_dev *rt2x00dev)
         char *fw_name;
         int retval;
         u16 crc;
-        u16 tmp;
 
         /*
          * Read correct firmware from harddisk.
@@ -64,17 +64,37 @@ static int rt2x00lib_request_firmware(struct rt2x00_dev *rt2x00dev)
         }
 
         /*
-         * Validate the firmware using 16 bit CRC.
-         * The last 2 bytes of the firmware are the CRC
-         * so substract those 2 bytes from the CRC checksum,
-         * and set those 2 bytes to 0 when calculating CRC.
+         * Perform crc validation on the firmware.
+         * The last 2 bytes in the firmware array are the crc checksum itself,
+         * this means that we should never pass those 2 bytes to the crc
+         * algorithm.
          */
-        tmp = 0;
-        crc = crc_itu_t(0, fw->data, fw->size - 2);
-        crc = crc_itu_t(crc, (u8 *)&tmp, 2);
+        if (test_bit(DRIVER_REQUIRE_FIRMWARE_CRC_ITU_T, &rt2x00dev->flags)) {
+                /*
+                 * Use the crc itu-t algorithm.
+                 * Use 0 for the last 2 bytes to complete the checksum.
+                 */
+                crc = crc_itu_t(0, fw->data, fw->size - 2);
+                crc = crc_itu_t_byte(crc, 0);
+                crc = crc_itu_t_byte(crc, 0);
+        } else if (test_bit(DRIVER_REQUIRE_FIRMWARE_CCITT, &rt2x00dev->flags)) {
+                /*
+                 * Use the crc ccitt algorithm.
+                 * This will return the same value as the legacy driver which
+                 * used bit ordering reversion on the both the firmware bytes
+                 * before input input as well as on the final output.
+                 * Obviously using crc ccitt directly is much more efficient.
+                 */
+                crc = crc_ccitt(~0, fw->data, fw->size - 2);
+        } else {
+                ERROR(rt2x00dev, "No checksum algorithm selected "
+                      "for firmware validation.\n");
+                retval = -ENOENT;
+                goto exit;
+        }
 
         if (crc != (fw->data[fw->size - 2] << 8 | fw->data[fw->size - 1])) {
-                ERROR(rt2x00dev, "Firmware CRC error.\n");
+                ERROR(rt2x00dev, "Firmware checksum error.\n");
                 retval = -ENOENT;
                 goto exit;
         }
@@ -96,6 +116,9 @@ int rt2x00lib_load_firmware(struct rt2x00_dev *rt2x00dev)
 {
         int retval;
 
+        if (!test_bit(DRIVER_REQUIRE_FIRMWARE, &rt2x00dev->flags))
+                return 0;
+
         if (!rt2x00dev->fw) {
                 retval = rt2x00lib_request_firmware(rt2x00dev);
                 if (retval)
diff --git a/drivers/net/wireless/rt2x00/rt2x00leds.c b/drivers/net/wireless/rt2x00/rt2x00leds.c
new file mode 100644
index 000000000000..9c29d17e0cc2
--- /dev/null
+++ b/drivers/net/wireless/rt2x00/rt2x00leds.c
@@ -0,0 +1,217 @@
+/*
+        Copyright (C) 2004 - 2008 rt2x00 SourceForge Project
+        <http://rt2x00.serialmonkey.com>
+
+        This program is free software; you can redistribute it and/or modify
+        it under the terms of the GNU General Public License as published by
+        the Free Software Foundation; either version 2 of the License, or
+        (at your option) any later version.
+
+        This program is distributed in the hope that it will be useful,
+        but WITHOUT ANY WARRANTY; without even the implied warranty of
+        MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+        GNU General Public License for more details.
+
+        You should have received a copy of the GNU General Public License
+        along with this program; if not, write to the
+        Free Software Foundation, Inc.,
+        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+/*
+        Module: rt2x00lib
+        Abstract: rt2x00 led specific routines.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+
+#include "rt2x00.h"
+#include "rt2x00lib.h"
+
+void rt2x00leds_led_quality(struct rt2x00_dev *rt2x00dev, int rssi)
+{
+        if (!rt2x00dev->trigger_qual.registered)
+                return;
+
+        /*
+         * Led handling requires a positive value for the rssi,
+         * to do that correctly we need to add the correction.
+         */
+        rssi += rt2x00dev->rssi_offset;
+
+        /*
+         * Get the rssi level, this is used to convert the rssi
+         * to a LED value inside the range LED_OFF - LED_FULL.
+         */
+        if (rssi <= 30)
+                rssi = 0;
+        else if (rssi <= 39)
+                rssi = 1;
+        else if (rssi <= 49)
+                rssi = 2;
+        else if (rssi <= 53)
+                rssi = 3;
+        else if (rssi <= 63)
+                rssi = 4;
+        else
+                rssi = 5;
+
+        /*
+         * Note that we must _not_ send LED_OFF since the driver
+         * is going to calculate the value and might use it in a
+         * division.
+         */
+        led_trigger_event(&rt2x00dev->trigger_qual.trigger,
+                          ((LED_FULL / 6) * rssi) + 1);
+}
+
+static int rt2x00leds_register_trigger(struct rt2x00_dev *rt2x00dev,
+                                       struct rt2x00_trigger *trigger,
+                                       const char *name)
+{
+        int retval;
+
+        trigger->trigger.name = name;
+        retval = led_trigger_register(&trigger->trigger);
+        if (retval) {
+                ERROR(rt2x00dev, "Failed to register led trigger.\n");
+                return retval;
+        }
+
+        trigger->registered = 1;
+
+        return 0;
+}
+
+static int rt2x00leds_register_led(struct rt2x00_dev *rt2x00dev,
+                                   struct rt2x00_led *led,
+                                   enum led_type type,
+                                   const char *name, char *trigger)
+{
+        struct device *device = wiphy_dev(rt2x00dev->hw->wiphy);
+        int retval;
+
+        led->led_dev.name = name;
+        led->led_dev.brightness_set = rt2x00dev->ops->lib->led_brightness;
+        led->led_dev.default_trigger = trigger;
+
+        retval = led_classdev_register(device, &led->led_dev);
+        if (retval) {
+                ERROR(rt2x00dev, "Failed to register led handler.\n");
+                return retval;
+        }
+
+        led->rt2x00dev = rt2x00dev;
+        led->type = type;
+        led->registered = 1;
+
+        return 0;
+}
+
+int rt2x00leds_register(struct rt2x00_dev *rt2x00dev)
+{
+        char *trigger;
+        char dev_name[16];
+        char name[32];
+        int retval;
+
+        if (!rt2x00dev->ops->lib->led_brightness)
+                return 0;
+
+        snprintf(dev_name, sizeof(dev_name), "%s-%s",
+                 rt2x00dev->ops->name, wiphy_name(rt2x00dev->hw->wiphy));
+
+        if (rt2x00dev->led_flags & LED_SUPPORT_RADIO) {
+                trigger = ieee80211_get_radio_led_name(rt2x00dev->hw);
+                snprintf(name, sizeof(name), "%s:radio", dev_name);
+
+                retval = rt2x00leds_register_led(rt2x00dev,
+                                                 &rt2x00dev->led_radio,
+                                                 LED_TYPE_RADIO,
+                                                 name, trigger);
+                if (retval)
+                        goto exit_fail;
+        }
+
+        if (rt2x00dev->led_flags & LED_SUPPORT_ASSOC) {
+                trigger = ieee80211_get_assoc_led_name(rt2x00dev->hw);
+                snprintf(name, sizeof(name), "%s:assoc", dev_name);
+
+                retval = rt2x00leds_register_led(rt2x00dev,
+                                                 &rt2x00dev->led_assoc,
+                                                 LED_TYPE_ASSOC,
+                                                 name, trigger);
+                if (retval)
+                        goto exit_fail;
+        }
+
+        if (rt2x00dev->led_flags & LED_SUPPORT_QUALITY) {
+                snprintf(name, sizeof(name), "%s:quality", dev_name);
+
+                retval = rt2x00leds_register_trigger(rt2x00dev,
+                                                     &rt2x00dev->trigger_qual,
+                                                     name);
+
+                retval = rt2x00leds_register_led(rt2x00dev,
+                                                 &rt2x00dev->led_qual,
+                                                 LED_TYPE_QUALITY,
+                                                 name, name);
+                if (retval)
+                        goto exit_fail;
+        }
+
+        return 0;
+
+exit_fail:
+        rt2x00leds_unregister(rt2x00dev);
+        return retval;
+}
+
+static void rt2x00leds_unregister_trigger(struct rt2x00_trigger *trigger)
+{
+        if (!trigger->registered)
+                return;
+
+        led_trigger_unregister(&trigger->trigger);
+        trigger->registered = 0;
+}
+
+static void rt2x00leds_unregister_led(struct rt2x00_led *led)
+{
+        if (!led->registered)
+                return;
+
+        led_classdev_unregister(&led->led_dev);
+
+        led->led_dev.brightness_set(&led->led_dev, LED_OFF);
+        led->registered = 0;
+}
+
+void rt2x00leds_unregister(struct rt2x00_dev *rt2x00dev)
+{
+        rt2x00leds_unregister_trigger(&rt2x00dev->trigger_qual);
+        rt2x00leds_unregister_led(&rt2x00dev->led_qual);
+        rt2x00leds_unregister_led(&rt2x00dev->led_assoc);
+        rt2x00leds_unregister_led(&rt2x00dev->led_radio);
+}
+
+void rt2x00leds_suspend(struct rt2x00_dev *rt2x00dev)
+{
+        if (rt2x00dev->led_qual.registered)
+                led_classdev_suspend(&rt2x00dev->led_qual.led_dev);
+        if (rt2x00dev->led_assoc.registered)
+                led_classdev_suspend(&rt2x00dev->led_assoc.led_dev);
+        if (rt2x00dev->led_radio.registered)
+                led_classdev_suspend(&rt2x00dev->led_radio.led_dev);
+}
+
+void rt2x00leds_resume(struct rt2x00_dev *rt2x00dev)
+{
+        if (rt2x00dev->led_radio.registered)
+                led_classdev_resume(&rt2x00dev->led_radio.led_dev);
+        if (rt2x00dev->led_assoc.registered)
+                led_classdev_resume(&rt2x00dev->led_assoc.led_dev);
+        if (rt2x00dev->led_qual.registered)
+                led_classdev_resume(&rt2x00dev->led_qual.led_dev);
+}
diff --git a/drivers/net/wireless/rt2x00/rt2x00leds.h b/drivers/net/wireless/rt2x00/rt2x00leds.h
new file mode 100644
index 000000000000..11e71e9ce853
--- /dev/null
+++ b/drivers/net/wireless/rt2x00/rt2x00leds.h
@@ -0,0 +1,63 @@
+/*
+        Copyright (C) 2004 - 2008 rt2x00 SourceForge Project
+        <http://rt2x00.serialmonkey.com>
+
+        This program is free software; you can redistribute it and/or modify
+        it under the terms of the GNU General Public License as published by
+        the Free Software Foundation; either version 2 of the License, or
+        (at your option) any later version.
+
+        This program is distributed in the hope that it will be useful,
+        but WITHOUT ANY WARRANTY; without even the implied warranty of
+        MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+        GNU General Public License for more details.
+
+        You should have received a copy of the GNU General Public License
+        along with this program; if not, write to the
+        Free Software Foundation, Inc.,
+        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+/*
+        Module: rt2x00lib
+        Abstract: rt2x00 led datastructures and routines
+ */
+
+#ifndef RT2X00LEDS_H
+#define RT2X00LEDS_H
+
+/*
+* Flags used by driver to indicate which
+ * which led types are supported.
+ */
+#define LED_SUPPORT_RADIO       0x000001
+#define LED_SUPPORT_ASSOC       0x000002
+#define LED_SUPPORT_ACTIVITY    0x000004
+#define LED_SUPPORT_QUALITY     0x000008
+
+enum led_type {
+        LED_TYPE_RADIO,
+        LED_TYPE_ASSOC,
+        LED_TYPE_QUALITY,
+};
+
+#ifdef CONFIG_RT2X00_LIB_LEDS
+
+struct rt2x00_led {
+        struct rt2x00_dev *rt2x00dev;
+        struct led_classdev led_dev;
+
+        enum led_type type;
+        unsigned int registered;
+};
+
+struct rt2x00_trigger {
+        struct led_trigger trigger;
+
+        enum led_type type;
+        unsigned int registered;
+};
+
+#endif /* CONFIG_RT2X00_LIB_LEDS */
+
+#endif /* RT2X00LEDS_H */
diff --git a/drivers/net/wireless/rt2x00/rt2x00lib.h b/drivers/net/wireless/rt2x00/rt2x00lib.h
index 1adbd28e0973..34ccb3de687e 100644
--- a/drivers/net/wireless/rt2x00/rt2x00lib.h
+++ b/drivers/net/wireless/rt2x00/rt2x00lib.h
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2007 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2008 rt2x00 SourceForge Project
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
@@ -34,6 +34,52 @@
 #define RFKILL_POLL_INTERVAL    ( 1000 )
 
 /*
+ * rt2x00_rate: Per rate device information
+ */
+struct rt2x00_rate {
+        unsigned short flags;
+#define DEV_RATE_CCK                    0x0001
+#define DEV_RATE_OFDM                   0x0002
+#define DEV_RATE_SHORT_PREAMBLE         0x0004
+
+        unsigned short bitrate; /* In 100kbit/s */
+
+        unsigned short ratemask;
+#define DEV_RATEMASK_1MB        ( (1 << 1) - 1 )
+#define DEV_RATEMASK_2MB        ( (1 << 2) - 1 )
+#define DEV_RATEMASK_5_5MB      ( (1 << 3) - 1 )
+#define DEV_RATEMASK_11MB       ( (1 << 4) - 1 )
+#define DEV_RATEMASK_6MB        ( (1 << 5) - 1 )
+#define DEV_RATEMASK_9MB        ( (1 << 6) - 1 )
+#define DEV_RATEMASK_12MB       ( (1 << 7) - 1 )
+#define DEV_RATEMASK_18MB       ( (1 << 8) - 1 )
+#define DEV_RATEMASK_24MB       ( (1 << 9) - 1 )
+#define DEV_RATEMASK_36MB       ( (1 << 10) - 1 )
+#define DEV_RATEMASK_48MB       ( (1 << 11) - 1 )
+#define DEV_RATEMASK_54MB       ( (1 << 12) - 1 )
+
+        unsigned short plcp;
+};
+
+extern const struct rt2x00_rate rt2x00_supported_rates[12];
+
+static inline u16 rt2x00_create_rate_hw_value(const u16 index,
+                                              const u16 short_preamble)
+{
+        return (short_preamble << 8) | (index & 0xff);
+}
+
+static inline const struct rt2x00_rate *rt2x00_get_rate(const u16 hw_value)
+{
+        return &rt2x00_supported_rates[hw_value & 0xff];
+}
+
+static inline int rt2x00_get_rate_preamble(const u16 hw_value)
+{
+        return (hw_value & 0xff00);
+}
+
+/*
  * Radio control handlers.
  */
 int rt2x00lib_enable_radio(struct rt2x00_dev *rt2x00dev);
@@ -50,15 +96,29 @@ void rt2x00lib_stop(struct rt2x00_dev *rt2x00dev);
 /*
  * Configuration handlers.
  */
-void rt2x00lib_config_mac_addr(struct rt2x00_dev *rt2x00dev, u8 *mac);
-void rt2x00lib_config_bssid(struct rt2x00_dev *rt2x00dev, u8 *bssid);
-void rt2x00lib_config_type(struct rt2x00_dev *rt2x00dev, const int type);
+void rt2x00lib_config_intf(struct rt2x00_dev *rt2x00dev,
+                           struct rt2x00_intf *intf,
+                           enum ieee80211_if_types type,
+                           u8 *mac, u8 *bssid);
+void rt2x00lib_config_preamble(struct rt2x00_dev *rt2x00dev,
+                               struct rt2x00_intf *intf,
+                               const unsigned int short_preamble);
 void rt2x00lib_config_antenna(struct rt2x00_dev *rt2x00dev,
                               enum antenna rx, enum antenna tx);
 void rt2x00lib_config(struct rt2x00_dev *rt2x00dev,
                       struct ieee80211_conf *conf, const int force_config);
 
 /*
+ * Queue handlers.
+ */
+void rt2x00queue_init_rx(struct rt2x00_dev *rt2x00dev);
+void rt2x00queue_init_tx(struct rt2x00_dev *rt2x00dev);
+int rt2x00queue_initialize(struct rt2x00_dev *rt2x00dev);
+void rt2x00queue_uninitialize(struct rt2x00_dev *rt2x00dev);
+int rt2x00queue_allocate(struct rt2x00_dev *rt2x00dev);
+void rt2x00queue_free(struct rt2x00_dev *rt2x00dev);
+
+/*
  * Firmware handlers.
  */
 #ifdef CONFIG_RT2X00_LIB_FIRMWARE
@@ -124,4 +184,37 @@ static inline void rt2x00rfkill_free(struct rt2x00_dev *rt2x00dev)
 }
 #endif /* CONFIG_RT2X00_LIB_RFKILL */
 
+/*
+ * LED handlers
+ */
+#ifdef CONFIG_RT2X00_LIB_LEDS
+void rt2x00leds_led_quality(struct rt2x00_dev *rt2x00dev, int rssi);
+int rt2x00leds_register(struct rt2x00_dev *rt2x00dev);
+void rt2x00leds_unregister(struct rt2x00_dev *rt2x00dev);
+void rt2x00leds_suspend(struct rt2x00_dev *rt2x00dev);
+void rt2x00leds_resume(struct rt2x00_dev *rt2x00dev);
+#else
+static inline void rt2x00leds_led_quality(struct rt2x00_dev *rt2x00dev,
+                                          int rssi)
+{
+}
+
+static inline int rt2x00leds_register(struct rt2x00_dev *rt2x00dev)
+{
+        return 0;
+}
+
+static inline void rt2x00leds_unregister(struct rt2x00_dev *rt2x00dev)
+{
+}
+
+static inline void rt2x00leds_suspend(struct rt2x00_dev *rt2x00dev)
+{
+}
+
+static inline void rt2x00leds_resume(struct rt2x00_dev *rt2x00dev)
+{
+}
+#endif /* CONFIG_RT2X00_LIB_LEDS */
+
 #endif /* RT2X00LIB_H */
diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
index e3f15e518c76..a54f6873e9ea 100644
--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2007 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2008 rt2x00 SourceForge Project
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
@@ -30,10 +30,11 @@
 #include "rt2x00lib.h"
 
 static int rt2x00mac_tx_rts_cts(struct rt2x00_dev *rt2x00dev,
-                                struct data_ring *ring,
+                                struct data_queue *queue,
                                 struct sk_buff *frag_skb,
                                 struct ieee80211_tx_control *control)
 {
+        struct skb_frame_desc *skbdesc;
         struct sk_buff *skb;
         int size;
 
@@ -52,15 +53,22 @@ static int rt2x00mac_tx_rts_cts(struct rt2x00_dev *rt2x00dev,
         skb_put(skb, size);
 
         if (control->flags & IEEE80211_TXCTL_USE_CTS_PROTECT)
-                ieee80211_ctstoself_get(rt2x00dev->hw, rt2x00dev->interface.id,
+                ieee80211_ctstoself_get(rt2x00dev->hw, control->vif,
                                         frag_skb->data, frag_skb->len, control,
                                         (struct ieee80211_cts *)(skb->data));
         else
-                ieee80211_rts_get(rt2x00dev->hw, rt2x00dev->interface.id,
+                ieee80211_rts_get(rt2x00dev->hw, control->vif,
                                   frag_skb->data, frag_skb->len, control,
                                   (struct ieee80211_rts *)(skb->data));
 
-        if (rt2x00dev->ops->lib->write_tx_data(rt2x00dev, ring, skb, control)) {
+        /*
+         * Initialize skb descriptor
+         */
+        skbdesc = get_skb_frame_desc(skb);
+        memset(skbdesc, 0, sizeof(*skbdesc));
+        skbdesc->flags |= FRAME_DESC_DRIVER_GENERATED;
+
+        if (rt2x00dev->ops->lib->write_tx_data(rt2x00dev, queue, skb, control)) {
                 WARNING(rt2x00dev, "Failed to send RTS/CTS frame.\n");
                 return NETDEV_TX_BUSY;
         }
@@ -73,7 +81,8 @@ int rt2x00mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb,
 {
         struct rt2x00_dev *rt2x00dev = hw->priv;
         struct ieee80211_hdr *ieee80211hdr = (struct ieee80211_hdr *)skb->data;
-        struct data_ring *ring;
+        struct data_queue *queue;
+        struct skb_frame_desc *skbdesc;
         u16 frame_control;
 
         /*
@@ -88,10 +97,10 @@ int rt2x00mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb,
         }
 
         /*
-         * Determine which ring to put packet on.
+         * Determine which queue to put packet on.
          */
-        ring = rt2x00lib_get_ring(rt2x00dev, control->queue);
-        if (unlikely(!ring)) {
+        queue = rt2x00queue_get_queue(rt2x00dev, control->queue);
+        if (unlikely(!queue)) {
                 ERROR(rt2x00dev,
                       "Attempt to send packet over invalid queue %d.\n"
                       "Please file bug report to %s.\n",
@@ -110,23 +119,29 @@ int rt2x00mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb,
         if (!is_rts_frame(frame_control) && !is_cts_frame(frame_control) &&
             (control->flags & (IEEE80211_TXCTL_USE_RTS_CTS |
                                IEEE80211_TXCTL_USE_CTS_PROTECT))) {
-                if (rt2x00_ring_free(ring) <= 1) {
+                if (rt2x00queue_available(queue) <= 1) {
                         ieee80211_stop_queue(rt2x00dev->hw, control->queue);
                         return NETDEV_TX_BUSY;
                 }
 
-                if (rt2x00mac_tx_rts_cts(rt2x00dev, ring, skb, control)) {
+                if (rt2x00mac_tx_rts_cts(rt2x00dev, queue, skb, control)) {
                         ieee80211_stop_queue(rt2x00dev->hw, control->queue);
                         return NETDEV_TX_BUSY;
                 }
         }
 
-        if (rt2x00dev->ops->lib->write_tx_data(rt2x00dev, ring, skb, control)) {
+        /*
+         * Initialize skb descriptor
+         */
+        skbdesc = get_skb_frame_desc(skb);
+        memset(skbdesc, 0, sizeof(*skbdesc));
+
+        if (rt2x00dev->ops->lib->write_tx_data(rt2x00dev, queue, skb, control)) {
                 ieee80211_stop_queue(rt2x00dev->hw, control->queue);
                 return NETDEV_TX_BUSY;
         }
 
-        if (rt2x00_ring_full(ring))
+        if (rt2x00queue_full(queue))
                 ieee80211_stop_queue(rt2x00dev->hw, control->queue);
 
         if (rt2x00dev->ops->lib->kick_tx_queue)
@@ -162,27 +177,67 @@ int rt2x00mac_add_interface(struct ieee80211_hw *hw,
                             struct ieee80211_if_init_conf *conf)
 {
         struct rt2x00_dev *rt2x00dev = hw->priv;
-        struct interface *intf = &rt2x00dev->interface;
-
-        /* FIXME: Beaconing is broken in rt2x00. */
-        if (conf->type == IEEE80211_IF_TYPE_IBSS ||
-            conf->type == IEEE80211_IF_TYPE_AP) {
-                ERROR(rt2x00dev,
-                      "rt2x00 does not support Adhoc or Master mode");
-                return -EOPNOTSUPP;
-        }
+        struct rt2x00_intf *intf = vif_to_intf(conf->vif);
+        struct data_queue *queue =
+            rt2x00queue_get_queue(rt2x00dev, RT2X00_BCN_QUEUE_BEACON);
+        struct queue_entry *entry = NULL;
+        unsigned int i;
 
         /*
-         * Don't allow interfaces to be added while
-         * either the device has disappeared or when
-         * another interface is already present.
+         * Don't allow interfaces to be added
+         * the device has disappeared.
          */
         if (!test_bit(DEVICE_PRESENT, &rt2x00dev->flags) ||
-            is_interface_present(intf))
+            !test_bit(DEVICE_STARTED, &rt2x00dev->flags))
+                return -ENODEV;
+
+        /*
+         * When we don't support mixed interfaces (a combination
+         * of sta and ap virtual interfaces) then we can only
+         * add this interface when the rival interface count is 0.
+         */
+        if (!test_bit(DRIVER_SUPPORT_MIXED_INTERFACES, &rt2x00dev->flags) &&
+            ((conf->type == IEEE80211_IF_TYPE_AP && rt2x00dev->intf_sta_count) ||
+             (conf->type != IEEE80211_IF_TYPE_AP && rt2x00dev->intf_ap_count)))
                 return -ENOBUFS;
 
-        intf->id = conf->vif;
-        intf->type = conf->type;
+        /*
+         * Check if we exceeded the maximum amount of supported interfaces.
+         */
+        if ((conf->type == IEEE80211_IF_TYPE_AP &&
+             rt2x00dev->intf_ap_count >= rt2x00dev->ops->max_ap_intf) ||
+            (conf->type != IEEE80211_IF_TYPE_AP &&
+             rt2x00dev->intf_sta_count >= rt2x00dev->ops->max_sta_intf))
+                return -ENOBUFS;
+
+        /*
+         * Loop through all beacon queues to find a free
+         * entry. Since there are as much beacon entries
+         * as the maximum interfaces, this search shouldn't
+         * fail.
+         */
+        for (i = 0; i < queue->limit; i++) {
+                entry = &queue->entries[i];
+                if (!__test_and_set_bit(ENTRY_BCN_ASSIGNED, &entry->flags))
+                        break;
+        }
+
+        if (unlikely(i == queue->limit))
+                return -ENOBUFS;
+
+        /*
+         * We are now absolutely sure the interface can be created,
+         * increase interface count and start initialization.
+         */
+
+        if (conf->type == IEEE80211_IF_TYPE_AP)
+                rt2x00dev->intf_ap_count++;
+        else
+                rt2x00dev->intf_sta_count++;
+
+        spin_lock_init(&intf->lock);
+        intf->beacon = entry;
+
         if (conf->type == IEEE80211_IF_TYPE_AP)
                 memcpy(&intf->bssid, conf->mac_addr, ETH_ALEN);
         memcpy(&intf->mac, conf->mac_addr, ETH_ALEN);
@@ -192,8 +247,7 @@ int rt2x00mac_add_interface(struct ieee80211_hw *hw,
          * has been initialized. Otherwise the device can reset
          * the MAC registers.
          */
-        rt2x00lib_config_mac_addr(rt2x00dev, intf->mac);
-        rt2x00lib_config_type(rt2x00dev, conf->type);
+        rt2x00lib_config_intf(rt2x00dev, intf, conf->type, intf->mac, NULL);
 
         return 0;
 }
@@ -203,7 +257,7 @@ void rt2x00mac_remove_interface(struct ieee80211_hw *hw,
                                 struct ieee80211_if_init_conf *conf)
 {
         struct rt2x00_dev *rt2x00dev = hw->priv;
-        struct interface *intf = &rt2x00dev->interface;
+        struct rt2x00_intf *intf = vif_to_intf(conf->vif);
 
         /*
          * Don't allow interfaces to be remove while
@@ -211,21 +265,27 @@ void rt2x00mac_remove_interface(struct ieee80211_hw *hw,
          * no interface is present.
          */
         if (!test_bit(DEVICE_PRESENT, &rt2x00dev->flags) ||
-            !is_interface_present(intf))
+            (conf->type == IEEE80211_IF_TYPE_AP && !rt2x00dev->intf_ap_count) ||
+            (conf->type != IEEE80211_IF_TYPE_AP && !rt2x00dev->intf_sta_count))
                 return;
 
-        intf->id = 0;
-        intf->type = IEEE80211_IF_TYPE_INVALID;
-        memset(&intf->bssid, 0x00, ETH_ALEN);
-        memset(&intf->mac, 0x00, ETH_ALEN);
+        if (conf->type == IEEE80211_IF_TYPE_AP)
+                rt2x00dev->intf_ap_count--;
+        else
+                rt2x00dev->intf_sta_count--;
+
+        /*
+         * Release beacon entry so it is available for
+         * new interfaces again.
+         */
+        __clear_bit(ENTRY_BCN_ASSIGNED, &intf->beacon->flags);
 
         /*
          * Make sure the bssid and mac address registers
          * are cleared to prevent false ACKing of frames.
          */
-        rt2x00lib_config_mac_addr(rt2x00dev, intf->mac);
-        rt2x00lib_config_bssid(rt2x00dev, intf->bssid);
-        rt2x00lib_config_type(rt2x00dev, intf->type);
+        rt2x00lib_config_intf(rt2x00dev, intf,
+                              IEEE80211_IF_TYPE_INVALID, NULL, NULL);
 }
 EXPORT_SYMBOL_GPL(rt2x00mac_remove_interface);
 
@@ -270,7 +330,7 @@ int rt2x00mac_config_interface(struct ieee80211_hw *hw,
                                struct ieee80211_if_conf *conf)
 {
         struct rt2x00_dev *rt2x00dev = hw->priv;
-        struct interface *intf = &rt2x00dev->interface;
+        struct rt2x00_intf *intf = vif_to_intf(vif);
         int status;
 
         /*
@@ -280,12 +340,7 @@ int rt2x00mac_config_interface(struct ieee80211_hw *hw,
         if (!test_bit(DEVICE_PRESENT, &rt2x00dev->flags))
                 return 0;
 
-        /*
-         * If the given type does not match the configured type,
-         * there has been a problem.
-         */
-        if (conf->type != intf->type)
-                return -EINVAL;
+        spin_lock(&intf->lock);
 
         /*
          * If the interface does not work in master mode,
@@ -294,7 +349,16 @@ int rt2x00mac_config_interface(struct ieee80211_hw *hw,
          */
         if (conf->type != IEEE80211_IF_TYPE_AP)
                 memcpy(&intf->bssid, conf->bssid, ETH_ALEN);
-        rt2x00lib_config_bssid(rt2x00dev, intf->bssid);
+
+        spin_unlock(&intf->lock);
+
+        /*
+         * Call rt2x00_config_intf() outside of the spinlock context since
+         * the call will sleep for USB drivers. By using the ieee80211_if_conf
+         * values as arguments we make keep access to rt2x00_intf thread safe
+         * even without the lock.
+         */
+        rt2x00lib_config_intf(rt2x00dev, intf, conf->type, NULL, conf->bssid);
 
         /*
          * We only need to initialize the beacon when master mode is enabled.
@@ -334,9 +398,11 @@ int rt2x00mac_get_tx_stats(struct ieee80211_hw *hw,
         struct rt2x00_dev *rt2x00dev = hw->priv;
         unsigned int i;
 
-        for (i = 0; i < hw->queues; i++)
-                memcpy(&stats->data[i], &rt2x00dev->tx[i].stats,
-                       sizeof(rt2x00dev->tx[i].stats));
+        for (i = 0; i < hw->queues; i++) {
+                stats->data[i].len = rt2x00dev->tx[i].length;
+                stats->data[i].limit = rt2x00dev->tx[i].limit;
+                stats->data[i].count = rt2x00dev->tx[i].count;
+        }
 
         return 0;
 }
@@ -348,71 +414,70 @@ void rt2x00mac_bss_info_changed(struct ieee80211_hw *hw,
                                 u32 changes)
 {
         struct rt2x00_dev *rt2x00dev = hw->priv;
-        int short_preamble;
-        int ack_timeout;
-        int ack_consume_time;
-        int difs;
-        int preamble;
+        struct rt2x00_intf *intf = vif_to_intf(vif);
 
         /*
-         * We only support changing preamble mode.
+         * When the association status has changed we must reset the link
+         * tuner counter. This is because some drivers determine if they
+         * should perform link tuning based on the number of seconds
+         * while associated or not associated.
          */
-        if (!(changes & BSS_CHANGED_ERP_PREAMBLE))
-                return;
-
-        short_preamble = bss_conf->use_short_preamble;
-        preamble = bss_conf->use_short_preamble ?
-                                SHORT_PREAMBLE : PREAMBLE;
-
-        difs = (hw->conf.flags & IEEE80211_CONF_SHORT_SLOT_TIME) ?
-                SHORT_DIFS : DIFS;
-        ack_timeout = difs + PLCP + preamble + get_duration(ACK_SIZE, 10);
+        if (changes & BSS_CHANGED_ASSOC) {
+                rt2x00dev->link.count = 0;
 
-        ack_consume_time = SIFS + PLCP + preamble + get_duration(ACK_SIZE, 10);
+                if (bss_conf->assoc)
+                        rt2x00dev->intf_associated++;
+                else
+                        rt2x00dev->intf_associated--;
+        }
 
-        if (short_preamble)
-                __set_bit(CONFIG_SHORT_PREAMBLE, &rt2x00dev->flags);
-        else
-                __clear_bit(CONFIG_SHORT_PREAMBLE, &rt2x00dev->flags);
+        /*
+         * When the preamble mode has changed, we should perform additional
+         * configuration steps. For all other changes we are already done.
+         */
+        if (changes & BSS_CHANGED_ERP_PREAMBLE) {
+                rt2x00lib_config_preamble(rt2x00dev, intf,
+                                          bss_conf->use_short_preamble);
 
-        rt2x00dev->ops->lib->config_preamble(rt2x00dev, short_preamble,
-                                             ack_timeout, ack_consume_time);
+                spin_lock(&intf->lock);
+                memcpy(&intf->conf, bss_conf, sizeof(*bss_conf));
+                spin_unlock(&intf->lock);
+        }
 }
 EXPORT_SYMBOL_GPL(rt2x00mac_bss_info_changed);
 
-int rt2x00mac_conf_tx(struct ieee80211_hw *hw, int queue,
+int rt2x00mac_conf_tx(struct ieee80211_hw *hw, int queue_idx,
                       const struct ieee80211_tx_queue_params *params)
 {
         struct rt2x00_dev *rt2x00dev = hw->priv;
-        struct data_ring *ring;
+        struct data_queue *queue;
 
-        ring = rt2x00lib_get_ring(rt2x00dev, queue);
-        if (unlikely(!ring))
+        queue = rt2x00queue_get_queue(rt2x00dev, queue_idx);
+        if (unlikely(!queue))
                 return -EINVAL;
 
         /*
          * The passed variables are stored as real value ((2^n)-1).
          * Ralink registers require to know the bit number 'n'.
          */
-        if (params->cw_min)
-                ring->tx_params.cw_min = fls(params->cw_min);
+        if (params->cw_min > 0)
+                queue->cw_min = fls(params->cw_min);
         else
-                ring->tx_params.cw_min = 5; /* cw_min: 2^5 = 32. */
+                queue->cw_min = 5; /* cw_min: 2^5 = 32. */
 
-        if (params->cw_max)
-                ring->tx_params.cw_max = fls(params->cw_max);
+        if (params->cw_max > 0)
+                queue->cw_max = fls(params->cw_max);
         else
-                ring->tx_params.cw_max = 10; /* cw_min: 2^10 = 1024. */
+                queue->cw_max = 10; /* cw_min: 2^10 = 1024. */
 
-        if (params->aifs)
-                ring->tx_params.aifs = params->aifs;
+        if (params->aifs >= 0)
+                queue->aifs = params->aifs;
         else
-                ring->tx_params.aifs = 2;
+                queue->aifs = 2;
 
         INFO(rt2x00dev,
-             "Configured TX ring %d - CWmin: %d, CWmax: %d, Aifs: %d.\n",
-             queue, ring->tx_params.cw_min, ring->tx_params.cw_max,
-             ring->tx_params.aifs);
+             "Configured TX queue %d - CWmin: %d, CWmax: %d, Aifs: %d.\n",
+             queue_idx, queue->cw_min, queue->cw_max, queue->aifs);
 
         return 0;
 }
diff --git a/drivers/net/wireless/rt2x00/rt2x00pci.c b/drivers/net/wireless/rt2x00/rt2x00pci.c
index 804a9980055d..1960d938d73b 100644
--- a/drivers/net/wireless/rt2x00/rt2x00pci.c
+++ b/drivers/net/wireless/rt2x00/rt2x00pci.c
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2007 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2008 rt2x00 SourceForge Project
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
@@ -32,64 +32,21 @@
 #include "rt2x00pci.h"
 
 /*
- * Beacon handlers.
- */
-int rt2x00pci_beacon_update(struct ieee80211_hw *hw, struct sk_buff *skb,
-                            struct ieee80211_tx_control *control)
-{
-        struct rt2x00_dev *rt2x00dev = hw->priv;
-        struct skb_desc *desc;
-        struct data_ring *ring;
-        struct data_entry *entry;
-
-        /*
-         * Just in case mac80211 doesn't set this correctly,
-         * but we need this queue set for the descriptor
-         * initialization.
-         */
-        control->queue = IEEE80211_TX_QUEUE_BEACON;
-        ring = rt2x00lib_get_ring(rt2x00dev, control->queue);
-        entry = rt2x00_get_data_entry(ring);
-
-        /*
-         * Fill in skb descriptor
-         */
-        desc = get_skb_desc(skb);
-        desc->desc_len = ring->desc_size;
-        desc->data_len = skb->len;
-        desc->desc = entry->priv;
-        desc->data = skb->data;
-        desc->ring = ring;
-        desc->entry = entry;
-
-        memcpy(entry->data_addr, skb->data, skb->len);
-        rt2x00lib_write_tx_desc(rt2x00dev, skb, control);
-
-        /*
-         * Enable beacon generation.
-         */
-        rt2x00dev->ops->lib->kick_tx_queue(rt2x00dev, control->queue);
-
-        return 0;
-}
-EXPORT_SYMBOL_GPL(rt2x00pci_beacon_update);
-
-/*
  * TX data handlers.
  */
 int rt2x00pci_write_tx_data(struct rt2x00_dev *rt2x00dev,
-                            struct data_ring *ring, struct sk_buff *skb,
+                            struct data_queue *queue, struct sk_buff *skb,
                             struct ieee80211_tx_control *control)
 {
-        struct data_entry *entry = rt2x00_get_data_entry(ring);
-        __le32 *txd = entry->priv;
-        struct skb_desc *desc;
+        struct queue_entry *entry = rt2x00queue_get_entry(queue, Q_INDEX);
+        struct queue_entry_priv_pci_tx *priv_tx = entry->priv_data;
+        struct skb_frame_desc *skbdesc;
         u32 word;
 
-        if (rt2x00_ring_full(ring))
+        if (rt2x00queue_full(queue))
                 return -EINVAL;
 
-        rt2x00_desc_read(txd, 0, &word);
+        rt2x00_desc_read(priv_tx->desc, 0, &word);
 
         if (rt2x00_get_field32(word, TXD_ENTRY_OWNER_NIC) ||
             rt2x00_get_field32(word, TXD_ENTRY_VALID)) {
@@ -103,18 +60,17 @@ int rt2x00pci_write_tx_data(struct rt2x00_dev *rt2x00dev,
         /*
          * Fill in skb descriptor
          */
-        desc = get_skb_desc(skb);
-        desc->desc_len = ring->desc_size;
-        desc->data_len = skb->len;
-        desc->desc = entry->priv;
-        desc->data = skb->data;
-        desc->ring = ring;
-        desc->entry = entry;
-
-        memcpy(entry->data_addr, skb->data, skb->len);
+        skbdesc = get_skb_frame_desc(skb);
+        skbdesc->data = skb->data;
+        skbdesc->data_len = skb->len;
+        skbdesc->desc = priv_tx->desc;
+        skbdesc->desc_len = queue->desc_size;
+        skbdesc->entry = entry;
+
+        memcpy(priv_tx->data, skb->data, skb->len);
         rt2x00lib_write_tx_desc(rt2x00dev, skb, control);
 
-        rt2x00_ring_index_inc(ring);
+        rt2x00queue_index_inc(queue, Q_INDEX);
 
         return 0;
 }
@@ -125,29 +81,28 @@ EXPORT_SYMBOL_GPL(rt2x00pci_write_tx_data);
  */
 void rt2x00pci_rxdone(struct rt2x00_dev *rt2x00dev)
 {
-        struct data_ring *ring = rt2x00dev->rx;
-        struct data_entry *entry;
-        struct sk_buff *skb;
+        struct data_queue *queue = rt2x00dev->rx;
+        struct queue_entry *entry;
+        struct queue_entry_priv_pci_rx *priv_rx;
         struct ieee80211_hdr *hdr;
-        struct skb_desc *skbdesc;
-        struct rxdata_entry_desc desc;
+        struct skb_frame_desc *skbdesc;
+        struct rxdone_entry_desc rxdesc;
         int header_size;
-        __le32 *rxd;
         int align;
         u32 word;
 
         while (1) {
-                entry = rt2x00_get_data_entry(ring);
-                rxd = entry->priv;
-                rt2x00_desc_read(rxd, 0, &word);
+                entry = rt2x00queue_get_entry(queue, Q_INDEX);
+                priv_rx = entry->priv_data;
+                rt2x00_desc_read(priv_rx->desc, 0, &word);
 
                 if (rt2x00_get_field32(word, RXD_ENTRY_OWNER_NIC))
                         break;
 
-                memset(&desc, 0, sizeof(desc));
-                rt2x00dev->ops->lib->fill_rxdone(entry, &desc);
+                memset(&rxdesc, 0, sizeof(rxdesc));
+                rt2x00dev->ops->lib->fill_rxdone(entry, &rxdesc);
 
-                hdr = (struct ieee80211_hdr *)entry->data_addr;
+                hdr = (struct ieee80211_hdr *)priv_rx->data;
                 header_size =
                     ieee80211_get_hdrlen(le16_to_cpu(hdr->frame_control));
 
@@ -161,66 +116,68 @@ void rt2x00pci_rxdone(struct rt2x00_dev *rt2x00dev)
                  * Allocate the sk_buffer, initialize it and copy
                  * all data into it.
                  */
-                skb = dev_alloc_skb(desc.size + align);
-                if (!skb)
+                entry->skb = dev_alloc_skb(rxdesc.size + align);
+                if (!entry->skb)
                         return;
 
-                skb_reserve(skb, align);
-                memcpy(skb_put(skb, desc.size), entry->data_addr, desc.size);
+                skb_reserve(entry->skb, align);
+                memcpy(skb_put(entry->skb, rxdesc.size),
+                       priv_rx->data, rxdesc.size);
 
                 /*
                  * Fill in skb descriptor
                  */
-                skbdesc = get_skb_desc(skb);
-                skbdesc->desc_len = entry->ring->desc_size;
-                skbdesc->data_len = skb->len;
-                skbdesc->desc = entry->priv;
-                skbdesc->data = skb->data;
-                skbdesc->ring = ring;
+                skbdesc = get_skb_frame_desc(entry->skb);
+                memset(skbdesc, 0, sizeof(*skbdesc));
+                skbdesc->data = entry->skb->data;
+                skbdesc->data_len = entry->skb->len;
+                skbdesc->desc = priv_rx->desc;
+                skbdesc->desc_len = queue->desc_size;
                 skbdesc->entry = entry;
 
                 /*
                  * Send the frame to rt2x00lib for further processing.
                  */
-                rt2x00lib_rxdone(entry, skb, &desc);
+                rt2x00lib_rxdone(entry, &rxdesc);
 
-                if (test_bit(DEVICE_ENABLED_RADIO, &ring->rt2x00dev->flags)) {
+                if (test_bit(DEVICE_ENABLED_RADIO, &queue->rt2x00dev->flags)) {
                         rt2x00_set_field32(&word, RXD_ENTRY_OWNER_NIC, 1);
-                        rt2x00_desc_write(rxd, 0, word);
+                        rt2x00_desc_write(priv_rx->desc, 0, word);
                 }
 
-                rt2x00_ring_index_inc(ring);
+                rt2x00queue_index_inc(queue, Q_INDEX);
         }
 }
 EXPORT_SYMBOL_GPL(rt2x00pci_rxdone);
 
-void rt2x00pci_txdone(struct rt2x00_dev *rt2x00dev, struct data_entry *entry,
-                      const int tx_status, const int retry)
+void rt2x00pci_txdone(struct rt2x00_dev *rt2x00dev, struct queue_entry *entry,
+                      struct txdone_entry_desc *txdesc)
 {
+        struct queue_entry_priv_pci_tx *priv_tx = entry->priv_data;
         u32 word;
 
-        rt2x00lib_txdone(entry, tx_status, retry);
+        txdesc->control = &priv_tx->control;
+        rt2x00lib_txdone(entry, txdesc);
 
         /*
          * Make this entry available for reuse.
          */
         entry->flags = 0;
 
-        rt2x00_desc_read(entry->priv, 0, &word);
+        rt2x00_desc_read(priv_tx->desc, 0, &word);
         rt2x00_set_field32(&word, TXD_ENTRY_OWNER_NIC, 0);
         rt2x00_set_field32(&word, TXD_ENTRY_VALID, 0);
-        rt2x00_desc_write(entry->priv, 0, word);
+        rt2x00_desc_write(priv_tx->desc, 0, word);
 
-        rt2x00_ring_index_done_inc(entry->ring);
+        rt2x00queue_index_inc(entry->queue, Q_INDEX_DONE);
 
         /*
-         * If the data ring was full before the txdone handler
+         * If the data queue was full before the txdone handler
          * we must make sure the packet queue in the mac80211 stack
          * is reenabled when the txdone handler has finished.
          */
-        if (!rt2x00_ring_full(entry->ring))
-                ieee80211_wake_queue(rt2x00dev->hw,
-                                     entry->tx_status.control.queue);
+        if (!rt2x00queue_full(entry->queue))
+                ieee80211_wake_queue(rt2x00dev->hw, priv_tx->control.queue);
 
 }
 EXPORT_SYMBOL_GPL(rt2x00pci_txdone);
@@ -228,73 +185,122 @@ EXPORT_SYMBOL_GPL(rt2x00pci_txdone);
 /*
  * Device initialization handlers.
  */
-#define priv_offset(__ring, __i)                                \
-({                                                              \
-        ring->data_addr + (i * ring->desc_size);                \
+#define desc_size(__queue)                      \
+({                                              \
+         ((__queue)->limit * (__queue)->desc_size);\
+})
+
+#define data_size(__queue)                      \
+({                                              \
+         ((__queue)->limit * (__queue)->data_size);\
 })
 
-#define data_addr_offset(__ring, __i)                           \
-({                                                              \
-        (__ring)->data_addr +                                   \
-            ((__ring)->stats.limit * (__ring)->desc_size) +     \
-            ((__i) * (__ring)->data_size);                      \
+#define dma_size(__queue)                       \
+({                                              \
+        data_size(__queue) + desc_size(__queue);\
 })
 
-#define data_dma_offset(__ring, __i)                            \
-({                                                              \
-        (__ring)->data_dma +                                    \
-            ((__ring)->stats.limit * (__ring)->desc_size) +     \
-            ((__i) * (__ring)->data_size);                      \
+#define desc_offset(__queue, __base, __i)       \
+({                                              \
+        (__base) + data_size(__queue) +         \
+            ((__i) * (__queue)->desc_size);     \
 })
 
-static int rt2x00pci_alloc_dma(struct rt2x00_dev *rt2x00dev,
-                               struct data_ring *ring)
+#define data_offset(__queue, __base, __i)       \
+({                                              \
+        (__base) +                              \
+            ((__i) * (__queue)->data_size);     \
+})
+
+static int rt2x00pci_alloc_queue_dma(struct rt2x00_dev *rt2x00dev,
+                                     struct data_queue *queue)
 {
+        struct pci_dev *pci_dev = rt2x00dev_pci(rt2x00dev);
+        struct queue_entry_priv_pci_rx *priv_rx;
+        struct queue_entry_priv_pci_tx *priv_tx;
+        void *addr;
+        dma_addr_t dma;
+        void *desc_addr;
+        dma_addr_t desc_dma;
+        void *data_addr;
+        dma_addr_t data_dma;
         unsigned int i;
 
         /*
          * Allocate DMA memory for descriptor and buffer.
          */
-        ring->data_addr = pci_alloc_consistent(rt2x00dev_pci(rt2x00dev),
-                                               rt2x00_get_ring_size(ring),
-                                               &ring->data_dma);
-        if (!ring->data_addr)
+        addr = pci_alloc_consistent(pci_dev, dma_size(queue), &dma);
+        if (!addr)
                 return -ENOMEM;
 
+        memset(addr, 0, dma_size(queue));
+
         /*
-         * Initialize all ring entries to contain valid
-         * addresses.
+         * Initialize all queue entries to contain valid addresses.
          */
-        for (i = 0; i < ring->stats.limit; i++) {
-                ring->entry[i].priv = priv_offset(ring, i);
-                ring->entry[i].data_addr = data_addr_offset(ring, i);
-                ring->entry[i].data_dma = data_dma_offset(ring, i);
+        for (i = 0; i < queue->limit; i++) {
+                desc_addr = desc_offset(queue, addr, i);
+                desc_dma = desc_offset(queue, dma, i);
+                data_addr = data_offset(queue, addr, i);
+                data_dma = data_offset(queue, dma, i);
+
+                if (queue->qid == QID_RX) {
+                        priv_rx = queue->entries[i].priv_data;
+                        priv_rx->desc = desc_addr;
+                        priv_rx->desc_dma = desc_dma;
+                        priv_rx->data = data_addr;
+                        priv_rx->data_dma = data_dma;
+                } else {
+                        priv_tx = queue->entries[i].priv_data;
+                        priv_tx->desc = desc_addr;
+                        priv_tx->desc_dma = desc_dma;
+                        priv_tx->data = data_addr;
+                        priv_tx->data_dma = data_dma;
+                }
         }
 
         return 0;
 }
 
-static void rt2x00pci_free_dma(struct rt2x00_dev *rt2x00dev,
-                               struct data_ring *ring)
+static void rt2x00pci_free_queue_dma(struct rt2x00_dev *rt2x00dev,
+                                     struct data_queue *queue)
 {
-        if (ring->data_addr)
-                pci_free_consistent(rt2x00dev_pci(rt2x00dev),
-                                    rt2x00_get_ring_size(ring),
-                                    ring->data_addr, ring->data_dma);
-        ring->data_addr = NULL;
+        struct pci_dev *pci_dev = rt2x00dev_pci(rt2x00dev);
+        struct queue_entry_priv_pci_rx *priv_rx;
+        struct queue_entry_priv_pci_tx *priv_tx;
+        void *data_addr;
+        dma_addr_t data_dma;
+
+        if (queue->qid == QID_RX) {
+                priv_rx = queue->entries[0].priv_data;
+                data_addr = priv_rx->data;
+                data_dma = priv_rx->data_dma;
+
+                priv_rx->data = NULL;
+        } else {
+                priv_tx = queue->entries[0].priv_data;
+                data_addr = priv_tx->data;
+                data_dma = priv_tx->data_dma;
+
+                priv_tx->data = NULL;
+        }
+
+        if (data_addr)
+                pci_free_consistent(pci_dev, dma_size(queue),
+                                    data_addr, data_dma);
 }
 
 int rt2x00pci_initialize(struct rt2x00_dev *rt2x00dev)
 {
         struct pci_dev *pci_dev = rt2x00dev_pci(rt2x00dev);
-        struct data_ring *ring;
+        struct data_queue *queue;
         int status;
 
         /*
          * Allocate DMA
          */
-        ring_for_each(rt2x00dev, ring) {
-                status = rt2x00pci_alloc_dma(rt2x00dev, ring);
+        queue_for_each(rt2x00dev, queue) {
+                status = rt2x00pci_alloc_queue_dma(rt2x00dev, queue);
                 if (status)
                         goto exit;
         }
@@ -321,7 +327,7 @@ EXPORT_SYMBOL_GPL(rt2x00pci_initialize);
 
 void rt2x00pci_uninitialize(struct rt2x00_dev *rt2x00dev)
 {
-        struct data_ring *ring;
+        struct data_queue *queue;
 
         /*
          * Free irq line.
@@ -331,8 +337,8 @@ void rt2x00pci_uninitialize(struct rt2x00_dev *rt2x00dev)
         /*
          * Free DMA
          */
-        ring_for_each(rt2x00dev, ring)
-                rt2x00pci_free_dma(rt2x00dev, ring);
+        queue_for_each(rt2x00dev, queue)
+                rt2x00pci_free_queue_dma(rt2x00dev, queue);
 }
 EXPORT_SYMBOL_GPL(rt2x00pci_uninitialize);
 
@@ -347,9 +353,9 @@ static void rt2x00pci_free_reg(struct rt2x00_dev *rt2x00dev)
         kfree(rt2x00dev->eeprom);
         rt2x00dev->eeprom = NULL;
 
-        if (rt2x00dev->csr_addr) {
-                iounmap(rt2x00dev->csr_addr);
-                rt2x00dev->csr_addr = NULL;
+        if (rt2x00dev->csr.base) {
+                iounmap(rt2x00dev->csr.base);
+                rt2x00dev->csr.base = NULL;
         }
 }
 
@@ -357,9 +363,9 @@ static int rt2x00pci_alloc_reg(struct rt2x00_dev *rt2x00dev)
 {
         struct pci_dev *pci_dev = rt2x00dev_pci(rt2x00dev);
 
-        rt2x00dev->csr_addr = ioremap(pci_resource_start(pci_dev, 0),
+        rt2x00dev->csr.base = ioremap(pci_resource_start(pci_dev, 0),
                                       pci_resource_len(pci_dev, 0));
-        if (!rt2x00dev->csr_addr)
+        if (!rt2x00dev->csr.base)
                 goto exit;
 
         rt2x00dev->eeprom = kzalloc(rt2x00dev->ops->eeprom_size, GFP_KERNEL);
@@ -530,5 +536,5 @@ EXPORT_SYMBOL_GPL(rt2x00pci_resume);
  */
 MODULE_AUTHOR(DRV_PROJECT);
 MODULE_VERSION(DRV_VERSION);
-MODULE_DESCRIPTION("rt2x00 library");
+MODULE_DESCRIPTION("rt2x00 pci library");
 MODULE_LICENSE("GPL");
diff --git a/drivers/net/wireless/rt2x00/rt2x00pci.h b/drivers/net/wireless/rt2x00/rt2x00pci.h
index 2d1eb8144da4..9d1cdb99431c 100644
--- a/drivers/net/wireless/rt2x00/rt2x00pci.h
+++ b/drivers/net/wireless/rt2x00/rt2x00pci.h
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2007 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2008 rt2x00 SourceForge Project
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
@@ -61,7 +61,7 @@ static inline void rt2x00pci_register_read(struct rt2x00_dev *rt2x00dev,
                                            const unsigned long offset,
                                            u32 *value)
 {
-        *value = readl(rt2x00dev->csr_addr + offset);
+        *value = readl(rt2x00dev->csr.base + offset);
 }
 
 static inline void
@@ -69,14 +69,14 @@ rt2x00pci_register_multiread(struct rt2x00_dev *rt2x00dev,
                              const unsigned long offset,
                              void *value, const u16 length)
 {
-        memcpy_fromio(value, rt2x00dev->csr_addr + offset, length);
+        memcpy_fromio(value, rt2x00dev->csr.base + offset, length);
 }
 
 static inline void rt2x00pci_register_write(struct rt2x00_dev *rt2x00dev,
                                             const unsigned long offset,
                                             u32 value)
 {
-        writel(value, rt2x00dev->csr_addr + offset);
+        writel(value, rt2x00dev->csr.base + offset);
 }
 
 static inline void
@@ -84,28 +84,63 @@ rt2x00pci_register_multiwrite(struct rt2x00_dev *rt2x00dev,
                               const unsigned long offset,
                               void *value, const u16 length)
 {
-        memcpy_toio(rt2x00dev->csr_addr + offset, value, length);
+        memcpy_toio(rt2x00dev->csr.base + offset, value, length);
 }
 
 /*
- * Beacon handlers.
- */
-int rt2x00pci_beacon_update(struct ieee80211_hw *hw, struct sk_buff *skb,
-                            struct ieee80211_tx_control *control);
-
-/*
  * TX data handlers.
  */
 int rt2x00pci_write_tx_data(struct rt2x00_dev *rt2x00dev,
-                            struct data_ring *ring, struct sk_buff *skb,
+                            struct data_queue *queue, struct sk_buff *skb,
                             struct ieee80211_tx_control *control);
 
-/*
- * RX/TX data handlers.
+/**
+ * struct queue_entry_priv_pci_rx: Per RX entry PCI specific information
+ *
+ * @desc: Pointer to device descriptor.
+ * @data: Pointer to device's entry memory.
+ * @dma: DMA pointer to &data.
+ */
+struct queue_entry_priv_pci_rx {
+        __le32 *desc;
+        dma_addr_t desc_dma;
+
+        void *data;
+        dma_addr_t data_dma;
+};
+
+/**
+ * struct queue_entry_priv_pci_tx: Per TX entry PCI specific information
+ *
+ * @desc: Pointer to device descriptor
+ * @data: Pointer to device's entry memory.
+ * @dma: DMA pointer to &data.
+ * @control: mac80211 control structure used to transmit data.
+ */
+struct queue_entry_priv_pci_tx {
+        __le32 *desc;
+        dma_addr_t desc_dma;
+
+        void *data;
+        dma_addr_t data_dma;
+
+        struct ieee80211_tx_control control;
+};
+
+/**
+ * rt2x00pci_rxdone - Handle RX done events
+ * @rt2x00dev: Device pointer, see &struct rt2x00_dev.
  */
 void rt2x00pci_rxdone(struct rt2x00_dev *rt2x00dev);
-void rt2x00pci_txdone(struct rt2x00_dev *rt2x00dev, struct data_entry *entry,
-                      const int tx_status, const int retry);
+
+/**
+ * rt2x00pci_txdone - Handle TX done events
+ * @rt2x00dev: Device pointer, see &struct rt2x00_dev.
+ * @entry: Entry which has completed the transmission of a frame.
+ * @desc: TX done descriptor
+ */
+void rt2x00pci_txdone(struct rt2x00_dev *rt2x00dev, struct queue_entry *entry,
+                      struct txdone_entry_desc *desc);
 
 /*
  * Device initialization handlers.
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
new file mode 100644
index 000000000000..9188323f067b
--- /dev/null
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -0,0 +1,299 @@
+/*
+        Copyright (C) 2004 - 2008 rt2x00 SourceForge Project
+        <http://rt2x00.serialmonkey.com>
+
+        This program is free software; you can redistribute it and/or modify
+        it under the terms of the GNU General Public License as published by
+        the Free Software Foundation; either version 2 of the License, or
+        (at your option) any later version.
+
+        This program is distributed in the hope that it will be useful,
+        but WITHOUT ANY WARRANTY; without even the implied warranty of
+        MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+        GNU General Public License for more details.
+
+        You should have received a copy of the GNU General Public License
+        along with this program; if not, write to the
+        Free Software Foundation, Inc.,
+        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+/*
+        Module: rt2x00lib
+        Abstract: rt2x00 queue specific routines.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+
+#include "rt2x00.h"
+#include "rt2x00lib.h"
+
+struct data_queue *rt2x00queue_get_queue(struct rt2x00_dev *rt2x00dev,
+                                         const unsigned int queue)
+{
+        int atim = test_bit(DRIVER_REQUIRE_ATIM_QUEUE, &rt2x00dev->flags);
+
+        if (queue < rt2x00dev->hw->queues && rt2x00dev->tx)
+                return &rt2x00dev->tx[queue];
+
+        if (!rt2x00dev->bcn)
+                return NULL;
+
+        if (queue == RT2X00_BCN_QUEUE_BEACON)
+                return &rt2x00dev->bcn[0];
+        else if (queue == RT2X00_BCN_QUEUE_ATIM && atim)
+                return &rt2x00dev->bcn[1];
+
+        return NULL;
+}
+EXPORT_SYMBOL_GPL(rt2x00queue_get_queue);
+
+struct queue_entry *rt2x00queue_get_entry(struct data_queue *queue,
+                                          enum queue_index index)
+{
+        struct queue_entry *entry;
+
+        if (unlikely(index >= Q_INDEX_MAX)) {
+                ERROR(queue->rt2x00dev,
+                      "Entry requested from invalid index type (%d)\n", index);
+                return NULL;
+        }
+
+        spin_lock(&queue->lock);
+
+        entry = &queue->entries[queue->index[index]];
+
+        spin_unlock(&queue->lock);
+
+        return entry;
+}
+EXPORT_SYMBOL_GPL(rt2x00queue_get_entry);
+
+void rt2x00queue_index_inc(struct data_queue *queue, enum queue_index index)
+{
+        if (unlikely(index >= Q_INDEX_MAX)) {
+                ERROR(queue->rt2x00dev,
+                      "Index change on invalid index type (%d)\n", index);
+                return;
+        }
+
+        spin_lock(&queue->lock);
+
+        queue->index[index]++;
+        if (queue->index[index] >= queue->limit)
+                queue->index[index] = 0;
+
+        if (index == Q_INDEX) {
+                queue->length++;
+        } else if (index == Q_INDEX_DONE) {
+                queue->length--;
+                queue->count ++;
+        }
+
+        spin_unlock(&queue->lock);
+}
+EXPORT_SYMBOL_GPL(rt2x00queue_index_inc);
+
+static void rt2x00queue_reset(struct data_queue *queue)
+{
+        spin_lock(&queue->lock);
+
+        queue->count = 0;
+        queue->length = 0;
+        memset(queue->index, 0, sizeof(queue->index));
+
+        spin_unlock(&queue->lock);
+}
+
+void rt2x00queue_init_rx(struct rt2x00_dev *rt2x00dev)
+{
+        struct data_queue *queue = rt2x00dev->rx;
+        unsigned int i;
+
+        rt2x00queue_reset(queue);
+
+        if (!rt2x00dev->ops->lib->init_rxentry)
+                return;
+
+        for (i = 0; i < queue->limit; i++)
+                rt2x00dev->ops->lib->init_rxentry(rt2x00dev,
+                                                  &queue->entries[i]);
+}
+
+void rt2x00queue_init_tx(struct rt2x00_dev *rt2x00dev)
+{
+        struct data_queue *queue;
+        unsigned int i;
+
+        txall_queue_for_each(rt2x00dev, queue) {
+                rt2x00queue_reset(queue);
+
+                if (!rt2x00dev->ops->lib->init_txentry)
+                        continue;
+
+                for (i = 0; i < queue->limit; i++)
+                        rt2x00dev->ops->lib->init_txentry(rt2x00dev,
+                                                          &queue->entries[i]);
+        }
+}
+
+static int rt2x00queue_alloc_entries(struct data_queue *queue,
+                                     const struct data_queue_desc *qdesc)
+{
+        struct queue_entry *entries;
+        unsigned int entry_size;
+        unsigned int i;
+
+        rt2x00queue_reset(queue);
+
+        queue->limit = qdesc->entry_num;
+        queue->data_size = qdesc->data_size;
+        queue->desc_size = qdesc->desc_size;
+
+        /*
+         * Allocate all queue entries.
+         */
+        entry_size = sizeof(*entries) + qdesc->priv_size;
+        entries = kzalloc(queue->limit * entry_size, GFP_KERNEL);
+        if (!entries)
+                return -ENOMEM;
+
+#define QUEUE_ENTRY_PRIV_OFFSET(__base, __index, __limit, __esize, __psize) \
+        ( ((char *)(__base)) + ((__limit) * (__esize)) + \
+            ((__index) * (__psize)) )
+
+        for (i = 0; i < queue->limit; i++) {
+                entries[i].flags = 0;
+                entries[i].queue = queue;
+                entries[i].skb = NULL;
+                entries[i].entry_idx = i;
+                entries[i].priv_data =
+                    QUEUE_ENTRY_PRIV_OFFSET(entries, i, queue->limit,
+                                            sizeof(*entries), qdesc->priv_size);
+        }
+
+#undef QUEUE_ENTRY_PRIV_OFFSET
+
+        queue->entries = entries;
+
+        return 0;
+}
+
+int rt2x00queue_initialize(struct rt2x00_dev *rt2x00dev)
+{
+        struct data_queue *queue;
+        int status;
+
+
+        status = rt2x00queue_alloc_entries(rt2x00dev->rx, rt2x00dev->ops->rx);
+        if (status)
+                goto exit;
+
+        tx_queue_for_each(rt2x00dev, queue) {
+                status = rt2x00queue_alloc_entries(queue, rt2x00dev->ops->tx);
+                if (status)
+                        goto exit;
+        }
+
+        status = rt2x00queue_alloc_entries(rt2x00dev->bcn, rt2x00dev->ops->bcn);
+        if (status)
+                goto exit;
+
+        if (!test_bit(DRIVER_REQUIRE_ATIM_QUEUE, &rt2x00dev->flags))
+                return 0;
+
+        status = rt2x00queue_alloc_entries(&rt2x00dev->bcn[1],
+                                           rt2x00dev->ops->atim);
+        if (status)
+                goto exit;
+
+        return 0;
+
+exit:
+        ERROR(rt2x00dev, "Queue entries allocation failed.\n");
+
+        rt2x00queue_uninitialize(rt2x00dev);
+
+        return status;
+}
+
+void rt2x00queue_uninitialize(struct rt2x00_dev *rt2x00dev)
+{
+        struct data_queue *queue;
+
+        queue_for_each(rt2x00dev, queue) {
+                kfree(queue->entries);
+                queue->entries = NULL;
+        }
+}
+
+static void rt2x00queue_init(struct rt2x00_dev *rt2x00dev,
+                             struct data_queue *queue, enum data_queue_qid qid)
+{
+        spin_lock_init(&queue->lock);
+
+        queue->rt2x00dev = rt2x00dev;
+        queue->qid = qid;
+        queue->aifs = 2;
+        queue->cw_min = 5;
+        queue->cw_max = 10;
+}
+
+int rt2x00queue_allocate(struct rt2x00_dev *rt2x00dev)
+{
+        struct data_queue *queue;
+        enum data_queue_qid qid;
+        unsigned int req_atim =
+            !!test_bit(DRIVER_REQUIRE_ATIM_QUEUE, &rt2x00dev->flags);
+
+        /*
+         * We need the following queues:
+         * RX: 1
+         * TX: hw->queues
+         * Beacon: 1
+         * Atim: 1 (if required)
+         */
+        rt2x00dev->data_queues = 2 + rt2x00dev->hw->queues + req_atim;
+
+        queue = kzalloc(rt2x00dev->data_queues * sizeof(*queue), GFP_KERNEL);
+        if (!queue) {
+                ERROR(rt2x00dev, "Queue allocation failed.\n");
+                return -ENOMEM;
+        }
+
+        /*
+         * Initialize pointers
+         */
+        rt2x00dev->rx = queue;
+        rt2x00dev->tx = &queue[1];
+        rt2x00dev->bcn = &queue[1 + rt2x00dev->hw->queues];
+
+        /*
+         * Initialize queue parameters.
+         * RX: qid = QID_RX
+         * TX: qid = QID_AC_BE + index
+         * TX: cw_min: 2^5 = 32.
+         * TX: cw_max: 2^10 = 1024.
+         * BCN & Atim: qid = QID_MGMT
+         */
+        rt2x00queue_init(rt2x00dev, rt2x00dev->rx, QID_RX);
+
+        qid = QID_AC_BE;
+        tx_queue_for_each(rt2x00dev, queue)
+                rt2x00queue_init(rt2x00dev, queue, qid++);
+
+        rt2x00queue_init(rt2x00dev, &rt2x00dev->bcn[0], QID_MGMT);
+        if (req_atim)
+                rt2x00queue_init(rt2x00dev, &rt2x00dev->bcn[1], QID_MGMT);
+
+        return 0;
+}
+
+void rt2x00queue_free(struct rt2x00_dev *rt2x00dev)
+{
+        kfree(rt2x00dev->rx);
+        rt2x00dev->rx = NULL;
+        rt2x00dev->tx = NULL;
+        rt2x00dev->bcn = NULL;
+}
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.h b/drivers/net/wireless/rt2x00/rt2x00queue.h
new file mode 100644
index 000000000000..fbabf389b622
--- /dev/null
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.h
@@ -0,0 +1,457 @@
+/*
+        Copyright (C) 2004 - 2008 rt2x00 SourceForge Project
+        <http://rt2x00.serialmonkey.com>
+
+        This program is free software; you can redistribute it and/or modify
+        it under the terms of the GNU General Public License as published by
+        the Free Software Foundation; either version 2 of the License, or
+        (at your option) any later version.
+
+        This program is distributed in the hope that it will be useful,
+        but WITHOUT ANY WARRANTY; without even the implied warranty of
+        MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+        GNU General Public License for more details.
+
+        You should have received a copy of the GNU General Public License
+        along with this program; if not, write to the
+        Free Software Foundation, Inc.,
+        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+/*
+        Module: rt2x00
+        Abstract: rt2x00 queue datastructures and routines
+ */
+
+#ifndef RT2X00QUEUE_H
+#define RT2X00QUEUE_H
+
+#include <linux/prefetch.h>
+
+/**
+ * DOC: Entrie frame size
+ *
+ * Ralink PCI devices demand the Frame size to be a multiple of 128 bytes,
+ * for USB devices this restriction does not apply, but the value of
+ * 2432 makes sense since it is big enough to contain the maximum fragment
+ * size according to the ieee802.11 specs.
+ */
+#define DATA_FRAME_SIZE 2432
+#define MGMT_FRAME_SIZE 256
+
+/**
+ * DOC: Number of entries per queue
+ *
+ * After research it was concluded that 12 entries in a RX and TX
+ * queue would be sufficient. Although this is almost one third of
+ * the amount the legacy driver allocated, the queues aren't getting
+ * filled to the maximum even when working with the maximum rate.
+ */
+#define RX_ENTRIES      12
+#define TX_ENTRIES      12
+#define BEACON_ENTRIES  1
+#define ATIM_ENTRIES    1
+
+/**
+ * enum data_queue_qid: Queue identification
+ */
+enum data_queue_qid {
+        QID_AC_BE = 0,
+        QID_AC_BK = 1,
+        QID_AC_VI = 2,
+        QID_AC_VO = 3,
+        QID_HCCA = 4,
+        QID_MGMT = 13,
+        QID_RX = 14,
+        QID_OTHER = 15,
+};
+
+/**
+ * enum rt2x00_bcn_queue: Beacon queue index
+ *
+ * Start counting with a high offset, this because this enumeration
+ * supplements &enum ieee80211_tx_queue and we should prevent value
+ * conflicts.
+ *
+ * @RT2X00_BCN_QUEUE_BEACON: Beacon queue
+ * @RT2X00_BCN_QUEUE_ATIM: Atim queue (sends frame after beacon)
+ */
+enum rt2x00_bcn_queue {
+        RT2X00_BCN_QUEUE_BEACON = 100,
+        RT2X00_BCN_QUEUE_ATIM = 101,
+};
+
+/**
+ * enum skb_frame_desc_flags: Flags for &struct skb_frame_desc
+ *
+ * @FRAME_DESC_DRIVER_GENERATED: Frame was generated inside driver
+ *      and should not be reported back to mac80211 during txdone.
+ */
+enum skb_frame_desc_flags {
+        FRAME_DESC_DRIVER_GENERATED = 1 << 0,
+};
+
+/**
+ * struct skb_frame_desc: Descriptor information for the skb buffer
+ *
+ * This structure is placed over the skb->cb array, this means that
+ * this structure should not exceed the size of that array (48 bytes).
+ *
+ * @flags: Frame flags, see &enum skb_frame_desc_flags.
+ * @frame_type: Frame type, see &enum rt2x00_dump_type.
+ * @data: Pointer to data part of frame (Start of ieee80211 header).
+ * @desc: Pointer to descriptor part of the frame.
+ *      Note that this pointer could point to something outside
+ *      of the scope of the skb->data pointer.
+ * @data_len: Length of the frame data.
+ * @desc_len: Length of the frame descriptor.
+
+ * @entry: The entry to which this sk buffer belongs.
+ */
+struct skb_frame_desc {
+        unsigned int flags;
+
+        unsigned int frame_type;
+
+        void *data;
+        void *desc;
+
+        unsigned int data_len;
+        unsigned int desc_len;
+
+        struct queue_entry *entry;
+};
+
+static inline struct skb_frame_desc* get_skb_frame_desc(struct sk_buff *skb)
+{
+        BUILD_BUG_ON(sizeof(struct skb_frame_desc) > sizeof(skb->cb));
+        return (struct skb_frame_desc *)&skb->cb[0];
+}
+
+/**
+ * struct rxdone_entry_desc: RX Entry descriptor
+ *
+ * Summary of information that has been read from the RX frame descriptor.
+ *
+ * @signal: Signal of the received frame.
+ * @rssi: RSSI of the received frame.
+ * @ofdm: Was frame send with an OFDM rate.
+ * @size: Data size of the received frame.
+ * @flags: MAC80211 receive flags (See &enum mac80211_rx_flags).
+ * @my_bss: Does this frame originate from device's BSS.
+ */
+struct rxdone_entry_desc {
+        int signal;
+        int rssi;
+        int ofdm;
+        int size;
+        int flags;
+        int my_bss;
+};
+
+/**
+ * struct txdone_entry_desc: TX done entry descriptor
+ *
+ * Summary of information that has been read from the TX frame descriptor
+ * after the device is done with transmission.
+ *
+ * @control: Control structure which was used to transmit the frame.
+ * @status: TX status (See &enum tx_status).
+ * @retry: Retry count.
+ */
+struct txdone_entry_desc {
+        struct ieee80211_tx_control *control;
+        int status;
+        int retry;
+};
+
+/**
+ * enum txentry_desc_flags: Status flags for TX entry descriptor
+ *
+ * @ENTRY_TXD_RTS_FRAME: This frame is a RTS frame.
+ * @ENTRY_TXD_OFDM_RATE: This frame is send out with an OFDM rate.
+ * @ENTRY_TXD_MORE_FRAG: This frame is followed by another fragment.
+ * @ENTRY_TXD_REQ_TIMESTAMP: Require timestamp to be inserted.
+ * @ENTRY_TXD_BURST: This frame belongs to the same burst event.
+ * @ENTRY_TXD_ACK: An ACK is required for this frame.
+ */
+enum txentry_desc_flags {
+        ENTRY_TXD_RTS_FRAME,
+        ENTRY_TXD_OFDM_RATE,
+        ENTRY_TXD_MORE_FRAG,
+        ENTRY_TXD_REQ_TIMESTAMP,
+        ENTRY_TXD_BURST,
+        ENTRY_TXD_ACK,
+};
+
+/**
+ * struct txentry_desc: TX Entry descriptor
+ *
+ * Summary of information for the frame descriptor before sending a TX frame.
+ *
+ * @flags: Descriptor flags (See &enum queue_entry_flags).
+ * @queue: Queue identification (See &enum data_queue_qid).
+ * @length_high: PLCP length high word.
+ * @length_low: PLCP length low word.
+ * @signal: PLCP signal.
+ * @service: PLCP service.
+ * @aifs: AIFS value.
+ * @ifs: IFS value.
+ * @cw_min: cwmin value.
+ * @cw_max: cwmax value.
+ */
+struct txentry_desc {
+        unsigned long flags;
+
+        enum data_queue_qid queue;
+
+        u16 length_high;
+        u16 length_low;
+        u16 signal;
+        u16 service;
+
+        int aifs;
+        int ifs;
+        int cw_min;
+        int cw_max;
+};
+
+/**
+ * enum queue_entry_flags: Status flags for queue entry
+ *
+ * @ENTRY_BCN_ASSIGNED: This entry has been assigned to an interface.
+ *      As long as this bit is set, this entry may only be touched
+ *      through the interface structure.
+ * @ENTRY_OWNER_DEVICE_DATA: This entry is owned by the device for data
+ *      transfer (either TX or RX depending on the queue). The entry should
+ *      only be touched after the device has signaled it is done with it.
+ * @ENTRY_OWNER_DEVICE_CRYPTO: This entry is owned by the device for data
+ *      encryption or decryption. The entry should only be touched after
+ *      the device has signaled it is done with it.
+ */
+
+enum queue_entry_flags {
+        ENTRY_BCN_ASSIGNED,
+        ENTRY_OWNER_DEVICE_DATA,
+        ENTRY_OWNER_DEVICE_CRYPTO,
+};
+
+/**
+ * struct queue_entry: Entry inside the &struct data_queue
+ *
+ * @flags: Entry flags, see &enum queue_entry_flags.
+ * @queue: The data queue (&struct data_queue) to which this entry belongs.
+ * @skb: The buffer which is currently being transmitted (for TX queue),
+ *      or used to directly recieve data in (for RX queue).
+ * @entry_idx: The entry index number.
+ * @priv_data: Private data belonging to this queue entry. The pointer
+ *      points to data specific to a particular driver and queue type.
+ */
+struct queue_entry {
+        unsigned long flags;
+
+        struct data_queue *queue;
+
+        struct sk_buff *skb;
+
+        unsigned int entry_idx;
+
+        void *priv_data;
+};
+
+/**
+ * enum queue_index: Queue index type
+ *
+ * @Q_INDEX: Index pointer to the current entry in the queue, if this entry is
+ *      owned by the hardware then the queue is considered to be full.
+ * @Q_INDEX_DONE: Index pointer to the next entry which will be completed by
+ *      the hardware and for which we need to run the txdone handler. If this
+ *      entry is not owned by the hardware the queue is considered to be empty.
+ * @Q_INDEX_CRYPTO: Index pointer to the next entry which encryption/decription
+ *      will be completed by the hardware next.
+ * @Q_INDEX_MAX: Keep last, used in &struct data_queue to determine the size
+ *      of the index array.
+ */
+enum queue_index {
+        Q_INDEX,
+        Q_INDEX_DONE,
+        Q_INDEX_CRYPTO,
+        Q_INDEX_MAX,
+};
+
+/**
+ * struct data_queue: Data queue
+ *
+ * @rt2x00dev: Pointer to main &struct rt2x00dev where this queue belongs to.
+ * @entries: Base address of the &struct queue_entry which are
+ *      part of this queue.
+ * @qid: The queue identification, see &enum data_queue_qid.
+ * @lock: Spinlock to protect index handling. Whenever @index, @index_done or
+ *      @index_crypt needs to be changed this lock should be grabbed to prevent
+ *      index corruption due to concurrency.
+ * @count: Number of frames handled in the queue.
+ * @limit: Maximum number of entries in the queue.
+ * @length: Number of frames in queue.
+ * @index: Index pointers to entry positions in the queue,
+ *      use &enum queue_index to get a specific index field.
+ * @aifs: The aifs value for outgoing frames (field ignored in RX queue).
+ * @cw_min: The cw min value for outgoing frames (field ignored in RX queue).
+ * @cw_max: The cw max value for outgoing frames (field ignored in RX queue).
+ * @data_size: Maximum data size for the frames in this queue.
+ * @desc_size: Hardware descriptor size for the data in this queue.
+ */
+struct data_queue {
+        struct rt2x00_dev *rt2x00dev;
+        struct queue_entry *entries;
+
+        enum data_queue_qid qid;
+
+        spinlock_t lock;
+        unsigned int count;
+        unsigned short limit;
+        unsigned short length;
+        unsigned short index[Q_INDEX_MAX];
+
+        unsigned short aifs;
+        unsigned short cw_min;
+        unsigned short cw_max;
+
+        unsigned short data_size;
+        unsigned short desc_size;
+};
+
+/**
+ * struct data_queue_desc: Data queue description
+ *
+ * The information in this structure is used by drivers
+ * to inform rt2x00lib about the creation of the data queue.
+ *
+ * @entry_num: Maximum number of entries for a queue.
+ * @data_size: Maximum data size for the frames in this queue.
+ * @desc_size: Hardware descriptor size for the data in this queue.
+ * @priv_size: Size of per-queue_entry private data.
+ */
+struct data_queue_desc {
+        unsigned short entry_num;
+        unsigned short data_size;
+        unsigned short desc_size;
+        unsigned short priv_size;
+};
+
+/**
+ * queue_end - Return pointer to the last queue (HELPER MACRO).
+ * @__dev: Pointer to &struct rt2x00_dev
+ *
+ * Using the base rx pointer and the maximum number of available queues,
+ * this macro will return the address of 1 position beyond  the end of the
+ * queues array.
+ */
+#define queue_end(__dev) \
+        &(__dev)->rx[(__dev)->data_queues]
+
+/**
+ * tx_queue_end - Return pointer to the last TX queue (HELPER MACRO).
+ * @__dev: Pointer to &struct rt2x00_dev
+ *
+ * Using the base tx pointer and the maximum number of available TX
+ * queues, this macro will return the address of 1 position beyond
+ * the end of the TX queue array.
+ */
+#define tx_queue_end(__dev) \
+        &(__dev)->tx[(__dev)->hw->queues]
+
+/**
+ * queue_loop - Loop through the queues within a specific range (HELPER MACRO).
+ * @__entry: Pointer where the current queue entry will be stored in.
+ * @__start: Start queue pointer.
+ * @__end: End queue pointer.
+ *
+ * This macro will loop through all queues between &__start and &__end.
+ */
+#define queue_loop(__entry, __start, __end)                     \
+        for ((__entry) = (__start);                             \
+             prefetch(&(__entry)[1]), (__entry) != (__end);     \
+             (__entry) = &(__entry)[1])
+
+/**
+ * queue_for_each - Loop through all queues
+ * @__dev: Pointer to &struct rt2x00_dev
+ * @__entry: Pointer where the current queue entry will be stored in.
+ *
+ * This macro will loop through all available queues.
+ */
+#define queue_for_each(__dev, __entry) \
+        queue_loop(__entry, (__dev)->rx, queue_end(__dev))
+
+/**
+ * tx_queue_for_each - Loop through the TX queues
+ * @__dev: Pointer to &struct rt2x00_dev
+ * @__entry: Pointer where the current queue entry will be stored in.
+ *
+ * This macro will loop through all TX related queues excluding
+ * the Beacon and Atim queues.
+ */
+#define tx_queue_for_each(__dev, __entry) \
+        queue_loop(__entry, (__dev)->tx, tx_queue_end(__dev))
+
+/**
+ * txall_queue_for_each - Loop through all TX related queues
+ * @__dev: Pointer to &struct rt2x00_dev
+ * @__entry: Pointer where the current queue entry will be stored in.
+ *
+ * This macro will loop through all TX related queues including
+ * the Beacon and Atim queues.
+ */
+#define txall_queue_for_each(__dev, __entry) \
+        queue_loop(__entry, (__dev)->tx, queue_end(__dev))
+
+/**
+ * rt2x00queue_empty - Check if the queue is empty.
+ * @queue: Queue to check if empty.
+ */
+static inline int rt2x00queue_empty(struct data_queue *queue)
+{
+        return queue->length == 0;
+}
+
+/**
+ * rt2x00queue_full - Check if the queue is full.
+ * @queue: Queue to check if full.
+ */
+static inline int rt2x00queue_full(struct data_queue *queue)
+{
+        return queue->length == queue->limit;
+}
+
+/**
+ * rt2x00queue_free - Check the number of available entries in queue.
+ * @queue: Queue to check.
+ */
+static inline int rt2x00queue_available(struct data_queue *queue)
+{
+        return queue->limit - queue->length;
+}
+
+/**
+ * rt2x00_desc_read - Read a word from the hardware descriptor.
+ * @desc: Base descriptor address
+ * @word: Word index from where the descriptor should be read.
+ * @value: Address where the descriptor value should be written into.
+ */
+static inline void rt2x00_desc_read(__le32 *desc, const u8 word, u32 *value)
+{
+        *value = le32_to_cpu(desc[word]);
+}
+
+/**
+ * rt2x00_desc_write - wrote a word to the hardware descriptor.
+ * @desc: Base descriptor address
+ * @word: Word index from where the descriptor should be written.
+ * @value: Value that should be written into the descriptor.
+ */
+static inline void rt2x00_desc_write(__le32 *desc, const u8 word, u32 value)
+{
+        desc[word] = cpu_to_le32(value);
+}
+
+#endif /* RT2X00QUEUE_H */
diff --git a/drivers/net/wireless/rt2x00/rt2x00reg.h b/drivers/net/wireless/rt2x00/rt2x00reg.h
index b1915dc7dda1..0325bed2fbf5 100644
--- a/drivers/net/wireless/rt2x00/rt2x00reg.h
+++ b/drivers/net/wireless/rt2x00/rt2x00reg.h
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2007 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2008 rt2x00 SourceForge Project
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
@@ -29,7 +29,7 @@
 /*
  * TX result flags.
  */
-enum TX_STATUS {
+enum tx_status {
         TX_SUCCESS = 0,
         TX_SUCCESS_RETRY = 1,
         TX_FAIL_RETRY = 2,
@@ -220,75 +220,4 @@ static inline u8 rt2x00_get_field8(const u8 reg,
         return (reg & field.bit_mask) >> field.bit_offset;
 }
 
-/*
- * Device specific rate value.
- * We will have to create the device specific rate value
- * passed to the ieee80211 kernel. We need to make it a consist of
- * multiple fields because we want to store more then 1 device specific
- * values inside the value.
- *      1 - rate, stored as 100 kbit/s.
- *      2 - preamble, short_preamble enabled flag.
- *      3 - MASK_RATE, which rates are enabled in this mode, this mask
- *      corresponds with the TX register format for the current device.
- *      4 - plcp, 802.11b rates are device specific,
- *      802.11g rates are set according to the ieee802.11a-1999 p.14.
- * The bit to enable preamble is set in a seperate define.
- */
-#define DEV_RATE        FIELD32(0x000007ff)
-#define DEV_PREAMBLE    FIELD32(0x00000800)
-#define DEV_RATEMASK    FIELD32(0x00fff000)
-#define DEV_PLCP        FIELD32(0xff000000)
-
-/*
- * Bitfields
- */
-#define DEV_RATEBIT_1MB         ( 1 << 0 )
-#define DEV_RATEBIT_2MB         ( 1 << 1 )
-#define DEV_RATEBIT_5_5MB       ( 1 << 2 )
-#define DEV_RATEBIT_11MB        ( 1 << 3 )
-#define DEV_RATEBIT_6MB         ( 1 << 4 )
-#define DEV_RATEBIT_9MB         ( 1 << 5 )
-#define DEV_RATEBIT_12MB        ( 1 << 6 )
-#define DEV_RATEBIT_18MB        ( 1 << 7 )
-#define DEV_RATEBIT_24MB        ( 1 << 8 )
-#define DEV_RATEBIT_36MB        ( 1 << 9 )
-#define DEV_RATEBIT_48MB        ( 1 << 10 )
-#define DEV_RATEBIT_54MB        ( 1 << 11 )
-
-/*
- * Bitmasks for DEV_RATEMASK
- */
-#define DEV_RATEMASK_1MB        ( (DEV_RATEBIT_1MB << 1) -1 )
-#define DEV_RATEMASK_2MB        ( (DEV_RATEBIT_2MB << 1) -1 )
-#define DEV_RATEMASK_5_5MB      ( (DEV_RATEBIT_5_5MB << 1) -1 )
-#define DEV_RATEMASK_11MB       ( (DEV_RATEBIT_11MB << 1) -1 )
-#define DEV_RATEMASK_6MB        ( (DEV_RATEBIT_6MB << 1) -1 )
-#define DEV_RATEMASK_9MB        ( (DEV_RATEBIT_9MB << 1) -1 )
-#define DEV_RATEMASK_12MB       ( (DEV_RATEBIT_12MB << 1) -1 )
-#define DEV_RATEMASK_18MB       ( (DEV_RATEBIT_18MB << 1) -1 )
-#define DEV_RATEMASK_24MB       ( (DEV_RATEBIT_24MB << 1) -1 )
-#define DEV_RATEMASK_36MB       ( (DEV_RATEBIT_36MB << 1) -1 )
-#define DEV_RATEMASK_48MB       ( (DEV_RATEBIT_48MB << 1) -1 )
-#define DEV_RATEMASK_54MB       ( (DEV_RATEBIT_54MB << 1) -1 )
-
-/*
- * Bitmask groups of bitrates
- */
-#define DEV_BASIC_RATEMASK \
-        ( DEV_RATEMASK_11MB | \
-          DEV_RATEBIT_6MB | DEV_RATEBIT_12MB | DEV_RATEBIT_24MB )
-
-#define DEV_CCK_RATEMASK        ( DEV_RATEMASK_11MB )
-#define DEV_OFDM_RATEMASK       ( DEV_RATEMASK_54MB & ~DEV_CCK_RATEMASK )
-
-/*
- * Macro's to set and get specific fields from the device specific val and val2
- * fields inside the ieee80211_rate entry.
- */
-#define DEVICE_SET_RATE_FIELD(__value, __mask) \
-        (int)( ((__value) << DEV_##__mask.bit_offset) & DEV_##__mask.bit_mask )
-
-#define DEVICE_GET_RATE_FIELD(__value, __mask) \
-        (int)( ((__value) & DEV_##__mask.bit_mask) >> DEV_##__mask.bit_offset )
-
 #endif /* RT2X00REG_H */
diff --git a/drivers/net/wireless/rt2x00/rt2x00rfkill.c b/drivers/net/wireless/rt2x00/rt2x00rfkill.c
index 34a96d44e306..67121427a5bd 100644
--- a/drivers/net/wireless/rt2x00/rt2x00rfkill.c
+++ b/drivers/net/wireless/rt2x00/rt2x00rfkill.c
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2007 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2008 rt2x00 SourceForge Project
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
diff --git a/drivers/net/wireless/rt2x00/rt2x00ring.h b/drivers/net/wireless/rt2x00/rt2x00ring.h
deleted file mode 100644
index 1caa6d688c40..000000000000
--- a/drivers/net/wireless/rt2x00/rt2x00ring.h
+++ /dev/null
@@ -1,290 +0,0 @@
-/*
-        Copyright (C) 2004 - 2007 rt2x00 SourceForge Project
-        <http://rt2x00.serialmonkey.com>
-
-        This program is free software; you can redistribute it and/or modify
-        it under the terms of the GNU General Public License as published by
-        the Free Software Foundation; either version 2 of the License, or
-        (at your option) any later version.
-
-        This program is distributed in the hope that it will be useful,
-        but WITHOUT ANY WARRANTY; without even the implied warranty of
-        MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-        GNU General Public License for more details.
-
-        You should have received a copy of the GNU General Public License
-        along with this program; if not, write to the
-        Free Software Foundation, Inc.,
-        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
- */
-
-/*
-        Module: rt2x00
-        Abstract: rt2x00 ring datastructures and routines
- */
-
-#ifndef RT2X00RING_H
-#define RT2X00RING_H
-
-/*
- * skb_desc
- * Descriptor information for the skb buffer
- */
-struct skb_desc {
-        unsigned int frame_type;
-
-        unsigned int desc_len;
-        unsigned int data_len;
-
-        void *desc;
-        void *data;
-
-        struct data_ring *ring;
-        struct data_entry *entry;
-};
-
-static inline struct skb_desc* get_skb_desc(struct sk_buff *skb)
-{
-        return (struct skb_desc*)&skb->cb[0];
-}
-
-/*
- * rxdata_entry_desc
- * Summary of information that has been read from the
- * RX frame descriptor.
- */
-struct rxdata_entry_desc {
-        int signal;
-        int rssi;
-        int ofdm;
-        int size;
-        int flags;
-        int my_bss;
-};
-
-/*
- * txdata_entry_desc
- * Summary of information that should be written into the
- * descriptor for sending a TX frame.
- */
-struct txdata_entry_desc {
-        unsigned long flags;
-#define ENTRY_TXDONE            1
-#define ENTRY_TXD_RTS_FRAME     2
-#define ENTRY_TXD_OFDM_RATE     3
-#define ENTRY_TXD_MORE_FRAG     4
-#define ENTRY_TXD_REQ_TIMESTAMP 5
-#define ENTRY_TXD_BURST         6
-#define ENTRY_TXD_ACK           7
-
-/*
- * Queue ID. ID's 0-4 are data TX rings
- */
-        int queue;
-#define QUEUE_MGMT              13
-#define QUEUE_RX                14
-#define QUEUE_OTHER             15
-
-        /*
-         * PLCP values.
-         */
-        u16 length_high;
-        u16 length_low;
-        u16 signal;
-        u16 service;
-
-        /*
-         * Timing information
-         */
-        int aifs;
-        int ifs;
-        int cw_min;
-        int cw_max;
-};
-
-/*
- * data_entry
- * The data ring is a list of data entries.
- * Each entry holds a reference to the descriptor
- * and the data buffer. For TX rings the reference to the
- * sk_buff of the packet being transmitted is also stored here.
- */
-struct data_entry {
-        /*
-         * Status flags
-         */
-        unsigned long flags;
-#define ENTRY_OWNER_NIC         1
-
-        /*
-         * Ring we belong to.
-         */
-        struct data_ring *ring;
-
-        /*
-         * sk_buff for the packet which is being transmitted
-         * in this entry (Only used with TX related rings).
-         */
-        struct sk_buff *skb;
-
-        /*
-         * Store a ieee80211_tx_status structure in each
-         * ring entry, this will optimize the txdone
-         * handler.
-         */
-        struct ieee80211_tx_status tx_status;
-
-        /*
-         * private pointer specific to driver.
-         */
-        void *priv;
-
-        /*
-         * Data address for this entry.
-         */
-        void *data_addr;
-        dma_addr_t data_dma;
-
-        /*
-         * Entry identification number (index).
-         */
-        unsigned int entry_idx;
-};
-
-/*
- * data_ring
- * Data rings are used by the device to send and receive packets.
- * The data_addr is the base address of the data memory.
- * To determine at which point in the ring we are,
- * have to use the rt2x00_ring_index_*() functions.
- */
-struct data_ring {
-        /*
-         * Pointer to main rt2x00dev structure where this
-         * ring belongs to.
-         */
-        struct rt2x00_dev *rt2x00dev;
-
-        /*
-         * Base address for the device specific data entries.
-         */
-        struct data_entry *entry;
-
-        /*
-         * TX queue statistic info.
-         */
-        struct ieee80211_tx_queue_stats_data stats;
-
-        /*
-         * TX Queue parameters.
-         */
-        struct ieee80211_tx_queue_params tx_params;
-
-        /*
-         * Base address for data ring.
-         */
-        dma_addr_t data_dma;
-        void *data_addr;
-
-        /*
-         * Queue identification number:
-         * RX: 0
-         * TX: IEEE80211_TX_*
-         */
-        unsigned int queue_idx;
-
-        /*
-         * Index variables.
-         */
-        u16 index;
-        u16 index_done;
-
-        /*
-         * Size of packet and descriptor in bytes.
-         */
-        u16 data_size;
-        u16 desc_size;
-};
-
-/*
- * Handlers to determine the address of the current device specific
- * data entry, where either index or index_done points to.
- */
-static inline struct data_entry *rt2x00_get_data_entry(struct data_ring *ring)
-{
-        return &ring->entry[ring->index];
-}
-
-static inline struct data_entry *rt2x00_get_data_entry_done(struct data_ring
-                                                            *ring)
-{
-        return &ring->entry[ring->index_done];
-}
-
-/*
- * Total ring memory
- */
-static inline int rt2x00_get_ring_size(struct data_ring *ring)
-{
-        return ring->stats.limit * (ring->desc_size + ring->data_size);
-}
-
-/*
- * Ring index manipulation functions.
- */
-static inline void rt2x00_ring_index_inc(struct data_ring *ring)
-{
-        ring->index++;
-        if (ring->index >= ring->stats.limit)
-                ring->index = 0;
-        ring->stats.len++;
-}
-
-static inline void rt2x00_ring_index_done_inc(struct data_ring *ring)
-{
-        ring->index_done++;
-        if (ring->index_done >= ring->stats.limit)
-                ring->index_done = 0;
-        ring->stats.len--;
-        ring->stats.count++;
-}
-
-static inline void rt2x00_ring_index_clear(struct data_ring *ring)
-{
-        ring->index = 0;
-        ring->index_done = 0;
-        ring->stats.len = 0;
-        ring->stats.count = 0;
-}
-
-static inline int rt2x00_ring_empty(struct data_ring *ring)
-{
-        return ring->stats.len == 0;
-}
-
-static inline int rt2x00_ring_full(struct data_ring *ring)
-{
-        return ring->stats.len == ring->stats.limit;
-}
-
-static inline int rt2x00_ring_free(struct data_ring *ring)
-{
-        return ring->stats.limit - ring->stats.len;
-}
-
-/*
- * TX/RX Descriptor access functions.
- */
-static inline void rt2x00_desc_read(__le32 *desc,
-                                    const u8 word, u32 *value)
-{
-        *value = le32_to_cpu(desc[word]);
-}
-
-static inline void rt2x00_desc_write(__le32 *desc,
-                                     const u8 word, const u32 value)
-{
-        desc[word] = cpu_to_le32(value);
-}
-
-#endif /* RT2X00RING_H */
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.c b/drivers/net/wireless/rt2x00/rt2x00usb.c
index 84e9bdb73910..063b167da31e 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.c
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.c
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2007 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2008 rt2x00 SourceForge Project
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
@@ -40,8 +40,7 @@ int rt2x00usb_vendor_request(struct rt2x00_dev *rt2x00dev,
                              void *buffer, const u16 buffer_length,
                              const int timeout)
 {
-        struct usb_device *usb_dev =
-            interface_to_usbdev(rt2x00dev_usb(rt2x00dev));
+        struct usb_device *usb_dev = rt2x00dev_usb_dev(rt2x00dev);
         int status;
         unsigned int i;
         unsigned int pipe =
@@ -85,20 +84,20 @@ int rt2x00usb_vendor_req_buff_lock(struct rt2x00_dev *rt2x00dev,
         /*
          * Check for Cache availability.
          */
-        if (unlikely(!rt2x00dev->csr_cache || buffer_length > CSR_CACHE_SIZE)) {
+        if (unlikely(!rt2x00dev->csr.cache || buffer_length > CSR_CACHE_SIZE)) {
                 ERROR(rt2x00dev, "CSR cache not available.\n");
                 return -ENOMEM;
         }
 
         if (requesttype == USB_VENDOR_REQUEST_OUT)
-                memcpy(rt2x00dev->csr_cache, buffer, buffer_length);
+                memcpy(rt2x00dev->csr.cache, buffer, buffer_length);
 
         status = rt2x00usb_vendor_request(rt2x00dev, request, requesttype,
-                                          offset, 0, rt2x00dev->csr_cache,
+                                          offset, 0, rt2x00dev->csr.cache,
                                           buffer_length, timeout);
 
         if (!status && requesttype == USB_VENDOR_REQUEST_IN)
-                memcpy(buffer, rt2x00dev->csr_cache, buffer_length);
+                memcpy(buffer, rt2x00dev->csr.cache, buffer_length);
 
         return status;
 }
@@ -128,15 +127,15 @@ EXPORT_SYMBOL_GPL(rt2x00usb_vendor_request_buff);
  */
 static void rt2x00usb_interrupt_txdone(struct urb *urb)
 {
-        struct data_entry *entry = (struct data_entry *)urb->context;
-        struct data_ring *ring = entry->ring;
-        struct rt2x00_dev *rt2x00dev = ring->rt2x00dev;
+        struct queue_entry *entry = (struct queue_entry *)urb->context;
+        struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
+        struct queue_entry_priv_usb_tx *priv_tx = entry->priv_data;
+        struct txdone_entry_desc txdesc;
         __le32 *txd = (__le32 *)entry->skb->data;
         u32 word;
-        int tx_status;
 
         if (!test_bit(DEVICE_ENABLED_RADIO, &rt2x00dev->flags) ||
-            !__test_and_clear_bit(ENTRY_OWNER_NIC, &entry->flags))
+            !__test_and_clear_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags))
                 return;
 
         rt2x00_desc_read(txd, 0, &word);
@@ -144,45 +143,46 @@ static void rt2x00usb_interrupt_txdone(struct urb *urb)
         /*
          * Remove the descriptor data from the buffer.
          */
-        skb_pull(entry->skb, ring->desc_size);
+        skb_pull(entry->skb, entry->queue->desc_size);
 
         /*
          * Obtain the status about this packet.
          */
-        tx_status = !urb->status ? TX_SUCCESS : TX_FAIL_RETRY;
+        txdesc.status = !urb->status ? TX_SUCCESS : TX_FAIL_RETRY;
+        txdesc.retry = 0;
+        txdesc.control = &priv_tx->control;
 
-        rt2x00lib_txdone(entry, tx_status, 0);
+        rt2x00lib_txdone(entry, &txdesc);
 
         /*
          * Make this entry available for reuse.
          */
         entry->flags = 0;
-        rt2x00_ring_index_done_inc(entry->ring);
+        rt2x00queue_index_inc(entry->queue, Q_INDEX_DONE);
 
         /*
-         * If the data ring was full before the txdone handler
+         * If the data queue was full before the txdone handler
          * we must make sure the packet queue in the mac80211 stack
          * is reenabled when the txdone handler has finished.
          */
-        if (!rt2x00_ring_full(ring))
-                ieee80211_wake_queue(rt2x00dev->hw,
-                                     entry->tx_status.control.queue);
+        if (!rt2x00queue_full(entry->queue))
+                ieee80211_wake_queue(rt2x00dev->hw, priv_tx->control.queue);
 }
 
 int rt2x00usb_write_tx_data(struct rt2x00_dev *rt2x00dev,
-                            struct data_ring *ring, struct sk_buff *skb,
+                            struct data_queue *queue, struct sk_buff *skb,
                             struct ieee80211_tx_control *control)
 {
-        struct usb_device *usb_dev =
-            interface_to_usbdev(rt2x00dev_usb(rt2x00dev));
-        struct data_entry *entry = rt2x00_get_data_entry(ring);
-        struct skb_desc *desc;
+        struct usb_device *usb_dev = rt2x00dev_usb_dev(rt2x00dev);
+        struct queue_entry *entry = rt2x00queue_get_entry(queue, Q_INDEX);
+        struct queue_entry_priv_usb_tx *priv_tx = entry->priv_data;
+        struct skb_frame_desc *skbdesc;
         u32 length;
 
-        if (rt2x00_ring_full(ring))
+        if (rt2x00queue_full(queue))
                 return -EINVAL;
 
-        if (test_bit(ENTRY_OWNER_NIC, &entry->flags)) {
+        if (test_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags)) {
                 ERROR(rt2x00dev,
                       "Arrived at non-free entry in the non-full queue %d.\n"
                       "Please file bug report to %s.\n",
@@ -193,19 +193,18 @@ int rt2x00usb_write_tx_data(struct rt2x00_dev *rt2x00dev,
         /*
          * Add the descriptor in front of the skb.
          */
-        skb_push(skb, ring->desc_size);
-        memset(skb->data, 0, ring->desc_size);
+        skb_push(skb, queue->desc_size);
+        memset(skb->data, 0, queue->desc_size);
 
         /*
          * Fill in skb descriptor
          */
-        desc = get_skb_desc(skb);
-        desc->desc_len = ring->desc_size;
-        desc->data_len = skb->len - ring->desc_size;
-        desc->desc = skb->data;
-        desc->data = skb->data + ring->desc_size;
-        desc->ring = ring;
-        desc->entry = entry;
+        skbdesc = get_skb_frame_desc(skb);
+        skbdesc->data = skb->data + queue->desc_size;
+        skbdesc->data_len = skb->len - queue->desc_size;
+        skbdesc->desc = skb->data;
+        skbdesc->desc_len = queue->desc_size;
+        skbdesc->entry = entry;
 
         rt2x00lib_write_tx_desc(rt2x00dev, skb, control);
 
@@ -219,12 +218,12 @@ int rt2x00usb_write_tx_data(struct rt2x00_dev *rt2x00dev,
         /*
          * Initialize URB and send the frame to the device.
          */
-        __set_bit(ENTRY_OWNER_NIC, &entry->flags);
-        usb_fill_bulk_urb(entry->priv, usb_dev, usb_sndbulkpipe(usb_dev, 1),
+        __set_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags);
+        usb_fill_bulk_urb(priv_tx->urb, usb_dev, usb_sndbulkpipe(usb_dev, 1),
                           skb->data, length, rt2x00usb_interrupt_txdone, entry);
-        usb_submit_urb(entry->priv, GFP_ATOMIC);
+        usb_submit_urb(priv_tx->urb, GFP_ATOMIC);
 
-        rt2x00_ring_index_inc(ring);
+        rt2x00queue_index_inc(queue, Q_INDEX);
 
         return 0;
 }
@@ -233,20 +232,41 @@ EXPORT_SYMBOL_GPL(rt2x00usb_write_tx_data);
 /*
  * RX data handlers.
  */
+static struct sk_buff* rt2x00usb_alloc_rxskb(struct data_queue *queue)
+{
+        struct sk_buff *skb;
+        unsigned int frame_size;
+
+        /*
+         * As alignment we use 2 and not NET_IP_ALIGN because we need
+         * to be sure we have 2 bytes room in the head. (NET_IP_ALIGN
+         * can be 0 on some hardware). We use these 2 bytes for frame
+         * alignment later, we assume that the chance that
+         * header_size % 4 == 2 is bigger then header_size % 2 == 0
+         * and thus optimize alignment by reserving the 2 bytes in
+         * advance.
+         */
+        frame_size = queue->data_size + queue->desc_size;
+        skb = dev_alloc_skb(frame_size + 2);
+        if (!skb)
+                return NULL;
+
+        skb_reserve(skb, 2);
+        skb_put(skb, frame_size);
+
+        return skb;
+}
+
 static void rt2x00usb_interrupt_rxdone(struct urb *urb)
 {
-        struct data_entry *entry = (struct data_entry *)urb->context;
-        struct data_ring *ring = entry->ring;
-        struct rt2x00_dev *rt2x00dev = ring->rt2x00dev;
+        struct queue_entry *entry = (struct queue_entry *)urb->context;
+        struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
         struct sk_buff *skb;
-        struct ieee80211_hdr *hdr;
-        struct skb_desc *skbdesc;
-        struct rxdata_entry_desc desc;
-        int header_size;
-        int frame_size;
+        struct skb_frame_desc *skbdesc;
+        struct rxdone_entry_desc rxdesc;
 
         if (!test_bit(DEVICE_ENABLED_RADIO, &rt2x00dev->flags) ||
-            !test_and_clear_bit(ENTRY_OWNER_NIC, &entry->flags))
+            !test_and_clear_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags))
                 return;
 
         /*
@@ -254,67 +274,32 @@ static void rt2x00usb_interrupt_rxdone(struct urb *urb)
          * to be actually valid, or if the urb is signaling
          * a problem.
          */
-        if (urb->actual_length < entry->ring->desc_size || urb->status)
+        if (urb->actual_length < entry->queue->desc_size || urb->status)
                 goto skip_entry;
 
         /*
          * Fill in skb descriptor
          */
-        skbdesc = get_skb_desc(entry->skb);
-        skbdesc->ring = ring;
+        skbdesc = get_skb_frame_desc(entry->skb);
+        memset(skbdesc, 0, sizeof(*skbdesc));
         skbdesc->entry = entry;
 
-        memset(&desc, 0, sizeof(desc));
-        rt2x00dev->ops->lib->fill_rxdone(entry, &desc);
+        memset(&rxdesc, 0, sizeof(rxdesc));
+        rt2x00dev->ops->lib->fill_rxdone(entry, &rxdesc);
 
         /*
          * Allocate a new sk buffer to replace the current one.
          * If allocation fails, we should drop the current frame
          * so we can recycle the existing sk buffer for the new frame.
-         * As alignment we use 2 and not NET_IP_ALIGN because we need
-         * to be sure we have 2 bytes room in the head. (NET_IP_ALIGN
-         * can be 0 on some hardware). We use these 2 bytes for frame
-         * alignment later, we assume that the chance that
-         * header_size % 4 == 2 is bigger then header_size % 2 == 0
-         * and thus optimize alignment by reserving the 2 bytes in
-         * advance.
          */
-        frame_size = entry->ring->data_size + entry->ring->desc_size;
-        skb = dev_alloc_skb(frame_size + 2);
+        skb = rt2x00usb_alloc_rxskb(entry->queue);
         if (!skb)
                 goto skip_entry;
 
-        skb_reserve(skb, 2);
-        skb_put(skb, frame_size);
-
-        /*
-         * The data behind the ieee80211 header must be
-         * aligned on a 4 byte boundary.
-         */
-        hdr = (struct ieee80211_hdr *)entry->skb->data;
-        header_size =
-            ieee80211_get_hdrlen(le16_to_cpu(hdr->frame_control));
-
-        if (header_size % 4 == 0) {
-                skb_push(entry->skb, 2);
-                memmove(entry->skb->data, entry->skb->data + 2, skb->len - 2);
-        }
-
-        /*
-         * Trim the entire buffer down to only contain the valid frame data
-         * excluding the device descriptor. The position of the descriptor
-         * varies. This means that we should check where the descriptor is
-         * and decide if we need to pull the data pointer to exclude the
-         * device descriptor.
-         */
-        if (skbdesc->data > skbdesc->desc)
-                skb_pull(entry->skb, skbdesc->desc_len);
-        skb_trim(entry->skb, desc.size);
-
         /*
          * Send the frame to rt2x00lib for further processing.
          */
-        rt2x00lib_rxdone(entry, entry->skb, &desc);
+        rt2x00lib_rxdone(entry, &rxdesc);
 
         /*
          * Replace current entry's skb with the newly allocated one,
@@ -325,12 +310,12 @@ static void rt2x00usb_interrupt_rxdone(struct urb *urb)
         urb->transfer_buffer_length = entry->skb->len;
 
 skip_entry:
-        if (test_bit(DEVICE_ENABLED_RADIO, &ring->rt2x00dev->flags)) {
-                __set_bit(ENTRY_OWNER_NIC, &entry->flags);
+        if (test_bit(DEVICE_ENABLED_RADIO, &entry->queue->rt2x00dev->flags)) {
+                __set_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags);
                 usb_submit_urb(urb, GFP_ATOMIC);
         }
 
-        rt2x00_ring_index_inc(ring);
+        rt2x00queue_index_inc(entry->queue, Q_INDEX);
 }
 
 /*
@@ -338,18 +323,44 @@ skip_entry:
  */
 void rt2x00usb_disable_radio(struct rt2x00_dev *rt2x00dev)
 {
-        struct data_ring *ring;
+        struct queue_entry_priv_usb_rx *priv_rx;
+        struct queue_entry_priv_usb_tx *priv_tx;
+        struct queue_entry_priv_usb_bcn *priv_bcn;
+        struct data_queue *queue;
         unsigned int i;
 
         rt2x00usb_vendor_request_sw(rt2x00dev, USB_RX_CONTROL, 0x0000, 0x0000,
                                     REGISTER_TIMEOUT);
 
         /*
-         * Cancel all rings.
+         * Cancel all queues.
          */
-        ring_for_each(rt2x00dev, ring) {
-                for (i = 0; i < ring->stats.limit; i++)
-                        usb_kill_urb(ring->entry[i].priv);
+        for (i = 0; i < rt2x00dev->rx->limit; i++) {
+                priv_rx = rt2x00dev->rx->entries[i].priv_data;
+                usb_kill_urb(priv_rx->urb);
+        }
+
+        tx_queue_for_each(rt2x00dev, queue) {
+                for (i = 0; i < queue->limit; i++) {
+                        priv_tx = queue->entries[i].priv_data;
+                        usb_kill_urb(priv_tx->urb);
+                }
+        }
+
+        for (i = 0; i < rt2x00dev->bcn->limit; i++) {
+                priv_bcn = rt2x00dev->bcn->entries[i].priv_data;
+                usb_kill_urb(priv_bcn->urb);
+
+                if (priv_bcn->guardian_urb)
+                        usb_kill_urb(priv_bcn->guardian_urb);
+        }
+
+        if (!test_bit(DRIVER_REQUIRE_ATIM_QUEUE, &rt2x00dev->flags))
+                return;
+
+        for (i = 0; i < rt2x00dev->bcn[1].limit; i++) {
+                priv_tx = rt2x00dev->bcn[1].entries[i].priv_data;
+                usb_kill_urb(priv_tx->urb);
         }
 }
 EXPORT_SYMBOL_GPL(rt2x00usb_disable_radio);
@@ -358,64 +369,108 @@ EXPORT_SYMBOL_GPL(rt2x00usb_disable_radio);
  * Device initialization handlers.
  */
 void rt2x00usb_init_rxentry(struct rt2x00_dev *rt2x00dev,
-                            struct data_entry *entry)
+                            struct queue_entry *entry)
 {
-        struct usb_device *usb_dev =
-             interface_to_usbdev(rt2x00dev_usb(rt2x00dev));
+        struct usb_device *usb_dev = rt2x00dev_usb_dev(rt2x00dev);
+        struct queue_entry_priv_usb_rx *priv_rx = entry->priv_data;
 
-        usb_fill_bulk_urb(entry->priv, usb_dev,
+        usb_fill_bulk_urb(priv_rx->urb, usb_dev,
                           usb_rcvbulkpipe(usb_dev, 1),
                           entry->skb->data, entry->skb->len,
                           rt2x00usb_interrupt_rxdone, entry);
 
-        __set_bit(ENTRY_OWNER_NIC, &entry->flags);
-        usb_submit_urb(entry->priv, GFP_ATOMIC);
+        __set_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags);
+        usb_submit_urb(priv_rx->urb, GFP_ATOMIC);
 }
 EXPORT_SYMBOL_GPL(rt2x00usb_init_rxentry);
 
 void rt2x00usb_init_txentry(struct rt2x00_dev *rt2x00dev,
-                            struct data_entry *entry)
+                            struct queue_entry *entry)
 {
         entry->flags = 0;
 }
 EXPORT_SYMBOL_GPL(rt2x00usb_init_txentry);
 
 static int rt2x00usb_alloc_urb(struct rt2x00_dev *rt2x00dev,
-                               struct data_ring *ring)
+                               struct data_queue *queue)
 {
+        struct queue_entry_priv_usb_rx *priv_rx;
+        struct queue_entry_priv_usb_tx *priv_tx;
+        struct queue_entry_priv_usb_bcn *priv_bcn;
+        struct urb *urb;
+        unsigned int guardian =
+            test_bit(DRIVER_REQUIRE_BEACON_GUARD, &rt2x00dev->flags);
         unsigned int i;
 
         /*
          * Allocate the URB's
          */
-        for (i = 0; i < ring->stats.limit; i++) {
-                ring->entry[i].priv = usb_alloc_urb(0, GFP_KERNEL);
-                if (!ring->entry[i].priv)
+        for (i = 0; i < queue->limit; i++) {
+                urb = usb_alloc_urb(0, GFP_KERNEL);
+                if (!urb)
                         return -ENOMEM;
+
+                if (queue->qid == QID_RX) {
+                        priv_rx = queue->entries[i].priv_data;
+                        priv_rx->urb = urb;
+                } else if (queue->qid == QID_MGMT && guardian) {
+                        priv_bcn = queue->entries[i].priv_data;
+                        priv_bcn->urb = urb;
+
+                        urb = usb_alloc_urb(0, GFP_KERNEL);
+                        if (!urb)
+                                return -ENOMEM;
+
+                        priv_bcn->guardian_urb = urb;
+                } else {
+                        priv_tx = queue->entries[i].priv_data;
+                        priv_tx->urb = urb;
+                }
         }
 
         return 0;
 }
 
 static void rt2x00usb_free_urb(struct rt2x00_dev *rt2x00dev,
-                               struct data_ring *ring)
+                               struct data_queue *queue)
 {
+        struct queue_entry_priv_usb_rx *priv_rx;
+        struct queue_entry_priv_usb_tx *priv_tx;
+        struct queue_entry_priv_usb_bcn *priv_bcn;
+        struct urb *urb;
+        unsigned int guardian =
+            test_bit(DRIVER_REQUIRE_BEACON_GUARD, &rt2x00dev->flags);
         unsigned int i;
 
-        if (!ring->entry)
+        if (!queue->entries)
                 return;
 
-        for (i = 0; i < ring->stats.limit; i++) {
-                usb_kill_urb(ring->entry[i].priv);
-                usb_free_urb(ring->entry[i].priv);
-                if (ring->entry[i].skb)
-                        kfree_skb(ring->entry[i].skb);
+        for (i = 0; i < queue->limit; i++) {
+                if (queue->qid == QID_RX) {
+                        priv_rx = queue->entries[i].priv_data;
+                        urb = priv_rx->urb;
+                } else if (queue->qid == QID_MGMT && guardian) {
+                        priv_bcn = queue->entries[i].priv_data;
+
+                        usb_kill_urb(priv_bcn->guardian_urb);
+                        usb_free_urb(priv_bcn->guardian_urb);
+
+                        urb = priv_bcn->urb;
+                } else {
+                        priv_tx = queue->entries[i].priv_data;
+                        urb = priv_tx->urb;
+                }
+
+                usb_kill_urb(urb);
+                usb_free_urb(urb);
+                if (queue->entries[i].skb)
+                        kfree_skb(queue->entries[i].skb);
         }
 }
 
 int rt2x00usb_initialize(struct rt2x00_dev *rt2x00dev)
 {
-        struct data_ring *ring;
+        struct data_queue *queue;
         struct sk_buff *skb;
         unsigned int entry_size;
         unsigned int i;
@@ -424,25 +479,22 @@ int rt2x00usb_initialize(struct rt2x00_dev *rt2x00dev)
         /*
          * Allocate DMA
          */
-        ring_for_each(rt2x00dev, ring) {
-                status = rt2x00usb_alloc_urb(rt2x00dev, ring);
+        queue_for_each(rt2x00dev, queue) {
+                status = rt2x00usb_alloc_urb(rt2x00dev, queue);
                 if (status)
                         goto exit;
         }
 
         /*
-         * For the RX ring, skb's should be allocated.
+         * For the RX queue, skb's should be allocated.
          */
         entry_size = rt2x00dev->rx->data_size + rt2x00dev->rx->desc_size;
-        for (i = 0; i < rt2x00dev->rx->stats.limit; i++) {
-                skb = dev_alloc_skb(NET_IP_ALIGN + entry_size);
+        for (i = 0; i < rt2x00dev->rx->limit; i++) {
+                skb = rt2x00usb_alloc_rxskb(rt2x00dev->rx);
                 if (!skb)
                         goto exit;
 
-                skb_reserve(skb, NET_IP_ALIGN);
-                skb_put(skb, entry_size);
-
-                rt2x00dev->rx->entry[i].skb = skb;
+                rt2x00dev->rx->entries[i].skb = skb;
         }
 
         return 0;
@@ -456,10 +508,10 @@ EXPORT_SYMBOL_GPL(rt2x00usb_initialize);
 
 void rt2x00usb_uninitialize(struct rt2x00_dev *rt2x00dev)
 {
-        struct data_ring *ring;
+        struct data_queue *queue;
 
-        ring_for_each(rt2x00dev, ring)
-                rt2x00usb_free_urb(rt2x00dev, ring);
+        queue_for_each(rt2x00dev, queue)
+                rt2x00usb_free_urb(rt2x00dev, queue);
 }
 EXPORT_SYMBOL_GPL(rt2x00usb_uninitialize);
 
@@ -474,14 +526,14 @@ static void rt2x00usb_free_reg(struct rt2x00_dev *rt2x00dev)
         kfree(rt2x00dev->eeprom);
         rt2x00dev->eeprom = NULL;
 
-        kfree(rt2x00dev->csr_cache);
-        rt2x00dev->csr_cache = NULL;
+        kfree(rt2x00dev->csr.cache);
+        rt2x00dev->csr.cache = NULL;
 }
 
 static int rt2x00usb_alloc_reg(struct rt2x00_dev *rt2x00dev)
 {
-        rt2x00dev->csr_cache = kzalloc(CSR_CACHE_SIZE, GFP_KERNEL);
-        if (!rt2x00dev->csr_cache)
+        rt2x00dev->csr.cache = kzalloc(CSR_CACHE_SIZE, GFP_KERNEL);
+        if (!rt2x00dev->csr.cache)
                 goto exit;
 
         rt2x00dev->eeprom = kzalloc(rt2x00dev->ops->eeprom_size, GFP_KERNEL);
@@ -627,9 +679,9 @@ EXPORT_SYMBOL_GPL(rt2x00usb_resume);
 #endif /* CONFIG_PM */
 
 /*
- * rt2x00pci module information.
+ * rt2x00usb module information.
  */
 MODULE_AUTHOR(DRV_PROJECT);
 MODULE_VERSION(DRV_VERSION);
-MODULE_DESCRIPTION("rt2x00 library");
+MODULE_DESCRIPTION("rt2x00 usb library");
 MODULE_LICENSE("GPL");
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.h b/drivers/net/wireless/rt2x00/rt2x00usb.h
index e40df4050cd0..11e55180cbaf 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.h
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.h
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2007 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2008 rt2x00 SourceForge Project
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
@@ -60,34 +60,47 @@
 #define USB_VENDOR_REQUEST_IN   ( USB_DIR_IN | USB_VENDOR_REQUEST )
 #define USB_VENDOR_REQUEST_OUT  ( USB_DIR_OUT | USB_VENDOR_REQUEST )
 
-/*
- * USB vendor commands.
- */
-#define USB_DEVICE_MODE         0x01
-#define USB_SINGLE_WRITE        0x02
-#define USB_SINGLE_READ         0x03
-#define USB_MULTI_WRITE         0x06
-#define USB_MULTI_READ          0x07
-#define USB_EEPROM_WRITE        0x08
-#define USB_EEPROM_READ         0x09
-#define USB_LED_CONTROL         0x0a    /* RT73USB */
-#define USB_RX_CONTROL          0x0c
+/**
+ * enum rt2x00usb_vendor_request: USB vendor commands.
+ */
+enum rt2x00usb_vendor_request {
+        USB_DEVICE_MODE = 1,
+        USB_SINGLE_WRITE = 2,
+        USB_SINGLE_READ = 3,
+        USB_MULTI_WRITE = 6,
+        USB_MULTI_READ = 7,
+        USB_EEPROM_WRITE = 8,
+        USB_EEPROM_READ = 9,
+        USB_LED_CONTROL = 10, /* RT73USB */
+        USB_RX_CONTROL = 12,
+};
 
-/*
- * Device modes offset
+/**
+ * enum rt2x00usb_mode_offset: Device modes offset.
  */
-#define USB_MODE_RESET          0x01
-#define USB_MODE_UNPLUG         0x02
-#define USB_MODE_FUNCTION       0x03
-#define USB_MODE_TEST           0x04
-#define USB_MODE_SLEEP          0x07    /* RT73USB */
-#define USB_MODE_FIRMWARE       0x08    /* RT73USB */
-#define USB_MODE_WAKEUP         0x09    /* RT73USB */
+enum rt2x00usb_mode_offset {
+        USB_MODE_RESET = 1,
+        USB_MODE_UNPLUG = 2,
+        USB_MODE_FUNCTION = 3,
+        USB_MODE_TEST = 4,
+        USB_MODE_SLEEP = 7,     /* RT73USB */
+        USB_MODE_FIRMWARE = 8,  /* RT73USB */
+        USB_MODE_WAKEUP = 9,    /* RT73USB */
+};
 
-/*
- * Used to read/write from/to the device.
+/**
+ * rt2x00usb_vendor_request - Send register command to device
+ * @rt2x00dev: Pointer to &struct rt2x00_dev
+ * @request: USB vendor command (See &enum rt2x00usb_vendor_request)
+ * @requesttype: Request type &USB_VENDOR_REQUEST_*
+ * @offset: Register offset to perform action on
+ * @value: Value to write to device
+ * @buffer: Buffer where information will be read/written to by device
+ * @buffer_length: Size of &buffer
+ * @timeout: Operation timeout
+ *
  * This is the main function to communicate with the device,
- * the buffer argument _must_ either be NULL or point to
+ * the &buffer argument _must_ either be NULL or point to
  * a buffer allocated by kmalloc. Failure to do so can lead
  * to unexpected behavior depending on the architecture.
  */
@@ -97,13 +110,21 @@ int rt2x00usb_vendor_request(struct rt2x00_dev *rt2x00dev,
                              void *buffer, const u16 buffer_length,
                              const int timeout);
 
-/*
- * Used to read/write from/to the device.
+/**
+ * rt2x00usb_vendor_request_buff - Send register command to device (buffered)
+ * @rt2x00dev: Pointer to &struct rt2x00_dev
+ * @request: USB vendor command (See &enum rt2x00usb_vendor_request)
+ * @requesttype: Request type &USB_VENDOR_REQUEST_*
+ * @offset: Register offset to perform action on
+ * @buffer: Buffer where information will be read/written to by device
+ * @buffer_length: Size of &buffer
+ * @timeout: Operation timeout
+ *
  * This function will use a previously with kmalloc allocated cache
  * to communicate with the device. The contents of the buffer pointer
  * will be copied to this cache when writing, or read from the cache
  * when reading.
- * Buffers send to rt2x00usb_vendor_request _must_ be allocated with
+ * Buffers send to &rt2x00usb_vendor_request _must_ be allocated with
  * kmalloc. Hence the reason for using a previously allocated cache
  * which has been allocated properly.
  */
@@ -112,15 +133,32 @@ int rt2x00usb_vendor_request_buff(struct rt2x00_dev *rt2x00dev,
                                   const u16 offset, void *buffer,
                                   const u16 buffer_length, const int timeout);
 
-/*
- * A version of rt2x00usb_vendor_request_buff which must be called
- * if the usb_cache_mutex is already held. */
+/**
+ * rt2x00usb_vendor_request_buff - Send register command to device (buffered)
+ * @rt2x00dev: Pointer to &struct rt2x00_dev
+ * @request: USB vendor command (See &enum rt2x00usb_vendor_request)
+ * @requesttype: Request type &USB_VENDOR_REQUEST_*
+ * @offset: Register offset to perform action on
+ * @buffer: Buffer where information will be read/written to by device
+ * @buffer_length: Size of &buffer
+ * @timeout: Operation timeout
+ *
+ * A version of &rt2x00usb_vendor_request_buff which must be called
+ * if the usb_cache_mutex is already held.
+ */
 int rt2x00usb_vendor_req_buff_lock(struct rt2x00_dev *rt2x00dev,
                                    const u8 request, const u8 requesttype,
                                    const u16 offset, void *buffer,
                                    const u16 buffer_length, const int timeout);
 
-/*
+/**
+ * rt2x00usb_vendor_request_sw - Send single register command to device
+ * @rt2x00dev: Pointer to &struct rt2x00_dev
+ * @request: USB vendor command (See &enum rt2x00usb_vendor_request)
+ * @offset: Register offset to perform action on
+ * @value: Value to write to device
+ * @timeout: Operation timeout
+ *
  * Simple wrapper around rt2x00usb_vendor_request to write a single
  * command to the device. Since we don't use the buffer argument we
  * don't have to worry about kmalloc here.
@@ -136,7 +174,12 @@ static inline int rt2x00usb_vendor_request_sw(struct rt2x00_dev *rt2x00dev,
                                         value, NULL, 0, timeout);
 }
 
-/*
+/**
+ * rt2x00usb_eeprom_read - Read eeprom from device
+ * @rt2x00dev: Pointer to &struct rt2x00_dev
+ * @eeprom: Pointer to eeprom array to store the information in
+ * @length: Number of bytes to read from the eeprom
+ *
  * Simple wrapper around rt2x00usb_vendor_request to read the eeprom
  * from the device. Note that the eeprom argument _must_ be allocated using
  * kmalloc for correct handling inside the kernel USB layer.
@@ -147,8 +190,8 @@ static inline int rt2x00usb_eeprom_read(struct rt2x00_dev *rt2x00dev,
         int timeout = REGISTER_TIMEOUT * (lenght / sizeof(u16));
 
         return rt2x00usb_vendor_request(rt2x00dev, USB_EEPROM_READ,
-                                        USB_VENDOR_REQUEST_IN, 0x0000,
-                                        0x0000, eeprom, lenght, timeout);
+                                        USB_VENDOR_REQUEST_IN, 0, 0,
+                                        eeprom, lenght, timeout);
 }
 
 /*
@@ -160,16 +203,58 @@ void rt2x00usb_disable_radio(struct rt2x00_dev *rt2x00dev);
  * TX data handlers.
  */
 int rt2x00usb_write_tx_data(struct rt2x00_dev *rt2x00dev,
-                            struct data_ring *ring, struct sk_buff *skb,
+                            struct data_queue *queue, struct sk_buff *skb,
                             struct ieee80211_tx_control *control);
 
+/**
+ * struct queue_entry_priv_usb_rx: Per RX entry USB specific information
+ *
+ * @urb: Urb structure used for device communication.
+ */
+struct queue_entry_priv_usb_rx {
+        struct urb *urb;
+};
+
+/**
+ * struct queue_entry_priv_usb_tx: Per TX entry USB specific information
+ *
+ * @urb: Urb structure used for device communication.
+ * @control: mac80211 control structure used to transmit data.
+ */
+struct queue_entry_priv_usb_tx {
+        struct urb *urb;
+
+        struct ieee80211_tx_control control;
+};
+
+/**
+ * struct queue_entry_priv_usb_tx: Per TX entry USB specific information
+ *
+ * The first section should match &struct queue_entry_priv_usb_tx exactly.
+ * rt2500usb can use this structure to send a guardian byte when working
+ * with beacons.
+ *
+ * @urb: Urb structure used for device communication.
+ * @control: mac80211 control structure used to transmit data.
+ * @guardian_data: Set to 0, used for sending the guardian data.
+ * @guardian_urb: Urb structure used to send the guardian data.
+ */
+struct queue_entry_priv_usb_bcn {
+        struct urb *urb;
+
+        struct ieee80211_tx_control control;
+
+        unsigned int guardian_data;
+        struct urb *guardian_urb;
+};
+
 /*
  * Device initialization handlers.
  */
 void rt2x00usb_init_rxentry(struct rt2x00_dev *rt2x00dev,
-                            struct data_entry *entry);
+                            struct queue_entry *entry);
 void rt2x00usb_init_txentry(struct rt2x00_dev *rt2x00dev,
-                            struct data_entry *entry);
+                            struct queue_entry *entry);
 int rt2x00usb_initialize(struct rt2x00_dev *rt2x00dev);
 void rt2x00usb_uninitialize(struct rt2x00_dev *rt2x00dev);
 
diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
index e808db98f2f5..091fe398676d 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2007 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2008 rt2x00 SourceForge Project
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
@@ -155,6 +155,12 @@ rf_write:
         rt2x00_rf_write(rt2x00dev, word, value);
 }
 
+#ifdef CONFIG_RT61PCI_LEDS
+/*
+ * This function is only called from rt61pci_led_brightness()
+ * make gcc happy by placing this function inside the
+ * same ifdef statement as the caller.
+ */
 static void rt61pci_mcu_request(struct rt2x00_dev *rt2x00dev,
                                 const u8 command, const u8 token,
                                 const u8 arg0, const u8 arg1)
@@ -181,6 +187,7 @@ static void rt61pci_mcu_request(struct rt2x00_dev *rt2x00dev,
         rt2x00_set_field32(&reg, HOST_CMD_CSR_INTERRUPT_MCU, 1);
         rt2x00pci_register_write(rt2x00dev, HOST_CMD_CSR, reg);
 }
+#endif /* CONFIG_RT61PCI_LEDS */
 
 static void rt61pci_eepromregister_read(struct eeprom_93cx6 *eeprom)
 {
@@ -262,72 +269,111 @@ static int rt61pci_rfkill_poll(struct rt2x00_dev *rt2x00dev)
         u32 reg;
 
         rt2x00pci_register_read(rt2x00dev, MAC_CSR13, &reg);
-        return rt2x00_get_field32(reg, MAC_CSR13_BIT5);;
+        return rt2x00_get_field32(reg, MAC_CSR13_BIT5);
 }
 #else
 #define rt61pci_rfkill_poll     NULL
 #endif /* CONFIG_RT61PCI_RFKILL */
 
+#ifdef CONFIG_RT61PCI_LEDS
+static void rt61pci_led_brightness(struct led_classdev *led_cdev,
+                                   enum led_brightness brightness)
+{
+        struct rt2x00_led *led =
+            container_of(led_cdev, struct rt2x00_led, led_dev);
+        unsigned int enabled = brightness != LED_OFF;
+        unsigned int a_mode =
+            (enabled && led->rt2x00dev->curr_band == IEEE80211_BAND_5GHZ);
+        unsigned int bg_mode =
+            (enabled && led->rt2x00dev->curr_band == IEEE80211_BAND_2GHZ);
+
+        if (led->type == LED_TYPE_RADIO) {
+                rt2x00_set_field16(&led->rt2x00dev->led_mcu_reg,
+                                   MCU_LEDCS_RADIO_STATUS, enabled);
+
+                rt61pci_mcu_request(led->rt2x00dev, MCU_LED, 0xff,
+                                    (led->rt2x00dev->led_mcu_reg & 0xff),
+                                    ((led->rt2x00dev->led_mcu_reg >> 8)));
+        } else if (led->type == LED_TYPE_ASSOC) {
+                rt2x00_set_field16(&led->rt2x00dev->led_mcu_reg,
+                                   MCU_LEDCS_LINK_BG_STATUS, bg_mode);
+                rt2x00_set_field16(&led->rt2x00dev->led_mcu_reg,
+                                   MCU_LEDCS_LINK_A_STATUS, a_mode);
+
+                rt61pci_mcu_request(led->rt2x00dev, MCU_LED, 0xff,
+                                    (led->rt2x00dev->led_mcu_reg & 0xff),
+                                    ((led->rt2x00dev->led_mcu_reg >> 8)));
+        } else if (led->type == LED_TYPE_QUALITY) {
+                /*
+                 * The brightness is divided into 6 levels (0 - 5),
+                 * this means we need to convert the brightness
+                 * argument into the matching level within that range.
+                 */
+                rt61pci_mcu_request(led->rt2x00dev, MCU_LED_STRENGTH, 0xff,
+                                    brightness / (LED_FULL / 6), 0);
+        }
+}
+#else
+#define rt61pci_led_brightness  NULL
+#endif /* CONFIG_RT61PCI_LEDS */
+
 /*
  * Configuration handlers.
  */
-static void rt61pci_config_mac_addr(struct rt2x00_dev *rt2x00dev, __le32 *mac)
+static void rt61pci_config_intf(struct rt2x00_dev *rt2x00dev,
+                                struct rt2x00_intf *intf,
+                                struct rt2x00intf_conf *conf,
+                                const unsigned int flags)
 {
-        u32 tmp;
-
-        tmp = le32_to_cpu(mac[1]);
-        rt2x00_set_field32(&tmp, MAC_CSR3_UNICAST_TO_ME_MASK, 0xff);
-        mac[1] = cpu_to_le32(tmp);
+        unsigned int beacon_base;
+        u32 reg;
 
-        rt2x00pci_register_multiwrite(rt2x00dev, MAC_CSR2, mac,
-                                      (2 * sizeof(__le32)));
-}
+        if (flags & CONFIG_UPDATE_TYPE) {
+                /*
+                 * Clear current synchronisation setup.
+                 * For the Beacon base registers we only need to clear
+                 * the first byte since that byte contains the VALID and OWNER
+                 * bits which (when set to 0) will invalidate the entire beacon.
+                 */
+                beacon_base = HW_BEACON_OFFSET(intf->beacon->entry_idx);
+                rt2x00pci_register_write(rt2x00dev, TXRX_CSR9, 0);
+                rt2x00pci_register_write(rt2x00dev, beacon_base, 0);
 
-static void rt61pci_config_bssid(struct rt2x00_dev *rt2x00dev, __le32 *bssid)
-{
-        u32 tmp;
+                /*
+                 * Enable synchronisation.
+                 */
+                rt2x00pci_register_read(rt2x00dev, TXRX_CSR9, &reg);
+                rt2x00_set_field32(&reg, TXRX_CSR9_TSF_TICKING, 1);
+                rt2x00_set_field32(&reg, TXRX_CSR9_TBTT_ENABLE,
+                                  (conf->sync == TSF_SYNC_BEACON));
+                rt2x00_set_field32(&reg, TXRX_CSR9_BEACON_GEN, 0);
+                rt2x00_set_field32(&reg, TXRX_CSR9_TSF_SYNC, conf->sync);
+                rt2x00pci_register_write(rt2x00dev, TXRX_CSR9, reg);
+        }
 
-        tmp = le32_to_cpu(bssid[1]);
-        rt2x00_set_field32(&tmp, MAC_CSR5_BSS_ID_MASK, 3);
-        bssid[1] = cpu_to_le32(tmp);
+        if (flags & CONFIG_UPDATE_MAC) {
+                reg = le32_to_cpu(conf->mac[1]);
+                rt2x00_set_field32(&reg, MAC_CSR3_UNICAST_TO_ME_MASK, 0xff);
+                conf->mac[1] = cpu_to_le32(reg);
 
-        rt2x00pci_register_multiwrite(rt2x00dev, MAC_CSR4, bssid,
-                                      (2 * sizeof(__le32)));
-}
+                rt2x00pci_register_multiwrite(rt2x00dev, MAC_CSR2,
+                                              conf->mac, sizeof(conf->mac));
+        }
 
-static void rt61pci_config_type(struct rt2x00_dev *rt2x00dev, const int type,
-                                const int tsf_sync)
-{
-        u32 reg;
+        if (flags & CONFIG_UPDATE_BSSID) {
+                reg = le32_to_cpu(conf->bssid[1]);
+                rt2x00_set_field32(&reg, MAC_CSR5_BSS_ID_MASK, 3);
+                conf->bssid[1] = cpu_to_le32(reg);
 
-        /*
-         * Clear current synchronisation setup.
-         * For the Beacon base registers we only need to clear
-         * the first byte since that byte contains the VALID and OWNER
-         * bits which (when set to 0) will invalidate the entire beacon.
-         */
-        rt2x00pci_register_write(rt2x00dev, TXRX_CSR9, 0);
-        rt2x00pci_register_write(rt2x00dev, HW_BEACON_BASE0, 0);
-        rt2x00pci_register_write(rt2x00dev, HW_BEACON_BASE1, 0);
-        rt2x00pci_register_write(rt2x00dev, HW_BEACON_BASE2, 0);
-        rt2x00pci_register_write(rt2x00dev, HW_BEACON_BASE3, 0);
-
-        /*
-         * Enable synchronisation.
-         */
-        rt2x00pci_register_read(rt2x00dev, TXRX_CSR9, &reg);
-        rt2x00_set_field32(&reg, TXRX_CSR9_TSF_TICKING, 1);
-        rt2x00_set_field32(&reg, TXRX_CSR9_TBTT_ENABLE,
-                          (tsf_sync == TSF_SYNC_BEACON));
-        rt2x00_set_field32(&reg, TXRX_CSR9_BEACON_GEN, 0);
-        rt2x00_set_field32(&reg, TXRX_CSR9_TSF_SYNC, tsf_sync);
-        rt2x00pci_register_write(rt2x00dev, TXRX_CSR9, reg);
+                rt2x00pci_register_multiwrite(rt2x00dev, MAC_CSR4,
+                                              conf->bssid, sizeof(conf->bssid));
+        }
 }
 
-static void rt61pci_config_preamble(struct rt2x00_dev *rt2x00dev,
-                                    const int short_preamble,
-                                    const int ack_timeout,
-                                    const int ack_consume_time)
+static int rt61pci_config_preamble(struct rt2x00_dev *rt2x00dev,
+                                   const int short_preamble,
+                                   const int ack_timeout,
+                                   const int ack_consume_time)
 {
         u32 reg;
 
@@ -339,6 +385,8 @@ static void rt61pci_config_preamble(struct rt2x00_dev *rt2x00dev,
         rt2x00_set_field32(&reg, TXRX_CSR4_AUTORESPOND_PREAMBLE,
                            !!short_preamble);
         rt2x00pci_register_write(rt2x00dev, TXRX_CSR4, reg);
+
+        return 0;
 }
 
 static void rt61pci_config_phymode(struct rt2x00_dev *rt2x00dev,
@@ -427,12 +475,12 @@ static void rt61pci_config_antenna_5x(struct rt2x00_dev *rt2x00dev,
         case ANTENNA_HW_DIVERSITY:
                 rt2x00_set_field8(&r4, BBP_R4_RX_ANTENNA_CONTROL, 2);
                 rt2x00_set_field8(&r4, BBP_R4_RX_FRAME_END,
-                                  (rt2x00dev->curr_hwmode != HWMODE_A));
+                                  (rt2x00dev->curr_band != IEEE80211_BAND_5GHZ));
                 break;
         case ANTENNA_A:
                 rt2x00_set_field8(&r4, BBP_R4_RX_ANTENNA_CONTROL, 1);
                 rt2x00_set_field8(&r4, BBP_R4_RX_FRAME_END, 0);
-                if (rt2x00dev->curr_hwmode == HWMODE_A)
+                if (rt2x00dev->curr_band == IEEE80211_BAND_5GHZ)
                         rt2x00_set_field8(&r77, BBP_R77_RX_ANTENNA, 0);
                 else
                         rt2x00_set_field8(&r77, BBP_R77_RX_ANTENNA, 3);
@@ -447,7 +495,7 @@ static void rt61pci_config_antenna_5x(struct rt2x00_dev *rt2x00dev,
         case ANTENNA_B:
                 rt2x00_set_field8(&r4, BBP_R4_RX_ANTENNA_CONTROL, 1);
                 rt2x00_set_field8(&r4, BBP_R4_RX_FRAME_END, 0);
-                if (rt2x00dev->curr_hwmode == HWMODE_A)
+                if (rt2x00dev->curr_band == IEEE80211_BAND_5GHZ)
                         rt2x00_set_field8(&r77, BBP_R77_RX_ANTENNA, 3);
                 else
                         rt2x00_set_field8(&r77, BBP_R77_RX_ANTENNA, 0);
@@ -603,7 +651,7 @@ static void rt61pci_config_antenna(struct rt2x00_dev *rt2x00dev,
         unsigned int i;
         u32 reg;
 
-        if (rt2x00dev->curr_hwmode == HWMODE_A) {
+        if (rt2x00dev->curr_band == IEEE80211_BAND_5GHZ) {
                 sel = antenna_sel_a;
                 lna = test_bit(CONFIG_EXTERNAL_LNA_A, &rt2x00dev->flags);
         } else {
@@ -617,10 +665,9 @@ static void rt61pci_config_antenna(struct rt2x00_dev *rt2x00dev,
         rt2x00pci_register_read(rt2x00dev, PHY_CSR0, &reg);
 
         rt2x00_set_field32(&reg, PHY_CSR0_PA_PE_BG,
-                           (rt2x00dev->curr_hwmode == HWMODE_B ||
-                            rt2x00dev->curr_hwmode == HWMODE_G));
+                           rt2x00dev->curr_band == IEEE80211_BAND_2GHZ);
         rt2x00_set_field32(&reg, PHY_CSR0_PA_PE_A,
-                           (rt2x00dev->curr_hwmode == HWMODE_A));
+                           rt2x00dev->curr_band == IEEE80211_BAND_5GHZ);
 
         rt2x00pci_register_write(rt2x00dev, PHY_CSR0, reg);
 
@@ -667,8 +714,8 @@ static void rt61pci_config_duration(struct rt2x00_dev *rt2x00dev,
 }
 
 static void rt61pci_config(struct rt2x00_dev *rt2x00dev,
-                           const unsigned int flags,
-                           struct rt2x00lib_conf *libconf)
+                           struct rt2x00lib_conf *libconf,
+                           const unsigned int flags)
 {
         if (flags & CONFIG_UPDATE_PHYMODE)
                 rt61pci_config_phymode(rt2x00dev, libconf->basic_rates);
@@ -684,78 +731,6 @@ static void rt61pci_config(struct rt2x00_dev *rt2x00dev,
 }
 
 /*
- * LED functions.
- */
-static void rt61pci_enable_led(struct rt2x00_dev *rt2x00dev)
-{
-        u32 reg;
-        u8 arg0;
-        u8 arg1;
-
-        rt2x00pci_register_read(rt2x00dev, MAC_CSR14, &reg);
-        rt2x00_set_field32(&reg, MAC_CSR14_ON_PERIOD, 70);
-        rt2x00_set_field32(&reg, MAC_CSR14_OFF_PERIOD, 30);
-        rt2x00pci_register_write(rt2x00dev, MAC_CSR14, reg);
-
-        rt2x00_set_field16(&rt2x00dev->led_reg, MCU_LEDCS_RADIO_STATUS, 1);
-        rt2x00_set_field16(&rt2x00dev->led_reg, MCU_LEDCS_LINK_A_STATUS,
-                           (rt2x00dev->rx_status.phymode == MODE_IEEE80211A));
-        rt2x00_set_field16(&rt2x00dev->led_reg, MCU_LEDCS_LINK_BG_STATUS,
-                           (rt2x00dev->rx_status.phymode != MODE_IEEE80211A));
-
-        arg0 = rt2x00dev->led_reg & 0xff;
-        arg1 = (rt2x00dev->led_reg >> 8) & 0xff;
-
-        rt61pci_mcu_request(rt2x00dev, MCU_LED, 0xff, arg0, arg1);
-}
-
-static void rt61pci_disable_led(struct rt2x00_dev *rt2x00dev)
-{
-        u16 led_reg;
-        u8 arg0;
-        u8 arg1;
-
-        led_reg = rt2x00dev->led_reg;
-        rt2x00_set_field16(&led_reg, MCU_LEDCS_RADIO_STATUS, 0);
-        rt2x00_set_field16(&led_reg, MCU_LEDCS_LINK_BG_STATUS, 0);
-        rt2x00_set_field16(&led_reg, MCU_LEDCS_LINK_A_STATUS, 0);
-
-        arg0 = led_reg & 0xff;
-        arg1 = (led_reg >> 8) & 0xff;
-
-        rt61pci_mcu_request(rt2x00dev, MCU_LED, 0xff, arg0, arg1);
-}
-
-static void rt61pci_activity_led(struct rt2x00_dev *rt2x00dev, int rssi)
-{
-        u8 led;
-
-        if (rt2x00dev->led_mode != LED_MODE_SIGNAL_STRENGTH)
-                return;
-
-        /*
-         * Led handling requires a positive value for the rssi,
-         * to do that correctly we need to add the correction.
-         */
-        rssi += rt2x00dev->rssi_offset;
-
-        if (rssi <= 30)
-                led = 0;
-        else if (rssi <= 39)
-                led = 1;
-        else if (rssi <= 49)
-                led = 2;
-        else if (rssi <= 53)
-                led = 3;
-        else if (rssi <= 63)
-                led = 4;
-        else
-                led = 5;
-
-        rt61pci_mcu_request(rt2x00dev, MCU_LED_STRENGTH, 0xff, led, 0);
-}
-
-/*
  * Link tuning
  */
 static void rt61pci_link_stats(struct rt2x00_dev *rt2x00dev,
@@ -789,17 +764,12 @@ static void rt61pci_link_tuner(struct rt2x00_dev *rt2x00dev)
         u8 up_bound;
         u8 low_bound;
 
-        /*
-         * Update Led strength
-         */
-        rt61pci_activity_led(rt2x00dev, rssi);
-
         rt61pci_bbp_read(rt2x00dev, 17, &r17);
 
         /*
          * Determine r17 bounds.
          */
-        if (rt2x00dev->rx_status.phymode == MODE_IEEE80211A) {
+        if (rt2x00dev->rx_status.band == IEEE80211_BAND_5GHZ) {
                 low_bound = 0x28;
                 up_bound = 0x48;
                 if (test_bit(CONFIG_EXTERNAL_LNA_A, &rt2x00dev->flags)) {
@@ -816,6 +786,13 @@ static void rt61pci_link_tuner(struct rt2x00_dev *rt2x00dev)
         }
 
         /*
+         * If we are not associated, we should go straight to the
+         * dynamic CCA tuning.
+         */
+        if (!rt2x00dev->intf_associated)
+                goto dynamic_cca_tune;
+
+        /*
          * Special big-R17 for very short distance
          */
         if (rssi >= -35) {
@@ -866,6 +843,8 @@ static void rt61pci_link_tuner(struct rt2x00_dev *rt2x00dev)
                 return;
         }
 
+dynamic_cca_tune:
+
         /*
          * r17 does not yet exceed upper limit, continue and base
          * the r17 tuning on the false CCA count.
@@ -990,49 +969,51 @@ static int rt61pci_load_firmware(struct rt2x00_dev *rt2x00dev, void *data,
 }
 
 static void rt61pci_init_rxentry(struct rt2x00_dev *rt2x00dev,
-                                 struct data_entry *entry)
+                                 struct queue_entry *entry)
 {
-        __le32 *rxd = entry->priv;
+        struct queue_entry_priv_pci_rx *priv_rx = entry->priv_data;
         u32 word;
 
-        rt2x00_desc_read(rxd, 5, &word);
+        rt2x00_desc_read(priv_rx->desc, 5, &word);
         rt2x00_set_field32(&word, RXD_W5_BUFFER_PHYSICAL_ADDRESS,
-                           entry->data_dma);
-        rt2x00_desc_write(rxd, 5, word);
+                           priv_rx->data_dma);
+        rt2x00_desc_write(priv_rx->desc, 5, word);
 
-        rt2x00_desc_read(rxd, 0, &word);
+        rt2x00_desc_read(priv_rx->desc, 0, &word);
         rt2x00_set_field32(&word, RXD_W0_OWNER_NIC, 1);
-        rt2x00_desc_write(rxd, 0, word);
+        rt2x00_desc_write(priv_rx->desc, 0, word);
 }
 
 static void rt61pci_init_txentry(struct rt2x00_dev *rt2x00dev,
-                                 struct data_entry *entry)
+                                 struct queue_entry *entry)
 {
-        __le32 *txd = entry->priv;
+        struct queue_entry_priv_pci_tx *priv_tx = entry->priv_data;
         u32 word;
 
-        rt2x00_desc_read(txd, 1, &word);
+        rt2x00_desc_read(priv_tx->desc, 1, &word);
         rt2x00_set_field32(&word, TXD_W1_BUFFER_COUNT, 1);
-        rt2x00_desc_write(txd, 1, word);
+        rt2x00_desc_write(priv_tx->desc, 1, word);
 
-        rt2x00_desc_read(txd, 5, &word);
-        rt2x00_set_field32(&word, TXD_W5_PID_TYPE, entry->ring->queue_idx);
+        rt2x00_desc_read(priv_tx->desc, 5, &word);
+        rt2x00_set_field32(&word, TXD_W5_PID_TYPE, entry->queue->qid);
         rt2x00_set_field32(&word, TXD_W5_PID_SUBTYPE, entry->entry_idx);
-        rt2x00_desc_write(txd, 5, word);
+        rt2x00_desc_write(priv_tx->desc, 5, word);
 
-        rt2x00_desc_read(txd, 6, &word);
+        rt2x00_desc_read(priv_tx->desc, 6, &word);
         rt2x00_set_field32(&word, TXD_W6_BUFFER_PHYSICAL_ADDRESS,
-                           entry->data_dma);
-        rt2x00_desc_write(txd, 6, word);
+                           priv_tx->data_dma);
+        rt2x00_desc_write(priv_tx->desc, 6, word);
 
-        rt2x00_desc_read(txd, 0, &word);
+        rt2x00_desc_read(priv_tx->desc, 0, &word);
         rt2x00_set_field32(&word, TXD_W0_VALID, 0);
         rt2x00_set_field32(&word, TXD_W0_OWNER_NIC, 0);
-        rt2x00_desc_write(txd, 0, word);
+        rt2x00_desc_write(priv_tx->desc, 0, word);
 }
 
-static int rt61pci_init_rings(struct rt2x00_dev *rt2x00dev)
+static int rt61pci_init_queues(struct rt2x00_dev *rt2x00dev)
 {
+        struct queue_entry_priv_pci_rx *priv_rx;
+        struct queue_entry_priv_pci_tx *priv_tx;
         u32 reg;
 
         /*
@@ -1040,59 +1021,55 @@ static int rt61pci_init_rings(struct rt2x00_dev *rt2x00dev)
          */
         rt2x00pci_register_read(rt2x00dev, TX_RING_CSR0, &reg);
         rt2x00_set_field32(&reg, TX_RING_CSR0_AC0_RING_SIZE,
-                           rt2x00dev->tx[IEEE80211_TX_QUEUE_DATA0].stats.limit);
+                           rt2x00dev->tx[0].limit);
         rt2x00_set_field32(&reg, TX_RING_CSR0_AC1_RING_SIZE,
-                           rt2x00dev->tx[IEEE80211_TX_QUEUE_DATA1].stats.limit);
+                           rt2x00dev->tx[1].limit);
         rt2x00_set_field32(&reg, TX_RING_CSR0_AC2_RING_SIZE,
-                           rt2x00dev->tx[IEEE80211_TX_QUEUE_DATA2].stats.limit);
+                           rt2x00dev->tx[2].limit);
         rt2x00_set_field32(&reg, TX_RING_CSR0_AC3_RING_SIZE,
-                           rt2x00dev->tx[IEEE80211_TX_QUEUE_DATA3].stats.limit);
+                           rt2x00dev->tx[3].limit);
         rt2x00pci_register_write(rt2x00dev, TX_RING_CSR0, reg);
 
         rt2x00pci_register_read(rt2x00dev, TX_RING_CSR1, &reg);
-        rt2x00_set_field32(&reg, TX_RING_CSR1_MGMT_RING_SIZE,
-                           rt2x00dev->tx[IEEE80211_TX_QUEUE_DATA4].stats.limit);
         rt2x00_set_field32(&reg, TX_RING_CSR1_TXD_SIZE,
-                           rt2x00dev->tx[IEEE80211_TX_QUEUE_DATA0].desc_size /
-                           4);
+                           rt2x00dev->tx[0].desc_size / 4);
         rt2x00pci_register_write(rt2x00dev, TX_RING_CSR1, reg);
 
+        priv_tx = rt2x00dev->tx[0].entries[0].priv_data;
         rt2x00pci_register_read(rt2x00dev, AC0_BASE_CSR, &reg);
         rt2x00_set_field32(&reg, AC0_BASE_CSR_RING_REGISTER,
-                           rt2x00dev->tx[IEEE80211_TX_QUEUE_DATA0].data_dma);
+                           priv_tx->desc_dma);
         rt2x00pci_register_write(rt2x00dev, AC0_BASE_CSR, reg);
 
+        priv_tx = rt2x00dev->tx[1].entries[0].priv_data;
         rt2x00pci_register_read(rt2x00dev, AC1_BASE_CSR, &reg);
         rt2x00_set_field32(&reg, AC1_BASE_CSR_RING_REGISTER,
-                           rt2x00dev->tx[IEEE80211_TX_QUEUE_DATA1].data_dma);
+                           priv_tx->desc_dma);
         rt2x00pci_register_write(rt2x00dev, AC1_BASE_CSR, reg);
 
+        priv_tx = rt2x00dev->tx[2].entries[0].priv_data;
         rt2x00pci_register_read(rt2x00dev, AC2_BASE_CSR, &reg);
         rt2x00_set_field32(&reg, AC2_BASE_CSR_RING_REGISTER,
-                           rt2x00dev->tx[IEEE80211_TX_QUEUE_DATA2].data_dma);
+                           priv_tx->desc_dma);
         rt2x00pci_register_write(rt2x00dev, AC2_BASE_CSR, reg);
 
+        priv_tx = rt2x00dev->tx[3].entries[0].priv_data;
         rt2x00pci_register_read(rt2x00dev, AC3_BASE_CSR, &reg);
         rt2x00_set_field32(&reg, AC3_BASE_CSR_RING_REGISTER,
-                           rt2x00dev->tx[IEEE80211_TX_QUEUE_DATA3].data_dma);
+                           priv_tx->desc_dma);
         rt2x00pci_register_write(rt2x00dev, AC3_BASE_CSR, reg);
 
-        rt2x00pci_register_read(rt2x00dev, MGMT_BASE_CSR, &reg);
-        rt2x00_set_field32(&reg, MGMT_BASE_CSR_RING_REGISTER,
-                           rt2x00dev->tx[IEEE80211_TX_QUEUE_DATA4].data_dma);
-        rt2x00pci_register_write(rt2x00dev, MGMT_BASE_CSR, reg);
-
         rt2x00pci_register_read(rt2x00dev, RX_RING_CSR, &reg);
-        rt2x00_set_field32(&reg, RX_RING_CSR_RING_SIZE,
-                           rt2x00dev->rx->stats.limit);
+        rt2x00_set_field32(&reg, RX_RING_CSR_RING_SIZE, rt2x00dev->rx->limit);
         rt2x00_set_field32(&reg, RX_RING_CSR_RXD_SIZE,
                            rt2x00dev->rx->desc_size / 4);
         rt2x00_set_field32(&reg, RX_RING_CSR_RXD_WRITEBACK_SIZE, 4);
         rt2x00pci_register_write(rt2x00dev, RX_RING_CSR, reg);
 
+        priv_rx = rt2x00dev->rx->entries[0].priv_data;
         rt2x00pci_register_read(rt2x00dev, RX_BASE_CSR, &reg);
         rt2x00_set_field32(&reg, RX_BASE_CSR_RING_REGISTER,
-                           rt2x00dev->rx->data_dma);
+                           priv_rx->desc_dma);
         rt2x00pci_register_write(rt2x00dev, RX_BASE_CSR, reg);
 
         rt2x00pci_register_read(rt2x00dev, TX_DMA_DST_CSR, &reg);
@@ -1100,7 +1077,6 @@ static int rt61pci_init_rings(struct rt2x00_dev *rt2x00dev)
         rt2x00_set_field32(&reg, TX_DMA_DST_CSR_DEST_AC1, 2);
         rt2x00_set_field32(&reg, TX_DMA_DST_CSR_DEST_AC2, 2);
         rt2x00_set_field32(&reg, TX_DMA_DST_CSR_DEST_AC3, 2);
-        rt2x00_set_field32(&reg, TX_DMA_DST_CSR_DEST_MGMT, 0);
         rt2x00pci_register_write(rt2x00dev, TX_DMA_DST_CSR, reg);
 
         rt2x00pci_register_read(rt2x00dev, LOAD_TX_RING_CSR, &reg);
@@ -1108,7 +1084,6 @@ static int rt61pci_init_rings(struct rt2x00_dev *rt2x00dev)
         rt2x00_set_field32(&reg, LOAD_TX_RING_CSR_LOAD_TXD_AC1, 1);
         rt2x00_set_field32(&reg, LOAD_TX_RING_CSR_LOAD_TXD_AC2, 1);
         rt2x00_set_field32(&reg, LOAD_TX_RING_CSR_LOAD_TXD_AC3, 1);
-        rt2x00_set_field32(&reg, LOAD_TX_RING_CSR_LOAD_TXD_MGMT, 1);
         rt2x00pci_register_write(rt2x00dev, LOAD_TX_RING_CSR, reg);
 
         rt2x00pci_register_read(rt2x00dev, RX_CNTL_CSR, &reg);
@@ -1194,6 +1169,11 @@ static int rt61pci_init_registers(struct rt2x00_dev *rt2x00dev)
 
         rt2x00pci_register_write(rt2x00dev, MAC_CSR13, 0x0000e000);
 
+        rt2x00pci_register_read(rt2x00dev, MAC_CSR14, &reg);
+        rt2x00_set_field32(&reg, MAC_CSR14_ON_PERIOD, 70);
+        rt2x00_set_field32(&reg, MAC_CSR14_OFF_PERIOD, 30);
+        rt2x00pci_register_write(rt2x00dev, MAC_CSR14, reg);
+
         /*
          * Invalidate all Shared Keys (SEC_CSR0),
          * and clear the Shared key Cipher algorithms (SEC_CSR1 & SEC_CSR5)
@@ -1224,6 +1204,17 @@ static int rt61pci_init_registers(struct rt2x00_dev *rt2x00dev)
         rt2x00pci_register_write(rt2x00dev, AC_TXOP_CSR1, reg);
 
         /*
+         * Clear all beacons
+         * For the Beacon base registers we only need to clear
+         * the first byte since that byte contains the VALID and OWNER
+         * bits which (when set to 0) will invalidate the entire beacon.
+         */
+        rt2x00pci_register_write(rt2x00dev, HW_BEACON_BASE0, 0);
+        rt2x00pci_register_write(rt2x00dev, HW_BEACON_BASE1, 0);
+        rt2x00pci_register_write(rt2x00dev, HW_BEACON_BASE2, 0);
+        rt2x00pci_register_write(rt2x00dev, HW_BEACON_BASE3, 0);
+
+        /*
          * We must clear the error counters.
          * These registers are cleared on read,
          * so we may pass a useless variable to store the value.
@@ -1296,19 +1287,15 @@ continue_csr_init:
         rt61pci_bbp_write(rt2x00dev, 102, 0x16);
         rt61pci_bbp_write(rt2x00dev, 107, 0x04);
 
-        DEBUG(rt2x00dev, "Start initialization from EEPROM...\n");
         for (i = 0; i < EEPROM_BBP_SIZE; i++) {
                 rt2x00_eeprom_read(rt2x00dev, EEPROM_BBP_START + i, &eeprom);
 
                 if (eeprom != 0xffff && eeprom != 0x0000) {
                         reg_id = rt2x00_get_field16(eeprom, EEPROM_BBP_REG_ID);
                         value = rt2x00_get_field16(eeprom, EEPROM_BBP_VALUE);
-                        DEBUG(rt2x00dev, "BBP: 0x%02x, value: 0x%02x.\n",
-                              reg_id, value);
                         rt61pci_bbp_write(rt2x00dev, reg_id, value);
                 }
         }
-        DEBUG(rt2x00dev, "...End initialization from EEPROM.\n");
 
         return 0;
 }
@@ -1375,7 +1362,7 @@ static int rt61pci_enable_radio(struct rt2x00_dev *rt2x00dev)
         /*
          * Initialize all registers.
          */
-        if (rt61pci_init_rings(rt2x00dev) ||
+        if (rt61pci_init_queues(rt2x00dev) ||
             rt61pci_init_registers(rt2x00dev) ||
             rt61pci_init_bbp(rt2x00dev)) {
                 ERROR(rt2x00dev, "Register initialization failed.\n");
@@ -1394,11 +1381,6 @@ static int rt61pci_enable_radio(struct rt2x00_dev *rt2x00dev)
         rt2x00_set_field32(&reg, RX_CNTL_CSR_ENABLE_RX_DMA, 1);
         rt2x00pci_register_write(rt2x00dev, RX_CNTL_CSR, reg);
 
-        /*
-         * Enable LED
-         */
-        rt61pci_enable_led(rt2x00dev);
-
         return 0;
 }
 
@@ -1406,11 +1388,6 @@ static void rt61pci_disable_radio(struct rt2x00_dev *rt2x00dev)
 {
         u32 reg;
 
-        /*
-         * Disable LED
-         */
-        rt61pci_disable_led(rt2x00dev);
-
         rt2x00pci_register_write(rt2x00dev, MAC_CSR10, 0x00001818);
 
         /*
@@ -1426,7 +1403,6 @@ static void rt61pci_disable_radio(struct rt2x00_dev *rt2x00dev)
         rt2x00_set_field32(&reg, TX_CNTL_CSR_ABORT_TX_AC1, 1);
         rt2x00_set_field32(&reg, TX_CNTL_CSR_ABORT_TX_AC2, 1);
         rt2x00_set_field32(&reg, TX_CNTL_CSR_ABORT_TX_AC3, 1);
-        rt2x00_set_field32(&reg, TX_CNTL_CSR_ABORT_TX_MGMT, 1);
         rt2x00pci_register_write(rt2x00dev, TX_CNTL_CSR, reg);
 
         /*
@@ -1508,10 +1484,10 @@ static int rt61pci_set_device_state(struct rt2x00_dev *rt2x00dev,
  */
 static void rt61pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
                                     struct sk_buff *skb,
-                                    struct txdata_entry_desc *desc,
+                                    struct txentry_desc *txdesc,
                                     struct ieee80211_tx_control *control)
 {
-        struct skb_desc *skbdesc = get_skb_desc(skb);
+        struct skb_frame_desc *skbdesc = get_skb_frame_desc(skb);
         __le32 *txd = skbdesc->desc;
         u32 word;
 
@@ -1519,50 +1495,52 @@ static void rt61pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
          * Start writing the descriptor words.
          */
         rt2x00_desc_read(txd, 1, &word);
-        rt2x00_set_field32(&word, TXD_W1_HOST_Q_ID, desc->queue);
-        rt2x00_set_field32(&word, TXD_W1_AIFSN, desc->aifs);
-        rt2x00_set_field32(&word, TXD_W1_CWMIN, desc->cw_min);
-        rt2x00_set_field32(&word, TXD_W1_CWMAX, desc->cw_max);
+        rt2x00_set_field32(&word, TXD_W1_HOST_Q_ID, txdesc->queue);
+        rt2x00_set_field32(&word, TXD_W1_AIFSN, txdesc->aifs);
+        rt2x00_set_field32(&word, TXD_W1_CWMIN, txdesc->cw_min);
+        rt2x00_set_field32(&word, TXD_W1_CWMAX, txdesc->cw_max);
         rt2x00_set_field32(&word, TXD_W1_IV_OFFSET, IEEE80211_HEADER);
         rt2x00_set_field32(&word, TXD_W1_HW_SEQUENCE, 1);
         rt2x00_desc_write(txd, 1, word);
 
         rt2x00_desc_read(txd, 2, &word);
-        rt2x00_set_field32(&word, TXD_W2_PLCP_SIGNAL, desc->signal);
-        rt2x00_set_field32(&word, TXD_W2_PLCP_SERVICE, desc->service);
-        rt2x00_set_field32(&word, TXD_W2_PLCP_LENGTH_LOW, desc->length_low);
-        rt2x00_set_field32(&word, TXD_W2_PLCP_LENGTH_HIGH, desc->length_high);
+        rt2x00_set_field32(&word, TXD_W2_PLCP_SIGNAL, txdesc->signal);
+        rt2x00_set_field32(&word, TXD_W2_PLCP_SERVICE, txdesc->service);
+        rt2x00_set_field32(&word, TXD_W2_PLCP_LENGTH_LOW, txdesc->length_low);
+        rt2x00_set_field32(&word, TXD_W2_PLCP_LENGTH_HIGH, txdesc->length_high);
         rt2x00_desc_write(txd, 2, word);
 
         rt2x00_desc_read(txd, 5, &word);
         rt2x00_set_field32(&word, TXD_W5_TX_POWER,
-                           TXPOWER_TO_DEV(control->power_level));
+                           TXPOWER_TO_DEV(rt2x00dev->tx_power));
         rt2x00_set_field32(&word, TXD_W5_WAITING_DMA_DONE_INT, 1);
         rt2x00_desc_write(txd, 5, word);
 
-        rt2x00_desc_read(txd, 11, &word);
-        rt2x00_set_field32(&word, TXD_W11_BUFFER_LENGTH0, skbdesc->data_len);
-        rt2x00_desc_write(txd, 11, word);
+        if (skbdesc->desc_len > TXINFO_SIZE) {
+                rt2x00_desc_read(txd, 11, &word);
+                rt2x00_set_field32(&word, TXD_W11_BUFFER_LENGTH0, skbdesc->data_len);
+                rt2x00_desc_write(txd, 11, word);
+        }
 
         rt2x00_desc_read(txd, 0, &word);
         rt2x00_set_field32(&word, TXD_W0_OWNER_NIC, 1);
         rt2x00_set_field32(&word, TXD_W0_VALID, 1);
         rt2x00_set_field32(&word, TXD_W0_MORE_FRAG,
-                           test_bit(ENTRY_TXD_MORE_FRAG, &desc->flags));
+                           test_bit(ENTRY_TXD_MORE_FRAG, &txdesc->flags));
         rt2x00_set_field32(&word, TXD_W0_ACK,
-                           test_bit(ENTRY_TXD_ACK, &desc->flags));
+                           test_bit(ENTRY_TXD_ACK, &txdesc->flags));
         rt2x00_set_field32(&word, TXD_W0_TIMESTAMP,
-                           test_bit(ENTRY_TXD_REQ_TIMESTAMP, &desc->flags));
+                           test_bit(ENTRY_TXD_REQ_TIMESTAMP, &txdesc->flags));
         rt2x00_set_field32(&word, TXD_W0_OFDM,
-                           test_bit(ENTRY_TXD_OFDM_RATE, &desc->flags));
-        rt2x00_set_field32(&word, TXD_W0_IFS, desc->ifs);
+                           test_bit(ENTRY_TXD_OFDM_RATE, &txdesc->flags));
+        rt2x00_set_field32(&word, TXD_W0_IFS, txdesc->ifs);
         rt2x00_set_field32(&word, TXD_W0_RETRY_MODE,
                            !!(control->flags &
                               IEEE80211_TXCTL_LONG_RETRY_LIMIT));
         rt2x00_set_field32(&word, TXD_W0_TKIP_MIC, 0);
         rt2x00_set_field32(&word, TXD_W0_DATABYTE_COUNT, skbdesc->data_len);
         rt2x00_set_field32(&word, TXD_W0_BURST,
-                           test_bit(ENTRY_TXD_BURST, &desc->flags));
+                           test_bit(ENTRY_TXD_BURST, &txdesc->flags));
         rt2x00_set_field32(&word, TXD_W0_CIPHER_ALG, CIPHER_NONE);
         rt2x00_desc_write(txd, 0, word);
 }
@@ -1571,11 +1549,11 @@ static void rt61pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
  * TX data initialization
  */
 static void rt61pci_kick_tx_queue(struct rt2x00_dev *rt2x00dev,
-                                  unsigned int queue)
+                                  const unsigned int queue)
 {
         u32 reg;
 
-        if (queue == IEEE80211_TX_QUEUE_BEACON) {
+        if (queue == RT2X00_BCN_QUEUE_BEACON) {
                 /*
                  * For Wi-Fi faily generated beacons between participating
                  * stations. Set TBTT phase adaptive adjustment step to 8us.
@@ -1599,8 +1577,6 @@ static void rt61pci_kick_tx_queue(struct rt2x00_dev *rt2x00dev,
                            (queue == IEEE80211_TX_QUEUE_DATA2));
         rt2x00_set_field32(&reg, TX_CNTL_CSR_KICK_TX_AC3,
                            (queue == IEEE80211_TX_QUEUE_DATA3));
-        rt2x00_set_field32(&reg, TX_CNTL_CSR_KICK_TX_MGMT,
-                           (queue == IEEE80211_TX_QUEUE_DATA4));
         rt2x00pci_register_write(rt2x00dev, TX_CNTL_CSR, reg);
 }
 
@@ -1628,7 +1604,7 @@ static int rt61pci_agc_to_rssi(struct rt2x00_dev *rt2x00dev, int rxd_w1)
                 return 0;
         }
 
-        if (rt2x00dev->rx_status.phymode == MODE_IEEE80211A) {
+        if (rt2x00dev->rx_status.band == IEEE80211_BAND_5GHZ) {
                 if (test_bit(CONFIG_EXTERNAL_LNA_A, &rt2x00dev->flags))
                         offset += 14;
 
@@ -1648,28 +1624,28 @@ static int rt61pci_agc_to_rssi(struct rt2x00_dev *rt2x00dev, int rxd_w1)
         return rt2x00_get_field32(rxd_w1, RXD_W1_RSSI_AGC) * 2 - offset;
 }
 
-static void rt61pci_fill_rxdone(struct data_entry *entry,
-                                struct rxdata_entry_desc *desc)
+static void rt61pci_fill_rxdone(struct queue_entry *entry,
+                                struct rxdone_entry_desc *rxdesc)
 {
-        __le32 *rxd = entry->priv;
+        struct queue_entry_priv_pci_rx *priv_rx = entry->priv_data;
         u32 word0;
         u32 word1;
 
-        rt2x00_desc_read(rxd, 0, &word0);
-        rt2x00_desc_read(rxd, 1, &word1);
+        rt2x00_desc_read(priv_rx->desc, 0, &word0);
+        rt2x00_desc_read(priv_rx->desc, 1, &word1);
 
-        desc->flags = 0;
+        rxdesc->flags = 0;
         if (rt2x00_get_field32(word0, RXD_W0_CRC_ERROR))
-                desc->flags |= RX_FLAG_FAILED_FCS_CRC;
+                rxdesc->flags |= RX_FLAG_FAILED_FCS_CRC;
 
         /*
          * Obtain the status about this packet.
          */
-        desc->signal = rt2x00_get_field32(word1, RXD_W1_SIGNAL);
-        desc->rssi = rt61pci_agc_to_rssi(entry->ring->rt2x00dev, word1);
-        desc->ofdm = rt2x00_get_field32(word0, RXD_W0_OFDM);
-        desc->size = rt2x00_get_field32(word0, RXD_W0_DATABYTE_COUNT);
-        desc->my_bss = !!rt2x00_get_field32(word0, RXD_W0_MY_BSS);
+        rxdesc->signal = rt2x00_get_field32(word1, RXD_W1_SIGNAL);
+        rxdesc->rssi = rt61pci_agc_to_rssi(entry->queue->rt2x00dev, word1);
+        rxdesc->ofdm = rt2x00_get_field32(word0, RXD_W0_OFDM);
+        rxdesc->size = rt2x00_get_field32(word0, RXD_W0_DATABYTE_COUNT);
+        rxdesc->my_bss = !!rt2x00_get_field32(word0, RXD_W0_MY_BSS);
 }
 
 /*
@@ -1677,17 +1653,16 @@ static void rt61pci_fill_rxdone(struct data_entry *entry,
  */
 static void rt61pci_txdone(struct rt2x00_dev *rt2x00dev)
 {
-        struct data_ring *ring;
-        struct data_entry *entry;
-        struct data_entry *entry_done;
-        __le32 *txd;
+        struct data_queue *queue;
+        struct queue_entry *entry;
+        struct queue_entry *entry_done;
+        struct queue_entry_priv_pci_tx *priv_tx;
+        struct txdone_entry_desc txdesc;
         u32 word;
         u32 reg;
         u32 old_reg;
         int type;
         int index;
-        int tx_status;
-        int retry;
 
         /*
          * During each loop we will compare the freshly read
@@ -1710,11 +1685,11 @@ static void rt61pci_txdone(struct rt2x00_dev *rt2x00dev)
 
                 /*
                  * Skip this entry when it contains an invalid
-                 * ring identication number.
+                 * queue identication number.
                  */
                 type = rt2x00_get_field32(reg, STA_CSR4_PID_TYPE);
-                ring = rt2x00lib_get_ring(rt2x00dev, type);
-                if (unlikely(!ring))
+                queue = rt2x00queue_get_queue(rt2x00dev, type);
+                if (unlikely(!queue))
                         continue;
 
                 /*
@@ -1722,36 +1697,40 @@ static void rt61pci_txdone(struct rt2x00_dev *rt2x00dev)
                  * index number.
                  */
                 index = rt2x00_get_field32(reg, STA_CSR4_PID_SUBTYPE);
-                if (unlikely(index >= ring->stats.limit))
+                if (unlikely(index >= queue->limit))
                         continue;
 
-                entry = &ring->entry[index];
-                txd = entry->priv;
-                rt2x00_desc_read(txd, 0, &word);
+                entry = &queue->entries[index];
+                priv_tx = entry->priv_data;
+                rt2x00_desc_read(priv_tx->desc, 0, &word);
 
                 if (rt2x00_get_field32(word, TXD_W0_OWNER_NIC) ||
                     !rt2x00_get_field32(word, TXD_W0_VALID))
                         return;
 
-                entry_done = rt2x00_get_data_entry_done(ring);
+                entry_done = rt2x00queue_get_entry(queue, Q_INDEX_DONE);
                 while (entry != entry_done) {
-                        /* Catch up. Just report any entries we missed as
-                         * failed. */
+                        /* Catch up.
+                         * Just report any entries we missed as failed.
+                         */
                         WARNING(rt2x00dev,
-                                "TX status report missed for entry %p\n",
-                                entry_done);
-                        rt2x00pci_txdone(rt2x00dev, entry_done, TX_FAIL_OTHER,
-                                         0);
-                        entry_done = rt2x00_get_data_entry_done(ring);
+                                "TX status report missed for entry %d\n",
+                                entry_done->entry_idx);
+
+                        txdesc.status = TX_FAIL_OTHER;
+                        txdesc.retry = 0;
+
+                        rt2x00pci_txdone(rt2x00dev, entry_done, &txdesc);
+                        entry_done = rt2x00queue_get_entry(queue, Q_INDEX_DONE);
                 }
 
                 /*
                  * Obtain the status about this packet.
                  */
-                tx_status = rt2x00_get_field32(reg, STA_CSR4_TX_RESULT);
-                retry = rt2x00_get_field32(reg, STA_CSR4_RETRY_COUNT);
+                txdesc.status = rt2x00_get_field32(reg, STA_CSR4_TX_RESULT);
+                txdesc.retry = rt2x00_get_field32(reg, STA_CSR4_RETRY_COUNT);
 
-                rt2x00pci_txdone(rt2x00dev, entry, tx_status, retry);
+                rt2x00pci_txdone(rt2x00dev, entry, &txdesc);
         }
 }
 
@@ -1906,7 +1885,7 @@ static int rt61pci_validate_eeprom(struct rt2x00_dev *rt2x00dev)
                 rt2x00_set_field16(&word, EEPROM_RSSI_OFFSET_A_1, 0);
                 rt2x00_set_field16(&word, EEPROM_RSSI_OFFSET_A_2, 0);
                 rt2x00_eeprom_write(rt2x00dev, EEPROM_RSSI_OFFSET_A, word);
-                EEPROM(rt2x00dev, "RSSI OFFSET BG: 0x%04x\n", word);
+                EEPROM(rt2x00dev, "RSSI OFFSET A: 0x%04x\n", word);
         } else {
                 value = rt2x00_get_field16(word, EEPROM_RSSI_OFFSET_A_1);
                 if (value < -10 || value > 10)
@@ -2035,35 +2014,51 @@ static int rt61pci_init_eeprom(struct rt2x00_dev *rt2x00dev)
          * If the eeprom value is invalid,
          * switch to default led mode.
          */
+#ifdef CONFIG_RT61PCI_LEDS
         rt2x00_eeprom_read(rt2x00dev, EEPROM_LED, &eeprom);
 
-        rt2x00dev->led_mode = rt2x00_get_field16(eeprom, EEPROM_LED_LED_MODE);
+        value = rt2x00_get_field16(eeprom, EEPROM_LED_LED_MODE);
+
+        switch (value) {
+        case LED_MODE_TXRX_ACTIVITY:
+        case LED_MODE_ASUS:
+        case LED_MODE_ALPHA:
+        case LED_MODE_DEFAULT:
+                rt2x00dev->led_flags =
+                    LED_SUPPORT_RADIO | LED_SUPPORT_ASSOC;
+                break;
+        case LED_MODE_SIGNAL_STRENGTH:
+                rt2x00dev->led_flags =
+                    LED_SUPPORT_RADIO | LED_SUPPORT_ASSOC |
+                    LED_SUPPORT_QUALITY;
+                break;
+        }
 
-        rt2x00_set_field16(&rt2x00dev->led_reg, MCU_LEDCS_LED_MODE,
-                           rt2x00dev->led_mode);
-        rt2x00_set_field16(&rt2x00dev->led_reg, MCU_LEDCS_POLARITY_GPIO_0,
+        rt2x00_set_field16(&rt2x00dev->led_mcu_reg, MCU_LEDCS_LED_MODE, value);
+        rt2x00_set_field16(&rt2x00dev->led_mcu_reg, MCU_LEDCS_POLARITY_GPIO_0,
                            rt2x00_get_field16(eeprom,
                                               EEPROM_LED_POLARITY_GPIO_0));
-        rt2x00_set_field16(&rt2x00dev->led_reg, MCU_LEDCS_POLARITY_GPIO_1,
+        rt2x00_set_field16(&rt2x00dev->led_mcu_reg, MCU_LEDCS_POLARITY_GPIO_1,
                            rt2x00_get_field16(eeprom,
                                               EEPROM_LED_POLARITY_GPIO_1));
-        rt2x00_set_field16(&rt2x00dev->led_reg, MCU_LEDCS_POLARITY_GPIO_2,
+        rt2x00_set_field16(&rt2x00dev->led_mcu_reg, MCU_LEDCS_POLARITY_GPIO_2,
                            rt2x00_get_field16(eeprom,
                                               EEPROM_LED_POLARITY_GPIO_2));
-        rt2x00_set_field16(&rt2x00dev->led_reg, MCU_LEDCS_POLARITY_GPIO_3,
+        rt2x00_set_field16(&rt2x00dev->led_mcu_reg, MCU_LEDCS_POLARITY_GPIO_3,
                            rt2x00_get_field16(eeprom,
                                               EEPROM_LED_POLARITY_GPIO_3));
-        rt2x00_set_field16(&rt2x00dev->led_reg, MCU_LEDCS_POLARITY_GPIO_4,
+        rt2x00_set_field16(&rt2x00dev->led_mcu_reg, MCU_LEDCS_POLARITY_GPIO_4,
                            rt2x00_get_field16(eeprom,
                                               EEPROM_LED_POLARITY_GPIO_4));
-        rt2x00_set_field16(&rt2x00dev->led_reg, MCU_LEDCS_POLARITY_ACT,
+        rt2x00_set_field16(&rt2x00dev->led_mcu_reg, MCU_LEDCS_POLARITY_ACT,
                            rt2x00_get_field16(eeprom, EEPROM_LED_POLARITY_ACT));
-        rt2x00_set_field16(&rt2x00dev->led_reg, MCU_LEDCS_POLARITY_READY_BG,
+        rt2x00_set_field16(&rt2x00dev->led_mcu_reg, MCU_LEDCS_POLARITY_READY_BG,
                            rt2x00_get_field16(eeprom,
                                               EEPROM_LED_POLARITY_RDY_G));
-        rt2x00_set_field16(&rt2x00dev->led_reg, MCU_LEDCS_POLARITY_READY_A,
+        rt2x00_set_field16(&rt2x00dev->led_mcu_reg, MCU_LEDCS_POLARITY_READY_A,
                            rt2x00_get_field16(eeprom,
                                               EEPROM_LED_POLARITY_RDY_A));
+#endif /* CONFIG_RT61PCI_LEDS */
 
         return 0;
 }
@@ -2197,7 +2192,7 @@ static void rt61pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
         rt2x00dev->hw->extra_tx_headroom = 0;
         rt2x00dev->hw->max_signal = MAX_SIGNAL;
         rt2x00dev->hw->max_rssi = MAX_RX_SSI;
-        rt2x00dev->hw->queues = 5;
+        rt2x00dev->hw->queues = 4;
 
         SET_IEEE80211_DEV(rt2x00dev->hw, &rt2x00dev_pci(rt2x00dev)->dev);
         SET_IEEE80211_PERM_ADDR(rt2x00dev->hw,
@@ -2214,8 +2209,8 @@ static void rt61pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
         /*
          * Initialize hw_mode information.
          */
-        spec->num_modes = 2;
-        spec->num_rates = 12;
+        spec->supported_bands = SUPPORT_BAND_2GHZ;
+        spec->supported_rates = SUPPORT_RATE_CCK | SUPPORT_RATE_OFDM;
         spec->tx_power_a = NULL;
         spec->tx_power_bg = txpower;
         spec->tx_power_default = DEFAULT_TXPOWER;
@@ -2230,7 +2225,7 @@ static void rt61pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
 
         if (rt2x00_rf(&rt2x00dev->chip, RF5225) ||
             rt2x00_rf(&rt2x00dev->chip, RF5325)) {
-                spec->num_modes = 3;
+                spec->supported_bands |= SUPPORT_BAND_5GHZ;
                 spec->num_channels = ARRAY_SIZE(rf_vals_seq);
 
                 txpower = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_A_START);
@@ -2262,9 +2257,10 @@ static int rt61pci_probe_hw(struct rt2x00_dev *rt2x00dev)
         rt61pci_probe_hw_mode(rt2x00dev);
 
         /*
-         * This device requires firmware
+         * This device requires firmware.
          */
         __set_bit(DRIVER_REQUIRE_FIRMWARE, &rt2x00dev->flags);
+        __set_bit(DRIVER_REQUIRE_FIRMWARE_CRC_ITU_T, &rt2x00dev->flags);
 
         /*
          * Set the rssi offset.
@@ -2336,8 +2332,9 @@ static void rt61pci_configure_filter(struct ieee80211_hw *hw,
         rt2x00_set_field32(&reg, TXRX_CSR0_DROP_VERSION_ERROR, 1);
         rt2x00_set_field32(&reg, TXRX_CSR0_DROP_MULTICAST,
                            !(*total_flags & FIF_ALLMULTI));
-        rt2x00_set_field32(&reg, TXRX_CSR0_DROP_BORADCAST, 0);
-        rt2x00_set_field32(&reg, TXRX_CSR0_DROP_ACK_CTS, 1);
+        rt2x00_set_field32(&reg, TXRX_CSR0_DROP_BROADCAST, 0);
+        rt2x00_set_field32(&reg, TXRX_CSR0_DROP_ACK_CTS,
+                           !(*total_flags & FIF_CONTROL));
         rt2x00pci_register_write(rt2x00dev, TXRX_CSR0, reg);
 }
 
@@ -2369,37 +2366,24 @@ static u64 rt61pci_get_tsf(struct ieee80211_hw *hw)
         return tsf;
 }
 
-static void rt61pci_reset_tsf(struct ieee80211_hw *hw)
-{
-        struct rt2x00_dev *rt2x00dev = hw->priv;
-
-        rt2x00pci_register_write(rt2x00dev, TXRX_CSR12, 0);
-        rt2x00pci_register_write(rt2x00dev, TXRX_CSR13, 0);
-}
-
 static int rt61pci_beacon_update(struct ieee80211_hw *hw, struct sk_buff *skb,
                           struct ieee80211_tx_control *control)
 {
         struct rt2x00_dev *rt2x00dev = hw->priv;
-        struct skb_desc *desc;
-        struct data_ring *ring;
-        struct data_entry *entry;
+        struct rt2x00_intf *intf = vif_to_intf(control->vif);
+        struct skb_frame_desc *skbdesc;
+        unsigned int beacon_base;
 
-        /*
-         * Just in case the ieee80211 doesn't set this,
-         * but we need this queue set for the descriptor
-         * initialization.
-         */
-        control->queue = IEEE80211_TX_QUEUE_BEACON;
-        ring = rt2x00lib_get_ring(rt2x00dev, control->queue);
-        entry = rt2x00_get_data_entry(ring);
+        if (unlikely(!intf->beacon))
+                return -ENOBUFS;
 
         /*
          * We need to append the descriptor in front of the
          * beacon frame.
          */
-        if (skb_headroom(skb) < TXD_DESC_SIZE) {
-                if (pskb_expand_head(skb, TXD_DESC_SIZE, 0, GFP_ATOMIC)) {
+        if (skb_headroom(skb) < intf->beacon->queue->desc_size) {
+                if (pskb_expand_head(skb, intf->beacon->queue->desc_size,
+                                     0, GFP_ATOMIC)) {
                         dev_kfree_skb(skb);
                         return -ENOMEM;
                 }
@@ -2408,29 +2392,37 @@ static int rt61pci_beacon_update(struct ieee80211_hw *hw, struct sk_buff *skb,
         /*
          * Add the descriptor in front of the skb.
          */
-        skb_push(skb, ring->desc_size);
-        memset(skb->data, 0, ring->desc_size);
+        skb_push(skb, intf->beacon->queue->desc_size);
+        memset(skb->data, 0, intf->beacon->queue->desc_size);
 
         /*
          * Fill in skb descriptor
          */
-        desc = get_skb_desc(skb);
-        desc->desc_len = ring->desc_size;
-        desc->data_len = skb->len - ring->desc_size;
-        desc->desc = skb->data;
-        desc->data = skb->data + ring->desc_size;
-        desc->ring = ring;
-        desc->entry = entry;
+        skbdesc = get_skb_frame_desc(skb);
+        memset(skbdesc, 0, sizeof(*skbdesc));
+        skbdesc->flags |= FRAME_DESC_DRIVER_GENERATED;
+        skbdesc->data = skb->data + intf->beacon->queue->desc_size;
+        skbdesc->data_len = skb->len - intf->beacon->queue->desc_size;
+        skbdesc->desc = skb->data;
+        skbdesc->desc_len = intf->beacon->queue->desc_size;
+        skbdesc->entry = intf->beacon;
 
+        /*
+         * mac80211 doesn't provide the control->queue variable
+         * for beacons. Set our own queue identification so
+         * it can be used during descriptor initialization.
+         */
+        control->queue = RT2X00_BCN_QUEUE_BEACON;
         rt2x00lib_write_tx_desc(rt2x00dev, skb, control);
 
         /*
          * Write entire beacon with descriptor to register,
          * and kick the beacon generator.
          */
-        rt2x00pci_register_multiwrite(rt2x00dev, HW_BEACON_BASE0,
+        beacon_base = HW_BEACON_OFFSET(intf->beacon->entry_idx);
+        rt2x00pci_register_multiwrite(rt2x00dev, beacon_base,
                                       skb->data, skb->len);
-        rt61pci_kick_tx_queue(rt2x00dev, IEEE80211_TX_QUEUE_BEACON);
+        rt61pci_kick_tx_queue(rt2x00dev, control->queue);
 
         return 0;
 }
@@ -2450,7 +2442,6 @@ static const struct ieee80211_ops rt61pci_mac80211_ops = {
         .conf_tx                = rt2x00mac_conf_tx,
         .get_tx_stats           = rt2x00mac_get_tx_stats,
         .get_tsf                = rt61pci_get_tsf,
-        .reset_tsf              = rt61pci_reset_tsf,
         .beacon_update          = rt61pci_beacon_update,
 };
 
@@ -2468,23 +2459,46 @@ static const struct rt2x00lib_ops rt61pci_rt2x00_ops = {
         .link_stats             = rt61pci_link_stats,
         .reset_tuner            = rt61pci_reset_tuner,
         .link_tuner             = rt61pci_link_tuner,
+        .led_brightness         = rt61pci_led_brightness,
         .write_tx_desc          = rt61pci_write_tx_desc,
         .write_tx_data          = rt2x00pci_write_tx_data,
         .kick_tx_queue          = rt61pci_kick_tx_queue,
         .fill_rxdone            = rt61pci_fill_rxdone,
-        .config_mac_addr        = rt61pci_config_mac_addr,
-        .config_bssid           = rt61pci_config_bssid,
-        .config_type            = rt61pci_config_type,
+        .config_intf            = rt61pci_config_intf,
         .config_preamble        = rt61pci_config_preamble,
         .config                 = rt61pci_config,
 };
 
+static const struct data_queue_desc rt61pci_queue_rx = {
+        .entry_num              = RX_ENTRIES,
+        .data_size              = DATA_FRAME_SIZE,
+        .desc_size              = RXD_DESC_SIZE,
+        .priv_size              = sizeof(struct queue_entry_priv_pci_rx),
+};
+
+static const struct data_queue_desc rt61pci_queue_tx = {
+        .entry_num              = TX_ENTRIES,
+        .data_size              = DATA_FRAME_SIZE,
+        .desc_size              = TXD_DESC_SIZE,
+        .priv_size              = sizeof(struct queue_entry_priv_pci_tx),
+};
+
+static const struct data_queue_desc rt61pci_queue_bcn = {
+        .entry_num              = 4 * BEACON_ENTRIES,
+        .data_size              = MGMT_FRAME_SIZE,
+        .desc_size              = TXINFO_SIZE,
+        .priv_size              = sizeof(struct queue_entry_priv_pci_tx),
+};
+
 static const struct rt2x00_ops rt61pci_ops = {
         .name           = KBUILD_MODNAME,
-        .rxd_size       = RXD_DESC_SIZE,
-        .txd_size       = TXD_DESC_SIZE,
+        .max_sta_intf   = 1,
+        .max_ap_intf    = 4,
         .eeprom_size    = EEPROM_SIZE,
         .rf_size        = RF_SIZE,
+        .rx             = &rt61pci_queue_rx,
+        .tx             = &rt61pci_queue_tx,
+        .bcn            = &rt61pci_queue_bcn,
         .lib            = &rt61pci_rt2x00_ops,
         .hw             = &rt61pci_mac80211_ops,
 #ifdef CONFIG_RT2X00_LIB_DEBUGFS
diff --git a/drivers/net/wireless/rt2x00/rt61pci.h b/drivers/net/wireless/rt2x00/rt61pci.h
index 4c6524eedad0..3511bba7ff65 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.h
+++ b/drivers/net/wireless/rt2x00/rt61pci.h
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2007 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2008 rt2x00 SourceForge Project
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
@@ -161,7 +161,9 @@ struct hw_pairwise_ta_entry {
 #define HW_BEACON_BASE1                 0x2d00
 #define HW_BEACON_BASE2                 0x2e00
 #define HW_BEACON_BASE3                 0x2f00
-#define HW_BEACON_OFFSET                0x0100
+
+#define HW_BEACON_OFFSET(__index) \
+        ( HW_BEACON_BASE0 + (__index * 0x0100) )
 
 /*
  * HOST-MCU shared memory.
@@ -234,6 +236,11 @@ struct hw_pairwise_ta_entry {
 
 /*
  * MAC_CSR3: STA MAC register 1.
+ * UNICAST_TO_ME_MASK:
+ *      Used to mask off bits from byte 5 of the MAC address
+ *      to determine the UNICAST_TO_ME bit for RX frames.
+ *      The full mask is complemented by BSS_ID_MASK:
+ *              MASK = BSS_ID_MASK & UNICAST_TO_ME_MASK
  */
 #define MAC_CSR3                        0x300c
 #define MAC_CSR3_BYTE4                  FIELD32(0x000000ff)
@@ -251,7 +258,14 @@ struct hw_pairwise_ta_entry {
 
 /*
  * MAC_CSR5: BSSID register 1.
- * BSS_ID_MASK: 3: one BSSID, 0: 4 BSSID, 2 or 1: 2 BSSID.
+ * BSS_ID_MASK:
+ *      This mask is used to mask off bits 0 and 1 of byte 5 of the
+ *      BSSID. This will make sure that those bits will be ignored
+ *      when determining the MY_BSS of RX frames.
+ *              0: 1-BSSID mode (BSS index = 0)
+ *              1: 2-BSSID mode (BSS index: Byte5, bit 0)
+ *              2: 2-BSSID mode (BSS index: byte5, bit 1)
+ *              3: 4-BSSID mode (BSS index: byte5, bit 0 - 1)
  */
 #define MAC_CSR5                        0x3014
 #define MAC_CSR5_BYTE4                  FIELD32(0x000000ff)
@@ -391,7 +405,7 @@ struct hw_pairwise_ta_entry {
 #define TXRX_CSR0_DROP_TO_DS            FIELD32(0x00200000)
 #define TXRX_CSR0_DROP_VERSION_ERROR    FIELD32(0x00400000)
 #define TXRX_CSR0_DROP_MULTICAST        FIELD32(0x00800000)
-#define TXRX_CSR0_DROP_BORADCAST        FIELD32(0x01000000)
+#define TXRX_CSR0_DROP_BROADCAST        FIELD32(0x01000000)
 #define TXRX_CSR0_DROP_ACK_CTS          FIELD32(0x02000000)
 #define TXRX_CSR0_TX_WITHOUT_WAITING    FIELD32(0x04000000)
 
@@ -866,7 +880,7 @@ struct hw_pairwise_ta_entry {
 #define TX_CNTL_CSR_ABORT_TX_MGMT       FIELD32(0x00100000)
 
 /*
- * LOAD_TX_RING_CSR: Load RX de
+ * LOAD_TX_RING_CSR: Load RX desriptor
  */
 #define LOAD_TX_RING_CSR                0x3434
 #define LOAD_TX_RING_CSR_LOAD_TXD_AC0   FIELD32(0x00000001)
@@ -1116,10 +1130,10 @@ struct hw_pairwise_ta_entry {
 #define EEPROM_MAC_ADDR_0               0x0002
 #define EEPROM_MAC_ADDR_BYTE0           FIELD16(0x00ff)
 #define EEPROM_MAC_ADDR_BYTE1           FIELD16(0xff00)
-#define EEPROM_MAC_ADDR1                0x0004
+#define EEPROM_MAC_ADDR1                0x0003
 #define EEPROM_MAC_ADDR_BYTE2           FIELD16(0x00ff)
 #define EEPROM_MAC_ADDR_BYTE3           FIELD16(0xff00)
-#define EEPROM_MAC_ADDR_2               0x0006
+#define EEPROM_MAC_ADDR_2               0x0004
 #define EEPROM_MAC_ADDR_BYTE4           FIELD16(0x00ff)
 #define EEPROM_MAC_ADDR_BYTE5           FIELD16(0xff00)
 
@@ -1247,6 +1261,7 @@ struct hw_pairwise_ta_entry {
  * DMA descriptor defines.
  */
 #define TXD_DESC_SIZE                   ( 16 * sizeof(__le32) )
+#define TXINFO_SIZE                     ( 6 * sizeof(__le32) )
 #define RXD_DESC_SIZE                   ( 16 * sizeof(__le32) )
 
 /*
@@ -1440,8 +1455,8 @@ struct hw_pairwise_ta_entry {
 #define RXD_W15_RESERVED                FIELD32(0xffffffff)
 
 /*
- * Macro's for converting txpower from EEPROM to dscape value
- * and from dscape value to register value.
+ * Macro's for converting txpower from EEPROM to mac80211 value
+ * and from mac80211 value to register value.
  */
 #define MIN_TXPOWER     0
 #define MAX_TXPOWER     31
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index 4fac2d414d84..6546b0d607b9 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2007 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2008 rt2x00 SourceForge Project
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
@@ -278,77 +278,122 @@ static const struct rt2x00debug rt73usb_rt2x00debug = {
 };
 #endif /* CONFIG_RT2X00_LIB_DEBUGFS */
 
-/*
- * Configuration handlers.
- */
-static void rt73usb_config_mac_addr(struct rt2x00_dev *rt2x00dev, __le32 *mac)
+#ifdef CONFIG_RT73USB_LEDS
+static void rt73usb_led_brightness(struct led_classdev *led_cdev,
+                                   enum led_brightness brightness)
 {
-        u32 tmp;
+        struct rt2x00_led *led =
+           container_of(led_cdev, struct rt2x00_led, led_dev);
+        unsigned int enabled = brightness != LED_OFF;
+        unsigned int a_mode =
+            (enabled && led->rt2x00dev->curr_band == IEEE80211_BAND_5GHZ);
+        unsigned int bg_mode =
+            (enabled && led->rt2x00dev->curr_band == IEEE80211_BAND_2GHZ);
 
-        tmp = le32_to_cpu(mac[1]);
-        rt2x00_set_field32(&tmp, MAC_CSR3_UNICAST_TO_ME_MASK, 0xff);
-        mac[1] = cpu_to_le32(tmp);
+        if (in_atomic()) {
+                NOTICE(led->rt2x00dev,
+                       "Ignoring LED brightness command for led %d", led->type);
+                return;
+        }
 
-        rt73usb_register_multiwrite(rt2x00dev, MAC_CSR2, mac,
-                                    (2 * sizeof(__le32)));
+        if (led->type == LED_TYPE_RADIO) {
+                rt2x00_set_field16(&led->rt2x00dev->led_mcu_reg,
+                                   MCU_LEDCS_RADIO_STATUS, enabled);
+
+                rt2x00usb_vendor_request_sw(led->rt2x00dev, USB_LED_CONTROL,
+                                            0, led->rt2x00dev->led_mcu_reg,
+                                            REGISTER_TIMEOUT);
+        } else if (led->type == LED_TYPE_ASSOC) {
+                rt2x00_set_field16(&led->rt2x00dev->led_mcu_reg,
+                                   MCU_LEDCS_LINK_BG_STATUS, bg_mode);
+                rt2x00_set_field16(&led->rt2x00dev->led_mcu_reg,
+                                   MCU_LEDCS_LINK_A_STATUS, a_mode);
+
+                rt2x00usb_vendor_request_sw(led->rt2x00dev, USB_LED_CONTROL,
+                                            0, led->rt2x00dev->led_mcu_reg,
+                                            REGISTER_TIMEOUT);
+        } else if (led->type == LED_TYPE_QUALITY) {
+                /*
+                 * The brightness is divided into 6 levels (0 - 5),
+                 * this means we need to convert the brightness
+                 * argument into the matching level within that range.
+                 */
+                rt2x00usb_vendor_request_sw(led->rt2x00dev, USB_LED_CONTROL,
+                                            brightness / (LED_FULL / 6),
+                                            led->rt2x00dev->led_mcu_reg,
+                                            REGISTER_TIMEOUT);
+        }
 }
+#else
+#define rt73usb_led_brightness  NULL
+#endif /* CONFIG_RT73USB_LEDS */
 
-static void rt73usb_config_bssid(struct rt2x00_dev *rt2x00dev, __le32 *bssid)
+/*
+ * Configuration handlers.
+ */
+static void rt73usb_config_intf(struct rt2x00_dev *rt2x00dev,
+                                struct rt2x00_intf *intf,
+                                struct rt2x00intf_conf *conf,
+                                const unsigned int flags)
 {
-        u32 tmp;
+        unsigned int beacon_base;
+        u32 reg;
 
-        tmp = le32_to_cpu(bssid[1]);
-        rt2x00_set_field32(&tmp, MAC_CSR5_BSS_ID_MASK, 3);
-        bssid[1] = cpu_to_le32(tmp);
+        if (flags & CONFIG_UPDATE_TYPE) {
+                /*
+                 * Clear current synchronisation setup.
+                 * For the Beacon base registers we only need to clear
+                 * the first byte since that byte contains the VALID and OWNER
+                 * bits which (when set to 0) will invalidate the entire beacon.
+                 */
+                beacon_base = HW_BEACON_OFFSET(intf->beacon->entry_idx);
+                rt73usb_register_write(rt2x00dev, TXRX_CSR9, 0);
+                rt73usb_register_write(rt2x00dev, beacon_base, 0);
 
-        rt73usb_register_multiwrite(rt2x00dev, MAC_CSR4, bssid,
-                                    (2 * sizeof(__le32)));
-}
+                /*
+                 * Enable synchronisation.
+                 */
+                rt73usb_register_read(rt2x00dev, TXRX_CSR9, &reg);
+                rt2x00_set_field32(&reg, TXRX_CSR9_TSF_TICKING, 1);
+                rt2x00_set_field32(&reg, TXRX_CSR9_TBTT_ENABLE,
+                                  (conf->sync == TSF_SYNC_BEACON));
+                rt2x00_set_field32(&reg, TXRX_CSR9_BEACON_GEN, 0);
+                rt2x00_set_field32(&reg, TXRX_CSR9_TSF_SYNC, conf->sync);
+                rt73usb_register_write(rt2x00dev, TXRX_CSR9, reg);
+        }
 
-static void rt73usb_config_type(struct rt2x00_dev *rt2x00dev, const int type,
-                                const int tsf_sync)
-{
-        u32 reg;
+        if (flags & CONFIG_UPDATE_MAC) {
+                reg = le32_to_cpu(conf->mac[1]);
+                rt2x00_set_field32(&reg, MAC_CSR3_UNICAST_TO_ME_MASK, 0xff);
+                conf->mac[1] = cpu_to_le32(reg);
 
-        /*
-         * Clear current synchronisation setup.
-         * For the Beacon base registers we only need to clear
-         * the first byte since that byte contains the VALID and OWNER
-         * bits which (when set to 0) will invalidate the entire beacon.
-         */
-        rt73usb_register_write(rt2x00dev, TXRX_CSR9, 0);
-        rt73usb_register_write(rt2x00dev, HW_BEACON_BASE0, 0);
-        rt73usb_register_write(rt2x00dev, HW_BEACON_BASE1, 0);
-        rt73usb_register_write(rt2x00dev, HW_BEACON_BASE2, 0);
-        rt73usb_register_write(rt2x00dev, HW_BEACON_BASE3, 0);
+                rt73usb_register_multiwrite(rt2x00dev, MAC_CSR2,
+                                            conf->mac, sizeof(conf->mac));
+        }
 
-        /*
-         * Enable synchronisation.
-         */
-        rt73usb_register_read(rt2x00dev, TXRX_CSR9, &reg);
-        rt2x00_set_field32(&reg, TXRX_CSR9_TSF_TICKING, 1);
-        rt2x00_set_field32(&reg, TXRX_CSR9_TBTT_ENABLE,
-                           (tsf_sync == TSF_SYNC_BEACON));
-        rt2x00_set_field32(&reg, TXRX_CSR9_BEACON_GEN, 0);
-        rt2x00_set_field32(&reg, TXRX_CSR9_TSF_SYNC, tsf_sync);
-        rt73usb_register_write(rt2x00dev, TXRX_CSR9, reg);
+        if (flags & CONFIG_UPDATE_BSSID) {
+                reg = le32_to_cpu(conf->bssid[1]);
+                rt2x00_set_field32(&reg, MAC_CSR5_BSS_ID_MASK, 3);
+                conf->bssid[1] = cpu_to_le32(reg);
+
+                rt73usb_register_multiwrite(rt2x00dev, MAC_CSR4,
+                                            conf->bssid, sizeof(conf->bssid));
+        }
 }
 
-static void rt73usb_config_preamble(struct rt2x00_dev *rt2x00dev,
-                                      const int short_preamble,
-                                      const int ack_timeout,
-                                      const int ack_consume_time)
+static int rt73usb_config_preamble(struct rt2x00_dev *rt2x00dev,
+                                   const int short_preamble,
+                                   const int ack_timeout,
+                                   const int ack_consume_time)
 {
         u32 reg;
 
         /*
-         * When in atomic context, reschedule and let rt2x00lib
-         * call this function again.
+         * When in atomic context, we should let rt2x00lib
+         * try this configuration again later.
          */
-        if (in_atomic()) {
-                queue_work(rt2x00dev->hw->workqueue, &rt2x00dev->config_work);
-                return;
-        }
+        if (in_atomic())
+                return -EAGAIN;
 
         rt73usb_register_read(rt2x00dev, TXRX_CSR0, &reg);
         rt2x00_set_field32(&reg, TXRX_CSR0_RX_ACK_TIMEOUT, ack_timeout);
@@ -358,6 +403,8 @@ static void rt73usb_config_preamble(struct rt2x00_dev *rt2x00dev,
         rt2x00_set_field32(&reg, TXRX_CSR4_AUTORESPOND_PREAMBLE,
                            !!short_preamble);
         rt73usb_register_write(rt2x00dev, TXRX_CSR4, reg);
+
+        return 0;
 }
 
 static void rt73usb_config_phymode(struct rt2x00_dev *rt2x00dev,
@@ -442,13 +489,13 @@ static void rt73usb_config_antenna_5x(struct rt2x00_dev *rt2x00dev,
         case ANTENNA_HW_DIVERSITY:
                 rt2x00_set_field8(&r4, BBP_R4_RX_ANTENNA_CONTROL, 2);
                 temp = !test_bit(CONFIG_FRAME_TYPE, &rt2x00dev->flags)
-                       && (rt2x00dev->curr_hwmode != HWMODE_A);
+                       && (rt2x00dev->curr_band != IEEE80211_BAND_5GHZ);
                 rt2x00_set_field8(&r4, BBP_R4_RX_FRAME_END, temp);
                 break;
         case ANTENNA_A:
                 rt2x00_set_field8(&r4, BBP_R4_RX_ANTENNA_CONTROL, 1);
                 rt2x00_set_field8(&r4, BBP_R4_RX_FRAME_END, 0);
-                if (rt2x00dev->curr_hwmode == HWMODE_A)
+                if (rt2x00dev->curr_band == IEEE80211_BAND_5GHZ)
                         rt2x00_set_field8(&r77, BBP_R77_RX_ANTENNA, 0);
                 else
                         rt2x00_set_field8(&r77, BBP_R77_RX_ANTENNA, 3);
@@ -463,7 +510,7 @@ static void rt73usb_config_antenna_5x(struct rt2x00_dev *rt2x00dev,
         case ANTENNA_B:
                 rt2x00_set_field8(&r4, BBP_R4_RX_ANTENNA_CONTROL, 1);
                 rt2x00_set_field8(&r4, BBP_R4_RX_FRAME_END, 0);
-                if (rt2x00dev->curr_hwmode == HWMODE_A)
+                if (rt2x00dev->curr_band == IEEE80211_BAND_5GHZ)
                         rt2x00_set_field8(&r77, BBP_R77_RX_ANTENNA, 3);
                 else
                         rt2x00_set_field8(&r77, BBP_R77_RX_ANTENNA, 0);
@@ -558,7 +605,7 @@ static void rt73usb_config_antenna(struct rt2x00_dev *rt2x00dev,
         unsigned int i;
         u32 reg;
 
-        if (rt2x00dev->curr_hwmode == HWMODE_A) {
+        if (rt2x00dev->curr_band == IEEE80211_BAND_5GHZ) {
                 sel = antenna_sel_a;
                 lna = test_bit(CONFIG_EXTERNAL_LNA_A, &rt2x00dev->flags);
         } else {
@@ -572,10 +619,9 @@ static void rt73usb_config_antenna(struct rt2x00_dev *rt2x00dev,
         rt73usb_register_read(rt2x00dev, PHY_CSR0, &reg);
 
         rt2x00_set_field32(&reg, PHY_CSR0_PA_PE_BG,
-                           (rt2x00dev->curr_hwmode == HWMODE_B ||
-                            rt2x00dev->curr_hwmode == HWMODE_G));
+                           (rt2x00dev->curr_band == IEEE80211_BAND_2GHZ));
         rt2x00_set_field32(&reg, PHY_CSR0_PA_PE_A,
-                           (rt2x00dev->curr_hwmode == HWMODE_A));
+                           (rt2x00dev->curr_band == IEEE80211_BAND_5GHZ));
 
         rt73usb_register_write(rt2x00dev, PHY_CSR0, reg);
 
@@ -617,8 +663,8 @@ static void rt73usb_config_duration(struct rt2x00_dev *rt2x00dev,
 }
 
 static void rt73usb_config(struct rt2x00_dev *rt2x00dev,
-                           const unsigned int flags,
-                           struct rt2x00lib_conf *libconf)
+                           struct rt2x00lib_conf *libconf,
+                           const unsigned int flags)
 {
         if (flags & CONFIG_UPDATE_PHYMODE)
                 rt73usb_config_phymode(rt2x00dev, libconf->basic_rates);
@@ -634,68 +680,6 @@ static void rt73usb_config(struct rt2x00_dev *rt2x00dev,
 }
 
 /*
- * LED functions.
- */
-static void rt73usb_enable_led(struct rt2x00_dev *rt2x00dev)
-{
-        u32 reg;
-
-        rt73usb_register_read(rt2x00dev, MAC_CSR14, &reg);
-        rt2x00_set_field32(&reg, MAC_CSR14_ON_PERIOD, 70);
-        rt2x00_set_field32(&reg, MAC_CSR14_OFF_PERIOD, 30);
-        rt73usb_register_write(rt2x00dev, MAC_CSR14, reg);
-
-        rt2x00_set_field16(&rt2x00dev->led_reg, MCU_LEDCS_RADIO_STATUS, 1);
-        rt2x00_set_field16(&rt2x00dev->led_reg, MCU_LEDCS_LINK_A_STATUS,
-                           (rt2x00dev->rx_status.phymode == MODE_IEEE80211A));
-        rt2x00_set_field16(&rt2x00dev->led_reg, MCU_LEDCS_LINK_BG_STATUS,
-                           (rt2x00dev->rx_status.phymode != MODE_IEEE80211A));
-
-        rt2x00usb_vendor_request_sw(rt2x00dev, USB_LED_CONTROL, 0x0000,
-                                    rt2x00dev->led_reg, REGISTER_TIMEOUT);
-}
-
-static void rt73usb_disable_led(struct rt2x00_dev *rt2x00dev)
-{
-        rt2x00_set_field16(&rt2x00dev->led_reg, MCU_LEDCS_RADIO_STATUS, 0);
-        rt2x00_set_field16(&rt2x00dev->led_reg, MCU_LEDCS_LINK_BG_STATUS, 0);
-        rt2x00_set_field16(&rt2x00dev->led_reg, MCU_LEDCS_LINK_A_STATUS, 0);
-
-        rt2x00usb_vendor_request_sw(rt2x00dev, USB_LED_CONTROL, 0x0000,
-                                    rt2x00dev->led_reg, REGISTER_TIMEOUT);
-}
-
-static void rt73usb_activity_led(struct rt2x00_dev *rt2x00dev, int rssi)
-{
-        u32 led;
-
-        if (rt2x00dev->led_mode != LED_MODE_SIGNAL_STRENGTH)
-                return;
-
-        /*
-         * Led handling requires a positive value for the rssi,
-         * to do that correctly we need to add the correction.
-         */
-        rssi += rt2x00dev->rssi_offset;
-
-        if (rssi <= 30)
-                led = 0;
-        else if (rssi <= 39)
-                led = 1;
-        else if (rssi <= 49)
-                led = 2;
-        else if (rssi <= 53)
-                led = 3;
-        else if (rssi <= 63)
-                led = 4;
-        else
-                led = 5;
-
-        rt2x00usb_vendor_request_sw(rt2x00dev, USB_LED_CONTROL, led,
-                                    rt2x00dev->led_reg, REGISTER_TIMEOUT);
-}
-
-/*
  * Link tuning
  */
 static void rt73usb_link_stats(struct rt2x00_dev *rt2x00dev,
@@ -729,17 +713,12 @@ static void rt73usb_link_tuner(struct rt2x00_dev *rt2x00dev)
         u8 up_bound;
         u8 low_bound;
 
-        /*
-         * Update Led strength
-         */
-        rt73usb_activity_led(rt2x00dev, rssi);
-
         rt73usb_bbp_read(rt2x00dev, 17, &r17);
 
         /*
          * Determine r17 bounds.
          */
-        if (rt2x00dev->rx_status.phymode == MODE_IEEE80211A) {
+        if (rt2x00dev->rx_status.band == IEEE80211_BAND_5GHZ) {
                 low_bound = 0x28;
                 up_bound = 0x48;
 
@@ -766,6 +745,13 @@ static void rt73usb_link_tuner(struct rt2x00_dev *rt2x00dev)
         }
 
         /*
+         * If we are not associated, we should go straight to the
+         * dynamic CCA tuning.
+         */
+        if (!rt2x00dev->intf_associated)
+                goto dynamic_cca_tune;
+
+        /*
          * Special big-R17 for very short distance
          */
         if (rssi > -35) {
@@ -815,6 +801,8 @@ static void rt73usb_link_tuner(struct rt2x00_dev *rt2x00dev)
                 return;
         }
 
+dynamic_cca_tune:
+
         /*
          * r17 does not yet exceed upper limit, continue and base
          * the r17 tuning on the false CCA count.
@@ -889,7 +877,7 @@ static int rt73usb_load_firmware(struct rt2x00_dev *rt2x00dev, void *data,
 
                 rt2x00usb_vendor_request(rt2x00dev, USB_MULTI_WRITE,
                                          USB_VENDOR_REQUEST_OUT,
-                                         FIRMWARE_IMAGE_BASE + i, 0x0000,
+                                         FIRMWARE_IMAGE_BASE + i, 0,
                                          cache, buflen, timeout);
 
                 ptr += buflen;
@@ -902,15 +890,13 @@ static int rt73usb_load_firmware(struct rt2x00_dev *rt2x00dev, void *data,
          * we need to specify a long timeout time.
          */
         status = rt2x00usb_vendor_request_sw(rt2x00dev, USB_DEVICE_MODE,
-                                             0x0000, USB_MODE_FIRMWARE,
+                                             0, USB_MODE_FIRMWARE,
                                              REGISTER_TIMEOUT_FIRMWARE);
         if (status < 0) {
                 ERROR(rt2x00dev, "Failed to write Firmware to device.\n");
                 return status;
         }
 
-        rt73usb_disable_led(rt2x00dev);
-
         return 0;
 }
 
@@ -988,6 +974,11 @@ static int rt73usb_init_registers(struct rt2x00_dev *rt2x00dev)
 
         rt73usb_register_write(rt2x00dev, MAC_CSR13, 0x00007f00);
 
+        rt73usb_register_read(rt2x00dev, MAC_CSR14, &reg);
+        rt2x00_set_field32(&reg, MAC_CSR14_ON_PERIOD, 70);
+        rt2x00_set_field32(&reg, MAC_CSR14_OFF_PERIOD, 30);
+        rt73usb_register_write(rt2x00dev, MAC_CSR14, reg);
+
         /*
          * Invalidate all Shared Keys (SEC_CSR0),
          * and clear the Shared key Cipher algorithms (SEC_CSR1 & SEC_CSR5)
@@ -1021,6 +1012,17 @@ static int rt73usb_init_registers(struct rt2x00_dev *rt2x00dev)
         rt73usb_register_write(rt2x00dev, MAC_CSR9, reg);
 
         /*
+         * Clear all beacons
+         * For the Beacon base registers we only need to clear
+         * the first byte since that byte contains the VALID and OWNER
+         * bits which (when set to 0) will invalidate the entire beacon.
+         */
+        rt73usb_register_write(rt2x00dev, HW_BEACON_BASE0, 0);
+        rt73usb_register_write(rt2x00dev, HW_BEACON_BASE1, 0);
+        rt73usb_register_write(rt2x00dev, HW_BEACON_BASE2, 0);
+        rt73usb_register_write(rt2x00dev, HW_BEACON_BASE3, 0);
+
+        /*
          * We must clear the error counters.
          * These registers are cleared on read,
          * so we may pass a useless variable to store the value.
@@ -1094,19 +1096,15 @@ continue_csr_init:
         rt73usb_bbp_write(rt2x00dev, 102, 0x16);
         rt73usb_bbp_write(rt2x00dev, 107, 0x04);
 
-        DEBUG(rt2x00dev, "Start initialization from EEPROM...\n");
         for (i = 0; i < EEPROM_BBP_SIZE; i++) {
                 rt2x00_eeprom_read(rt2x00dev, EEPROM_BBP_START + i, &eeprom);
 
                 if (eeprom != 0xffff && eeprom != 0x0000) {
                         reg_id = rt2x00_get_field16(eeprom, EEPROM_BBP_REG_ID);
                         value = rt2x00_get_field16(eeprom, EEPROM_BBP_VALUE);
-                        DEBUG(rt2x00dev, "BBP: 0x%02x, value: 0x%02x.\n",
-                              reg_id, value);
                         rt73usb_bbp_write(rt2x00dev, reg_id, value);
                 }
         }
-        DEBUG(rt2x00dev, "...End initialization from EEPROM.\n");
 
         return 0;
 }
@@ -1136,21 +1134,11 @@ static int rt73usb_enable_radio(struct rt2x00_dev *rt2x00dev)
                 return -EIO;
         }
 
-        /*
-         * Enable LED
-         */
-        rt73usb_enable_led(rt2x00dev);
-
         return 0;
 }
 
 static void rt73usb_disable_radio(struct rt2x00_dev *rt2x00dev)
 {
-        /*
-         * Disable LED
-         */
-        rt73usb_disable_led(rt2x00dev);
-
         rt73usb_register_write(rt2x00dev, MAC_CSR10, 0x00001818);
 
         /*
@@ -1234,10 +1222,10 @@ static int rt73usb_set_device_state(struct rt2x00_dev *rt2x00dev,
  */
 static void rt73usb_write_tx_desc(struct rt2x00_dev *rt2x00dev,
                                     struct sk_buff *skb,
-                                    struct txdata_entry_desc *desc,
+                                    struct txentry_desc *txdesc,
                                     struct ieee80211_tx_control *control)
 {
-        struct skb_desc *skbdesc = get_skb_desc(skb);
+        struct skb_frame_desc *skbdesc = get_skb_frame_desc(skb);
         __le32 *txd = skbdesc->desc;
         u32 word;
 
@@ -1245,47 +1233,47 @@ static void rt73usb_write_tx_desc(struct rt2x00_dev *rt2x00dev,
          * Start writing the descriptor words.
          */
         rt2x00_desc_read(txd, 1, &word);
-        rt2x00_set_field32(&word, TXD_W1_HOST_Q_ID, desc->queue);
-        rt2x00_set_field32(&word, TXD_W1_AIFSN, desc->aifs);
-        rt2x00_set_field32(&word, TXD_W1_CWMIN, desc->cw_min);
-        rt2x00_set_field32(&word, TXD_W1_CWMAX, desc->cw_max);
+        rt2x00_set_field32(&word, TXD_W1_HOST_Q_ID, txdesc->queue);
+        rt2x00_set_field32(&word, TXD_W1_AIFSN, txdesc->aifs);
+        rt2x00_set_field32(&word, TXD_W1_CWMIN, txdesc->cw_min);
+        rt2x00_set_field32(&word, TXD_W1_CWMAX, txdesc->cw_max);
         rt2x00_set_field32(&word, TXD_W1_IV_OFFSET, IEEE80211_HEADER);
         rt2x00_set_field32(&word, TXD_W1_HW_SEQUENCE, 1);
         rt2x00_desc_write(txd, 1, word);
 
         rt2x00_desc_read(txd, 2, &word);
-        rt2x00_set_field32(&word, TXD_W2_PLCP_SIGNAL, desc->signal);
-        rt2x00_set_field32(&word, TXD_W2_PLCP_SERVICE, desc->service);
-        rt2x00_set_field32(&word, TXD_W2_PLCP_LENGTH_LOW, desc->length_low);
-        rt2x00_set_field32(&word, TXD_W2_PLCP_LENGTH_HIGH, desc->length_high);
+        rt2x00_set_field32(&word, TXD_W2_PLCP_SIGNAL, txdesc->signal);
+        rt2x00_set_field32(&word, TXD_W2_PLCP_SERVICE, txdesc->service);
+        rt2x00_set_field32(&word, TXD_W2_PLCP_LENGTH_LOW, txdesc->length_low);
+        rt2x00_set_field32(&word, TXD_W2_PLCP_LENGTH_HIGH, txdesc->length_high);
         rt2x00_desc_write(txd, 2, word);
 
         rt2x00_desc_read(txd, 5, &word);
         rt2x00_set_field32(&word, TXD_W5_TX_POWER,
-                           TXPOWER_TO_DEV(control->power_level));
+                           TXPOWER_TO_DEV(rt2x00dev->tx_power));
         rt2x00_set_field32(&word, TXD_W5_WAITING_DMA_DONE_INT, 1);
         rt2x00_desc_write(txd, 5, word);
 
         rt2x00_desc_read(txd, 0, &word);
         rt2x00_set_field32(&word, TXD_W0_BURST,
-                           test_bit(ENTRY_TXD_BURST, &desc->flags));
+                           test_bit(ENTRY_TXD_BURST, &txdesc->flags));
         rt2x00_set_field32(&word, TXD_W0_VALID, 1);
         rt2x00_set_field32(&word, TXD_W0_MORE_FRAG,
-                           test_bit(ENTRY_TXD_MORE_FRAG, &desc->flags));
+                           test_bit(ENTRY_TXD_MORE_FRAG, &txdesc->flags));
         rt2x00_set_field32(&word, TXD_W0_ACK,
-                           test_bit(ENTRY_TXD_ACK, &desc->flags));
+                           test_bit(ENTRY_TXD_ACK, &txdesc->flags));
         rt2x00_set_field32(&word, TXD_W0_TIMESTAMP,
-                           test_bit(ENTRY_TXD_REQ_TIMESTAMP, &desc->flags));
+                           test_bit(ENTRY_TXD_REQ_TIMESTAMP, &txdesc->flags));
         rt2x00_set_field32(&word, TXD_W0_OFDM,
-                           test_bit(ENTRY_TXD_OFDM_RATE, &desc->flags));
-        rt2x00_set_field32(&word, TXD_W0_IFS, desc->ifs);
+                           test_bit(ENTRY_TXD_OFDM_RATE, &txdesc->flags));
+        rt2x00_set_field32(&word, TXD_W0_IFS, txdesc->ifs);
         rt2x00_set_field32(&word, TXD_W0_RETRY_MODE,
                            !!(control->flags &
                               IEEE80211_TXCTL_LONG_RETRY_LIMIT));
         rt2x00_set_field32(&word, TXD_W0_TKIP_MIC, 0);
         rt2x00_set_field32(&word, TXD_W0_DATABYTE_COUNT, skbdesc->data_len);
         rt2x00_set_field32(&word, TXD_W0_BURST2,
-                           test_bit(ENTRY_TXD_BURST, &desc->flags));
+                           test_bit(ENTRY_TXD_BURST, &txdesc->flags));
         rt2x00_set_field32(&word, TXD_W0_CIPHER_ALG, CIPHER_NONE);
         rt2x00_desc_write(txd, 0, word);
 }
@@ -1309,11 +1297,11 @@ static int rt73usb_get_tx_data_len(struct rt2x00_dev *rt2x00dev,
  * TX data initialization
  */
 static void rt73usb_kick_tx_queue(struct rt2x00_dev *rt2x00dev,
-                                  unsigned int queue)
+                                  const unsigned int queue)
 {
         u32 reg;
 
-        if (queue != IEEE80211_TX_QUEUE_BEACON)
+        if (queue != RT2X00_BCN_QUEUE_BEACON)
                 return;
 
         /*
@@ -1353,7 +1341,7 @@ static int rt73usb_agc_to_rssi(struct rt2x00_dev *rt2x00dev, int rxd_w1)
                 return 0;
         }
 
-        if (rt2x00dev->rx_status.phymode == MODE_IEEE80211A) {
+        if (rt2x00dev->rx_status.band == IEEE80211_BAND_5GHZ) {
                 if (test_bit(CONFIG_EXTERNAL_LNA_A, &rt2x00dev->flags)) {
                         if (lna == 3 || lna == 2)
                                 offset += 10;
@@ -1377,37 +1365,57 @@ static int rt73usb_agc_to_rssi(struct rt2x00_dev *rt2x00dev, int rxd_w1)
         return rt2x00_get_field32(rxd_w1, RXD_W1_RSSI_AGC) * 2 - offset;
 }
 
-static void rt73usb_fill_rxdone(struct data_entry *entry,
-                                struct rxdata_entry_desc *desc)
+static void rt73usb_fill_rxdone(struct queue_entry *entry,
+                                struct rxdone_entry_desc *rxdesc)
 {
-        struct skb_desc *skbdesc = get_skb_desc(entry->skb);
+        struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
         __le32 *rxd = (__le32 *)entry->skb->data;
+        struct ieee80211_hdr *hdr =
+            (struct ieee80211_hdr *)entry->skb->data + entry->queue->desc_size;
+        int header_size = ieee80211_get_hdrlen(le16_to_cpu(hdr->frame_control));
         u32 word0;
         u32 word1;
 
         rt2x00_desc_read(rxd, 0, &word0);
         rt2x00_desc_read(rxd, 1, &word1);
 
-        desc->flags = 0;
+        rxdesc->flags = 0;
         if (rt2x00_get_field32(word0, RXD_W0_CRC_ERROR))
-                desc->flags |= RX_FLAG_FAILED_FCS_CRC;
+                rxdesc->flags |= RX_FLAG_FAILED_FCS_CRC;
 
         /*
          * Obtain the status about this packet.
          */
-        desc->signal = rt2x00_get_field32(word1, RXD_W1_SIGNAL);
-        desc->rssi = rt73usb_agc_to_rssi(entry->ring->rt2x00dev, word1);
-        desc->ofdm = rt2x00_get_field32(word0, RXD_W0_OFDM);
-        desc->size = rt2x00_get_field32(word0, RXD_W0_DATABYTE_COUNT);
-        desc->my_bss = !!rt2x00_get_field32(word0, RXD_W0_MY_BSS);
+        rxdesc->signal = rt2x00_get_field32(word1, RXD_W1_SIGNAL);
+        rxdesc->rssi = rt73usb_agc_to_rssi(entry->queue->rt2x00dev, word1);
+        rxdesc->ofdm = rt2x00_get_field32(word0, RXD_W0_OFDM);
+        rxdesc->size = rt2x00_get_field32(word0, RXD_W0_DATABYTE_COUNT);
+        rxdesc->my_bss = !!rt2x00_get_field32(word0, RXD_W0_MY_BSS);
+
+        /*
+         * The data behind the ieee80211 header must be
+         * aligned on a 4 byte boundary.
+         */
+        if (header_size % 4 == 0) {
+                skb_push(entry->skb, 2);
+                memmove(entry->skb->data, entry->skb->data + 2,
+                        entry->skb->len - 2);
+        }
 
         /*
          * Set descriptor and data pointer.
          */
+        skbdesc->data = entry->skb->data + entry->queue->desc_size;
+        skbdesc->data_len = rxdesc->size;
         skbdesc->desc = entry->skb->data;
-        skbdesc->desc_len = entry->ring->desc_size;
-        skbdesc->data = entry->skb->data + entry->ring->desc_size;
-        skbdesc->data_len = desc->size;
+        skbdesc->desc_len = entry->queue->desc_size;
+
+        /*
+         * Remove descriptor from skb buffer and trim the whole thing
+         * down to only contain data.
+         */
+        skb_pull(entry->skb, skbdesc->desc_len);
+        skb_trim(entry->skb, rxdesc->size);
 }
 
 /*
@@ -1499,7 +1507,7 @@ static int rt73usb_validate_eeprom(struct rt2x00_dev *rt2x00dev)
                 rt2x00_set_field16(&word, EEPROM_RSSI_OFFSET_A_1, 0);
                 rt2x00_set_field16(&word, EEPROM_RSSI_OFFSET_A_2, 0);
                 rt2x00_eeprom_write(rt2x00dev, EEPROM_RSSI_OFFSET_A, word);
-                EEPROM(rt2x00dev, "RSSI OFFSET BG: 0x%04x\n", word);
+                EEPROM(rt2x00dev, "RSSI OFFSET A: 0x%04x\n", word);
         } else {
                 value = rt2x00_get_field16(word, EEPROM_RSSI_OFFSET_A_1);
                 if (value < -10 || value > 10)
@@ -1577,33 +1585,49 @@ static int rt73usb_init_eeprom(struct rt2x00_dev *rt2x00dev)
         /*
          * Store led settings, for correct led behaviour.
          */
+#ifdef CONFIG_RT73USB_LEDS
         rt2x00_eeprom_read(rt2x00dev, EEPROM_LED, &eeprom);
 
-        rt2x00_set_field16(&rt2x00dev->led_reg, MCU_LEDCS_LED_MODE,
-                           rt2x00dev->led_mode);
-        rt2x00_set_field16(&rt2x00dev->led_reg, MCU_LEDCS_POLARITY_GPIO_0,
+        switch (value) {
+        case LED_MODE_TXRX_ACTIVITY:
+        case LED_MODE_ASUS:
+        case LED_MODE_ALPHA:
+        case LED_MODE_DEFAULT:
+                rt2x00dev->led_flags =
+                    LED_SUPPORT_RADIO | LED_SUPPORT_ASSOC;
+                break;
+        case LED_MODE_SIGNAL_STRENGTH:
+                rt2x00dev->led_flags =
+                    LED_SUPPORT_RADIO | LED_SUPPORT_ASSOC |
+                    LED_SUPPORT_QUALITY;
+                break;
+        }
+
+        rt2x00_set_field16(&rt2x00dev->led_mcu_reg, MCU_LEDCS_LED_MODE, value);
+        rt2x00_set_field16(&rt2x00dev->led_mcu_reg, MCU_LEDCS_POLARITY_GPIO_0,
                            rt2x00_get_field16(eeprom,
                                               EEPROM_LED_POLARITY_GPIO_0));
-        rt2x00_set_field16(&rt2x00dev->led_reg, MCU_LEDCS_POLARITY_GPIO_1,
+        rt2x00_set_field16(&rt2x00dev->led_mcu_reg, MCU_LEDCS_POLARITY_GPIO_1,
                            rt2x00_get_field16(eeprom,
                                               EEPROM_LED_POLARITY_GPIO_1));
-        rt2x00_set_field16(&rt2x00dev->led_reg, MCU_LEDCS_POLARITY_GPIO_2,
+        rt2x00_set_field16(&rt2x00dev->led_mcu_reg, MCU_LEDCS_POLARITY_GPIO_2,
                            rt2x00_get_field16(eeprom,
                                               EEPROM_LED_POLARITY_GPIO_2));
-        rt2x00_set_field16(&rt2x00dev->led_reg, MCU_LEDCS_POLARITY_GPIO_3,
+        rt2x00_set_field16(&rt2x00dev->led_mcu_reg, MCU_LEDCS_POLARITY_GPIO_3,
                            rt2x00_get_field16(eeprom,
                                               EEPROM_LED_POLARITY_GPIO_3));
-        rt2x00_set_field16(&rt2x00dev->led_reg, MCU_LEDCS_POLARITY_GPIO_4,
+        rt2x00_set_field16(&rt2x00dev->led_mcu_reg, MCU_LEDCS_POLARITY_GPIO_4,
                            rt2x00_get_field16(eeprom,
                                               EEPROM_LED_POLARITY_GPIO_4));
-        rt2x00_set_field16(&rt2x00dev->led_reg, MCU_LEDCS_POLARITY_ACT,
+        rt2x00_set_field16(&rt2x00dev->led_mcu_reg, MCU_LEDCS_POLARITY_ACT,
                            rt2x00_get_field16(eeprom, EEPROM_LED_POLARITY_ACT));
-        rt2x00_set_field16(&rt2x00dev->led_reg, MCU_LEDCS_POLARITY_READY_BG,
+        rt2x00_set_field16(&rt2x00dev->led_mcu_reg, MCU_LEDCS_POLARITY_READY_BG,
                            rt2x00_get_field16(eeprom,
                                               EEPROM_LED_POLARITY_RDY_G));
-        rt2x00_set_field16(&rt2x00dev->led_reg, MCU_LEDCS_POLARITY_READY_A,
+        rt2x00_set_field16(&rt2x00dev->led_mcu_reg, MCU_LEDCS_POLARITY_READY_A,
                            rt2x00_get_field16(eeprom,
                                               EEPROM_LED_POLARITY_RDY_A));
+#endif /* CONFIG_RT73USB_LEDS */
 
         return 0;
 }
@@ -1759,7 +1783,7 @@ static void rt73usb_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
         rt2x00dev->hw->extra_tx_headroom = TXD_DESC_SIZE;
         rt2x00dev->hw->max_signal = MAX_SIGNAL;
         rt2x00dev->hw->max_rssi = MAX_RX_SSI;
-        rt2x00dev->hw->queues = 5;
+        rt2x00dev->hw->queues = 4;
 
         SET_IEEE80211_DEV(rt2x00dev->hw, &rt2x00dev_usb(rt2x00dev)->dev);
         SET_IEEE80211_PERM_ADDR(rt2x00dev->hw,
@@ -1776,8 +1800,8 @@ static void rt73usb_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
         /*
          * Initialize hw_mode information.
          */
-        spec->num_modes = 2;
-        spec->num_rates = 12;
+        spec->supported_bands = SUPPORT_BAND_2GHZ;
+        spec->supported_rates = SUPPORT_RATE_CCK | SUPPORT_RATE_OFDM;
         spec->tx_power_a = NULL;
         spec->tx_power_bg = txpower;
         spec->tx_power_default = DEFAULT_TXPOWER;
@@ -1786,20 +1810,20 @@ static void rt73usb_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
                 spec->num_channels = ARRAY_SIZE(rf_vals_bg_2528);
                 spec->channels = rf_vals_bg_2528;
         } else if (rt2x00_rf(&rt2x00dev->chip, RF5226)) {
+                spec->supported_bands |= SUPPORT_BAND_5GHZ;
                 spec->num_channels = ARRAY_SIZE(rf_vals_5226);
                 spec->channels = rf_vals_5226;
         } else if (rt2x00_rf(&rt2x00dev->chip, RF2527)) {
                 spec->num_channels = 14;
                 spec->channels = rf_vals_5225_2527;
         } else if (rt2x00_rf(&rt2x00dev->chip, RF5225)) {
+                spec->supported_bands |= SUPPORT_BAND_5GHZ;
                 spec->num_channels = ARRAY_SIZE(rf_vals_5225_2527);
                 spec->channels = rf_vals_5225_2527;
         }
 
         if (rt2x00_rf(&rt2x00dev->chip, RF5225) ||
             rt2x00_rf(&rt2x00dev->chip, RF5226)) {
-                spec->num_modes = 3;
-
                 txpower = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_A_START);
                 for (i = 0; i < 14; i++)
                         txpower[i] = TXPOWER_FROM_DEV(txpower[i]);
@@ -1829,9 +1853,10 @@ static int rt73usb_probe_hw(struct rt2x00_dev *rt2x00dev)
         rt73usb_probe_hw_mode(rt2x00dev);
 
         /*
-         * This device requires firmware
+         * This device requires firmware.
          */
         __set_bit(DRIVER_REQUIRE_FIRMWARE, &rt2x00dev->flags);
+        __set_bit(DRIVER_REQUIRE_FIRMWARE_CRC_ITU_T, &rt2x00dev->flags);
 
         /*
          * Set the rssi offset.
@@ -1913,7 +1938,8 @@ static void rt73usb_configure_filter(struct ieee80211_hw *hw,
         rt2x00_set_field32(&reg, TXRX_CSR0_DROP_MULTICAST,
                            !(*total_flags & FIF_ALLMULTI));
         rt2x00_set_field32(&reg, TXRX_CSR0_DROP_BROADCAST, 0);
-        rt2x00_set_field32(&reg, TXRX_CSR0_DROP_ACK_CTS, 1);
+        rt2x00_set_field32(&reg, TXRX_CSR0_DROP_ACK_CTS,
+                           !(*total_flags & FIF_CONTROL));
         rt73usb_register_write(rt2x00dev, TXRX_CSR0, reg);
 }
 
@@ -1955,61 +1981,54 @@ static u64 rt73usb_get_tsf(struct ieee80211_hw *hw)
 #define rt73usb_get_tsf NULL
 #endif
 
-static void rt73usb_reset_tsf(struct ieee80211_hw *hw)
-{
-        struct rt2x00_dev *rt2x00dev = hw->priv;
-
-        rt73usb_register_write(rt2x00dev, TXRX_CSR12, 0);
-        rt73usb_register_write(rt2x00dev, TXRX_CSR13, 0);
-}
-
 static int rt73usb_beacon_update(struct ieee80211_hw *hw, struct sk_buff *skb,
-                          struct ieee80211_tx_control *control)
+                                 struct ieee80211_tx_control *control)
 {
         struct rt2x00_dev *rt2x00dev = hw->priv;
-        struct skb_desc *desc;
-        struct data_ring *ring;
-        struct data_entry *entry;
-        int timeout;
+        struct rt2x00_intf *intf = vif_to_intf(control->vif);
+        struct skb_frame_desc *skbdesc;
+        unsigned int beacon_base;
+        unsigned int timeout;
 
-        /*
-         * Just in case the ieee80211 doesn't set this,
-         * but we need this queue set for the descriptor
-         * initialization.
-         */
-        control->queue = IEEE80211_TX_QUEUE_BEACON;
-        ring = rt2x00lib_get_ring(rt2x00dev, control->queue);
-        entry = rt2x00_get_data_entry(ring);
+        if (unlikely(!intf->beacon))
+                return -ENOBUFS;
 
         /*
          * Add the descriptor in front of the skb.
          */
-        skb_push(skb, ring->desc_size);
-        memset(skb->data, 0, ring->desc_size);
+        skb_push(skb, intf->beacon->queue->desc_size);
+        memset(skb->data, 0, intf->beacon->queue->desc_size);
 
         /*
          * Fill in skb descriptor
          */
-        desc = get_skb_desc(skb);
-        desc->desc_len = ring->desc_size;
-        desc->data_len = skb->len - ring->desc_size;
-        desc->desc = skb->data;
-        desc->data = skb->data + ring->desc_size;
-        desc->ring = ring;
-        desc->entry = entry;
+        skbdesc = get_skb_frame_desc(skb);
+        memset(skbdesc, 0, sizeof(*skbdesc));
+        skbdesc->flags |= FRAME_DESC_DRIVER_GENERATED;
+        skbdesc->data = skb->data + intf->beacon->queue->desc_size;
+        skbdesc->data_len = skb->len - intf->beacon->queue->desc_size;
+        skbdesc->desc = skb->data;
+        skbdesc->desc_len = intf->beacon->queue->desc_size;
+        skbdesc->entry = intf->beacon;
 
+        /*
+         * mac80211 doesn't provide the control->queue variable
+         * for beacons. Set our own queue identification so
+         * it can be used during descriptor initialization.
+         */
+        control->queue = RT2X00_BCN_QUEUE_BEACON;
         rt2x00lib_write_tx_desc(rt2x00dev, skb, control);
 
         /*
          * Write entire beacon with descriptor to register,
          * and kick the beacon generator.
          */
+        beacon_base = HW_BEACON_OFFSET(intf->beacon->entry_idx);
         timeout = REGISTER_TIMEOUT * (skb->len / sizeof(u32));
         rt2x00usb_vendor_request(rt2x00dev, USB_MULTI_WRITE,
-                                 USB_VENDOR_REQUEST_OUT,
-                                 HW_BEACON_BASE0, 0x0000,
+                                 USB_VENDOR_REQUEST_OUT, beacon_base, 0,
                                  skb->data, skb->len, timeout);
-        rt73usb_kick_tx_queue(rt2x00dev, IEEE80211_TX_QUEUE_BEACON);
+        rt73usb_kick_tx_queue(rt2x00dev, control->queue);
 
         return 0;
 }
@@ -2029,7 +2048,6 @@ static const struct ieee80211_ops rt73usb_mac80211_ops = {
         .conf_tx                = rt2x00mac_conf_tx,
         .get_tx_stats           = rt2x00mac_get_tx_stats,
         .get_tsf                = rt73usb_get_tsf,
-        .reset_tsf              = rt73usb_reset_tsf,
         .beacon_update          = rt73usb_beacon_update,
 };
 
@@ -2045,24 +2063,47 @@ static const struct rt2x00lib_ops rt73usb_rt2x00_ops = {
         .link_stats             = rt73usb_link_stats,
         .reset_tuner            = rt73usb_reset_tuner,
         .link_tuner             = rt73usb_link_tuner,
+        .led_brightness         = rt73usb_led_brightness,
         .write_tx_desc          = rt73usb_write_tx_desc,
         .write_tx_data          = rt2x00usb_write_tx_data,
         .get_tx_data_len        = rt73usb_get_tx_data_len,
         .kick_tx_queue          = rt73usb_kick_tx_queue,
         .fill_rxdone            = rt73usb_fill_rxdone,
-        .config_mac_addr        = rt73usb_config_mac_addr,
-        .config_bssid           = rt73usb_config_bssid,
-        .config_type            = rt73usb_config_type,
+        .config_intf            = rt73usb_config_intf,
         .config_preamble        = rt73usb_config_preamble,
         .config                 = rt73usb_config,
 };
 
+static const struct data_queue_desc rt73usb_queue_rx = {
+        .entry_num              = RX_ENTRIES,
+        .data_size              = DATA_FRAME_SIZE,
+        .desc_size              = RXD_DESC_SIZE,
+        .priv_size              = sizeof(struct queue_entry_priv_usb_rx),
+};
+
+static const struct data_queue_desc rt73usb_queue_tx = {
+        .entry_num              = TX_ENTRIES,
+        .data_size              = DATA_FRAME_SIZE,
+        .desc_size              = TXD_DESC_SIZE,
+        .priv_size              = sizeof(struct queue_entry_priv_usb_tx),
+};
+
+static const struct data_queue_desc rt73usb_queue_bcn = {
+        .entry_num              = 4 * BEACON_ENTRIES,
+        .data_size              = MGMT_FRAME_SIZE,
+        .desc_size              = TXINFO_SIZE,
+        .priv_size              = sizeof(struct queue_entry_priv_usb_tx),
+};
+
 static const struct rt2x00_ops rt73usb_ops = {
         .name           = KBUILD_MODNAME,
-        .rxd_size       = RXD_DESC_SIZE,
-        .txd_size       = TXD_DESC_SIZE,
+        .max_sta_intf   = 1,
+        .max_ap_intf    = 4,
         .eeprom_size    = EEPROM_SIZE,
         .rf_size        = RF_SIZE,
+        .rx             = &rt73usb_queue_rx,
+        .tx             = &rt73usb_queue_tx,
+        .bcn            = &rt73usb_queue_bcn,
         .lib            = &rt73usb_rt2x00_ops,
         .hw             = &rt73usb_mac80211_ops,
 #ifdef CONFIG_RT2X00_LIB_DEBUGFS
diff --git a/drivers/net/wireless/rt2x00/rt73usb.h b/drivers/net/wireless/rt2x00/rt73usb.h
index d49dcaacecee..06d687425fef 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.h
+++ b/drivers/net/wireless/rt2x00/rt73usb.h
@@ -1,5 +1,5 @@
 /*
-        Copyright (C) 2004 - 2007 rt2x00 SourceForge Project
+        Copyright (C) 2004 - 2008 rt2x00 SourceForge Project
         <http://rt2x00.serialmonkey.com>
 
         This program is free software; you can redistribute it and/or modify
@@ -114,6 +114,9 @@ struct hw_pairwise_ta_entry {
 #define HW_BEACON_BASE2                 0x2600
 #define HW_BEACON_BASE3                 0x2700
 
+#define HW_BEACON_OFFSET(__index) \
+        ( HW_BEACON_BASE0 + (__index * 0x0100) )
+
 /*
  * MAC Control/Status Registers(CSR).
  * Some values are set in TU, whereas 1 TU == 1024 us.
@@ -146,6 +149,11 @@ struct hw_pairwise_ta_entry {
 
 /*
  * MAC_CSR3: STA MAC register 1.
+ * UNICAST_TO_ME_MASK:
+ *      Used to mask off bits from byte 5 of the MAC address
+ *      to determine the UNICAST_TO_ME bit for RX frames.
+ *      The full mask is complemented by BSS_ID_MASK:
+ *              MASK = BSS_ID_MASK & UNICAST_TO_ME_MASK
  */
 #define MAC_CSR3                        0x300c
 #define MAC_CSR3_BYTE4                  FIELD32(0x000000ff)
@@ -163,7 +171,14 @@ struct hw_pairwise_ta_entry {
 
 /*
  * MAC_CSR5: BSSID register 1.
- * BSS_ID_MASK: 3: one BSSID, 0: 4 BSSID, 2 or 1: 2 BSSID.
+ * BSS_ID_MASK:
+ *      This mask is used to mask off bits 0 and 1 of byte 5 of the
+ *      BSSID. This will make sure that those bits will be ignored
+ *      when determining the MY_BSS of RX frames.
+ *              0: 1-BSSID mode (BSS index = 0)
+ *              1: 2-BSSID mode (BSS index: Byte5, bit 0)
+ *              2: 2-BSSID mode (BSS index: byte5, bit 1)
+ *              3: 4-BSSID mode (BSS index: byte5, bit 0 - 1)
  */
 #define MAC_CSR5                        0x3014
 #define MAC_CSR5_BYTE4                  FIELD32(0x000000ff)
@@ -867,6 +882,7 @@ struct hw_pairwise_ta_entry {
  * DMA descriptor defines.
  */
 #define TXD_DESC_SIZE                   ( 6 * sizeof(__le32) )
+#define TXINFO_SIZE                     ( 6 * sizeof(__le32) )
 #define RXD_DESC_SIZE                   ( 6 * sizeof(__le32) )
 
 /*
@@ -1007,8 +1023,8 @@ struct hw_pairwise_ta_entry {
 #define RXD_W5_RESERVED                 FIELD32(0xffffffff)
 
 /*
- * Macro's for converting txpower from EEPROM to dscape value
- * and from dscape value to register value.
+ * Macro's for converting txpower from EEPROM to mac80211 value
+ * and from mac80211 value to register value.
  */
 #define MIN_TXPOWER     0
 #define MAX_TXPOWER     31
diff --git a/drivers/net/wireless/rtl8180.h b/drivers/net/wireless/rtl8180.h
index 2cbfe3c8081f..082a11f93beb 100644
--- a/drivers/net/wireless/rtl8180.h
+++ b/drivers/net/wireless/rtl8180.h
@@ -102,7 +102,7 @@ struct rtl8180_priv {
         struct rtl8180_tx_ring tx_ring[4];
         struct ieee80211_channel channels[14];
         struct ieee80211_rate rates[12];
-        struct ieee80211_hw_mode modes[2];
+        struct ieee80211_supported_band band;
         struct pci_dev *pdev;
         u32 rx_conf;
 
diff --git a/drivers/net/wireless/rtl8180_dev.c b/drivers/net/wireless/rtl8180_dev.c
index 5e9a8ace0d81..b1b3a478335b 100644
--- a/drivers/net/wireless/rtl8180_dev.c
+++ b/drivers/net/wireless/rtl8180_dev.c
@@ -49,6 +49,41 @@ static struct pci_device_id rtl8180_table[] __devinitdata = {
 
 MODULE_DEVICE_TABLE(pci, rtl8180_table);
 
+static const struct ieee80211_rate rtl818x_rates[] = {
+        { .bitrate = 10, .hw_value = 0, },
+        { .bitrate = 20, .hw_value = 1, },
+        { .bitrate = 55, .hw_value = 2, },
+        { .bitrate = 110, .hw_value = 3, },
+        { .bitrate = 60, .hw_value = 4, },
+        { .bitrate = 90, .hw_value = 5, },
+        { .bitrate = 120, .hw_value = 6, },
+        { .bitrate = 180, .hw_value = 7, },
+        { .bitrate = 240, .hw_value = 8, },
+        { .bitrate = 360, .hw_value = 9, },
+        { .bitrate = 480, .hw_value = 10, },
+        { .bitrate = 540, .hw_value = 11, },
+};
+
+static const struct ieee80211_channel rtl818x_channels[] = {
+        { .center_freq = 2412 },
+        { .center_freq = 2417 },
+        { .center_freq = 2422 },
+        { .center_freq = 2427 },
+        { .center_freq = 2432 },
+        { .center_freq = 2437 },
+        { .center_freq = 2442 },
+        { .center_freq = 2447 },
+        { .center_freq = 2452 },
+        { .center_freq = 2457 },
+        { .center_freq = 2462 },
+        { .center_freq = 2467 },
+        { .center_freq = 2472 },
+        { .center_freq = 2484 },
+};
+
+
+
+
 void rtl8180_write_phy(struct ieee80211_hw *dev, u8 addr, u32 data)
 {
         struct rtl8180_priv *priv = dev->priv;
@@ -99,10 +134,10 @@ static void rtl8180_handle_rx(struct ieee80211_hw *dev)
                         /* TODO: improve signal/rssi reporting */
                         rx_status.signal = flags2 & 0xFF;
                         rx_status.ssi = (flags2 >> 8) & 0x7F;
-                        rx_status.rate = (flags >> 20) & 0xF;
-                        rx_status.freq = dev->conf.freq;
-                        rx_status.channel = dev->conf.channel;
-                        rx_status.phymode = dev->conf.phymode;
+                        /* XXX: is this correct? */
+                        rx_status.rate_idx = (flags >> 20) & 0xF;
+                        rx_status.freq = dev->conf.channel->center_freq;
+                        rx_status.band = dev->conf.channel->band;
                         rx_status.mactime = le64_to_cpu(entry->tsft);
                         rx_status.flag |= RX_FLAG_TSFT;
                         if (flags & RTL8180_RX_DESC_FLAG_CRC32_ERR)
@@ -222,18 +257,25 @@ static int rtl8180_tx(struct ieee80211_hw *dev, struct sk_buff *skb,
         mapping = pci_map_single(priv->pdev, skb->data,
                                  skb->len, PCI_DMA_TODEVICE);
 
+        BUG_ON(!control->tx_rate);
+
         tx_flags = RTL8180_TX_DESC_FLAG_OWN | RTL8180_TX_DESC_FLAG_FS |
-                   RTL8180_TX_DESC_FLAG_LS | (control->tx_rate << 24) |
-                   (control->rts_cts_rate << 19) | skb->len;
+                   RTL8180_TX_DESC_FLAG_LS |
+                   (control->tx_rate->hw_value << 24) | skb->len;
 
         if (priv->r8185)
                 tx_flags |= RTL8180_TX_DESC_FLAG_DMA |
                             RTL8180_TX_DESC_FLAG_NO_ENC;
 
-        if (control->flags & IEEE80211_TXCTL_USE_RTS_CTS)
+        if (control->flags & IEEE80211_TXCTL_USE_RTS_CTS) {
+                BUG_ON(!control->rts_cts_rate);
                 tx_flags |= RTL8180_TX_DESC_FLAG_RTS;
-        else if (control->flags & IEEE80211_TXCTL_USE_CTS_PROTECT)
+                tx_flags |= control->rts_cts_rate->hw_value << 19;
+        } else if (control->flags & IEEE80211_TXCTL_USE_CTS_PROTECT) {
+                BUG_ON(!control->rts_cts_rate);
                 tx_flags |= RTL8180_TX_DESC_FLAG_CTS;
+                tx_flags |= control->rts_cts_rate->hw_value << 19;
+        }
 
         *((struct ieee80211_tx_control **) skb->cb) =
                 kmemdup(control, sizeof(*control), GFP_ATOMIC);
@@ -246,9 +288,9 @@ static int rtl8180_tx(struct ieee80211_hw *dev, struct sk_buff *skb,
                 unsigned int remainder;
 
                 plcp_len = DIV_ROUND_UP(16 * (skb->len + 4),
-                                        (control->rate->rate * 2) / 10);
+                                        (control->tx_rate->bitrate * 2) / 10);
                 remainder = (16 * (skb->len + 4)) %
-                            ((control->rate->rate * 2) / 10);
+                            ((control->tx_rate->bitrate * 2) / 10);
                 if (remainder > 0 && remainder <= 6)
                         plcp_len |= 1 << 15;
         }
@@ -261,8 +303,8 @@ static int rtl8180_tx(struct ieee80211_hw *dev, struct sk_buff *skb,
         entry->plcp_len = cpu_to_le16(plcp_len);
         entry->tx_buf = cpu_to_le32(mapping);
         entry->frame_len = cpu_to_le32(skb->len);
-        entry->flags2 = control->alt_retry_rate != -1 ?
-                        control->alt_retry_rate << 4 : 0;
+        entry->flags2 = control->alt_retry_rate != NULL ?
+                        control->alt_retry_rate->bitrate << 4 : 0;
         entry->retry_limit = control->retry_limit;
         entry->flags = cpu_to_le32(tx_flags);
         __skb_queue_tail(&ring->queue, skb);
@@ -838,19 +880,19 @@ static int __devinit rtl8180_probe(struct pci_dev *pdev,
                 goto err_free_dev;
         }
 
+        BUILD_BUG_ON(sizeof(priv->channels) != sizeof(rtl818x_channels));
+        BUILD_BUG_ON(sizeof(priv->rates) != sizeof(rtl818x_rates));
+
         memcpy(priv->channels, rtl818x_channels, sizeof(rtl818x_channels));
         memcpy(priv->rates, rtl818x_rates, sizeof(rtl818x_rates));
-        priv->modes[0].mode = MODE_IEEE80211G;
-        priv->modes[0].num_rates = ARRAY_SIZE(rtl818x_rates);
-        priv->modes[0].rates = priv->rates;
-        priv->modes[0].num_channels = ARRAY_SIZE(rtl818x_channels);
-        priv->modes[0].channels = priv->channels;
-        priv->modes[1].mode = MODE_IEEE80211B;
-        priv->modes[1].num_rates = 4;
-        priv->modes[1].rates = priv->rates;
-        priv->modes[1].num_channels = ARRAY_SIZE(rtl818x_channels);
-        priv->modes[1].channels = priv->channels;
-        priv->mode = IEEE80211_IF_TYPE_INVALID;
+
+        priv->band.band = IEEE80211_BAND_2GHZ;
+        priv->band.channels = priv->channels;
+        priv->band.n_channels = ARRAY_SIZE(rtl818x_channels);
+        priv->band.bitrates = priv->rates;
+        priv->band.n_bitrates = 4;
+        dev->wiphy->bands[IEEE80211_BAND_2GHZ] = &priv->band;
+
         dev->flags = IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING |
                      IEEE80211_HW_RX_INCLUDES_FCS;
         dev->queues = 1;
@@ -879,15 +921,10 @@ static int __devinit rtl8180_probe(struct pci_dev *pdev,
 
         priv->r8185 = reg & RTL818X_TX_CONF_R8185_ABC;
         if (priv->r8185) {
-                if ((err = ieee80211_register_hwmode(dev, &priv->modes[0])))
-                        goto err_iounmap;
-
+                priv->band.n_bitrates = ARRAY_SIZE(rtl818x_rates);
                 pci_try_set_mwi(pdev);
         }
 
-        if ((err = ieee80211_register_hwmode(dev, &priv->modes[1])))
-                goto err_iounmap;
-
         eeprom.data = dev;
         eeprom.register_read = rtl8180_eeprom_register_read;
         eeprom.register_write = rtl8180_eeprom_register_write;
@@ -950,8 +987,8 @@ static int __devinit rtl8180_probe(struct pci_dev *pdev,
         for (i = 0; i < 14; i += 2) {
                 u16 txpwr;
                 eeprom_93cx6_read(&eeprom, 0x10 + (i >> 1), &txpwr);
-                priv->channels[i].val = txpwr & 0xFF;
-                priv->channels[i + 1].val = txpwr >> 8;
+                priv->channels[i].hw_value = txpwr & 0xFF;
+                priv->channels[i + 1].hw_value = txpwr >> 8;
         }
 
         /* OFDM TX power */
@@ -959,8 +996,8 @@ static int __devinit rtl8180_probe(struct pci_dev *pdev,
                 for (i = 0; i < 14; i += 2) {
                         u16 txpwr;
                         eeprom_93cx6_read(&eeprom, 0x20 + (i >> 1), &txpwr);
-                        priv->channels[i].val |= (txpwr & 0xFF) << 8;
-                        priv->channels[i + 1].val |= txpwr & 0xFF00;
+                        priv->channels[i].hw_value |= (txpwr & 0xFF) << 8;
+                        priv->channels[i + 1].hw_value |= txpwr & 0xFF00;
                 }
         }
 
diff --git a/drivers/net/wireless/rtl8180_grf5101.c b/drivers/net/wireless/rtl8180_grf5101.c
index 8293e19c4c59..5d47935dbac3 100644
--- a/drivers/net/wireless/rtl8180_grf5101.c
+++ b/drivers/net/wireless/rtl8180_grf5101.c
@@ -73,8 +73,9 @@ static void grf5101_rf_set_channel(struct ieee80211_hw *dev,
                                    struct ieee80211_conf *conf)
 {
         struct rtl8180_priv *priv = dev->priv;
-        u32 txpw = priv->channels[conf->channel - 1].val & 0xFF;
-        u32 chan = conf->channel - 1;
+        int channel = ieee80211_frequency_to_channel(conf->channel->center_freq);
+        u32 txpw = priv->channels[channel - 1].hw_value & 0xFF;
+        u32 chan = channel - 1;
 
         /* set TX power */
         write_grf5101(dev, 0x15, 0x0);
diff --git a/drivers/net/wireless/rtl8180_max2820.c b/drivers/net/wireless/rtl8180_max2820.c
index 98fe9fd64968..a34dfd382b6d 100644
--- a/drivers/net/wireless/rtl8180_max2820.c
+++ b/drivers/net/wireless/rtl8180_max2820.c
@@ -78,8 +78,9 @@ static void max2820_rf_set_channel(struct ieee80211_hw *dev,
                                    struct ieee80211_conf *conf)
 {
         struct rtl8180_priv *priv = dev->priv;
-        unsigned int chan_idx = conf ? conf->channel - 1 : 0;
-        u32 txpw = priv->channels[chan_idx].val & 0xFF;
+        int channel = ieee80211_frequency_to_channel(conf->channel->center_freq);
+        unsigned int chan_idx = channel - 1;
+        u32 txpw = priv->channels[chan_idx].hw_value & 0xFF;
         u32 chan = max2820_chan[chan_idx];
 
         /* While philips SA2400 drive the PA bias from
diff --git a/drivers/net/wireless/rtl8180_rtl8225.c b/drivers/net/wireless/rtl8180_rtl8225.c
index ef3832bee85c..cd22781728a9 100644
--- a/drivers/net/wireless/rtl8180_rtl8225.c
+++ b/drivers/net/wireless/rtl8180_rtl8225.c
@@ -261,8 +261,8 @@ static void rtl8225_rf_set_tx_power(struct ieee80211_hw *dev, int channel)
         u32 reg;
         int i;
 
-        cck_power = priv->channels[channel - 1].val & 0xFF;
-        ofdm_power = priv->channels[channel - 1].val >> 8;
+        cck_power = priv->channels[channel - 1].hw_value & 0xFF;
+        ofdm_power = priv->channels[channel - 1].hw_value >> 8;
 
         cck_power = min(cck_power, (u8)35);
         ofdm_power = min(ofdm_power, (u8)35);
@@ -476,8 +476,8 @@ static void rtl8225z2_rf_set_tx_power(struct ieee80211_hw *dev, int channel)
         const u8 *tmp;
         int i;
 
-        cck_power = priv->channels[channel - 1].val & 0xFF;
-        ofdm_power = priv->channels[channel - 1].val >> 8;
+        cck_power = priv->channels[channel - 1].hw_value & 0xFF;
+        ofdm_power = priv->channels[channel - 1].hw_value >> 8;
 
         if (channel == 14)
                 tmp = rtl8225z2_tx_power_cck_ch14;
@@ -716,13 +716,14 @@ static void rtl8225_rf_set_channel(struct ieee80211_hw *dev,
                                    struct ieee80211_conf *conf)
 {
         struct rtl8180_priv *priv = dev->priv;
+        int chan = ieee80211_frequency_to_channel(conf->channel->center_freq);
 
         if (priv->rf->init == rtl8225_rf_init)
-                rtl8225_rf_set_tx_power(dev, conf->channel);
+                rtl8225_rf_set_tx_power(dev, chan);
         else
-                rtl8225z2_rf_set_tx_power(dev, conf->channel);
+                rtl8225z2_rf_set_tx_power(dev, chan);
 
-        rtl8225_write(dev, 0x7, rtl8225_chan[conf->channel - 1]);
+        rtl8225_write(dev, 0x7, rtl8225_chan[chan - 1]);
         msleep(10);
 
         if (conf->flags & IEEE80211_CONF_SHORT_SLOT_TIME) {
diff --git a/drivers/net/wireless/rtl8180_sa2400.c b/drivers/net/wireless/rtl8180_sa2400.c
index e08ace7b1cb7..0311b4ea124c 100644
--- a/drivers/net/wireless/rtl8180_sa2400.c
+++ b/drivers/net/wireless/rtl8180_sa2400.c
@@ -80,8 +80,9 @@ static void sa2400_rf_set_channel(struct ieee80211_hw *dev,
                                   struct ieee80211_conf *conf)
 {
         struct rtl8180_priv *priv = dev->priv;
-        u32 txpw = priv->channels[conf->channel - 1].val & 0xFF;
-        u32 chan = sa2400_chan[conf->channel - 1];
+        int channel = ieee80211_frequency_to_channel(conf->channel->center_freq);
+        u32 txpw = priv->channels[channel - 1].hw_value & 0xFF;
+        u32 chan = sa2400_chan[channel - 1];
 
         write_sa2400(dev, 7, txpw);
 
diff --git a/drivers/net/wireless/rtl8187.h b/drivers/net/wireless/rtl8187.h
index 8680a0b6433c..076d88b6db0e 100644
--- a/drivers/net/wireless/rtl8187.h
+++ b/drivers/net/wireless/rtl8187.h
@@ -71,7 +71,7 @@ struct rtl8187_priv {
         /* rtl8187 specific */
         struct ieee80211_channel channels[14];
         struct ieee80211_rate rates[12];
-        struct ieee80211_hw_mode modes[2];
+        struct ieee80211_supported_band band;
         struct usb_device *udev;
         u32 rx_conf;
         u16 txpwr_base;
diff --git a/drivers/net/wireless/rtl8187_dev.c b/drivers/net/wireless/rtl8187_dev.c
index f44505994a0e..c03834d5cb0b 100644
--- a/drivers/net/wireless/rtl8187_dev.c
+++ b/drivers/net/wireless/rtl8187_dev.c
@@ -45,6 +45,38 @@ static struct usb_device_id rtl8187_table[] __devinitdata = {
 
 MODULE_DEVICE_TABLE(usb, rtl8187_table);
 
+static const struct ieee80211_rate rtl818x_rates[] = {
+        { .bitrate = 10, .hw_value = 0, },
+        { .bitrate = 20, .hw_value = 1, },
+        { .bitrate = 55, .hw_value = 2, },
+        { .bitrate = 110, .hw_value = 3, },
+        { .bitrate = 60, .hw_value = 4, },
+        { .bitrate = 90, .hw_value = 5, },
+        { .bitrate = 120, .hw_value = 6, },
+        { .bitrate = 180, .hw_value = 7, },
+        { .bitrate = 240, .hw_value = 8, },
+        { .bitrate = 360, .hw_value = 9, },
+        { .bitrate = 480, .hw_value = 10, },
+        { .bitrate = 540, .hw_value = 11, },
+};
+
+static const struct ieee80211_channel rtl818x_channels[] = {
+        { .center_freq = 2412 },
+        { .center_freq = 2417 },
+        { .center_freq = 2422 },
+        { .center_freq = 2427 },
+        { .center_freq = 2432 },
+        { .center_freq = 2437 },
+        { .center_freq = 2442 },
+        { .center_freq = 2447 },
+        { .center_freq = 2452 },
+        { .center_freq = 2457 },
+        { .center_freq = 2462 },
+        { .center_freq = 2467 },
+        { .center_freq = 2472 },
+        { .center_freq = 2484 },
+};
+
 static void rtl8187_iowrite_async_cb(struct urb *urb)
 {
         kfree(urb->context);
@@ -146,17 +178,23 @@ static int rtl8187_tx(struct ieee80211_hw *dev, struct sk_buff *skb,
 
         flags = skb->len;
         flags |= RTL8187_TX_FLAG_NO_ENCRYPT;
-        flags |= control->rts_cts_rate << 19;
-        flags |= control->tx_rate << 24;
+
+        BUG_ON(!control->tx_rate);
+
+        flags |= control->tx_rate->hw_value << 24;
         if (ieee80211_get_morefrag((struct ieee80211_hdr *)skb->data))
                 flags |= RTL8187_TX_FLAG_MORE_FRAG;
         if (control->flags & IEEE80211_TXCTL_USE_RTS_CTS) {
+                BUG_ON(!control->rts_cts_rate);
                 flags |= RTL8187_TX_FLAG_RTS;
+                flags |= control->rts_cts_rate->hw_value << 19;
                 rts_dur = ieee80211_rts_duration(dev, priv->vif,
                                                  skb->len, control);
-        }
-        if (control->flags & IEEE80211_TXCTL_USE_CTS_PROTECT)
+        } else if (control->flags & IEEE80211_TXCTL_USE_CTS_PROTECT) {
+                BUG_ON(!control->rts_cts_rate);
                 flags |= RTL8187_TX_FLAG_CTS;
+                flags |= control->rts_cts_rate->hw_value << 19;
+        }
 
         hdr = (struct rtl8187_tx_hdr *)skb_push(skb, sizeof(*hdr));
         hdr->flags = cpu_to_le32(flags);
@@ -225,10 +263,9 @@ static void rtl8187_rx_cb(struct urb *urb)
         rx_status.antenna = (hdr->signal >> 7) & 1;
         rx_status.signal = 64 - min(hdr->noise, (u8)64);
         rx_status.ssi = signal;
-        rx_status.rate = rate;
-        rx_status.freq = dev->conf.freq;
-        rx_status.channel = dev->conf.channel;
-        rx_status.phymode = dev->conf.phymode;
+        rx_status.rate_idx = rate;
+        rx_status.freq = dev->conf.channel->center_freq;
+        rx_status.band = dev->conf.channel->band;
         rx_status.mactime = le64_to_cpu(hdr->mac_time);
         rx_status.flag |= RX_FLAG_TSFT;
         if (flags & (1 << 13))
@@ -682,19 +719,22 @@ static int __devinit rtl8187_probe(struct usb_interface *intf,
         usb_get_dev(udev);
 
         skb_queue_head_init(&priv->rx_queue);
+
+        BUILD_BUG_ON(sizeof(priv->channels) != sizeof(rtl818x_channels));
+        BUILD_BUG_ON(sizeof(priv->rates) != sizeof(rtl818x_rates));
+
         memcpy(priv->channels, rtl818x_channels, sizeof(rtl818x_channels));
         memcpy(priv->rates, rtl818x_rates, sizeof(rtl818x_rates));
         priv->map = (struct rtl818x_csr *)0xFF00;
-        priv->modes[0].mode = MODE_IEEE80211G;
-        priv->modes[0].num_rates = ARRAY_SIZE(rtl818x_rates);
-        priv->modes[0].rates = priv->rates;
-        priv->modes[0].num_channels = ARRAY_SIZE(rtl818x_channels);
-        priv->modes[0].channels = priv->channels;
-        priv->modes[1].mode = MODE_IEEE80211B;
-        priv->modes[1].num_rates = 4;
-        priv->modes[1].rates = priv->rates;
-        priv->modes[1].num_channels = ARRAY_SIZE(rtl818x_channels);
-        priv->modes[1].channels = priv->channels;
+
+        priv->band.band = IEEE80211_BAND_2GHZ;
+        priv->band.channels = priv->channels;
+        priv->band.n_channels = ARRAY_SIZE(rtl818x_channels);
+        priv->band.bitrates = priv->rates;
+        priv->band.n_bitrates = ARRAY_SIZE(rtl818x_rates);
+        dev->wiphy->bands[IEEE80211_BAND_2GHZ] = &priv->band;
+
+
         priv->mode = IEEE80211_IF_TYPE_MNTR;
         dev->flags = IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING |
                      IEEE80211_HW_RX_INCLUDES_FCS;
@@ -703,10 +743,6 @@ static int __devinit rtl8187_probe(struct usb_interface *intf,
         dev->max_rssi = 65;
         dev->max_signal = 64;
 
-        for (i = 0; i < 2; i++)
-                if ((err = ieee80211_register_hwmode(dev, &priv->modes[i])))
-                        goto err_free_dev;
-
         eeprom.data = dev;
         eeprom.register_read = rtl8187_eeprom_register_read;
         eeprom.register_write = rtl8187_eeprom_register_write;
@@ -730,20 +766,20 @@ static int __devinit rtl8187_probe(struct usb_interface *intf,
         for (i = 0; i < 3; i++) {
                 eeprom_93cx6_read(&eeprom, RTL8187_EEPROM_TXPWR_CHAN_1 + i,
                                   &txpwr);
-                (*channel++).val = txpwr & 0xFF;
-                (*channel++).val = txpwr >> 8;
+                (*channel++).hw_value = txpwr & 0xFF;
+                (*channel++).hw_value = txpwr >> 8;
         }
         for (i = 0; i < 2; i++) {
                 eeprom_93cx6_read(&eeprom, RTL8187_EEPROM_TXPWR_CHAN_4 + i,
                                   &txpwr);
-                (*channel++).val = txpwr & 0xFF;
-                (*channel++).val = txpwr >> 8;
+                (*channel++).hw_value = txpwr & 0xFF;
+                (*channel++).hw_value = txpwr >> 8;
         }
         for (i = 0; i < 2; i++) {
                 eeprom_93cx6_read(&eeprom, RTL8187_EEPROM_TXPWR_CHAN_6 + i,
                                   &txpwr);
-                (*channel++).val = txpwr & 0xFF;
-                (*channel++).val = txpwr >> 8;
+                (*channel++).hw_value = txpwr & 0xFF;
+                (*channel++).hw_value = txpwr >> 8;
         }
 
         eeprom_93cx6_read(&eeprom, RTL8187_EEPROM_TXPWR_BASE,
diff --git a/drivers/net/wireless/rtl8187_rtl8225.c b/drivers/net/wireless/rtl8187_rtl8225.c
index b713de17ba0a..9146387b4c5e 100644
--- a/drivers/net/wireless/rtl8187_rtl8225.c
+++ b/drivers/net/wireless/rtl8187_rtl8225.c
@@ -283,8 +283,8 @@ static void rtl8225_rf_set_tx_power(struct ieee80211_hw *dev, int channel)
         u32 reg;
         int i;
 
-        cck_power = priv->channels[channel - 1].val & 0xF;
-        ofdm_power = priv->channels[channel - 1].val >> 4;
+        cck_power = priv->channels[channel - 1].hw_value & 0xF;
+        ofdm_power = priv->channels[channel - 1].hw_value >> 4;
 
         cck_power = min(cck_power, (u8)11);
         ofdm_power = min(ofdm_power, (u8)35);
@@ -500,8 +500,8 @@ static void rtl8225z2_rf_set_tx_power(struct ieee80211_hw *dev, int channel)
         u32 reg;
         int i;
 
-        cck_power = priv->channels[channel - 1].val & 0xF;
-        ofdm_power = priv->channels[channel - 1].val >> 4;
+        cck_power = priv->channels[channel - 1].hw_value & 0xF;
+        ofdm_power = priv->channels[channel - 1].hw_value >> 4;
 
         cck_power = min(cck_power, (u8)15);
         cck_power += priv->txpwr_base & 0xF;
@@ -735,13 +735,14 @@ static void rtl8225_rf_set_channel(struct ieee80211_hw *dev,
                                    struct ieee80211_conf *conf)
 {
         struct rtl8187_priv *priv = dev->priv;
+        int chan = ieee80211_frequency_to_channel(conf->channel->center_freq);
 
         if (priv->rf->init == rtl8225_rf_init)
-                rtl8225_rf_set_tx_power(dev, conf->channel);
+                rtl8225_rf_set_tx_power(dev, chan);
         else
-                rtl8225z2_rf_set_tx_power(dev, conf->channel);
+                rtl8225z2_rf_set_tx_power(dev, chan);
 
-        rtl8225_write(dev, 0x7, rtl8225_chan[conf->channel - 1]);
+        rtl8225_write(dev, 0x7, rtl8225_chan[chan - 1]);
         msleep(10);
 }
 
diff --git a/drivers/net/wireless/rtl818x.h b/drivers/net/wireless/rtl818x.h
index 1e7d6f8278d7..4f7d38f506eb 100644
--- a/drivers/net/wireless/rtl818x.h
+++ b/drivers/net/wireless/rtl818x.h
@@ -175,74 +175,4 @@ struct rtl818x_rf_ops {
         void (*set_chan)(struct ieee80211_hw *, struct ieee80211_conf *);
 };
 
-static const struct ieee80211_rate rtl818x_rates[] = {
-        { .rate = 10,
-          .val = 0,
-          .flags = IEEE80211_RATE_CCK },
-        { .rate = 20,
-          .val = 1,
-          .flags = IEEE80211_RATE_CCK },
-        { .rate = 55,
-          .val = 2,
-          .flags = IEEE80211_RATE_CCK },
-        { .rate = 110,
-          .val = 3,
-          .flags = IEEE80211_RATE_CCK },
-        { .rate = 60,
-          .val = 4,
-          .flags = IEEE80211_RATE_OFDM },
-        { .rate = 90,
-          .val = 5,
-          .flags = IEEE80211_RATE_OFDM },
-        { .rate = 120,
-          .val = 6,
-          .flags = IEEE80211_RATE_OFDM },
-        { .rate = 180,
-          .val = 7,
-          .flags = IEEE80211_RATE_OFDM },
-        { .rate = 240,
-          .val = 8,
-          .flags = IEEE80211_RATE_OFDM },
-        { .rate = 360,
-          .val = 9,
-          .flags = IEEE80211_RATE_OFDM },
-        { .rate = 480,
-          .val = 10,
-          .flags = IEEE80211_RATE_OFDM },
-        { .rate = 540,
-          .val = 11,
-          .flags = IEEE80211_RATE_OFDM },
-};
-
-static const struct ieee80211_channel rtl818x_channels[] = {
-        { .chan = 1,
-          .freq = 2412},
-        { .chan = 2,
-          .freq = 2417},
-        { .chan = 3,
-          .freq = 2422},
-        { .chan = 4,
-          .freq = 2427},
-        { .chan = 5,
-          .freq = 2432},
-        { .chan = 6,
-          .freq = 2437},
-        { .chan = 7,
-          .freq = 2442},
-        { .chan = 8,
-          .freq = 2447},
-        { .chan = 9,
-          .freq = 2452},
-        { .chan = 10,
-          .freq = 2457},
-        { .chan = 11,
-          .freq = 2462},
-        { .chan = 12,
-          .freq = 2467},
-        { .chan = 13,
-          .freq = 2472},
-        { .chan = 14,
-          .freq = 2484}
-};
-
 #endif /* RTL818X_H */
diff --git a/drivers/net/wireless/strip.c b/drivers/net/wireless/strip.c
index 88efe1bae58f..bced3fe1cf8a 100644
--- a/drivers/net/wireless/strip.c
+++ b/drivers/net/wireless/strip.c
@@ -962,12 +962,12 @@ static char *time_delta(char buffer[], long time)
 /* get Nth element of the linked list */
 static struct strip *strip_get_idx(loff_t pos) 
 {
-        struct list_head *l;
+        struct strip *str;
         int i = 0;
 
-        list_for_each_rcu(l, &strip_list) {
+        list_for_each_entry_rcu(str, &strip_list, list) {
                 if (pos == i)
-                        return list_entry(l, struct strip, list);
+                        return str;
                 ++i;
         }
         return NULL;
diff --git a/drivers/net/wireless/zd1211rw/zd_chip.c b/drivers/net/wireless/zd1211rw/zd_chip.c
index 99e5b03b3f51..db96adf90ae2 100644
--- a/drivers/net/wireless/zd1211rw/zd_chip.c
+++ b/drivers/net/wireless/zd1211rw/zd_chip.c
@@ -771,10 +771,10 @@ static int zd1211b_hw_init_hmac(struct zd_chip *chip)
 {
         static const struct zd_ioreq32 ioreqs[] = {
                 { CR_ZD1211B_RETRY_MAX,         0x02020202 },
-                { CR_ZD1211B_TX_PWR_CTL4,       0x007f003f },
-                { CR_ZD1211B_TX_PWR_CTL3,       0x007f003f },
-                { CR_ZD1211B_TX_PWR_CTL2,       0x003f001f },
-                { CR_ZD1211B_TX_PWR_CTL1,       0x001f000f },
+                { CR_ZD1211B_CWIN_MAX_MIN_AC0,  0x007f003f },
+                { CR_ZD1211B_CWIN_MAX_MIN_AC1,  0x007f003f },
+                { CR_ZD1211B_CWIN_MAX_MIN_AC2,  0x003f001f },
+                { CR_ZD1211B_CWIN_MAX_MIN_AC3,  0x001f000f },
                 { CR_ZD1211B_AIFS_CTL1,         0x00280028 },
                 { CR_ZD1211B_AIFS_CTL2,         0x008C003C },
                 { CR_ZD1211B_TXOP,              0x01800824 },
@@ -986,7 +986,7 @@ static int print_fw_version(struct zd_chip *chip)
         return 0;
 }
 
-static int set_mandatory_rates(struct zd_chip *chip, int mode)
+static int set_mandatory_rates(struct zd_chip *chip, int gmode)
 {
         u32 rates;
         ZD_ASSERT(mutex_is_locked(&chip->mutex));
@@ -994,17 +994,12 @@ static int set_mandatory_rates(struct zd_chip *chip, int mode)
          * that the device is supporting. Until further notice we should try
          * to support 802.11g also for full speed USB.
          */
-        switch (mode) {
-        case MODE_IEEE80211B:
+        if (!gmode)
                 rates = CR_RATE_1M|CR_RATE_2M|CR_RATE_5_5M|CR_RATE_11M;
-                break;
-        case MODE_IEEE80211G:
+        else
                 rates = CR_RATE_1M|CR_RATE_2M|CR_RATE_5_5M|CR_RATE_11M|
                         CR_RATE_6M|CR_RATE_12M|CR_RATE_24M;
-                break;
-        default:
-                return -EINVAL;
-        }
+
         return zd_iowrite32_locked(chip, rates, CR_MANDATORY_RATE_TBL);
 }
 
@@ -1108,7 +1103,7 @@ int zd_chip_init_hw(struct zd_chip *chip)
          * It might be discussed, whether we should suppport pure b mode for
          * full speed USB.
          */
-        r = set_mandatory_rates(chip, MODE_IEEE80211G);
+        r = set_mandatory_rates(chip, 1);
         if (r)
                 goto out;
         /* Disabling interrupts is certainly a smart thing here.
diff --git a/drivers/net/wireless/zd1211rw/zd_chip.h b/drivers/net/wireless/zd1211rw/zd_chip.h
index 009c03777a35..5b6e3a3751ba 100644
--- a/drivers/net/wireless/zd1211rw/zd_chip.h
+++ b/drivers/net/wireless/zd1211rw/zd_chip.h
@@ -625,11 +625,10 @@ enum {
 #define CR_S_MD                         CTL_REG(0x0830)
 
 #define CR_USB_DEBUG_PORT               CTL_REG(0x0888)
-
-#define CR_ZD1211B_TX_PWR_CTL1          CTL_REG(0x0b00)
-#define CR_ZD1211B_TX_PWR_CTL2          CTL_REG(0x0b04)
-#define CR_ZD1211B_TX_PWR_CTL3          CTL_REG(0x0b08)
-#define CR_ZD1211B_TX_PWR_CTL4          CTL_REG(0x0b0c)
+#define CR_ZD1211B_CWIN_MAX_MIN_AC0     CTL_REG(0x0b00)
+#define CR_ZD1211B_CWIN_MAX_MIN_AC1     CTL_REG(0x0b04)
+#define CR_ZD1211B_CWIN_MAX_MIN_AC2     CTL_REG(0x0b08)
+#define CR_ZD1211B_CWIN_MAX_MIN_AC3     CTL_REG(0x0b0c)
 #define CR_ZD1211B_AIFS_CTL1            CTL_REG(0x0b10)
 #define CR_ZD1211B_AIFS_CTL2            CTL_REG(0x0b14)
 #define CR_ZD1211B_TXOP                 CTL_REG(0x0b20)
diff --git a/drivers/net/wireless/zd1211rw/zd_ieee80211.c b/drivers/net/wireless/zd1211rw/zd_ieee80211.c
index 7c277ec43f79..d8dc41ec0e5d 100644
--- a/drivers/net/wireless/zd1211rw/zd_ieee80211.c
+++ b/drivers/net/wireless/zd1211rw/zd_ieee80211.c
@@ -65,16 +65,14 @@ static const struct channel_range *zd_channel_range(u8 regdomain)
 
 static void unmask_bg_channels(struct ieee80211_hw *hw,
         const struct channel_range *range,
-        struct ieee80211_hw_mode *mode)
+        struct ieee80211_supported_band *sband)
 {
         u8 channel;
 
         for (channel = range->start; channel < range->end; channel++) {
                 struct ieee80211_channel *chan =
-                        &mode->channels[CHAN_TO_IDX(channel)];
-                chan->flag |= IEEE80211_CHAN_W_SCAN |
-                        IEEE80211_CHAN_W_ACTIVE_SCAN |
-                        IEEE80211_CHAN_W_IBSS;
+                        &sband->channels[CHAN_TO_IDX(channel)];
+                chan->flags = 0;
         }
 }
 
@@ -97,7 +95,6 @@ void zd_geo_init(struct ieee80211_hw *hw, u8 regdomain)
                 range = zd_channel_range(ZD_REGDOMAIN_FCC);
         }
 
-        unmask_bg_channels(hw, range, &mac->modes[0]);
-        unmask_bg_channels(hw, range, &mac->modes[1]);
+        unmask_bg_channels(hw, range, &mac->band);
 }
 
diff --git a/drivers/net/wireless/zd1211rw/zd_mac.c b/drivers/net/wireless/zd1211rw/zd_mac.c
index 76ef2d83919d..f90f03f676de 100644
--- a/drivers/net/wireless/zd1211rw/zd_mac.c
+++ b/drivers/net/wireless/zd1211rw/zd_mac.c
@@ -34,76 +34,61 @@
 
 /* This table contains the hardware specific values for the modulation rates. */
 static const struct ieee80211_rate zd_rates[] = {
-        { .rate = 10,
-          .val = ZD_CCK_RATE_1M,
-          .flags = IEEE80211_RATE_CCK },
-        { .rate = 20,
-          .val = ZD_CCK_RATE_2M,
-          .val2 = ZD_CCK_RATE_2M | ZD_CCK_PREA_SHORT,
-          .flags = IEEE80211_RATE_CCK_2 },
-        { .rate = 55,
-          .val = ZD_CCK_RATE_5_5M,
-          .val2 = ZD_CCK_RATE_5_5M | ZD_CCK_PREA_SHORT,
-          .flags = IEEE80211_RATE_CCK_2 },
-        { .rate = 110,
-          .val = ZD_CCK_RATE_11M,
-          .val2 = ZD_CCK_RATE_11M | ZD_CCK_PREA_SHORT,
-          .flags = IEEE80211_RATE_CCK_2 },
-        { .rate = 60,
-          .val = ZD_OFDM_RATE_6M,
-          .flags = IEEE80211_RATE_OFDM },
-        { .rate = 90,
-          .val = ZD_OFDM_RATE_9M,
-          .flags = IEEE80211_RATE_OFDM },
-        { .rate = 120,
-          .val = ZD_OFDM_RATE_12M,
-          .flags = IEEE80211_RATE_OFDM },
-        { .rate = 180,
-          .val = ZD_OFDM_RATE_18M,
-          .flags = IEEE80211_RATE_OFDM },
-        { .rate = 240,
-          .val = ZD_OFDM_RATE_24M,
-          .flags = IEEE80211_RATE_OFDM },
-        { .rate = 360,
-          .val = ZD_OFDM_RATE_36M,
-          .flags = IEEE80211_RATE_OFDM },
-        { .rate = 480,
-          .val = ZD_OFDM_RATE_48M,
-          .flags = IEEE80211_RATE_OFDM },
-        { .rate = 540,
-          .val = ZD_OFDM_RATE_54M,
-          .flags = IEEE80211_RATE_OFDM },
+        { .bitrate = 10,
+          .hw_value = ZD_CCK_RATE_1M, },
+        { .bitrate = 20,
+          .hw_value = ZD_CCK_RATE_2M,
+          .hw_value_short = ZD_CCK_RATE_2M | ZD_CCK_PREA_SHORT,
+          .flags = IEEE80211_RATE_SHORT_PREAMBLE },
+        { .bitrate = 55,
+          .hw_value = ZD_CCK_RATE_5_5M,
+          .hw_value_short = ZD_CCK_RATE_5_5M | ZD_CCK_PREA_SHORT,
+          .flags = IEEE80211_RATE_SHORT_PREAMBLE },
+        { .bitrate = 110,
+          .hw_value = ZD_CCK_RATE_11M,
+          .hw_value_short = ZD_CCK_RATE_11M | ZD_CCK_PREA_SHORT,
+          .flags = IEEE80211_RATE_SHORT_PREAMBLE },
+        { .bitrate = 60,
+          .hw_value = ZD_OFDM_RATE_6M,
+          .flags = 0 },
+        { .bitrate = 90,
+          .hw_value = ZD_OFDM_RATE_9M,
+          .flags = 0 },
+        { .bitrate = 120,
+          .hw_value = ZD_OFDM_RATE_12M,
+          .flags = 0 },
+        { .bitrate = 180,
+          .hw_value = ZD_OFDM_RATE_18M,
+          .flags = 0 },
+        { .bitrate = 240,
+          .hw_value = ZD_OFDM_RATE_24M,
+          .flags = 0 },
+        { .bitrate = 360,
+          .hw_value = ZD_OFDM_RATE_36M,
+          .flags = 0 },
+        { .bitrate = 480,
+          .hw_value = ZD_OFDM_RATE_48M,
+          .flags = 0 },
+        { .bitrate = 540,
+          .hw_value = ZD_OFDM_RATE_54M,
+          .flags = 0 },
 };
 
 static const struct ieee80211_channel zd_channels[] = {
-        { .chan = 1,
-          .freq = 2412},
-        { .chan = 2,
-          .freq = 2417},
-        { .chan = 3,
-          .freq = 2422},
-        { .chan = 4,
-          .freq = 2427},
-        { .chan = 5,
-          .freq = 2432},
-        { .chan = 6,
-          .freq = 2437},
-        { .chan = 7,
-          .freq = 2442},
-        { .chan = 8,
-          .freq = 2447},
-        { .chan = 9,
-          .freq = 2452},
-        { .chan = 10,
-          .freq = 2457},
-        { .chan = 11,
-          .freq = 2462},
-        { .chan = 12,
-          .freq = 2467},
-        { .chan = 13,
-          .freq = 2472},
-        { .chan = 14,
-          .freq = 2484}
+        { .center_freq = 2412, .hw_value = 1 },
+        { .center_freq = 2417, .hw_value = 2 },
+        { .center_freq = 2422, .hw_value = 3 },
+        { .center_freq = 2427, .hw_value = 4 },
+        { .center_freq = 2432, .hw_value = 5 },
+        { .center_freq = 2437, .hw_value = 6 },
+        { .center_freq = 2442, .hw_value = 7 },
+        { .center_freq = 2447, .hw_value = 8 },
+        { .center_freq = 2452, .hw_value = 9 },
+        { .center_freq = 2457, .hw_value = 10 },
+        { .center_freq = 2462, .hw_value = 11 },
+        { .center_freq = 2467, .hw_value = 12 },
+        { .center_freq = 2472, .hw_value = 13 },
+        { .center_freq = 2484, .hw_value = 14 },
 };
 
 static void housekeeping_init(struct zd_mac *mac);
@@ -503,7 +488,9 @@ static int fill_ctrlset(struct zd_mac *mac,
 
         ZD_ASSERT(frag_len <= 0xffff);
 
-        cs->modulation = control->tx_rate;
+        cs->modulation = control->tx_rate->hw_value;
+        if (control->flags & IEEE80211_TXCTL_SHORT_PREAMBLE)
+                cs->modulation = control->tx_rate->hw_value_short;
 
         cs->tx_length = cpu_to_le16(frag_len);
 
@@ -631,6 +618,8 @@ int zd_mac_rx(struct ieee80211_hw *hw, const u8 *buffer, unsigned int length)
         int bad_frame = 0;
         u16 fc;
         bool is_qos, is_4addr, need_padding;
+        int i;
+        u8 rate;
 
         if (length < ZD_PLCP_HEADER_SIZE + 10 /* IEEE80211_1ADDR_LEN */ +
                      FCS_LEN + sizeof(struct rx_status))
@@ -660,14 +649,19 @@ int zd_mac_rx(struct ieee80211_hw *hw, const u8 *buffer, unsigned int length)
                 }
         }
 
-        stats.channel = _zd_chip_get_channel(&mac->chip);
-        stats.freq = zd_channels[stats.channel - 1].freq;
-        stats.phymode = MODE_IEEE80211G;
+        stats.freq = zd_channels[_zd_chip_get_channel(&mac->chip) - 1].center_freq;
+        stats.band = IEEE80211_BAND_2GHZ;
         stats.ssi = status->signal_strength;
         stats.signal = zd_rx_qual_percent(buffer,
                                           length - sizeof(struct rx_status),
                                           status);
-        stats.rate = zd_rx_rate(buffer, status);
+
+        rate = zd_rx_rate(buffer, status);
+
+        /* todo: return index in the big switches in zd_rx_rate instead */
+        for (i = 0; i < mac->band.n_bitrates; i++)
+                if (rate == mac->band.bitrates[i].hw_value)
+                        stats.rate_idx = i;
 
         length -= ZD_PLCP_HEADER_SIZE + sizeof(struct rx_status);
         buffer += ZD_PLCP_HEADER_SIZE;
@@ -736,7 +730,7 @@ static void zd_op_remove_interface(struct ieee80211_hw *hw,
 static int zd_op_config(struct ieee80211_hw *hw, struct ieee80211_conf *conf)
 {
         struct zd_mac *mac = zd_hw_mac(hw);
-        return zd_chip_set_channel(&mac->chip, conf->channel);
+        return zd_chip_set_channel(&mac->chip, conf->channel->hw_value);
 }
 
 static int zd_op_config_interface(struct ieee80211_hw *hw,
@@ -780,7 +774,7 @@ static void set_rx_filter_handler(struct work_struct *work)
 
 #define SUPPORTED_FIF_FLAGS \
         (FIF_PROMISC_IN_BSS | FIF_ALLMULTI | FIF_FCSFAIL | FIF_CONTROL | \
-        FIF_OTHER_BSS)
+        FIF_OTHER_BSS | FIF_BCN_PRBRESP_PROMISC)
 static void zd_op_configure_filter(struct ieee80211_hw *hw,
                         unsigned int changed_flags,
                         unsigned int *new_flags,
@@ -894,7 +888,6 @@ struct ieee80211_hw *zd_mac_alloc_hw(struct usb_interface *intf)
 {
         struct zd_mac *mac;
         struct ieee80211_hw *hw;
-        int i;
 
         hw = ieee80211_alloc_hw(sizeof(struct zd_mac), &zd_ops);
         if (!hw) {
@@ -912,19 +905,14 @@ struct ieee80211_hw *zd_mac_alloc_hw(struct usb_interface *intf)
 
         memcpy(mac->channels, zd_channels, sizeof(zd_channels));
         memcpy(mac->rates, zd_rates, sizeof(zd_rates));
-        mac->modes[0].mode = MODE_IEEE80211G;
-        mac->modes[0].num_rates = ARRAY_SIZE(zd_rates);
-        mac->modes[0].rates = mac->rates;
-        mac->modes[0].num_channels = ARRAY_SIZE(zd_channels);
-        mac->modes[0].channels = mac->channels;
-        mac->modes[1].mode = MODE_IEEE80211B;
-        mac->modes[1].num_rates = 4;
-        mac->modes[1].rates = mac->rates;
-        mac->modes[1].num_channels = ARRAY_SIZE(zd_channels);
-        mac->modes[1].channels = mac->channels;
-
-        hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
-                     IEEE80211_HW_DEFAULT_REG_DOMAIN_CONFIGURED;
+        mac->band.n_bitrates = ARRAY_SIZE(zd_rates);
+        mac->band.bitrates = mac->rates;
+        mac->band.n_channels = ARRAY_SIZE(zd_channels);
+        mac->band.channels = mac->channels;
+
+        hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &mac->band;
+
+        hw->flags = IEEE80211_HW_RX_INCLUDES_FCS;
         hw->max_rssi = 100;
         hw->max_signal = 100;
 
@@ -933,14 +921,6 @@ struct ieee80211_hw *zd_mac_alloc_hw(struct usb_interface *intf)
 
         skb_queue_head_init(&mac->ack_wait_queue);
 
-        for (i = 0; i < 2; i++) {
-                if (ieee80211_register_hwmode(hw, &mac->modes[i])) {
-                        dev_dbg_f(&intf->dev, "cannot register hwmode\n");
-                        ieee80211_free_hw(hw);
-                        return NULL;
-                }
-        }
-
         zd_chip_init(&mac->chip, hw, intf);
         housekeeping_init(mac);
         INIT_WORK(&mac->set_multicast_hash_work, set_multicast_hash_handler);
diff --git a/drivers/net/wireless/zd1211rw/zd_mac.h b/drivers/net/wireless/zd1211rw/zd_mac.h
index 2dde108df767..67dea9739c8f 100644
--- a/drivers/net/wireless/zd1211rw/zd_mac.h
+++ b/drivers/net/wireless/zd1211rw/zd_mac.h
@@ -185,7 +185,7 @@ struct zd_mac {
         struct sk_buff_head ack_wait_queue;
         struct ieee80211_channel channels[14];
         struct ieee80211_rate rates[12];
-        struct ieee80211_hw_mode modes[2];
+        struct ieee80211_supported_band band;
 
         /* Short preamble (used for RTS/CTS) */
         unsigned int short_preamble:1;
diff --git a/drivers/ssb/driver_chipcommon.c b/drivers/ssb/driver_chipcommon.c
index e586321a473a..45b672a69003 100644
--- a/drivers/ssb/driver_chipcommon.c
+++ b/drivers/ssb/driver_chipcommon.c
@@ -353,6 +353,16 @@ void ssb_chipco_watchdog_timer_set(struct ssb_chipcommon *cc, u32 ticks)
         chipco_write32(cc, SSB_CHIPCO_WATCHDOG, ticks);
 }
 
+void ssb_chipco_irq_mask(struct ssb_chipcommon *cc, u32 mask, u32 value)
+{
+        chipco_write32_masked(cc, SSB_CHIPCO_IRQMASK, mask, value);
+}
+
+u32 ssb_chipco_irq_status(struct ssb_chipcommon *cc, u32 mask)
+{
+        return chipco_read32(cc, SSB_CHIPCO_IRQSTAT) & mask;
+}
+
 u32 ssb_chipco_gpio_in(struct ssb_chipcommon *cc, u32 mask)
 {
         return chipco_read32(cc, SSB_CHIPCO_GPIOIN) & mask;
diff --git a/drivers/ssb/main.c b/drivers/ssb/main.c
index bedb2b4ee9d2..8db40c4b86e9 100644
--- a/drivers/ssb/main.c
+++ b/drivers/ssb/main.c
@@ -505,6 +505,14 @@ error:
         return err;
 }
 
+static u8 ssb_ssb_read8(struct ssb_device *dev, u16 offset)
+{
+        struct ssb_bus *bus = dev->bus;
+
+        offset += dev->core_index * SSB_CORE_SIZE;
+        return readb(bus->mmio + offset);
+}
+
 static u16 ssb_ssb_read16(struct ssb_device *dev, u16 offset)
 {
         struct ssb_bus *bus = dev->bus;
@@ -521,6 +529,14 @@ static u32 ssb_ssb_read32(struct ssb_device *dev, u16 offset)
         return readl(bus->mmio + offset);
 }
 
+static void ssb_ssb_write8(struct ssb_device *dev, u16 offset, u8 value)
+{
+        struct ssb_bus *bus = dev->bus;
+
+        offset += dev->core_index * SSB_CORE_SIZE;
+        writeb(value, bus->mmio + offset);
+}
+
 static void ssb_ssb_write16(struct ssb_device *dev, u16 offset, u16 value)
 {
         struct ssb_bus *bus = dev->bus;
@@ -539,8 +555,10 @@ static void ssb_ssb_write32(struct ssb_device *dev, u16 offset, u32 value)
 
 /* Ops for the plain SSB bus without a host-device (no PCI or PCMCIA). */
 static const struct ssb_bus_ops ssb_ssb_ops = {
+        .read8          = ssb_ssb_read8,
         .read16         = ssb_ssb_read16,
         .read32         = ssb_ssb_read32,
+        .write8         = ssb_ssb_write8,
         .write16        = ssb_ssb_write16,
         .write32        = ssb_ssb_write32,
 };
diff --git a/drivers/ssb/pci.c b/drivers/ssb/pci.c
index b434df75047f..1facc7620fc8 100644
--- a/drivers/ssb/pci.c
+++ b/drivers/ssb/pci.c
@@ -572,6 +572,19 @@ static inline int ssb_pci_assert_buspower(struct ssb_bus *bus)
 }
 #endif /* DEBUG */
 
+static u8 ssb_pci_read8(struct ssb_device *dev, u16 offset)
+{
+        struct ssb_bus *bus = dev->bus;
+
+        if (unlikely(ssb_pci_assert_buspower(bus)))
+                return 0xFF;
+        if (unlikely(bus->mapped_device != dev)) {
+                if (unlikely(ssb_pci_switch_core(bus, dev)))
+                        return 0xFF;
+        }
+        return ioread8(bus->mmio + offset);
+}
+
 static u16 ssb_pci_read16(struct ssb_device *dev, u16 offset)
 {
         struct ssb_bus *bus = dev->bus;
@@ -598,6 +611,19 @@ static u32 ssb_pci_read32(struct ssb_device *dev, u16 offset)
         return ioread32(bus->mmio + offset);
 }
 
+static void ssb_pci_write8(struct ssb_device *dev, u16 offset, u8 value)
+{
+        struct ssb_bus *bus = dev->bus;
+
+        if (unlikely(ssb_pci_assert_buspower(bus)))
+                return;
+        if (unlikely(bus->mapped_device != dev)) {
+                if (unlikely(ssb_pci_switch_core(bus, dev)))
+                        return;
+        }
+        iowrite8(value, bus->mmio + offset);
+}
+
 static void ssb_pci_write16(struct ssb_device *dev, u16 offset, u16 value)
 {
         struct ssb_bus *bus = dev->bus;
@@ -626,8 +652,10 @@ static void ssb_pci_write32(struct ssb_device *dev, u16 offset, u32 value)
 
 /* Not "static", as it's used in main.c */
 const struct ssb_bus_ops ssb_pci_ops = {
+        .read8          = ssb_pci_read8,
         .read16         = ssb_pci_read16,
         .read32         = ssb_pci_read32,
+        .write8         = ssb_pci_write8,
         .write16        = ssb_pci_write16,
         .write32        = ssb_pci_write32,
 };
diff --git a/drivers/ssb/pcmcia.c b/drivers/ssb/pcmcia.c
index 46816cda8b98..84b3a845a8a8 100644
--- a/drivers/ssb/pcmcia.c
+++ b/drivers/ssb/pcmcia.c
@@ -172,6 +172,22 @@ static int select_core_and_segment(struct ssb_device *dev,
         return 0;
 }
 
+static u8 ssb_pcmcia_read8(struct ssb_device *dev, u16 offset)
+{
+        struct ssb_bus *bus = dev->bus;
+        unsigned long flags;
+        int err;
+        u8 value = 0xFF;
+
+        spin_lock_irqsave(&bus->bar_lock, flags);
+        err = select_core_and_segment(dev, &offset);
+        if (likely(!err))
+                value = readb(bus->mmio + offset);
+        spin_unlock_irqrestore(&bus->bar_lock, flags);
+
+        return value;
+}
+
 static u16 ssb_pcmcia_read16(struct ssb_device *dev, u16 offset)
 {
         struct ssb_bus *bus = dev->bus;
@@ -206,6 +222,20 @@ static u32 ssb_pcmcia_read32(struct ssb_device *dev, u16 offset)
         return (lo | (hi << 16));
 }
 
+static void ssb_pcmcia_write8(struct ssb_device *dev, u16 offset, u8 value)
+{
+        struct ssb_bus *bus = dev->bus;
+        unsigned long flags;
+        int err;
+
+        spin_lock_irqsave(&bus->bar_lock, flags);
+        err = select_core_and_segment(dev, &offset);
+        if (likely(!err))
+                writeb(value, bus->mmio + offset);
+        mmiowb();
+        spin_unlock_irqrestore(&bus->bar_lock, flags);
+}
+
 static void ssb_pcmcia_write16(struct ssb_device *dev, u16 offset, u16 value)
 {
         struct ssb_bus *bus = dev->bus;
@@ -238,8 +268,10 @@ static void ssb_pcmcia_write32(struct ssb_device *dev, u16 offset, u32 value)
 
 /* Not "static", as it's used in main.c */
 const struct ssb_bus_ops ssb_pcmcia_ops = {
+        .read8          = ssb_pcmcia_read8,
         .read16         = ssb_pcmcia_read16,
         .read32         = ssb_pcmcia_read32,
+        .write8         = ssb_pcmcia_write8,
         .write16        = ssb_pcmcia_write16,
         .write32        = ssb_pcmcia_write32,
 };
diff --git a/include/linux/nl80211.h b/include/linux/nl80211.h
index 9fecf902419c..a9f0b93324a2 100644
--- a/include/linux/nl80211.h
+++ b/include/linux/nl80211.h
@@ -161,6 +161,12 @@ enum nl80211_commands {
  *      given for %NL80211_CMD_GET_STATION, nested attribute containing
  *      info as possible, see &enum nl80211_sta_stats.
  *
+ * @NL80211_ATTR_WIPHY_BANDS: Information about an operating bands,
+ *      consisting of a nested array.
+ *
+ * @NL80211_ATTR_MNTR_FLAGS: flags, nested element with NLA_FLAG attributes of
+ *      &enum nl80211_mntr_flags.
+ *
  * @NL80211_ATTR_MAX: highest attribute number currently defined
  * @__NL80211_ATTR_AFTER_LAST: internal use
  */
@@ -195,6 +201,10 @@ enum nl80211_attrs {
         NL80211_ATTR_STA_VLAN,
         NL80211_ATTR_STA_STATS,
 
+        NL80211_ATTR_WIPHY_BANDS,
+
+        NL80211_ATTR_MNTR_FLAGS,
+
         /* add attributes here, update the policy in nl80211.c */
 
         __NL80211_ATTR_AFTER_LAST,
@@ -280,4 +290,93 @@ enum nl80211_sta_stats {
         NL80211_STA_STAT_MAX = __NL80211_STA_STAT_AFTER_LAST - 1
 };
 
+/**
+ * enum nl80211_band_attr - band attributes
+ * @__NL80211_BAND_ATTR_INVALID: attribute number 0 is reserved
+ * @NL80211_BAND_ATTR_FREQS: supported frequencies in this band,
+ *      an array of nested frequency attributes
+ * @NL80211_BAND_ATTR_RATES: supported bitrates in this band,
+ *      an array of nested bitrate attributes
+ */
+enum nl80211_band_attr {
+        __NL80211_BAND_ATTR_INVALID,
+        NL80211_BAND_ATTR_FREQS,
+        NL80211_BAND_ATTR_RATES,
+
+        /* keep last */
+        __NL80211_BAND_ATTR_AFTER_LAST,
+        NL80211_BAND_ATTR_MAX = __NL80211_BAND_ATTR_AFTER_LAST - 1
+};
+
+/**
+ * enum nl80211_frequency_attr - frequency attributes
+ * @NL80211_FREQUENCY_ATTR_FREQ: Frequency in MHz
+ * @NL80211_FREQUENCY_ATTR_DISABLED: Channel is disabled in current
+ *      regulatory domain.
+ * @NL80211_FREQUENCY_ATTR_PASSIVE_SCAN: Only passive scanning is
+ *      permitted on this channel in current regulatory domain.
+ * @NL80211_FREQUENCY_ATTR_NO_IBSS: IBSS networks are not permitted
+ *      on this channel in current regulatory domain.
+ * @NL80211_FREQUENCY_ATTR_RADAR: Radar detection is mandatory
+ *      on this channel in current regulatory domain.
+ */
+enum nl80211_frequency_attr {
+        __NL80211_FREQUENCY_ATTR_INVALID,
+        NL80211_FREQUENCY_ATTR_FREQ,
+        NL80211_FREQUENCY_ATTR_DISABLED,
+        NL80211_FREQUENCY_ATTR_PASSIVE_SCAN,
+        NL80211_FREQUENCY_ATTR_NO_IBSS,
+        NL80211_FREQUENCY_ATTR_RADAR,
+
+        /* keep last */
+        __NL80211_FREQUENCY_ATTR_AFTER_LAST,
+        NL80211_FREQUENCY_ATTR_MAX = __NL80211_FREQUENCY_ATTR_AFTER_LAST - 1
+};
+
+/**
+ * enum nl80211_bitrate_attr - bitrate attributes
+ * @NL80211_BITRATE_ATTR_RATE: Bitrate in units of 100 kbps
+ * @NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE: Short preamble supported
+ *      in 2.4 GHz band.
+ */
+enum nl80211_bitrate_attr {
+        __NL80211_BITRATE_ATTR_INVALID,
+        NL80211_BITRATE_ATTR_RATE,
+        NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE,
+
+        /* keep last */
+        __NL80211_BITRATE_ATTR_AFTER_LAST,
+        NL80211_BITRATE_ATTR_MAX = __NL80211_BITRATE_ATTR_AFTER_LAST - 1
+};
+
+/**
+ * enum nl80211_mntr_flags - monitor configuration flags
+ *
+ * Monitor configuration flags.
+ *
+ * @__NL80211_MNTR_FLAG_INVALID: reserved
+ *
+ * @NL80211_MNTR_FLAG_FCSFAIL: pass frames with bad FCS
+ * @NL80211_MNTR_FLAG_PLCPFAIL: pass frames with bad PLCP
+ * @NL80211_MNTR_FLAG_CONTROL: pass control frames
+ * @NL80211_MNTR_FLAG_OTHER_BSS: disable BSSID filtering
+ * @NL80211_MNTR_FLAG_COOK_FRAMES: report frames after processing.
+ *      overrides all other flags.
+ *
+ * @__NL80211_MNTR_FLAG_AFTER_LAST: internal use
+ * @NL80211_MNTR_FLAG_MAX: highest possible monitor flag
+ */
+enum nl80211_mntr_flags {
+        __NL80211_MNTR_FLAG_INVALID,
+        NL80211_MNTR_FLAG_FCSFAIL,
+        NL80211_MNTR_FLAG_PLCPFAIL,
+        NL80211_MNTR_FLAG_CONTROL,
+        NL80211_MNTR_FLAG_OTHER_BSS,
+        NL80211_MNTR_FLAG_COOK_FRAMES,
+
+        /* keep last */
+        __NL80211_MNTR_FLAG_AFTER_LAST,
+        NL80211_MNTR_FLAG_MAX = __NL80211_MNTR_FLAG_AFTER_LAST - 1
+};
+
 #endif /* __LINUX_NL80211_H */
diff --git a/include/linux/ssb/ssb.h b/include/linux/ssb/ssb.h
index 20add65215af..860d28c6d149 100644
--- a/include/linux/ssb/ssb.h
+++ b/include/linux/ssb/ssb.h
@@ -72,8 +72,10 @@ struct ssb_device;
 /* Lowlevel read/write operations on the device MMIO.
  * Internal, don't use that outside of ssb. */
 struct ssb_bus_ops {
+        u8 (*read8)(struct ssb_device *dev, u16 offset);
         u16 (*read16)(struct ssb_device *dev, u16 offset);
         u32 (*read32)(struct ssb_device *dev, u16 offset);
+        void (*write8)(struct ssb_device *dev, u16 offset, u8 value);
         void (*write16)(struct ssb_device *dev, u16 offset, u16 value);
         void (*write32)(struct ssb_device *dev, u16 offset, u32 value);
 };
@@ -344,6 +346,10 @@ void ssb_device_disable(struct ssb_device *dev, u32 core_specific_flags);
 
 
 /* Device MMIO register read/write functions. */
+static inline u8 ssb_read8(struct ssb_device *dev, u16 offset)
+{
+        return dev->ops->read8(dev, offset);
+}
 static inline u16 ssb_read16(struct ssb_device *dev, u16 offset)
 {
         return dev->ops->read16(dev, offset);
@@ -352,6 +358,10 @@ static inline u32 ssb_read32(struct ssb_device *dev, u16 offset)
 {
         return dev->ops->read32(dev, offset);
 }
+static inline void ssb_write8(struct ssb_device *dev, u16 offset, u8 value)
+{
+        dev->ops->write8(dev, offset, value);
+}
 static inline void ssb_write16(struct ssb_device *dev, u16 offset, u16 value)
 {
         dev->ops->write16(dev, offset, value);
diff --git a/include/linux/ssb/ssb_driver_chipcommon.h b/include/linux/ssb/ssb_driver_chipcommon.h
index 536851b946f6..b548a54ff1f5 100644
--- a/include/linux/ssb/ssb_driver_chipcommon.h
+++ b/include/linux/ssb/ssb_driver_chipcommon.h
@@ -390,6 +390,10 @@ extern void ssb_chipco_set_clockmode(struct ssb_chipcommon *cc,
 extern void ssb_chipco_watchdog_timer_set(struct ssb_chipcommon *cc,
                                           u32 ticks);
 
+void ssb_chipco_irq_mask(struct ssb_chipcommon *cc, u32 mask, u32 value);
+
+u32 ssb_chipco_irq_status(struct ssb_chipcommon *cc, u32 mask);
+
 /* Chipcommon GPIO pin access. */
 u32 ssb_chipco_gpio_in(struct ssb_chipcommon *cc, u32 mask);
 u32 ssb_chipco_gpio_out(struct ssb_chipcommon *cc, u32 mask, u32 value);
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index bcc480b8892a..ab4caf63954f 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -163,6 +163,26 @@ struct station_stats {
         u32 tx_bytes;
 };
 
+/**
+ * enum monitor_flags - monitor flags
+ *
+ * Monitor interface configuration flags. Note that these must be the bits
+ * according to the nl80211 flags.
+ *
+ * @MONITOR_FLAG_FCSFAIL: pass frames with bad FCS
+ * @MONITOR_FLAG_PLCPFAIL: pass frames with bad PLCP
+ * @MONITOR_FLAG_CONTROL: pass control frames
+ * @MONITOR_FLAG_OTHER_BSS: disable BSSID filtering
+ * @MONITOR_FLAG_COOK_FRAMES: report frames after processing
+ */
+enum monitor_flags {
+        MONITOR_FLAG_FCSFAIL            = 1<<NL80211_MNTR_FLAG_FCSFAIL,
+        MONITOR_FLAG_PLCPFAIL           = 1<<NL80211_MNTR_FLAG_PLCPFAIL,
+        MONITOR_FLAG_CONTROL            = 1<<NL80211_MNTR_FLAG_CONTROL,
+        MONITOR_FLAG_OTHER_BSS          = 1<<NL80211_MNTR_FLAG_OTHER_BSS,
+        MONITOR_FLAG_COOK_FRAMES        = 1<<NL80211_MNTR_FLAG_COOK_FRAMES,
+};
+
 /* from net/wireless.h */
 struct wiphy;
 
@@ -213,10 +233,10 @@ struct wiphy;
  */
 struct cfg80211_ops {
         int     (*add_virtual_intf)(struct wiphy *wiphy, char *name,
-                                    enum nl80211_iftype type);
+                                    enum nl80211_iftype type, u32 *flags);
         int     (*del_virtual_intf)(struct wiphy *wiphy, int ifindex);
         int     (*change_virtual_intf)(struct wiphy *wiphy, int ifindex,
-                                       enum nl80211_iftype type);
+                                       enum nl80211_iftype type, u32 *flags);
 
         int     (*add_key)(struct wiphy *wiphy, struct net_device *netdev,
                            u8 key_index, u8 *mac_addr,
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 9083bafb63ca..7a80c3981237 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -38,7 +38,11 @@
  * called in hardware interrupt context. The low-level driver must not call any
  * other functions in hardware interrupt context. If there is a need for such
  * call, the low-level driver should first ACK the interrupt and perform the
- * IEEE 802.11 code call after this, e.g. from a scheduled workqueue function.
+ * IEEE 802.11 code call after this, e.g. from a scheduled workqueue or even
+ * tasklet function.
+ *
+ * NOTE: If the driver opts to use the _irqsafe() functions, it may not also
+ *       use the non-irqsafe functions!
  */
 
 /**
@@ -69,95 +73,6 @@
  * not do so then mac80211 may add this under certain circumstances.
  */
 
-#define IEEE80211_CHAN_W_SCAN 0x00000001
-#define IEEE80211_CHAN_W_ACTIVE_SCAN 0x00000002
-#define IEEE80211_CHAN_W_IBSS 0x00000004
-
-/* Channel information structure. Low-level driver is expected to fill in chan,
- * freq, and val fields. Other fields will be filled in by 80211.o based on
- * hostapd information and low-level driver does not need to use them. The
- * limits for each channel will be provided in 'struct ieee80211_conf' when
- * configuring the low-level driver with hw->config callback. If a device has
- * a default regulatory domain, IEEE80211_HW_DEFAULT_REG_DOMAIN_CONFIGURED
- * can be set to let the driver configure all fields */
-struct ieee80211_channel {
-        short chan; /* channel number (IEEE 802.11) */
-        short freq; /* frequency in MHz */
-        int val; /* hw specific value for the channel */
-        int flag; /* flag for hostapd use (IEEE80211_CHAN_*) */
-        unsigned char power_level;
-        unsigned char antenna_max;
-};
-
-#define IEEE80211_RATE_ERP 0x00000001
-#define IEEE80211_RATE_BASIC 0x00000002
-#define IEEE80211_RATE_PREAMBLE2 0x00000004
-#define IEEE80211_RATE_SUPPORTED 0x00000010
-#define IEEE80211_RATE_OFDM 0x00000020
-#define IEEE80211_RATE_CCK 0x00000040
-#define IEEE80211_RATE_MANDATORY 0x00000100
-
-#define IEEE80211_RATE_CCK_2 (IEEE80211_RATE_CCK | IEEE80211_RATE_PREAMBLE2)
-#define IEEE80211_RATE_MODULATION(f) \
-        (f & (IEEE80211_RATE_CCK | IEEE80211_RATE_OFDM))
-
-/* Low-level driver should set PREAMBLE2, OFDM and CCK flags.
- * BASIC, SUPPORTED, ERP, and MANDATORY flags are set in 80211.o based on the
- * configuration. */
-struct ieee80211_rate {
-        int rate; /* rate in 100 kbps */
-        int val; /* hw specific value for the rate */
-        int flags; /* IEEE80211_RATE_ flags */
-        int val2; /* hw specific value for the rate when using short preamble
-                   * (only when IEEE80211_RATE_PREAMBLE2 flag is set, i.e., for
-                   * 2, 5.5, and 11 Mbps) */
-        signed char min_rssi_ack;
-        unsigned char min_rssi_ack_delta;
-
-        /* following fields are set by 80211.o and need not be filled by the
-         * low-level driver */
-        int rate_inv; /* inverse of the rate (LCM(all rates) / rate) for
-                       * optimizing channel utilization estimates */
-};
-
-/**
- * enum ieee80211_phymode - PHY modes
- *
- * @MODE_IEEE80211A: 5GHz as defined by 802.11a/802.11h
- * @MODE_IEEE80211B: 2.4 GHz as defined by 802.11b
- * @MODE_IEEE80211G: 2.4 GHz as defined by 802.11g (with OFDM),
- *      backwards compatible with 11b mode
- * @NUM_IEEE80211_MODES: internal
- */
-enum ieee80211_phymode {
-        MODE_IEEE80211A,
-        MODE_IEEE80211B,
-        MODE_IEEE80211G,
-
-        /* keep last */
-        NUM_IEEE80211_MODES
-};
-
-/**
- * struct ieee80211_ht_info - describing STA's HT capabilities
- *
- * This structure describes most essential parameters needed
- * to describe 802.11n HT capabilities for an STA.
- *
- * @ht_supported: is HT supported by STA, 0: no, 1: yes
- * @cap: HT capabilities map as described in 802.11n spec
- * @ampdu_factor: Maximum A-MPDU length factor
- * @ampdu_density: Minimum A-MPDU spacing
- * @supp_mcs_set: Supported MCS set as described in 802.11n spec
- */
-struct ieee80211_ht_info {
-        u8 ht_supported;
-        u16 cap; /* use IEEE80211_HT_CAP_ */
-        u8 ampdu_factor;
-        u8 ampdu_density;
-        u8 supp_mcs_set[16];
-};
-
 /**
  * struct ieee80211_ht_bss_info - describing BSS's HT characteristics
  *
@@ -175,46 +90,22 @@ struct ieee80211_ht_bss_info {
 };
 
 /**
- * struct ieee80211_hw_mode - PHY mode definition
- *
- * This structure describes the capabilities supported by the device
- * in a single PHY mode.
- *
- * @list: internal
- * @channels: pointer to array of supported channels
- * @rates: pointer to array of supported bitrates
- * @mode: the PHY mode for this definition
- * @num_channels: number of supported channels
- * @num_rates: number of supported bitrates
- * @ht_info: PHY's 802.11n HT abilities for this mode
- */
-struct ieee80211_hw_mode {
-        struct list_head list;
-        struct ieee80211_channel *channels;
-        struct ieee80211_rate *rates;
-        enum ieee80211_phymode mode;
-        int num_channels;
-        int num_rates;
-        struct ieee80211_ht_info ht_info;
-};
-
-/**
  * struct ieee80211_tx_queue_params - transmit queue configuration
  *
  * The information provided in this structure is required for QoS
- * transmit queue configuration.
+ * transmit queue configuration. Cf. IEEE 802.11 7.3.2.29.
  *
  * @aifs: arbitration interface space [0..255, -1: use default]
  * @cw_min: minimum contention window [will be a value of the form
  *      2^n-1 in the range 1..1023; 0: use default]
  * @cw_max: maximum contention window [like @cw_min]
- * @burst_time: maximum burst time in units of 0.1ms, 0 meaning disabled
+ * @txop: maximum burst time in units of 32 usecs, 0 meaning disabled
  */
 struct ieee80211_tx_queue_params {
-        int aifs;
-        int cw_min;
-        int cw_max;
-        int burst_time;
+        s16 aifs;
+        u16 cw_min;
+        u16 cw_max;
+        u16 txop;
 };
 
 /**
@@ -246,6 +137,7 @@ struct ieee80211_tx_queue_stats_data {
  * @IEEE80211_TX_QUEUE_AFTER_BEACON: transmit queue for frames to be
  *      sent after a beacon
  * @IEEE80211_TX_QUEUE_BEACON: transmit queue for beacon frames
+ * @NUM_TX_DATA_QUEUES_AMPDU: adding more queues for A-MPDU
  */
 enum ieee80211_tx_queue {
         IEEE80211_TX_QUEUE_DATA0,
@@ -261,11 +153,12 @@ enum ieee80211_tx_queue {
  * this struct need to have fixed values. As soon as it is removed, we can
  * fix these entries. */
         IEEE80211_TX_QUEUE_AFTER_BEACON = 6,
-        IEEE80211_TX_QUEUE_BEACON = 7
+        IEEE80211_TX_QUEUE_BEACON = 7,
+        NUM_TX_DATA_QUEUES_AMPDU = 16
 };
 
 struct ieee80211_tx_queue_stats {
-        struct ieee80211_tx_queue_stats_data data[NUM_TX_DATA_QUEUES];
+        struct ieee80211_tx_queue_stats_data data[NUM_TX_DATA_QUEUES_AMPDU];
 };
 
 struct ieee80211_low_level_stats {
@@ -318,11 +211,13 @@ struct ieee80211_bss_conf {
 
 struct ieee80211_tx_control {
         struct ieee80211_vif *vif;
-        int tx_rate; /* Transmit rate, given as the hw specific value for the
-                      * rate (from struct ieee80211_rate) */
-        int rts_cts_rate; /* Transmit rate for RTS/CTS frame, given as the hw
-                           * specific value for the rate (from
-                           * struct ieee80211_rate) */
+        struct ieee80211_rate *tx_rate;
+
+        /* Transmit rate for RTS/CTS frame */
+        struct ieee80211_rate *rts_cts_rate;
+
+        /* retry rate for the last retries */
+        struct ieee80211_rate *alt_retry_rate;
 
 #define IEEE80211_TXCTL_REQ_TX_STATUS   (1<<0)/* request TX status callback for
                                                 * this frame */
@@ -337,10 +232,12 @@ struct ieee80211_tx_control {
 #define IEEE80211_TXCTL_NO_ACK          (1<<4) /* tell the low level not to
                                                 * wait for an ack */
 #define IEEE80211_TXCTL_RATE_CTRL_PROBE (1<<5)
-#define IEEE80211_TXCTL_CLEAR_DST_MASK  (1<<6)
+#define IEEE80211_TXCTL_CLEAR_PS_FILT   (1<<6) /* clear powersave filter
+                                                * for destination station */
 #define IEEE80211_TXCTL_REQUEUE         (1<<7)
 #define IEEE80211_TXCTL_FIRST_FRAGMENT  (1<<8) /* this is a first fragment of
                                                 * the frame */
+#define IEEE80211_TXCTL_SHORT_PREAMBLE  (1<<9)
 #define IEEE80211_TXCTL_LONG_RETRY_LIMIT (1<<10) /* this frame should be send
                                                   * using the through
                                                   * set_retry_limit configured
@@ -348,6 +245,8 @@ struct ieee80211_tx_control {
 #define IEEE80211_TXCTL_EAPOL_FRAME     (1<<11) /* internal to mac80211 */
 #define IEEE80211_TXCTL_SEND_AFTER_DTIM (1<<12) /* send this frame after DTIM
                                                  * beacon */
+#define IEEE80211_TXCTL_AMPDU           (1<<13) /* this frame should be sent
+                                                 * as part of an A-MPDU */
         u32 flags;                             /* tx control flags defined
                                                 * above */
         u8 key_idx;             /* keyidx from hw->set_key(), undefined if
@@ -355,20 +254,11 @@ struct ieee80211_tx_control {
         u8 retry_limit;         /* 1 = only first attempt, 2 = one retry, ..
                                  * This could be used when set_retry_limit
                                  * is not implemented by the driver */
-        u8 power_level;         /* per-packet transmit power level, in dBm */
         u8 antenna_sel_tx;      /* 0 = default/diversity, 1 = Ant0, 2 = Ant1 */
         u8 icv_len;             /* length of the ICV/MIC field in octets */
         u8 iv_len;              /* length of the IV field in octets */
         u8 queue;               /* hardware queue to use for this frame;
                                  * 0 = highest, hw->queues-1 = lowest */
-        struct ieee80211_rate *rate;            /* internal 80211.o rate */
-        struct ieee80211_rate *rts_rate;        /* internal 80211.o rate
-                                                 * for RTS/CTS */
-        int alt_retry_rate; /* retry rate for the last retries, given as the
-                             * hw specific value for the rate (from
-                             * struct ieee80211_rate). To be used to limit
-                             * packet dropping when probing higher rates, if hw
-                             * supports multiple retry rates. -1 = not used */
         int type;       /* internal */
 };
 
@@ -391,7 +281,8 @@ struct ieee80211_tx_control {
  * @RX_FLAG_FAILED_PLCP_CRC: Set this flag if the PCLP check failed on
  *      the frame.
  * @RX_FLAG_TSFT: The timestamp passed in the RX status (@mactime field)
- *      is valid.
+ *      is valid. This is useful in monitor mode and necessary for beacon frames
+ *      to enable IBSS merging.
  */
 enum mac80211_rx_flags {
         RX_FLAG_MMIC_ERROR      = 1<<0,
@@ -410,27 +301,26 @@ enum mac80211_rx_flags {
  * The low-level driver should provide this information (the subset
  * supported by hardware) to the 802.11 code with each received
  * frame.
- * @mactime: MAC timestamp as defined by 802.11
+ * @mactime: value in microseconds of the 64-bit Time Synchronization Function
+ *      (TSF) timer when the first data symbol (MPDU) arrived at the hardware.
+ * @band: the active band when this frame was received
  * @freq: frequency the radio was tuned to when receiving this frame, in MHz
- * @channel: channel the radio was tuned to
- * @phymode: active PHY mode
  * @ssi: signal strength when receiving this frame
  * @signal: used as 'qual' in statistics reporting
  * @noise: PHY noise when receiving this frame
  * @antenna: antenna used
- * @rate: data rate
+ * @rate_idx: index of data rate into band's supported rates
  * @flag: %RX_FLAG_*
  */
 struct ieee80211_rx_status {
         u64 mactime;
+        enum ieee80211_band band;
         int freq;
-        int channel;
-        enum ieee80211_phymode phymode;
         int ssi;
         int signal;
         int noise;
         int antenna;
-        int rate;
+        int rate_idx;
         int flag;
 };
 
@@ -441,12 +331,14 @@ struct ieee80211_rx_status {
  *
  * @IEEE80211_TX_STATUS_TX_FILTERED: The frame was not transmitted
  *      because the destination STA was in powersave mode.
- *
  * @IEEE80211_TX_STATUS_ACK: Frame was acknowledged
+ * @IEEE80211_TX_STATUS_AMPDU: The frame was aggregated, so status
+ *      is for the whole aggregation.
  */
 enum ieee80211_tx_status_flags {
         IEEE80211_TX_STATUS_TX_FILTERED = 1<<0,
         IEEE80211_TX_STATUS_ACK         = 1<<1,
+        IEEE80211_TX_STATUS_AMPDU       = 1<<2,
 };
 
 /**
@@ -457,24 +349,25 @@ enum ieee80211_tx_status_flags {
  *
  * @control: a copy of the &struct ieee80211_tx_control passed to the driver
  *      in the tx() callback.
- *
  * @flags: transmit status flags, defined above
- *
- * @ack_signal: signal strength of the ACK frame
- *
+ * @retry_count: number of retries
  * @excessive_retries: set to 1 if the frame was retried many times
  *      but not acknowledged
- *
- * @retry_count: number of retries
- *
+ * @ampdu_ack_len: number of aggregated frames.
+ *      relevant only if IEEE80211_TX_STATUS_AMPDU was set.
+ * @ampdu_ack_map: block ack bit map for the aggregation.
+ *      relevant only if IEEE80211_TX_STATUS_AMPDU was set.
+ * @ack_signal: signal strength of the ACK frame
  * @queue_length: ?? REMOVE
  * @queue_number: ?? REMOVE
  */
 struct ieee80211_tx_status {
         struct ieee80211_tx_control control;
         u8 flags;
-        bool excessive_retries;
         u8 retry_count;
+        bool excessive_retries;
+        u8 ampdu_ack_len;
+        u64 ampdu_ack_map;
         int ack_signal;
         int queue_length;
         int queue_number;
@@ -502,41 +395,30 @@ enum ieee80211_conf_flags {
  *
  * @radio_enabled: when zero, driver is required to switch off the radio.
  *      TODO make a flag
- * @channel: IEEE 802.11 channel number
- * @freq: frequency in MHz
- * @channel_val: hardware specific channel value for the channel
- * @phymode: PHY mode to activate (REMOVE)
- * @chan: channel to switch to, pointer to the channel information
- * @mode: pointer to mode definition
- * @regulatory_domain: ??
  * @beacon_int: beacon interval (TODO make interface config)
  * @flags: configuration flags defined above
- * @power_level: transmit power limit for current regulatory domain in dBm
- * @antenna_max: maximum antenna gain
+ * @power_level: requested transmit power (in dBm)
+ * @max_antenna_gain: maximum antenna gain (in dBi)
  * @antenna_sel_tx: transmit antenna selection, 0: default/diversity,
  *      1/2: antenna 0/1
  * @antenna_sel_rx: receive antenna selection, like @antenna_sel_tx
  * @ht_conf: describes current self configuration of 802.11n HT capabilies
  * @ht_bss_conf: describes current BSS configuration of 802.11n HT parameters
+ * @channel: the channel to tune to
  */
 struct ieee80211_conf {
-        int channel;                    /* IEEE 802.11 channel number */
-        int freq;                       /* MHz */
-        int channel_val;                /* hw specific value for the channel */
-
-        enum ieee80211_phymode phymode;
-        struct ieee80211_channel *chan;
-        struct ieee80211_hw_mode *mode;
         unsigned int regulatory_domain;
         int radio_enabled;
 
         int beacon_int;
         u32 flags;
-        u8 power_level;
-        u8 antenna_max;
+        int power_level;
+        int max_antenna_gain;
         u8 antenna_sel_tx;
         u8 antenna_sel_rx;
 
+        struct ieee80211_channel *channel;
+
         struct ieee80211_ht_info ht_conf;
         struct ieee80211_ht_bss_info ht_bss_conf;
 };
@@ -757,15 +639,19 @@ enum sta_notify_cmd {
  *      %IEEE80211_HW_HOST_GEN_BEACON_TEMPLATE is also not set because
  *      otherwise the stack will not know when the DTIM beacon was sent.
  *
- * @IEEE80211_HW_DEFAULT_REG_DOMAIN_CONFIGURED:
- *      Channels are already configured to the default regulatory domain
- *      specified in the device's EEPROM
+ * @IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE:
+ *      Hardware is not capable of short slot operation on the 2.4 GHz band.
+ *
+ * @IEEE80211_HW_2GHZ_SHORT_PREAMBLE_INCAPABLE:
+ *      Hardware is not capable of receiving frames with short preamble on
+ *      the 2.4 GHz band.
  */
 enum ieee80211_hw_flags {
         IEEE80211_HW_HOST_GEN_BEACON_TEMPLATE           = 1<<0,
         IEEE80211_HW_RX_INCLUDES_FCS                    = 1<<1,
         IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING        = 1<<2,
-        IEEE80211_HW_DEFAULT_REG_DOMAIN_CONFIGURED      = 1<<3,
+        IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE          = 1<<3,
+        IEEE80211_HW_2GHZ_SHORT_PREAMBLE_INCAPABLE      = 1<<4,
 };
 
 /**
@@ -777,7 +663,8 @@ enum ieee80211_hw_flags {
  * @wiphy: This points to the &struct wiphy allocated for this
  *      802.11 PHY. You must fill in the @perm_addr and @dev
  *      members of this structure using SET_IEEE80211_DEV()
- *      and SET_IEEE80211_PERM_ADDR().
+ *      and SET_IEEE80211_PERM_ADDR(). Additionally, all supported
+ *      bands (with channels, bitrates) are registered here.
  *
  * @conf: &struct ieee80211_conf, device configuration, don't use.
  *
@@ -913,8 +800,18 @@ static inline void SET_IEEE80211_PERM_ADDR(struct ieee80211_hw *hw, u8 *addr)
  * parameter to see whether multicast frames should be accepted
  * or dropped.
  *
- * All unsupported flags in @total_flags must be cleared, i.e. you
- * should clear all bits except those you honoured.
+ * All unsupported flags in @total_flags must be cleared.
+ * Hardware does not support a flag if it is incapable of _passing_
+ * the frame to the stack. Otherwise the driver must ignore
+ * the flag, but not clear it.
+ * You must _only_ clear the flag (announce no support for the
+ * flag to mac80211) if you are not able to pass the packet type
+ * to the stack (so the hardware always filters it).
+ * So for example, you should clear @FIF_CONTROL, if your hardware
+ * always filters control frames. If your hardware always passes
+ * control frames to the kernel and is incapable of filtering them,
+ * you do _not_ clear the @FIF_CONTROL flag.
+ * This rule applies to all other FIF flags as well.
  */
 
 /**
@@ -967,10 +864,14 @@ enum ieee80211_filter_flags {
  * &struct ieee80211_ops to indicate which action is needed.
  * @IEEE80211_AMPDU_RX_START: start Rx aggregation
  * @IEEE80211_AMPDU_RX_STOP: stop Rx aggregation
+ * @IEEE80211_AMPDU_TX_START: start Tx aggregation
+ * @IEEE80211_AMPDU_TX_STOP: stop Tx aggregation
  */
 enum ieee80211_ampdu_mlme_action {
         IEEE80211_AMPDU_RX_START,
         IEEE80211_AMPDU_RX_STOP,
+        IEEE80211_AMPDU_TX_START,
+        IEEE80211_AMPDU_TX_STOP,
 };
 
 /**
@@ -1051,7 +952,9 @@ enum ieee80211_ampdu_mlme_action {
  *      given local_address is enabled.
  *
  * @hw_scan: Ask the hardware to service the scan request, no need to start
- *      the scan state machine in stack.
+ *      the scan state machine in stack. The scan must honour the channel
+ *      configuration done by the regulatory agent in the wiphy's registered
+ *      bands.
  *
  * @get_stats: return low-level statistics
  *
@@ -1111,7 +1014,8 @@ enum ieee80211_ampdu_mlme_action {
  *      The RA/TID combination determines the destination and TID we want
  *      the ampdu action to be performed for. The action is defined through
  *      ieee80211_ampdu_mlme_action. Starting sequence number (@ssn)
- *      is the first frame we expect to perform the action on.
+ *      is the first frame we expect to perform the action on. notice
+ *      that TX/RX_STOP can pass NULL for this parameter.
  */
 struct ieee80211_ops {
         int (*tx)(struct ieee80211_hw *hw, struct sk_buff *skb,
@@ -1162,7 +1066,7 @@ struct ieee80211_ops {
         int (*conf_ht)(struct ieee80211_hw *hw, struct ieee80211_conf *conf);
         int (*ampdu_action)(struct ieee80211_hw *hw,
                             enum ieee80211_ampdu_mlme_action action,
-                            const u8 *ra, u16 tid, u16 ssn);
+                            const u8 *addr, u16 tid, u16 *ssn);
 };
 
 /**
@@ -1272,10 +1176,6 @@ static inline char *ieee80211_get_radio_led_name(struct ieee80211_hw *hw)
 #endif
 }
 
-/* Register a new hardware PHYMODE capability to the stack. */
-int ieee80211_register_hwmode(struct ieee80211_hw *hw,
-                              struct ieee80211_hw_mode *mode);
-
 /**
  * ieee80211_unregister_hw - Unregister a hardware device
  *
@@ -1308,7 +1208,10 @@ void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
  * buffer in @skb must start with an IEEE 802.11 header or a radiotap
  * header if %RX_FLAG_RADIOTAP is set in the @status flags.
  *
- * This function may not be called in IRQ context.
+ * This function may not be called in IRQ context. Calls to this function
+ * for a single hardware must be synchronized against each other. Calls
+ * to this function and ieee80211_rx_irqsafe() may not be mixed for a
+ * single hardware.
  *
  * @hw: the hardware this frame came in on
  * @skb: the buffer to receive, owned by mac80211 after this call
@@ -1325,7 +1228,10 @@ static inline void ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
  * ieee80211_rx_irqsafe - receive frame
  *
  * Like ieee80211_rx() but can be called in IRQ context
- * (internally defers to a workqueue.)
+ * (internally defers to a tasklet.)
+ *
+ * Calls to this function and ieee80211_rx() may not be mixed for a
+ * single hardware.
  *
  * @hw: the hardware this frame came in on
  * @skb: the buffer to receive, owned by mac80211 after this call
@@ -1344,6 +1250,11 @@ void ieee80211_rx_irqsafe(struct ieee80211_hw *hw,
  * transmitted. It is permissible to not call this function for
  * multicast frames but this can affect statistics.
  *
+ * This function may not be called in IRQ context. Calls to this function
+ * for a single hardware must be synchronized against each other. Calls
+ * to this function and ieee80211_tx_status_irqsafe() may not be mixed
+ * for a single hardware.
+ *
  * @hw: the hardware the frame was transmitted by
  * @skb: the frame that was transmitted, owned by mac80211 after this call
  * @status: status information for this frame; the status pointer need not
@@ -1353,6 +1264,22 @@ void ieee80211_rx_irqsafe(struct ieee80211_hw *hw,
 void ieee80211_tx_status(struct ieee80211_hw *hw,
                          struct sk_buff *skb,
                          struct ieee80211_tx_status *status);
+
+/**
+ * ieee80211_tx_status_irqsafe - irq-safe transmit status callback
+ *
+ * Like ieee80211_tx_status() but can be called in IRQ context
+ * (internally defers to a tasklet.)
+ *
+ * Calls to this function and ieee80211_tx_status() may not be mixed for a
+ * single hardware.
+ *
+ * @hw: the hardware the frame was transmitted by
+ * @skb: the frame that was transmitted, owned by mac80211 after this call
+ * @status: status information for this frame; the status pointer need not
+ *      be valid after this function returns and is not freed by mac80211,
+ *      it is recommended that it points to a stack area
+ */
 void ieee80211_tx_status_irqsafe(struct ieee80211_hw *hw,
                                  struct sk_buff *skb,
                                  struct ieee80211_tx_status *status);
@@ -1449,7 +1376,7 @@ __le16 ieee80211_ctstoself_duration(struct ieee80211_hw *hw,
  * @hw: pointer obtained from ieee80211_alloc_hw().
  * @vif: &struct ieee80211_vif pointer from &struct ieee80211_if_init_conf.
  * @frame_len: the length of the frame.
- * @rate: the rate (in 100kbps) at which the frame is going to be transmitted.
+ * @rate: the rate at which the frame is going to be transmitted.
  *
  * Calculate the duration field of some generic frame, given its
  * length and transmission rate (in 100kbps).
@@ -1457,7 +1384,7 @@ __le16 ieee80211_ctstoself_duration(struct ieee80211_hw *hw,
 __le16 ieee80211_generic_frame_duration(struct ieee80211_hw *hw,
                                         struct ieee80211_vif *vif,
                                         size_t frame_len,
-                                        int rate);
+                                        struct ieee80211_rate *rate);
 
 /**
  * ieee80211_get_buffered_bc - accessing buffered broadcast and multicast frames
@@ -1574,4 +1501,81 @@ void ieee80211_iterate_active_interfaces(struct ieee80211_hw *hw,
                                                 struct ieee80211_vif *vif),
                                          void *data);
 
+/**
+ * ieee80211_start_tx_ba_session - Start a tx Block Ack session.
+ * @hw: pointer as obtained from ieee80211_alloc_hw().
+ * @ra: receiver address of the BA session recipient
+ * @tid: the TID to BA on.
+ * @return: success if addBA request was sent, failure otherwise
+ *
+ * Although mac80211/low level driver/user space application can estimate
+ * the need to start aggregation on a certain RA/TID, the session level
+ * will be managed by the mac80211.
+ */
+int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid);
+
+/**
+ * ieee80211_start_tx_ba_cb - low level driver ready to aggregate.
+ * @hw: pointer as obtained from ieee80211_alloc_hw().
+ * @ra: receiver address of the BA session recipient.
+ * @tid: the TID to BA on.
+ *
+ * This function must be called by low level driver once it has
+ * finished with preparations for the BA session.
+ */
+void ieee80211_start_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u16 tid);
+
+/**
+ * ieee80211_start_tx_ba_cb_irqsafe - low level driver ready to aggregate.
+ * @hw: pointer as obtained from ieee80211_alloc_hw().
+ * @ra: receiver address of the BA session recipient.
+ * @tid: the TID to BA on.
+ *
+ * This function must be called by low level driver once it has
+ * finished with preparations for the BA session.
+ * This version of the function is irq safe.
+ */
+void ieee80211_start_tx_ba_cb_irqsafe(struct ieee80211_hw *hw, const u8 *ra,
+                                      u16 tid);
+
+/**
+ * ieee80211_stop_tx_ba_session - Stop a Block Ack session.
+ * @hw: pointer as obtained from ieee80211_alloc_hw().
+ * @ra: receiver address of the BA session recipient
+ * @tid: the TID to stop BA.
+ * @initiator: if indicates initiator DELBA frame will be sent.
+ * @return: error if no sta with matching da found, success otherwise
+ *
+ * Although mac80211/low level driver/user space application can estimate
+ * the need to stop aggregation on a certain RA/TID, the session level
+ * will be managed by the mac80211.
+ */
+int ieee80211_stop_tx_ba_session(struct ieee80211_hw *hw,
+                                 u8 *ra, u16 tid,
+                                 enum ieee80211_back_parties initiator);
+
+/**
+ * ieee80211_stop_tx_ba_cb - low level driver ready to stop aggregate.
+ * @hw: pointer as obtained from ieee80211_alloc_hw().
+ * @ra: receiver address of the BA session recipient.
+ * @tid: the desired TID to BA on.
+ *
+ * This function must be called by low level driver once it has
+ * finished with preparations for the BA session tear down.
+ */
+void ieee80211_stop_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u8 tid);
+
+/**
+ * ieee80211_stop_tx_ba_cb_irqsafe - low level driver ready to stop aggregate.
+ * @hw: pointer as obtained from ieee80211_alloc_hw().
+ * @ra: receiver address of the BA session recipient.
+ * @tid: the desired TID to BA on.
+ *
+ * This function must be called by low level driver once it has
+ * finished with preparations for the BA session tear down.
+ * This version of the function is irq safe.
+ */
+void ieee80211_stop_tx_ba_cb_irqsafe(struct ieee80211_hw *hw, const u8 *ra,
+                                     u16 tid);
+
 #endif /* MAC80211_H */
diff --git a/include/net/wireless.h b/include/net/wireless.h
index d30c4ba8fd99..c7f805ee5545 100644
--- a/include/net/wireless.h
+++ b/include/net/wireless.h
@@ -13,6 +13,162 @@
 #include <net/cfg80211.h>
 
 /**
+ * enum ieee80211_band - supported frequency bands
+ *
+ * The bands are assigned this way because the supported
+ * bitrates differ in these bands.
+ *
+ * @IEEE80211_BAND_2GHZ: 2.4GHz ISM band
+ * @IEEE80211_BAND_5GHZ: around 5GHz band (4.9-5.7)
+ */
+enum ieee80211_band {
+        IEEE80211_BAND_2GHZ,
+        IEEE80211_BAND_5GHZ,
+
+        /* keep last */
+        IEEE80211_NUM_BANDS
+};
+
+/**
+ * enum ieee80211_channel_flags - channel flags
+ *
+ * Channel flags set by the regulatory control code.
+ *
+ * @IEEE80211_CHAN_DISABLED: This channel is disabled.
+ * @IEEE80211_CHAN_PASSIVE_SCAN: Only passive scanning is permitted
+ *      on this channel.
+ * @IEEE80211_CHAN_NO_IBSS: IBSS is not allowed on this channel.
+ * @IEEE80211_CHAN_RADAR: Radar detection is required on this channel.
+ */
+enum ieee80211_channel_flags {
+        IEEE80211_CHAN_DISABLED         = 1<<0,
+        IEEE80211_CHAN_PASSIVE_SCAN     = 1<<1,
+        IEEE80211_CHAN_NO_IBSS          = 1<<2,
+        IEEE80211_CHAN_RADAR            = 1<<3,
+};
+
+/**
+ * struct ieee80211_channel - channel definition
+ *
+ * This structure describes a single channel for use
+ * with cfg80211.
+ *
+ * @center_freq: center frequency in MHz
+ * @hw_value: hardware-specific value for the channel
+ * @flags: channel flags from &enum ieee80211_channel_flags.
+ * @orig_flags: channel flags at registration time, used by regulatory
+ *      code to support devices with additional restrictions
+ * @band: band this channel belongs to.
+ * @max_antenna_gain: maximum antenna gain in dBi
+ * @max_power: maximum transmission power (in dBm)
+ * @orig_mag: internal use
+ * @orig_mpwr: internal use
+ */
+struct ieee80211_channel {
+        enum ieee80211_band band;
+        u16 center_freq;
+        u16 hw_value;
+        u32 flags;
+        int max_antenna_gain;
+        int max_power;
+        u32 orig_flags;
+        int orig_mag, orig_mpwr;
+};
+
+/**
+ * enum ieee80211_rate_flags - rate flags
+ *
+ * Hardware/specification flags for rates. These are structured
+ * in a way that allows using the same bitrate structure for
+ * different bands/PHY modes.
+ *
+ * @IEEE80211_RATE_SHORT_PREAMBLE: Hardware can send with short
+ *      preamble on this bitrate; only relevant in 2.4GHz band and
+ *      with CCK rates.
+ * @IEEE80211_RATE_MANDATORY_A: This bitrate is a mandatory rate
+ *      when used with 802.11a (on the 5 GHz band); filled by the
+ *      core code when registering the wiphy.
+ * @IEEE80211_RATE_MANDATORY_B: This bitrate is a mandatory rate
+ *      when used with 802.11b (on the 2.4 GHz band); filled by the
+ *      core code when registering the wiphy.
+ * @IEEE80211_RATE_MANDATORY_G: This bitrate is a mandatory rate
+ *      when used with 802.11g (on the 2.4 GHz band); filled by the
+ *      core code when registering the wiphy.
+ * @IEEE80211_RATE_ERP_G: This is an ERP rate in 802.11g mode.
+ */
+enum ieee80211_rate_flags {
+        IEEE80211_RATE_SHORT_PREAMBLE   = 1<<0,
+        IEEE80211_RATE_MANDATORY_A      = 1<<1,
+        IEEE80211_RATE_MANDATORY_B      = 1<<2,
+        IEEE80211_RATE_MANDATORY_G      = 1<<3,
+        IEEE80211_RATE_ERP_G            = 1<<4,
+};
+
+/**
+ * struct ieee80211_rate - bitrate definition
+ *
+ * This structure describes a bitrate that an 802.11 PHY can
+ * operate with. The two values @hw_value and @hw_value_short
+ * are only for driver use when pointers to this structure are
+ * passed around.
+ *
+ * @flags: rate-specific flags
+ * @bitrate: bitrate in units of 100 Kbps
+ * @hw_value: driver/hardware value for this rate
+ * @hw_value_short: driver/hardware value for this rate when
+ *      short preamble is used
+ */
+struct ieee80211_rate {
+        u32 flags;
+        u16 bitrate;
+        u16 hw_value, hw_value_short;
+};
+
+/**
+ * struct ieee80211_ht_info - describing STA's HT capabilities
+ *
+ * This structure describes most essential parameters needed
+ * to describe 802.11n HT capabilities for an STA.
+ *
+ * @ht_supported: is HT supported by STA, 0: no, 1: yes
+ * @cap: HT capabilities map as described in 802.11n spec
+ * @ampdu_factor: Maximum A-MPDU length factor
+ * @ampdu_density: Minimum A-MPDU spacing
+ * @supp_mcs_set: Supported MCS set as described in 802.11n spec
+ */
+struct ieee80211_ht_info {
+        u16 cap; /* use IEEE80211_HT_CAP_ */
+        u8 ht_supported;
+        u8 ampdu_factor;
+        u8 ampdu_density;
+        u8 supp_mcs_set[16];
+};
+
+/**
+ * struct ieee80211_supported_band - frequency band definition
+ *
+ * This structure describes a frequency band a wiphy
+ * is able to operate in.
+ *
+ * @channels: Array of channels the hardware can operate in
+ *      in this band.
+ * @band: the band this structure represents
+ * @n_channels: Number of channels in @channels
+ * @bitrates: Array of bitrates the hardware can operate with
+ *      in this band. Must be sorted to give a valid "supported
+ *      rates" IE, i.e. CCK rates first, then OFDM.
+ * @n_bitrates: Number of bitrates in @bitrates
+ */
+struct ieee80211_supported_band {
+        struct ieee80211_channel *channels;
+        struct ieee80211_rate *bitrates;
+        enum ieee80211_band band;
+        int n_channels;
+        int n_bitrates;
+        struct ieee80211_ht_info ht_info;
+};
+
+/**
  * struct wiphy - wireless hardware description
  * @idx: the wiphy index assigned to this item
  * @class_dev: the class device representing /sys/class/ieee80211/<wiphy-name>
@@ -30,6 +186,8 @@ struct wiphy {
          * help determine whether you own this wiphy or not. */
         void *privid;
 
+        struct ieee80211_supported_band *bands[IEEE80211_NUM_BANDS];
+
         /* fields below are read-only, assigned by cfg80211 */
 
         /* the item in /sys/class/ieee80211/ points to this,
@@ -136,4 +294,14 @@ extern void wiphy_unregister(struct wiphy *wiphy);
  */
 extern void wiphy_free(struct wiphy *wiphy);
 
+/**
+ * ieee80211_channel_to_frequency - convert channel number to frequency
+ */
+extern int ieee80211_channel_to_frequency(int chan);
+
+/**
+ * ieee80211_frequency_to_channel - convert frequency to channel number
+ */
+extern int ieee80211_frequency_to_channel(int freq);
+
 #endif /* __NET_WIRELESS_H */
diff --git a/net/mac80211/Makefile b/net/mac80211/Makefile
index 54f46bc80cfe..9d7a19581a29 100644
--- a/net/mac80211/Makefile
+++ b/net/mac80211/Makefile
@@ -19,7 +19,6 @@ mac80211-y := \
         ieee80211_iface.o \
         ieee80211_rate.o \
         michael.o \
-        regdomain.o \
         tkip.o \
         aes_ccm.o \
         cfg.o \
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 22c9619ba776..e7535ffc8e1c 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -34,10 +34,13 @@ nl80211_type_to_mac80211_type(enum nl80211_iftype type)
 }
 
 static int ieee80211_add_iface(struct wiphy *wiphy, char *name,
-                               enum nl80211_iftype type)
+                               enum nl80211_iftype type, u32 *flags)
 {
         struct ieee80211_local *local = wiphy_priv(wiphy);
         enum ieee80211_if_types itype;
+        struct net_device *dev;
+        struct ieee80211_sub_if_data *sdata;
+        int err;
 
         if (unlikely(local->reg_state != IEEE80211_DEV_REGISTERED))
                 return -ENODEV;
@@ -46,7 +49,13 @@ static int ieee80211_add_iface(struct wiphy *wiphy, char *name,
         if (itype == IEEE80211_IF_TYPE_INVALID)
                 return -EINVAL;
 
-        return ieee80211_if_add(local->mdev, name, NULL, itype);
+        err = ieee80211_if_add(local->mdev, name, &dev, itype);
+        if (err || itype != IEEE80211_IF_TYPE_MNTR || !flags)
+                return err;
+
+        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        sdata->u.mntr_flags = *flags;
+        return 0;
 }
 
 static int ieee80211_del_iface(struct wiphy *wiphy, int ifindex)
@@ -69,7 +78,7 @@ static int ieee80211_del_iface(struct wiphy *wiphy, int ifindex)
 }
 
 static int ieee80211_change_iface(struct wiphy *wiphy, int ifindex,
-                                  enum nl80211_iftype type)
+                                  enum nl80211_iftype type, u32 *flags)
 {
         struct ieee80211_local *local = wiphy_priv(wiphy);
         struct net_device *dev;
@@ -99,6 +108,10 @@ static int ieee80211_change_iface(struct wiphy *wiphy, int ifindex,
         ieee80211_if_reinit(dev);
         ieee80211_if_set_type(dev, itype);
 
+        if (sdata->vif.type != IEEE80211_IF_TYPE_MNTR || !flags)
+                return 0;
+
+        sdata->u.mntr_flags = *flags;
         return 0;
 }
 
@@ -110,6 +123,7 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev,
         struct sta_info *sta = NULL;
         enum ieee80211_key_alg alg;
         int ret;
+        struct ieee80211_key *key;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
@@ -128,16 +142,21 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev,
                 return -EINVAL;
         }
 
+        key = ieee80211_key_alloc(alg, key_idx, params->key_len, params->key);
+        if (!key)
+                return -ENOMEM;
+
         if (mac_addr) {
                 sta = sta_info_get(sdata->local, mac_addr);
-                if (!sta)
+                if (!sta) {
+                        ieee80211_key_free(key);
                         return -ENOENT;
+                }
         }
 
+        ieee80211_key_link(key, sdata, sta);
+
         ret = 0;
-        if (!ieee80211_key_alloc(sdata, sta, alg, key_idx,
-                                 params->key_len, params->key))
-                ret = -ENOMEM;
 
         if (sta)
                 sta_info_put(sta);
@@ -151,6 +170,7 @@ static int ieee80211_del_key(struct wiphy *wiphy, struct net_device *dev,
         struct ieee80211_sub_if_data *sdata;
         struct sta_info *sta;
         int ret;
+        struct ieee80211_key *key;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
@@ -160,9 +180,11 @@ static int ieee80211_del_key(struct wiphy *wiphy, struct net_device *dev,
                         return -ENOENT;
 
                 ret = 0;
-                if (sta->key)
-                        ieee80211_key_free(sta->key);
-                else
+                if (sta->key) {
+                        key = sta->key;
+                        ieee80211_key_free(key);
+                        WARN_ON(sta->key);
+                } else
                         ret = -ENOENT;
 
                 sta_info_put(sta);
@@ -172,7 +194,9 @@ static int ieee80211_del_key(struct wiphy *wiphy, struct net_device *dev,
         if (!sdata->keys[key_idx])
                 return -ENOENT;
 
-        ieee80211_key_free(sdata->keys[key_idx]);
+        key = sdata->keys[key_idx];
+        ieee80211_key_free(key);
+        WARN_ON(sdata->keys[key_idx]);
 
         return 0;
 }
@@ -498,7 +522,7 @@ static void sta_apply_parameters(struct ieee80211_local *local,
 {
         u32 rates;
         int i, j;
-        struct ieee80211_hw_mode *mode;
+        struct ieee80211_supported_band *sband;
 
         if (params->station_flags & STATION_FLAG_CHANGED) {
                 sta->flags &= ~WLAN_STA_AUTHORIZED;
@@ -525,15 +549,16 @@ static void sta_apply_parameters(struct ieee80211_local *local,
 
         if (params->supported_rates) {
                 rates = 0;
-                mode = local->oper_hw_mode;
+                sband = local->hw.wiphy->bands[local->oper_channel->band];
+
                 for (i = 0; i < params->supported_rates_len; i++) {
                         int rate = (params->supported_rates[i] & 0x7f) * 5;
-                        for (j = 0; j < mode->num_rates; j++) {
-                                if (mode->rates[j].rate == rate)
+                        for (j = 0; j < sband->n_bitrates; j++) {
+                                if (sband->bitrates[j].bitrate == rate)
                                         rates |= BIT(j);
                         }
                 }
-                sta->supp_rates = rates;
+                sta->supp_rates[local->oper_channel->band] = rates;
         }
 }
 
@@ -548,13 +573,6 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
         if (!netif_running(dev))
                 return -ENETDOWN;
 
-        /* XXX: get sta belonging to dev */
-        sta = sta_info_get(local, mac);
-        if (sta) {
-                sta_info_put(sta);
-                return -EEXIST;
-        }
-
         if (params->vlan) {
                 sdata = IEEE80211_DEV_TO_SUB_IF(params->vlan);
 
@@ -565,8 +583,8 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
                 sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
         sta = sta_info_add(local, dev, mac, GFP_KERNEL);
-        if (!sta)
-                return -ENOMEM;
+        if (IS_ERR(sta))
+                return PTR_ERR(sta);
 
         sta->dev = sdata->dev;
         if (sdata->vif.type == IEEE80211_IF_TYPE_VLAN ||
diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c
index 60514b2c97b9..4736c64937b4 100644
--- a/net/mac80211/debugfs.c
+++ b/net/mac80211/debugfs.c
@@ -19,41 +19,6 @@ int mac80211_open_file_generic(struct inode *inode, struct file *file)
         return 0;
 }
 
-static const char *ieee80211_mode_str(int mode)
-{
-        switch (mode) {
-        case MODE_IEEE80211A:
-                return "IEEE 802.11a";
-        case MODE_IEEE80211B:
-                return "IEEE 802.11b";
-        case MODE_IEEE80211G:
-                return "IEEE 802.11g";
-        default:
-                return "UNKNOWN";
-        }
-}
-
-static ssize_t modes_read(struct file *file, char __user *userbuf,
-                          size_t count, loff_t *ppos)
-{
-        struct ieee80211_local *local = file->private_data;
-        struct ieee80211_hw_mode *mode;
-        char buf[150], *p = buf;
-
-        /* FIXME: locking! */
-        list_for_each_entry(mode, &local->modes_list, list) {
-                p += scnprintf(p, sizeof(buf)+buf-p,
-                               "%s\n", ieee80211_mode_str(mode->mode));
-        }
-
-        return simple_read_from_buffer(userbuf, count, ppos, buf, p-buf);
-}
-
-static const struct file_operations modes_ops = {
-        .read = modes_read,
-        .open = mac80211_open_file_generic,
-};
-
 #define DEBUGFS_READONLY_FILE(name, buflen, fmt, value...)              \
 static ssize_t name## _read(struct file *file, char __user *userbuf,    \
                             size_t count, loff_t *ppos)                 \
@@ -80,10 +45,8 @@ static const struct file_operations name## _ops = {			\
         local->debugfs.name = NULL;
 
 
-DEBUGFS_READONLY_FILE(channel, 20, "%d",
-                      local->hw.conf.channel);
 DEBUGFS_READONLY_FILE(frequency, 20, "%d",
-                      local->hw.conf.freq);
+                      local->hw.conf.channel->center_freq);
 DEBUGFS_READONLY_FILE(antenna_sel_tx, 20, "%d",
                       local->hw.conf.antenna_sel_tx);
 DEBUGFS_READONLY_FILE(antenna_sel_rx, 20, "%d",
@@ -100,8 +63,6 @@ DEBUGFS_READONLY_FILE(long_retry_limit, 20, "%d",
                       local->long_retry_limit);
 DEBUGFS_READONLY_FILE(total_ps_buffered, 20, "%d",
                       local->total_ps_buffered);
-DEBUGFS_READONLY_FILE(mode, 20, "%s",
-                      ieee80211_mode_str(local->hw.conf.phymode));
 DEBUGFS_READONLY_FILE(wep_iv, 20, "%#06x",
                       local->wep_iv & 0xffffff);
 DEBUGFS_READONLY_FILE(rate_ctrl_alg, 100, "%s",
@@ -294,7 +255,6 @@ void debugfs_hw_add(struct ieee80211_local *local)
         local->debugfs.stations = debugfs_create_dir("stations", phyd);
         local->debugfs.keys = debugfs_create_dir("keys", phyd);
 
-        DEBUGFS_ADD(channel);
         DEBUGFS_ADD(frequency);
         DEBUGFS_ADD(antenna_sel_tx);
         DEBUGFS_ADD(antenna_sel_rx);
@@ -304,9 +264,7 @@ void debugfs_hw_add(struct ieee80211_local *local)
         DEBUGFS_ADD(short_retry_limit);
         DEBUGFS_ADD(long_retry_limit);
         DEBUGFS_ADD(total_ps_buffered);
-        DEBUGFS_ADD(mode);
         DEBUGFS_ADD(wep_iv);
-        DEBUGFS_ADD(modes);
 
         statsd = debugfs_create_dir("statistics", phyd);
         local->debugfs.statistics = statsd;
@@ -356,7 +314,6 @@ void debugfs_hw_add(struct ieee80211_local *local)
 
 void debugfs_hw_del(struct ieee80211_local *local)
 {
-        DEBUGFS_DEL(channel);
         DEBUGFS_DEL(frequency);
         DEBUGFS_DEL(antenna_sel_tx);
         DEBUGFS_DEL(antenna_sel_rx);
@@ -366,9 +323,7 @@ void debugfs_hw_del(struct ieee80211_local *local)
         DEBUGFS_DEL(short_retry_limit);
         DEBUGFS_DEL(long_retry_limit);
         DEBUGFS_DEL(total_ps_buffered);
-        DEBUGFS_DEL(mode);
         DEBUGFS_DEL(wep_iv);
-        DEBUGFS_DEL(modes);
 
         DEBUGFS_STATS_DEL(transmitted_fragment_count);
         DEBUGFS_STATS_DEL(multicast_transmitted_frame_count);
diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index 829872a3ae81..29f7b98ba1fb 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -91,7 +91,6 @@ static const struct file_operations name##_ops = {			\
 /* common attributes */
 IEEE80211_IF_FILE(channel_use, channel_use, DEC);
 IEEE80211_IF_FILE(drop_unencrypted, drop_unencrypted, DEC);
-IEEE80211_IF_FILE(ieee802_1x_pac, ieee802_1x_pac, DEC);
 
 /* STA/IBSS attributes */
 IEEE80211_IF_FILE(state, u.sta.state, DEC);
@@ -148,7 +147,6 @@ static void add_sta_files(struct ieee80211_sub_if_data *sdata)
 {
         DEBUGFS_ADD(channel_use, sta);
         DEBUGFS_ADD(drop_unencrypted, sta);
-        DEBUGFS_ADD(ieee802_1x_pac, sta);
         DEBUGFS_ADD(state, sta);
         DEBUGFS_ADD(bssid, sta);
         DEBUGFS_ADD(prev_bssid, sta);
@@ -169,7 +167,6 @@ static void add_ap_files(struct ieee80211_sub_if_data *sdata)
 {
         DEBUGFS_ADD(channel_use, ap);
         DEBUGFS_ADD(drop_unencrypted, ap);
-        DEBUGFS_ADD(ieee802_1x_pac, ap);
         DEBUGFS_ADD(num_sta_ps, ap);
         DEBUGFS_ADD(dtim_count, ap);
         DEBUGFS_ADD(num_beacons, ap);
@@ -182,7 +179,6 @@ static void add_wds_files(struct ieee80211_sub_if_data *sdata)
 {
         DEBUGFS_ADD(channel_use, wds);
         DEBUGFS_ADD(drop_unencrypted, wds);
-        DEBUGFS_ADD(ieee802_1x_pac, wds);
         DEBUGFS_ADD(peer, wds);
 }
 
@@ -190,7 +186,6 @@ static void add_vlan_files(struct ieee80211_sub_if_data *sdata)
 {
         DEBUGFS_ADD(channel_use, vlan);
         DEBUGFS_ADD(drop_unencrypted, vlan);
-        DEBUGFS_ADD(ieee802_1x_pac, vlan);
 }
 
 static void add_monitor_files(struct ieee80211_sub_if_data *sdata)
@@ -234,7 +229,6 @@ static void del_sta_files(struct ieee80211_sub_if_data *sdata)
 {
         DEBUGFS_DEL(channel_use, sta);
         DEBUGFS_DEL(drop_unencrypted, sta);
-        DEBUGFS_DEL(ieee802_1x_pac, sta);
         DEBUGFS_DEL(state, sta);
         DEBUGFS_DEL(bssid, sta);
         DEBUGFS_DEL(prev_bssid, sta);
@@ -255,7 +249,6 @@ static void del_ap_files(struct ieee80211_sub_if_data *sdata)
 {
         DEBUGFS_DEL(channel_use, ap);
         DEBUGFS_DEL(drop_unencrypted, ap);
-        DEBUGFS_DEL(ieee802_1x_pac, ap);
         DEBUGFS_DEL(num_sta_ps, ap);
         DEBUGFS_DEL(dtim_count, ap);
         DEBUGFS_DEL(num_beacons, ap);
@@ -268,7 +261,6 @@ static void del_wds_files(struct ieee80211_sub_if_data *sdata)
 {
         DEBUGFS_DEL(channel_use, wds);
         DEBUGFS_DEL(drop_unencrypted, wds);
-        DEBUGFS_DEL(ieee802_1x_pac, wds);
         DEBUGFS_DEL(peer, wds);
 }
 
@@ -276,7 +268,6 @@ static void del_vlan_files(struct ieee80211_sub_if_data *sdata)
 {
         DEBUGFS_DEL(channel_use, vlan);
         DEBUGFS_DEL(drop_unencrypted, vlan);
-        DEBUGFS_DEL(ieee802_1x_pac, vlan);
 }
 
 static void del_monitor_files(struct ieee80211_sub_if_data *sdata)
diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
index 8f5944c53d4e..ed7c9f3b4602 100644
--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -33,25 +33,16 @@ static ssize_t sta_ ##name## _read(struct file *file,			\
 #define STA_READ_LU(name, field) STA_READ(name, 20, field, "%lu\n")
 #define STA_READ_S(name, field) STA_READ(name, 20, field, "%s\n")
 
-#define STA_READ_RATE(name, field)                                      \
-static ssize_t sta_##name##_read(struct file *file,                     \
-                                 char __user *userbuf,                  \
-                                 size_t count, loff_t *ppos)            \
-{                                                                       \
-        struct sta_info *sta = file->private_data;                      \
-        struct ieee80211_local *local = wdev_priv(sta->dev->ieee80211_ptr);\
-        struct ieee80211_hw_mode *mode = local->oper_hw_mode;           \
-        char buf[20];                                                   \
-        int res = scnprintf(buf, sizeof(buf), "%d\n",                   \
-                            (sta->field >= 0 &&                         \
-                            sta->field < mode->num_rates) ?             \
-                            mode->rates[sta->field].rate : -1);         \
-        return simple_read_from_buffer(userbuf, count, ppos, buf, res); \
+#define STA_OPS(name)                                                   \
+static const struct file_operations sta_ ##name## _ops = {              \
+        .read = sta_##name##_read,                                      \
+        .open = mac80211_open_file_generic,                             \
 }
 
-#define STA_OPS(name)                                                   \
+#define STA_OPS_WR(name)                                                \
 static const struct file_operations sta_ ##name## _ops = {              \
         .read = sta_##name##_read,                                      \
+        .write = sta_##name##_write,                                    \
         .open = mac80211_open_file_generic,                             \
 }
 
@@ -70,8 +61,6 @@ STA_FILE(rx_fragments, rx_fragments, LU);
 STA_FILE(rx_dropped, rx_dropped, LU);
 STA_FILE(tx_fragments, tx_fragments, LU);
 STA_FILE(tx_filtered, tx_filtered_count, LU);
-STA_FILE(txrate, txrate, RATE);
-STA_FILE(last_txrate, last_txrate, RATE);
 STA_FILE(tx_retry_failed, tx_retry_failed, LU);
 STA_FILE(tx_retry_count, tx_retry_count, LU);
 STA_FILE(last_rssi, last_rssi, D);
@@ -85,12 +74,10 @@ static ssize_t sta_flags_read(struct file *file, char __user *userbuf,
 {
         char buf[100];
         struct sta_info *sta = file->private_data;
-        int res = scnprintf(buf, sizeof(buf), "%s%s%s%s%s%s%s%s%s",
+        int res = scnprintf(buf, sizeof(buf), "%s%s%s%s%s%s%s",
                 sta->flags & WLAN_STA_AUTH ? "AUTH\n" : "",
                 sta->flags & WLAN_STA_ASSOC ? "ASSOC\n" : "",
                 sta->flags & WLAN_STA_PS ? "PS\n" : "",
-                sta->flags & WLAN_STA_TIM ? "TIM\n" : "",
-                sta->flags & WLAN_STA_PERM ? "PERM\n" : "",
                 sta->flags & WLAN_STA_AUTHORIZED ? "AUTHORIZED\n" : "",
                 sta->flags & WLAN_STA_SHORT_PREAMBLE ? "SHORT PREAMBLE\n" : "",
                 sta->flags & WLAN_STA_WME ? "WME\n" : "",
@@ -111,31 +98,6 @@ static ssize_t sta_num_ps_buf_frames_read(struct file *file,
 }
 STA_OPS(num_ps_buf_frames);
 
-static ssize_t sta_last_ack_rssi_read(struct file *file, char __user *userbuf,
-                                      size_t count, loff_t *ppos)
-{
-        char buf[100];
-        struct sta_info *sta = file->private_data;
-        int res = scnprintf(buf, sizeof(buf), "%d %d %d\n",
-                            sta->last_ack_rssi[0],
-                            sta->last_ack_rssi[1],
-                            sta->last_ack_rssi[2]);
-        return simple_read_from_buffer(userbuf, count, ppos, buf, res);
-}
-STA_OPS(last_ack_rssi);
-
-static ssize_t sta_last_ack_ms_read(struct file *file, char __user *userbuf,
-                                    size_t count, loff_t *ppos)
-{
-        char buf[20];
-        struct sta_info *sta = file->private_data;
-        int res = scnprintf(buf, sizeof(buf), "%d\n",
-                            sta->last_ack ?
-                            jiffies_to_msecs(jiffies - sta->last_ack) : -1);
-        return simple_read_from_buffer(userbuf, count, ppos, buf, res);
-}
-STA_OPS(last_ack_ms);
-
 static ssize_t sta_inactive_ms_read(struct file *file, char __user *userbuf,
                                     size_t count, loff_t *ppos)
 {
@@ -191,6 +153,113 @@ static ssize_t sta_wme_tx_queue_read(struct file *file, char __user *userbuf,
 STA_OPS(wme_tx_queue);
 #endif
 
+static ssize_t sta_agg_status_read(struct file *file, char __user *userbuf,
+                                        size_t count, loff_t *ppos)
+{
+        char buf[768], *p = buf;
+        int i;
+        struct sta_info *sta = file->private_data;
+        p += scnprintf(p, sizeof(buf)+buf-p, "Agg state for STA is:\n");
+        p += scnprintf(p, sizeof(buf)+buf-p, " STA next dialog_token is %d \n "
+                        "TIDs info is: \n TID :",
+                        (sta->ampdu_mlme.dialog_token_allocator + 1));
+        for (i = 0; i < STA_TID_NUM; i++)
+                p += scnprintf(p, sizeof(buf)+buf-p, "%5d", i);
+
+        p += scnprintf(p, sizeof(buf)+buf-p, "\n RX  :");
+        for (i = 0; i < STA_TID_NUM; i++)
+                p += scnprintf(p, sizeof(buf)+buf-p, "%5d",
+        sta->ampdu_mlme.tid_rx[i].state);
+
+        p += scnprintf(p, sizeof(buf)+buf-p, "\n DTKN:");
+        for (i = 0; i < STA_TID_NUM; i++)
+                p += scnprintf(p, sizeof(buf)+buf-p, "%5d",
+                        sta->ampdu_mlme.tid_rx[i].dialog_token);
+
+        p += scnprintf(p, sizeof(buf)+buf-p, "\n TX  :");
+        for (i = 0; i < STA_TID_NUM; i++)
+                p += scnprintf(p, sizeof(buf)+buf-p, "%5d",
+                        sta->ampdu_mlme.tid_tx[i].state);
+
+        p += scnprintf(p, sizeof(buf)+buf-p, "\n DTKN:");
+        for (i = 0; i < STA_TID_NUM; i++)
+                p += scnprintf(p, sizeof(buf)+buf-p, "%5d",
+                        sta->ampdu_mlme.tid_tx[i].dialog_token);
+
+        p += scnprintf(p, sizeof(buf)+buf-p, "\n SSN :");
+        for (i = 0; i < STA_TID_NUM; i++)
+                p += scnprintf(p, sizeof(buf)+buf-p, "%5d",
+                        sta->ampdu_mlme.tid_tx[i].ssn);
+
+        p += scnprintf(p, sizeof(buf)+buf-p, "\n");
+
+        return simple_read_from_buffer(userbuf, count, ppos, buf, p - buf);
+}
+
+static ssize_t sta_agg_status_write(struct file *file,
+                const char __user *user_buf, size_t count, loff_t *ppos)
+{
+        struct sta_info *sta = file->private_data;
+        struct net_device *dev = sta->dev;
+        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_hw *hw = &local->hw;
+        u8 *da = sta->addr;
+        static int tid_static_tx[16] = {0, 0, 0, 0, 0, 0, 0, 0,
+                                        0, 0, 0, 0, 0, 0, 0, 0};
+        static int tid_static_rx[16] = {1, 1, 1, 1, 1, 1, 1, 1,
+                                        1, 1, 1, 1, 1, 1, 1, 1};
+        char *endp;
+        char buf[32];
+        int buf_size, rs;
+        unsigned int tid_num;
+        char state[4];
+
+        memset(buf, 0x00, sizeof(buf));
+        buf_size = min(count, (sizeof(buf)-1));
+        if (copy_from_user(buf, user_buf, buf_size))
+                return -EFAULT;
+
+        tid_num = simple_strtoul(buf, &endp, 0);
+        if (endp == buf)
+                return -EINVAL;
+
+        if ((tid_num >= 100) && (tid_num <= 115)) {
+                /* toggle Rx aggregation command */
+                tid_num = tid_num - 100;
+                if (tid_static_rx[tid_num] == 1) {
+                        strcpy(state, "off ");
+                        ieee80211_sta_stop_rx_ba_session(dev, da, tid_num, 0,
+                                        WLAN_REASON_QSTA_REQUIRE_SETUP);
+                        sta->ampdu_mlme.tid_rx[tid_num].buf_size = 0xFF;
+                        tid_static_rx[tid_num] = 0;
+                } else {
+                        strcpy(state, "on ");
+                        sta->ampdu_mlme.tid_rx[tid_num].buf_size = 0x00;
+                        tid_static_rx[tid_num] = 1;
+                }
+                printk(KERN_DEBUG "debugfs - try switching tid %u %s\n",
+                                tid_num, state);
+        } else if ((tid_num >= 0) && (tid_num <= 15)) {
+                /* toggle Tx aggregation command */
+                if (tid_static_tx[tid_num] == 0) {
+                        strcpy(state, "on ");
+                        rs =  ieee80211_start_tx_ba_session(hw, da, tid_num);
+                        if (rs == 0)
+                                tid_static_tx[tid_num] = 1;
+                } else {
+                        strcpy(state, "off");
+                        rs =  ieee80211_stop_tx_ba_session(hw, da, tid_num, 1);
+                        if (rs == 0)
+                                tid_static_tx[tid_num] = 0;
+                }
+                printk(KERN_DEBUG "debugfs - switching tid %u %s, return=%d\n",
+                                tid_num, state, rs);
+        }
+
+        return count;
+}
+STA_OPS_WR(agg_status);
+
 #define DEBUGFS_ADD(name) \
         sta->debugfs.name = debugfs_create_file(#name, 0444, \
                 sta->debugfs.dir, sta, &sta_ ##name## _ops);
@@ -203,12 +272,13 @@ STA_OPS(wme_tx_queue);
 void ieee80211_sta_debugfs_add(struct sta_info *sta)
 {
         struct dentry *stations_dir = sta->local->debugfs.stations;
-        DECLARE_MAC_BUF(mac);
+        DECLARE_MAC_BUF(mbuf);
+        u8 *mac;
 
         if (!stations_dir)
                 return;
 
-        print_mac(mac, sta->addr);
+        mac = print_mac(mbuf, sta->addr);
 
         sta->debugfs.dir = debugfs_create_dir(mac, stations_dir);
         if (!sta->debugfs.dir)
@@ -216,28 +286,26 @@ void ieee80211_sta_debugfs_add(struct sta_info *sta)
 
         DEBUGFS_ADD(flags);
         DEBUGFS_ADD(num_ps_buf_frames);
-        DEBUGFS_ADD(last_ack_rssi);
-        DEBUGFS_ADD(last_ack_ms);
         DEBUGFS_ADD(inactive_ms);
         DEBUGFS_ADD(last_seq_ctrl);
 #ifdef CONFIG_MAC80211_DEBUG_COUNTERS
         DEBUGFS_ADD(wme_rx_queue);
         DEBUGFS_ADD(wme_tx_queue);
 #endif
+        DEBUGFS_ADD(agg_status);
 }
 
 void ieee80211_sta_debugfs_remove(struct sta_info *sta)
 {
         DEBUGFS_DEL(flags);
         DEBUGFS_DEL(num_ps_buf_frames);
-        DEBUGFS_DEL(last_ack_rssi);
-        DEBUGFS_DEL(last_ack_ms);
         DEBUGFS_DEL(inactive_ms);
         DEBUGFS_DEL(last_seq_ctrl);
 #ifdef CONFIG_MAC80211_DEBUG_COUNTERS
         DEBUGFS_DEL(wme_rx_queue);
         DEBUGFS_DEL(wme_tx_queue);
 #endif
+        DEBUGFS_DEL(agg_status);
 
         debugfs_remove(sta->debugfs.dir);
         sta->debugfs.dir = NULL;
diff --git a/net/mac80211/ieee80211.c b/net/mac80211/ieee80211.c
index 28bcdf9fc3df..2133c9fd27a4 100644
--- a/net/mac80211/ieee80211.c
+++ b/net/mac80211/ieee80211.c
@@ -67,9 +67,19 @@ static void ieee80211_configure_filter(struct ieee80211_local *local)
                 new_flags |= FIF_ALLMULTI;
 
         if (local->monitors)
-                new_flags |= FIF_CONTROL |
-                             FIF_OTHER_BSS |
-                             FIF_BCN_PRBRESP_PROMISC;
+                new_flags |= FIF_BCN_PRBRESP_PROMISC;
+
+        if (local->fif_fcsfail)
+                new_flags |= FIF_FCSFAIL;
+
+        if (local->fif_plcpfail)
+                new_flags |= FIF_PLCPFAIL;
+
+        if (local->fif_control)
+                new_flags |= FIF_CONTROL;
+
+        if (local->fif_other_bss)
+                new_flags |= FIF_OTHER_BSS;
 
         changed_flags = local->filter_flags ^ new_flags;
 
@@ -173,8 +183,52 @@ static int ieee80211_open(struct net_device *dev)
         list_for_each_entry(nsdata, &local->interfaces, list) {
                 struct net_device *ndev = nsdata->dev;
 
-                if (ndev != dev && ndev != local->mdev && netif_running(ndev) &&
-                    compare_ether_addr(dev->dev_addr, ndev->dev_addr) == 0) {
+                if (ndev != dev && ndev != local->mdev && netif_running(ndev)) {
+                        /*
+                         * Allow only a single IBSS interface to be up at any
+                         * time. This is restricted because beacon distribution
+                         * cannot work properly if both are in the same IBSS.
+                         *
+                         * To remove this restriction we'd have to disallow them
+                         * from setting the same SSID on different IBSS interfaces
+                         * belonging to the same hardware. Then, however, we're
+                         * faced with having to adopt two different TSF timers...
+                         */
+                        if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS &&
+                            nsdata->vif.type == IEEE80211_IF_TYPE_IBSS)
+                                return -EBUSY;
+
+                        /*
+                         * Disallow multiple IBSS/STA mode interfaces.
+                         *
+                         * This is a technical restriction, it is possible although
+                         * most likely not IEEE 802.11 compliant to have multiple
+                         * STAs with just a single hardware (the TSF timer will not
+                         * be adjusted properly.)
+                         *
+                         * However, because mac80211 uses the master device's BSS
+                         * information for each STA/IBSS interface, doing this will
+                         * currently corrupt that BSS information completely, unless,
+                         * a not very useful case, both STAs are associated to the
+                         * same BSS.
+                         *
+                         * To remove this restriction, the BSS information needs to
+                         * be embedded in the STA/IBSS mode sdata instead of using
+                         * the master device's BSS structure.
+                         */
+                        if ((sdata->vif.type == IEEE80211_IF_TYPE_STA ||
+                             sdata->vif.type == IEEE80211_IF_TYPE_IBSS) &&
+                            (nsdata->vif.type == IEEE80211_IF_TYPE_STA ||
+                             nsdata->vif.type == IEEE80211_IF_TYPE_IBSS))
+                                return -EBUSY;
+
+                        /*
+                         * The remaining checks are only performed for interfaces
+                         * with the same MAC address.
+                         */
+                        if (compare_ether_addr(dev->dev_addr, ndev->dev_addr))
+                                continue;
+
                         /*
                          * check whether it may have the same address
                          */
@@ -186,8 +240,7 @@ static int ieee80211_open(struct net_device *dev)
                          * can only add VLANs to enabled APs
                          */
                         if (sdata->vif.type == IEEE80211_IF_TYPE_VLAN &&
-                            nsdata->vif.type == IEEE80211_IF_TYPE_AP &&
-                            netif_running(nsdata->dev))
+                            nsdata->vif.type == IEEE80211_IF_TYPE_AP)
                                 sdata->u.vlan.ap = nsdata;
                 }
         }
@@ -229,15 +282,28 @@ static int ieee80211_open(struct net_device *dev)
                 /* no need to tell driver */
                 break;
         case IEEE80211_IF_TYPE_MNTR:
+                if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES) {
+                        local->cooked_mntrs++;
+                        break;
+                }
+
                 /* must be before the call to ieee80211_configure_filter */
                 local->monitors++;
-                if (local->monitors == 1) {
-                        netif_tx_lock_bh(local->mdev);
-                        ieee80211_configure_filter(local);
-                        netif_tx_unlock_bh(local->mdev);
-
+                if (local->monitors == 1)
                         local->hw.conf.flags |= IEEE80211_CONF_RADIOTAP;
-                }
+
+                if (sdata->u.mntr_flags & MONITOR_FLAG_FCSFAIL)
+                        local->fif_fcsfail++;
+                if (sdata->u.mntr_flags & MONITOR_FLAG_PLCPFAIL)
+                        local->fif_plcpfail++;
+                if (sdata->u.mntr_flags & MONITOR_FLAG_CONTROL)
+                        local->fif_control++;
+                if (sdata->u.mntr_flags & MONITOR_FLAG_OTHER_BSS)
+                        local->fif_other_bss++;
+
+                netif_tx_lock_bh(local->mdev);
+                ieee80211_configure_filter(local);
+                netif_tx_unlock_bh(local->mdev);
                 break;
         case IEEE80211_IF_TYPE_STA:
         case IEEE80211_IF_TYPE_IBSS:
@@ -352,14 +418,27 @@ static int ieee80211_stop(struct net_device *dev)
                 /* no need to tell driver */
                 break;
         case IEEE80211_IF_TYPE_MNTR:
-                local->monitors--;
-                if (local->monitors == 0) {
-                        netif_tx_lock_bh(local->mdev);
-                        ieee80211_configure_filter(local);
-                        netif_tx_unlock_bh(local->mdev);
+                if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES) {
+                        local->cooked_mntrs--;
+                        break;
+                }
 
+                local->monitors--;
+                if (local->monitors == 0)
                         local->hw.conf.flags &= ~IEEE80211_CONF_RADIOTAP;
-                }
+
+                if (sdata->u.mntr_flags & MONITOR_FLAG_FCSFAIL)
+                        local->fif_fcsfail--;
+                if (sdata->u.mntr_flags & MONITOR_FLAG_PLCPFAIL)
+                        local->fif_plcpfail--;
+                if (sdata->u.mntr_flags & MONITOR_FLAG_CONTROL)
+                        local->fif_control--;
+                if (sdata->u.mntr_flags & MONITOR_FLAG_OTHER_BSS)
+                        local->fif_other_bss--;
+
+                netif_tx_lock_bh(local->mdev);
+                ieee80211_configure_filter(local);
+                netif_tx_unlock_bh(local->mdev);
                 break;
         case IEEE80211_IF_TYPE_STA:
         case IEEE80211_IF_TYPE_IBSS:
@@ -414,6 +493,329 @@ static int ieee80211_stop(struct net_device *dev)
         return 0;
 }
 
+int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+        struct sta_info *sta;
+        struct ieee80211_sub_if_data *sdata;
+        u16 start_seq_num = 0;
+        u8 *state;
+        int ret;
+        DECLARE_MAC_BUF(mac);
+
+        if (tid >= STA_TID_NUM)
+                return -EINVAL;
+
+#ifdef CONFIG_MAC80211_HT_DEBUG
+        printk(KERN_DEBUG "Open BA session requested for %s tid %u\n",
+                                print_mac(mac, ra), tid);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+
+        sta = sta_info_get(local, ra);
+        if (!sta) {
+                printk(KERN_DEBUG "Could not find the station\n");
+                return -ENOENT;
+        }
+
+        spin_lock_bh(&sta->ampdu_mlme.ampdu_tx);
+
+        /* we have tried too many times, receiver does not want A-MPDU */
+        if (sta->ampdu_mlme.tid_tx[tid].addba_req_num > HT_AGG_MAX_RETRIES) {
+                ret = -EBUSY;
+                goto start_ba_exit;
+        }
+
+        state = &sta->ampdu_mlme.tid_tx[tid].state;
+        /* check if the TID is not in aggregation flow already */
+        if (*state != HT_AGG_STATE_IDLE) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "BA request denied - session is not "
+                                 "idle on tid %u\n", tid);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+                ret = -EAGAIN;
+                goto start_ba_exit;
+        }
+
+        /* ensure that TX flow won't interrupt us
+         * until the end of the call to requeue function */
+        spin_lock_bh(&local->mdev->queue_lock);
+
+        /* create a new queue for this aggregation */
+        ret = ieee80211_ht_agg_queue_add(local, sta, tid);
+
+        /* case no queue is available to aggregation
+         * don't switch to aggregation */
+        if (ret) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "BA request denied - no queue available for"
+                                        " tid %d\n", tid);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+                spin_unlock_bh(&local->mdev->queue_lock);
+                goto start_ba_exit;
+        }
+        sdata = IEEE80211_DEV_TO_SUB_IF(sta->dev);
+
+        /* Ok, the Addba frame hasn't been sent yet, but if the driver calls the
+         * call back right away, it must see that the flow has begun */
+        *state |= HT_ADDBA_REQUESTED_MSK;
+
+        if (local->ops->ampdu_action)
+                ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_TX_START,
+                                                ra, tid, &start_seq_num);
+
+        if (ret) {
+                /* No need to requeue the packets in the agg queue, since we
+                 * held the tx lock: no packet could be enqueued to the newly
+                 * allocated queue */
+                 ieee80211_ht_agg_queue_remove(local, sta, tid, 0);
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "BA request denied - HW or queue unavailable"
+                                " for tid %d\n", tid);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+                spin_unlock_bh(&local->mdev->queue_lock);
+                *state = HT_AGG_STATE_IDLE;
+                goto start_ba_exit;
+        }
+
+        /* Will put all the packets in the new SW queue */
+        ieee80211_requeue(local, ieee802_1d_to_ac[tid]);
+        spin_unlock_bh(&local->mdev->queue_lock);
+
+        /* We have most probably almost emptied the legacy queue */
+        /* ieee80211_wake_queue(local_to_hw(local), ieee802_1d_to_ac[tid]); */
+
+        /* send an addBA request */
+        sta->ampdu_mlme.dialog_token_allocator++;
+        sta->ampdu_mlme.tid_tx[tid].dialog_token =
+                        sta->ampdu_mlme.dialog_token_allocator;
+        sta->ampdu_mlme.tid_tx[tid].ssn = start_seq_num;
+
+        ieee80211_send_addba_request(sta->dev, ra, tid,
+                         sta->ampdu_mlme.tid_tx[tid].dialog_token,
+                         sta->ampdu_mlme.tid_tx[tid].ssn,
+                         0x40, 5000);
+
+        /* activate the timer for the recipient's addBA response */
+        sta->ampdu_mlme.tid_tx[tid].addba_resp_timer.expires =
+                                jiffies + ADDBA_RESP_INTERVAL;
+        add_timer(&sta->ampdu_mlme.tid_tx[tid].addba_resp_timer);
+        printk(KERN_DEBUG "activated addBA response timer on tid %d\n", tid);
+
+start_ba_exit:
+        spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
+        sta_info_put(sta);
+        return ret;
+}
+EXPORT_SYMBOL(ieee80211_start_tx_ba_session);
+
+int ieee80211_stop_tx_ba_session(struct ieee80211_hw *hw,
+                                 u8 *ra, u16 tid,
+                                 enum ieee80211_back_parties initiator)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+        struct sta_info *sta;
+        u8 *state;
+        int ret = 0;
+        DECLARE_MAC_BUF(mac);
+
+        if (tid >= STA_TID_NUM)
+                return -EINVAL;
+
+#ifdef CONFIG_MAC80211_HT_DEBUG
+        printk(KERN_DEBUG "Stop a BA session requested for %s tid %u\n",
+                                print_mac(mac, ra), tid);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+
+        sta = sta_info_get(local, ra);
+        if (!sta)
+                return -ENOENT;
+
+        /* check if the TID is in aggregation */
+        state = &sta->ampdu_mlme.tid_tx[tid].state;
+        spin_lock_bh(&sta->ampdu_mlme.ampdu_tx);
+
+        if (*state != HT_AGG_STATE_OPERATIONAL) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "Try to stop Tx aggregation on"
+                                " non active TID\n");
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+                ret = -ENOENT;
+                goto stop_BA_exit;
+        }
+
+        ieee80211_stop_queue(hw, sta->tid_to_tx_q[tid]);
+
+        *state = HT_AGG_STATE_REQ_STOP_BA_MSK |
+                (initiator << HT_AGG_STATE_INITIATOR_SHIFT);
+
+        if (local->ops->ampdu_action)
+                ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_TX_STOP,
+                                                ra, tid, NULL);
+
+        /* case HW denied going back to legacy */
+        if (ret) {
+                WARN_ON(ret != -EBUSY);
+                *state = HT_AGG_STATE_OPERATIONAL;
+                ieee80211_wake_queue(hw, sta->tid_to_tx_q[tid]);
+                goto stop_BA_exit;
+        }
+
+stop_BA_exit:
+        spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
+        sta_info_put(sta);
+        return ret;
+}
+EXPORT_SYMBOL(ieee80211_stop_tx_ba_session);
+
+void ieee80211_start_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u16 tid)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+        struct sta_info *sta;
+        u8 *state;
+        DECLARE_MAC_BUF(mac);
+
+        if (tid >= STA_TID_NUM) {
+                printk(KERN_DEBUG "Bad TID value: tid = %d (>= %d)\n",
+                                tid, STA_TID_NUM);
+                return;
+        }
+
+        sta = sta_info_get(local, ra);
+        if (!sta) {
+                printk(KERN_DEBUG "Could not find station: %s\n",
+                                print_mac(mac, ra));
+                return;
+        }
+
+        state = &sta->ampdu_mlme.tid_tx[tid].state;
+        spin_lock_bh(&sta->ampdu_mlme.ampdu_tx);
+
+        if (!(*state & HT_ADDBA_REQUESTED_MSK)) {
+                printk(KERN_DEBUG "addBA was not requested yet, state is %d\n",
+                                *state);
+                spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
+                sta_info_put(sta);
+                return;
+        }
+
+        WARN_ON_ONCE(*state & HT_ADDBA_DRV_READY_MSK);
+
+        *state |= HT_ADDBA_DRV_READY_MSK;
+
+        if (*state == HT_AGG_STATE_OPERATIONAL) {
+                printk(KERN_DEBUG "Aggregation is on for tid %d \n", tid);
+                ieee80211_wake_queue(hw, sta->tid_to_tx_q[tid]);
+        }
+        spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
+        sta_info_put(sta);
+}
+EXPORT_SYMBOL(ieee80211_start_tx_ba_cb);
+
+void ieee80211_stop_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u8 tid)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+        struct sta_info *sta;
+        u8 *state;
+        int agg_queue;
+        DECLARE_MAC_BUF(mac);
+
+        if (tid >= STA_TID_NUM) {
+                printk(KERN_DEBUG "Bad TID value: tid = %d (>= %d)\n",
+                                tid, STA_TID_NUM);
+                return;
+        }
+
+        printk(KERN_DEBUG "Stop a BA session requested on DA %s tid %d\n",
+                                print_mac(mac, ra), tid);
+
+        sta = sta_info_get(local, ra);
+        if (!sta) {
+                printk(KERN_DEBUG "Could not find station: %s\n",
+                                print_mac(mac, ra));
+                return;
+        }
+        state = &sta->ampdu_mlme.tid_tx[tid].state;
+
+        spin_lock_bh(&sta->ampdu_mlme.ampdu_tx);
+        if ((*state & HT_AGG_STATE_REQ_STOP_BA_MSK) == 0) {
+                printk(KERN_DEBUG "unexpected callback to A-MPDU stop\n");
+                sta_info_put(sta);
+                spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
+                return;
+        }
+
+        if (*state & HT_AGG_STATE_INITIATOR_MSK)
+                ieee80211_send_delba(sta->dev, ra, tid,
+                        WLAN_BACK_INITIATOR, WLAN_REASON_QSTA_NOT_USE);
+
+        agg_queue = sta->tid_to_tx_q[tid];
+
+        /* avoid ordering issues: we are the only one that can modify
+         * the content of the qdiscs */
+        spin_lock_bh(&local->mdev->queue_lock);
+        /* remove the queue for this aggregation */
+        ieee80211_ht_agg_queue_remove(local, sta, tid, 1);
+        spin_unlock_bh(&local->mdev->queue_lock);
+
+        /* we just requeued the all the frames that were in the removed
+         * queue, and since we might miss a softirq we do netif_schedule.
+         * ieee80211_wake_queue is not used here as this queue is not
+         * necessarily stopped */
+        netif_schedule(local->mdev);
+        *state = HT_AGG_STATE_IDLE;
+        sta->ampdu_mlme.tid_tx[tid].addba_req_num = 0;
+        spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
+
+        sta_info_put(sta);
+}
+EXPORT_SYMBOL(ieee80211_stop_tx_ba_cb);
+
+void ieee80211_start_tx_ba_cb_irqsafe(struct ieee80211_hw *hw,
+                                      const u8 *ra, u16 tid)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+        struct ieee80211_ra_tid *ra_tid;
+        struct sk_buff *skb = dev_alloc_skb(0);
+
+        if (unlikely(!skb)) {
+                if (net_ratelimit())
+                        printk(KERN_WARNING "%s: Not enough memory, "
+                               "dropping start BA session", skb->dev->name);
+                return;
+        }
+        ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
+        memcpy(&ra_tid->ra, ra, ETH_ALEN);
+        ra_tid->tid = tid;
+
+        skb->pkt_type = IEEE80211_ADDBA_MSG;
+        skb_queue_tail(&local->skb_queue, skb);
+        tasklet_schedule(&local->tasklet);
+}
+EXPORT_SYMBOL(ieee80211_start_tx_ba_cb_irqsafe);
+
+void ieee80211_stop_tx_ba_cb_irqsafe(struct ieee80211_hw *hw,
+                                     const u8 *ra, u16 tid)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+        struct ieee80211_ra_tid *ra_tid;
+        struct sk_buff *skb = dev_alloc_skb(0);
+
+        if (unlikely(!skb)) {
+                if (net_ratelimit())
+                        printk(KERN_WARNING "%s: Not enough memory, "
+                               "dropping stop BA session", skb->dev->name);
+                return;
+        }
+        ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
+        memcpy(&ra_tid->ra, ra, ETH_ALEN);
+        ra_tid->tid = tid;
+
+        skb->pkt_type = IEEE80211_DELBA_MSG;
+        skb_queue_tail(&local->skb_queue, skb);
+        tasklet_schedule(&local->tasklet);
+}
+EXPORT_SYMBOL(ieee80211_stop_tx_ba_cb_irqsafe);
+
 static void ieee80211_set_multicast_list(struct net_device *dev)
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
@@ -479,8 +881,11 @@ int ieee80211_if_update_wds(struct net_device *dev, u8 *remote_addr)
 
         /* Create STA entry for the new peer */
         sta = sta_info_add(local, dev, remote_addr, GFP_KERNEL);
-        if (!sta)
-                return -ENOMEM;
+        if (IS_ERR(sta))
+                return PTR_ERR(sta);
+
+        sta->flags |= WLAN_STA_AUTHORIZED;
+
         sta_info_put(sta);
 
         /* Remove STA entry for the old peer */
@@ -553,37 +958,28 @@ int ieee80211_if_config_beacon(struct net_device *dev)
 
 int ieee80211_hw_config(struct ieee80211_local *local)
 {
-        struct ieee80211_hw_mode *mode;
         struct ieee80211_channel *chan;
         int ret = 0;
 
-        if (local->sta_sw_scanning) {
+        if (local->sta_sw_scanning)
                 chan = local->scan_channel;
-                mode = local->scan_hw_mode;
-        } else {
+        else
                 chan = local->oper_channel;
-                mode = local->oper_hw_mode;
-        }
 
-        local->hw.conf.channel = chan->chan;
-        local->hw.conf.channel_val = chan->val;
-        if (!local->hw.conf.power_level) {
-                local->hw.conf.power_level = chan->power_level;
-        } else {
-                local->hw.conf.power_level = min(chan->power_level,
-                                                 local->hw.conf.power_level);
-        }
-        local->hw.conf.freq = chan->freq;
-        local->hw.conf.phymode = mode->mode;
-        local->hw.conf.antenna_max = chan->antenna_max;
-        local->hw.conf.chan = chan;
-        local->hw.conf.mode = mode;
+        local->hw.conf.channel = chan;
+
+        if (!local->hw.conf.power_level)
+                local->hw.conf.power_level = chan->max_power;
+        else
+                local->hw.conf.power_level = min(chan->max_power,
+                                               local->hw.conf.power_level);
+
+        local->hw.conf.max_antenna_gain = chan->max_antenna_gain;
 
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-        printk(KERN_DEBUG "HW CONFIG: channel=%d freq=%d "
-               "phymode=%d\n", local->hw.conf.channel, local->hw.conf.freq,
-               local->hw.conf.phymode);
-#endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
+        printk(KERN_DEBUG "%s: HW CONFIG: freq=%d\n",
+               wiphy_name(local->hw.wiphy), chan->center_freq);
+#endif
 
         if (local->open_count)
                 ret = local->ops->config(local_to_hw(local), &local->hw.conf);
@@ -601,11 +997,13 @@ int ieee80211_hw_config_ht(struct ieee80211_local *local, int enable_ht,
                            struct ieee80211_ht_bss_info *req_bss_cap)
 {
         struct ieee80211_conf *conf = &local->hw.conf;
-        struct ieee80211_hw_mode *mode = conf->mode;
+        struct ieee80211_supported_band *sband;
         int i;
 
+        sband = local->hw.wiphy->bands[conf->channel->band];
+
         /* HT is not supported */
-        if (!mode->ht_info.ht_supported) {
+        if (!sband->ht_info.ht_supported) {
                 conf->flags &= ~IEEE80211_CONF_SUPPORT_HT_MODE;
                 return -EOPNOTSUPP;
         }
@@ -615,17 +1013,17 @@ int ieee80211_hw_config_ht(struct ieee80211_local *local, int enable_ht,
                 conf->flags &= ~IEEE80211_CONF_SUPPORT_HT_MODE;
         } else {
                 conf->flags |= IEEE80211_CONF_SUPPORT_HT_MODE;
-                conf->ht_conf.cap = req_ht_cap->cap & mode->ht_info.cap;
+                conf->ht_conf.cap = req_ht_cap->cap & sband->ht_info.cap;
                 conf->ht_conf.cap &= ~(IEEE80211_HT_CAP_MIMO_PS);
                 conf->ht_conf.cap |=
-                        mode->ht_info.cap & IEEE80211_HT_CAP_MIMO_PS;
+                        sband->ht_info.cap & IEEE80211_HT_CAP_MIMO_PS;
                 conf->ht_bss_conf.primary_channel =
                         req_bss_cap->primary_channel;
                 conf->ht_bss_conf.bss_cap = req_bss_cap->bss_cap;
                 conf->ht_bss_conf.bss_op_mode = req_bss_cap->bss_op_mode;
                 for (i = 0; i < SUPP_MCS_SET_LEN; i++)
                         conf->ht_conf.supp_mcs_set[i] =
-                                mode->ht_info.supp_mcs_set[i] &
+                                sband->ht_info.supp_mcs_set[i] &
                                   req_ht_cap->supp_mcs_set[i];
 
                 /* In STA mode, this gives us indication
@@ -713,6 +1111,7 @@ static void ieee80211_tasklet_handler(unsigned long data)
         struct sk_buff *skb;
         struct ieee80211_rx_status rx_status;
         struct ieee80211_tx_status *tx_status;
+        struct ieee80211_ra_tid *ra_tid;
 
         while ((skb = skb_dequeue(&local->skb_queue)) ||
                (skb = skb_dequeue(&local->skb_queue_unreliable))) {
@@ -733,6 +1132,18 @@ static void ieee80211_tasklet_handler(unsigned long data)
                                             skb, tx_status);
                         kfree(tx_status);
                         break;
+                case IEEE80211_DELBA_MSG:
+                        ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
+                        ieee80211_stop_tx_ba_cb(local_to_hw(local),
+                                                ra_tid->ra, ra_tid->tid);
+                        dev_kfree_skb(skb);
+                        break;
+                case IEEE80211_ADDBA_MSG:
+                        ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
+                        ieee80211_start_tx_ba_cb(local_to_hw(local),
+                                                 ra_tid->ra, ra_tid->tid);
+                        dev_kfree_skb(skb);
+                        break ;
                 default: /* should never get here! */
                         printk(KERN_ERR "%s: Unknown message type (%d)\n",
                                wiphy_name(local->hw.wiphy), skb->pkt_type);
@@ -810,6 +1221,77 @@ no_key:
         }
 }
 
+static void ieee80211_handle_filtered_frame(struct ieee80211_local *local,
+                                            struct sta_info *sta,
+                                            struct sk_buff *skb,
+                                            struct ieee80211_tx_status *status)
+{
+        sta->tx_filtered_count++;
+
+        /*
+         * Clear the TX filter mask for this STA when sending the next
+         * packet. If the STA went to power save mode, this will happen
+         * happen when it wakes up for the next time.
+         */
+        sta->flags |= WLAN_STA_CLEAR_PS_FILT;
+
+        /*
+         * This code races in the following way:
+         *
+         *  (1) STA sends frame indicating it will go to sleep and does so
+         *  (2) hardware/firmware adds STA to filter list, passes frame up
+         *  (3) hardware/firmware processes TX fifo and suppresses a frame
+         *  (4) we get TX status before having processed the frame and
+         *      knowing that the STA has gone to sleep.
+         *
+         * This is actually quite unlikely even when both those events are
+         * processed from interrupts coming in quickly after one another or
+         * even at the same time because we queue both TX status events and
+         * RX frames to be processed by a tasklet and process them in the
+         * same order that they were received or TX status last. Hence, there
+         * is no race as long as the frame RX is processed before the next TX
+         * status, which drivers can ensure, see below.
+         *
+         * Note that this can only happen if the hardware or firmware can
+         * actually add STAs to the filter list, if this is done by the
+         * driver in response to set_tim() (which will only reduce the race
+         * this whole filtering tries to solve, not completely solve it)
+         * this situation cannot happen.
+         *
+         * To completely solve this race drivers need to make sure that they
+         *  (a) don't mix the irq-safe/not irq-safe TX status/RX processing
+         *      functions and
+         *  (b) always process RX events before TX status events if ordering
+         *      can be unknown, for example with different interrupt status
+         *      bits.
+         */
+        if (sta->flags & WLAN_STA_PS &&
+            skb_queue_len(&sta->tx_filtered) < STA_MAX_TX_BUFFER) {
+                ieee80211_remove_tx_extra(local, sta->key, skb,
+                                          &status->control);
+                skb_queue_tail(&sta->tx_filtered, skb);
+                return;
+        }
+
+        if (!(sta->flags & WLAN_STA_PS) &&
+            !(status->control.flags & IEEE80211_TXCTL_REQUEUE)) {
+                /* Software retry the packet once */
+                status->control.flags |= IEEE80211_TXCTL_REQUEUE;
+                ieee80211_remove_tx_extra(local, sta->key, skb,
+                                          &status->control);
+                dev_queue_xmit(skb);
+                return;
+        }
+
+        if (net_ratelimit())
+                printk(KERN_DEBUG "%s: dropped TX filtered frame, "
+                       "queue_len=%d PS=%d @%lu\n",
+                       wiphy_name(local->hw.wiphy),
+                       skb_queue_len(&sta->tx_filtered),
+                       !!(sta->flags & WLAN_STA_PS), jiffies);
+        dev_kfree_skb(skb);
+}
+
 void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb,
                          struct ieee80211_tx_status *status)
 {
@@ -819,7 +1301,7 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb,
         u16 frag, type;
         struct ieee80211_tx_status_rtap_hdr *rthdr;
         struct ieee80211_sub_if_data *sdata;
-        int monitors;
+        struct net_device *prev_dev = NULL;
 
         if (!status) {
                 printk(KERN_ERR
@@ -834,11 +1316,16 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb,
                 sta = sta_info_get(local, hdr->addr1);
                 if (sta) {
                         if (sta->flags & WLAN_STA_PS) {
-                                /* The STA is in power save mode, so assume
+                                /*
+                                 * The STA is in power save mode, so assume
                                  * that this TX packet failed because of that.
                                  */
                                 status->excessive_retries = 0;
                                 status->flags |= IEEE80211_TX_STATUS_TX_FILTERED;
+                                ieee80211_handle_filtered_frame(local, sta,
+                                                                skb, status);
+                                sta_info_put(sta);
+                                return;
                         }
                         sta_info_put(sta);
                 }
@@ -848,47 +1335,8 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb,
                 struct sta_info *sta;
                 sta = sta_info_get(local, hdr->addr1);
                 if (sta) {
-                        sta->tx_filtered_count++;
-
-                        /* Clear the TX filter mask for this STA when sending
-                         * the next packet. If the STA went to power save mode,
-                         * this will happen when it is waking up for the next
-                         * time. */
-                        sta->clear_dst_mask = 1;
-
-                        /* TODO: Is the WLAN_STA_PS flag always set here or is
-                         * the race between RX and TX status causing some
-                         * packets to be filtered out before 80211.o gets an
-                         * update for PS status? This seems to be the case, so
-                         * no changes are likely to be needed. */
-                        if (sta->flags & WLAN_STA_PS &&
-                            skb_queue_len(&sta->tx_filtered) <
-                            STA_MAX_TX_BUFFER) {
-                                ieee80211_remove_tx_extra(local, sta->key,
-                                                          skb,
-                                                          &status->control);
-                                skb_queue_tail(&sta->tx_filtered, skb);
-                        } else if (!(sta->flags & WLAN_STA_PS) &&
-                                   !(status->control.flags & IEEE80211_TXCTL_REQUEUE)) {
-                                /* Software retry the packet once */
-                                status->control.flags |= IEEE80211_TXCTL_REQUEUE;
-                                ieee80211_remove_tx_extra(local, sta->key,
-                                                          skb,
-                                                          &status->control);
-                                dev_queue_xmit(skb);
-                        } else {
-                                if (net_ratelimit()) {
-                                        printk(KERN_DEBUG "%s: dropped TX "
-                                               "filtered frame queue_len=%d "
-                                               "PS=%d @%lu\n",
-                                               wiphy_name(local->hw.wiphy),
-                                               skb_queue_len(
-                                                       &sta->tx_filtered),
-                                               !!(sta->flags & WLAN_STA_PS),
-                                               jiffies);
-                                }
-                                dev_kfree_skb(skb);
-                        }
+                        ieee80211_handle_filtered_frame(local, sta, skb,
+                                                        status);
                         sta_info_put(sta);
                         return;
                 }
@@ -932,7 +1380,11 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb,
         /* this was a transmitted frame, but now we want to reuse it */
         skb_orphan(skb);
 
-        if (!local->monitors) {
+        /*
+         * This is a bit racy but we can avoid a lot of work
+         * with this test...
+         */
+        if (!local->monitors && !local->cooked_mntrs) {
                 dev_kfree_skb(skb);
                 return;
         }
@@ -966,51 +1418,44 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb,
 
         rthdr->data_retries = status->retry_count;
 
+        /* XXX: is this sufficient for BPF? */
+        skb_set_mac_header(skb, 0);
+        skb->ip_summed = CHECKSUM_UNNECESSARY;
+        skb->pkt_type = PACKET_OTHERHOST;
+        skb->protocol = htons(ETH_P_802_2);
+        memset(skb->cb, 0, sizeof(skb->cb));
+
         rcu_read_lock();
-        monitors = local->monitors;
         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
-                /*
-                 * Using the monitors counter is possibly racy, but
-                 * if the value is wrong we simply either clone the skb
-                 * once too much or forget sending it to one monitor iface
-                 * The latter case isn't nice but fixing the race is much
-                 * more complicated.
-                 */
-                if (!monitors || !skb)
-                        goto out;
-
                 if (sdata->vif.type == IEEE80211_IF_TYPE_MNTR) {
                         if (!netif_running(sdata->dev))
                                 continue;
-                        monitors--;
-                        if (monitors)
+
+                        if (prev_dev) {
                                 skb2 = skb_clone(skb, GFP_ATOMIC);
-                        else
-                                skb2 = NULL;
-                        skb->dev = sdata->dev;
-                        /* XXX: is this sufficient for BPF? */
-                        skb_set_mac_header(skb, 0);
-                        skb->ip_summed = CHECKSUM_UNNECESSARY;
-                        skb->pkt_type = PACKET_OTHERHOST;
-                        skb->protocol = htons(ETH_P_802_2);
-                        memset(skb->cb, 0, sizeof(skb->cb));
-                        netif_rx(skb);
-                        skb = skb2;
+                                if (skb2) {
+                                        skb2->dev = prev_dev;
+                                        netif_rx(skb2);
+                                }
+                        }
+
+                        prev_dev = sdata->dev;
                 }
         }
- out:
+        if (prev_dev) {
+                skb->dev = prev_dev;
+                netif_rx(skb);
+                skb = NULL;
+        }
         rcu_read_unlock();
-        if (skb)
-                dev_kfree_skb(skb);
+        dev_kfree_skb(skb);
 }
 EXPORT_SYMBOL(ieee80211_tx_status);
 
 struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
                                         const struct ieee80211_ops *ops)
 {
-        struct net_device *mdev;
         struct ieee80211_local *local;
-        struct ieee80211_sub_if_data *sdata;
         int priv_size;
         struct wiphy *wiphy;
 
@@ -1056,25 +1501,8 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
         BUG_ON(!ops->configure_filter);
         local->ops = ops;
 
-        /* for now, mdev needs sub_if_data :/ */
-        mdev = alloc_netdev(sizeof(struct ieee80211_sub_if_data),
-                            "wmaster%d", ether_setup);
-        if (!mdev) {
-                wiphy_free(wiphy);
-                return NULL;
-        }
-
-        sdata = IEEE80211_DEV_TO_SUB_IF(mdev);
-        mdev->ieee80211_ptr = &sdata->wdev;
-        sdata->wdev.wiphy = wiphy;
-
         local->hw.queues = 1; /* default */
 
-        local->mdev = mdev;
-        local->rx_pre_handlers = ieee80211_rx_pre_handlers;
-        local->rx_handlers = ieee80211_rx_handlers;
-        local->tx_handlers = ieee80211_tx_handlers;
-
         local->bridge_packets = 1;
 
         local->rts_threshold = IEEE80211_MAX_RTS_THRESHOLD;
@@ -1083,33 +1511,12 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
         local->long_retry_limit = 4;
         local->hw.conf.radio_enabled = 1;
 
-        local->enabled_modes = ~0;
-
-        INIT_LIST_HEAD(&local->modes_list);
-
         INIT_LIST_HEAD(&local->interfaces);
 
         INIT_DELAYED_WORK(&local->scan_work, ieee80211_sta_scan_work);
-        ieee80211_rx_bss_list_init(mdev);
 
         sta_info_init(local);
 
-        mdev->hard_start_xmit = ieee80211_master_start_xmit;
-        mdev->open = ieee80211_master_open;
-        mdev->stop = ieee80211_master_stop;
-        mdev->type = ARPHRD_IEEE80211;
-        mdev->header_ops = &ieee80211_header_ops;
-        mdev->set_multicast_list = ieee80211_master_set_multicast_list;
-
-        sdata->vif.type = IEEE80211_IF_TYPE_AP;
-        sdata->dev = mdev;
-        sdata->local = local;
-        sdata->u.ap.force_unicast_rateidx = -1;
-        sdata->u.ap.max_ratectrl_rateidx = -1;
-        ieee80211_if_sdata_init(sdata);
-        /* no RCU needed since we're still during init phase */
-        list_add_tail(&sdata->list, &local->interfaces);
-
         tasklet_init(&local->tx_pending_tasklet, ieee80211_tx_pending,
                      (unsigned long)local);
         tasklet_disable(&local->tx_pending_tasklet);
@@ -1131,11 +1538,63 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         struct ieee80211_local *local = hw_to_local(hw);
         const char *name;
         int result;
+        enum ieee80211_band band;
+        struct net_device *mdev;
+        struct ieee80211_sub_if_data *sdata;
+
+        /*
+         * generic code guarantees at least one band,
+         * set this very early because much code assumes
+         * that hw.conf.channel is assigned
+         */
+        for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
+                struct ieee80211_supported_band *sband;
+
+                sband = local->hw.wiphy->bands[band];
+                if (sband) {
+                        /* init channel we're on */
+                        local->hw.conf.channel =
+                        local->oper_channel =
+                        local->scan_channel = &sband->channels[0];
+                        break;
+                }
+        }
 
         result = wiphy_register(local->hw.wiphy);
         if (result < 0)
                 return result;
 
+        /* for now, mdev needs sub_if_data :/ */
+        mdev = alloc_netdev(sizeof(struct ieee80211_sub_if_data),
+                            "wmaster%d", ether_setup);
+        if (!mdev)
+                goto fail_mdev_alloc;
+
+        sdata = IEEE80211_DEV_TO_SUB_IF(mdev);
+        mdev->ieee80211_ptr = &sdata->wdev;
+        sdata->wdev.wiphy = local->hw.wiphy;
+
+        local->mdev = mdev;
+
+        ieee80211_rx_bss_list_init(mdev);
+
+        mdev->hard_start_xmit = ieee80211_master_start_xmit;
+        mdev->open = ieee80211_master_open;
+        mdev->stop = ieee80211_master_stop;
+        mdev->type = ARPHRD_IEEE80211;
+        mdev->header_ops = &ieee80211_header_ops;
+        mdev->set_multicast_list = ieee80211_master_set_multicast_list;
+
+        sdata->vif.type = IEEE80211_IF_TYPE_AP;
+        sdata->dev = mdev;
+        sdata->local = local;
+        sdata->u.ap.force_unicast_rateidx = -1;
+        sdata->u.ap.max_ratectrl_rateidx = -1;
+        ieee80211_if_sdata_init(sdata);
+
+        /* no RCU needed since we're still during init phase */
+        list_add_tail(&sdata->list, &local->interfaces);
+
         name = wiphy_dev(local->hw.wiphy)->driver->name;
         local->hw.workqueue = create_singlethread_workqueue(name);
         if (!local->hw.workqueue) {
@@ -1227,49 +1686,18 @@ fail_sta_info:
         debugfs_hw_del(local);
         destroy_workqueue(local->hw.workqueue);
 fail_workqueue:
+        ieee80211_if_free(local->mdev);
+        local->mdev = NULL;
+fail_mdev_alloc:
         wiphy_unregister(local->hw.wiphy);
         return result;
 }
 EXPORT_SYMBOL(ieee80211_register_hw);
 
-int ieee80211_register_hwmode(struct ieee80211_hw *hw,
-                              struct ieee80211_hw_mode *mode)
-{
-        struct ieee80211_local *local = hw_to_local(hw);
-        struct ieee80211_rate *rate;
-        int i;
-
-        INIT_LIST_HEAD(&mode->list);
-        list_add_tail(&mode->list, &local->modes_list);
-
-        local->hw_modes |= (1 << mode->mode);
-        for (i = 0; i < mode->num_rates; i++) {
-                rate = &(mode->rates[i]);
-                rate->rate_inv = CHAN_UTIL_RATE_LCM / rate->rate;
-        }
-        ieee80211_prepare_rates(local, mode);
-
-        if (!local->oper_hw_mode) {
-                /* Default to this mode */
-                local->hw.conf.phymode = mode->mode;
-                local->oper_hw_mode = local->scan_hw_mode = mode;
-                local->oper_channel = local->scan_channel = &mode->channels[0];
-                local->hw.conf.mode = local->oper_hw_mode;
-                local->hw.conf.chan = local->oper_channel;
-        }
-
-        if (!(hw->flags & IEEE80211_HW_DEFAULT_REG_DOMAIN_CONFIGURED))
-                ieee80211_set_default_regdomain(mode);
-
-        return 0;
-}
-EXPORT_SYMBOL(ieee80211_register_hwmode);
-
 void ieee80211_unregister_hw(struct ieee80211_hw *hw)
 {
         struct ieee80211_local *local = hw_to_local(hw);
         struct ieee80211_sub_if_data *sdata, *tmp;
-        int i;
 
         tasklet_kill(&local->tx_pending_tasklet);
         tasklet_kill(&local->tasklet);
@@ -1310,11 +1738,6 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
         rate_control_deinitialize(local);
         debugfs_hw_del(local);
 
-        for (i = 0; i < NUM_IEEE80211_MODES; i++) {
-                kfree(local->supp_rates[i]);
-                kfree(local->basic_rates[i]);
-        }
-
         if (skb_queue_len(&local->skb_queue)
                         || skb_queue_len(&local->skb_queue_unreliable))
                 printk(KERN_WARNING "%s: skb_queue not empty\n",
@@ -1326,6 +1749,8 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
         wiphy_unregister(local->hw.wiphy);
         ieee80211_wep_free(local);
         ieee80211_led_exit(local);
+        ieee80211_if_free(local->mdev);
+        local->mdev = NULL;
 }
 EXPORT_SYMBOL(ieee80211_unregister_hw);
 
@@ -1333,7 +1758,6 @@ void ieee80211_free_hw(struct ieee80211_hw *hw)
 {
         struct ieee80211_local *local = hw_to_local(hw);
 
-        ieee80211_if_free(local->mdev);
         wiphy_free(local->hw.wiphy);
 }
 EXPORT_SYMBOL(ieee80211_free_hw);
@@ -1361,7 +1785,6 @@ static int __init ieee80211_init(void)
         }
 
         ieee80211_debugfs_netdev_init();
-        ieee80211_regdomain_init();
 
         return 0;
 
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 72ecbf7bf962..b07b3cbfd039 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -79,8 +79,7 @@ struct ieee80211_sta_bss {
         u8 ssid[IEEE80211_MAX_SSID_LEN];
         size_t ssid_len;
         u16 capability; /* host byte order */
-        int hw_mode;
-        int channel;
+        enum ieee80211_band band;
         int freq;
         int rssi, signal, noise;
         u8 *wpa_ie;
@@ -109,9 +108,17 @@ struct ieee80211_sta_bss {
 };
 
 
-typedef enum {
-        TXRX_CONTINUE, TXRX_DROP, TXRX_QUEUED
-} ieee80211_txrx_result;
+typedef unsigned __bitwise__ ieee80211_tx_result;
+#define TX_CONTINUE     ((__force ieee80211_tx_result) 0u)
+#define TX_DROP         ((__force ieee80211_tx_result) 1u)
+#define TX_QUEUED       ((__force ieee80211_tx_result) 2u)
+
+typedef unsigned __bitwise__ ieee80211_rx_result;
+#define RX_CONTINUE             ((__force ieee80211_rx_result) 0u)
+#define RX_DROP_UNUSABLE        ((__force ieee80211_rx_result) 1u)
+#define RX_DROP_MONITOR         ((__force ieee80211_rx_result) 2u)
+#define RX_QUEUED               ((__force ieee80211_rx_result) 3u)
+
 
 /* flags used in struct ieee80211_txrx_data.flags */
 /* whether the MSDU was fragmented */
@@ -124,6 +131,7 @@ typedef enum {
 #define IEEE80211_TXRXD_RXRA_MATCH              BIT(5)
 #define IEEE80211_TXRXD_TX_INJECTED             BIT(6)
 #define IEEE80211_TXRXD_RX_AMSDU                BIT(7)
+#define IEEE80211_TXRXD_RX_CMNTR_REPORTED       BIT(8)
 struct ieee80211_txrx_data {
         struct sk_buff *skb;
         struct net_device *dev;
@@ -136,13 +144,12 @@ struct ieee80211_txrx_data {
         union {
                 struct {
                         struct ieee80211_tx_control *control;
-                        struct ieee80211_hw_mode *mode;
+                        struct ieee80211_channel *channel;
                         struct ieee80211_rate *rate;
                         /* use this rate (if set) for last fragment; rate can
                          * be set to lower rate for the first fragments, e.g.,
                          * when using CTS protection with IEEE 802.11g. */
                         struct ieee80211_rate *last_frag_rate;
-                        int last_frag_hwrate;
 
                         /* Extra fragments (in addition to the first fragment
                          * in skb) */
@@ -151,6 +158,7 @@ struct ieee80211_txrx_data {
                 } tx;
                 struct {
                         struct ieee80211_rx_status *status;
+                        struct ieee80211_rate *rate;
                         int sent_ps_buffered;
                         int queue;
                         int load;
@@ -165,6 +173,7 @@ struct ieee80211_txrx_data {
 #define IEEE80211_TXPD_DO_NOT_ENCRYPT   BIT(1)
 #define IEEE80211_TXPD_REQUEUE          BIT(2)
 #define IEEE80211_TXPD_EAPOL_FRAME      BIT(3)
+#define IEEE80211_TXPD_AMPDU            BIT(4)
 /* Stored in sk_buff->cb */
 struct ieee80211_tx_packet_data {
         int ifindex;
@@ -178,18 +187,10 @@ struct ieee80211_tx_stored_packet {
         struct sk_buff *skb;
         int num_extra_frag;
         struct sk_buff **extra_frag;
-        int last_frag_rateidx;
-        int last_frag_hwrate;
         struct ieee80211_rate *last_frag_rate;
         unsigned int last_frag_rate_ctrl_probe;
 };
 
-typedef ieee80211_txrx_result (*ieee80211_tx_handler)
-(struct ieee80211_txrx_data *tx);
-
-typedef ieee80211_txrx_result (*ieee80211_rx_handler)
-(struct ieee80211_txrx_data *rx);
-
 struct beacon_data {
         u8 *head, *tail;
         int head_len, tail_len;
@@ -206,7 +207,7 @@ struct ieee80211_if_ap {
 
         /* yes, this looks ugly, but guarantees that we can later use
          * bitmap_empty :)
-         * NB: don't ever use set_bit, use bss_tim_set/bss_tim_clear! */
+         * NB: don't touch this bitmap, use sta_info_{set,clear}_tim_bit */
         u8 tim[sizeof(unsigned long) * BITS_TO_LONGS(IEEE80211_MAX_AID + 1)];
         atomic_t num_sta_ps; /* number of stations in PS mode */
         struct sk_buff_head ps_bc_buf;
@@ -282,7 +283,7 @@ struct ieee80211_if_sta {
 
         unsigned long ibss_join_req;
         struct sk_buff *probe_resp; /* ProbeResp template for IBSS */
-        u32 supp_rates_bits;
+        u32 supp_rates_bits[IEEE80211_NUM_BANDS];
 
         int wmm_last_param_set;
 };
@@ -292,6 +293,7 @@ struct ieee80211_if_sta {
 #define IEEE80211_SDATA_ALLMULTI        BIT(0)
 #define IEEE80211_SDATA_PROMISC         BIT(1)
 #define IEEE80211_SDATA_USERSPACE_MLME  BIT(2)
+#define IEEE80211_SDATA_OPERATING_GMODE BIT(3)
 struct ieee80211_sub_if_data {
         struct list_head list;
 
@@ -306,11 +308,11 @@ struct ieee80211_sub_if_data {
         unsigned int flags;
 
         int drop_unencrypted;
+
         /*
-         * IEEE 802.1X Port access control in effect,
-         * drop packets to/from unauthorized port
+         * basic rates of this AP or the AP we're associated to
          */
-        int ieee802_1x_pac;
+        u64 basic_rates;
 
         u16 sequence;
 
@@ -338,6 +340,7 @@ struct ieee80211_sub_if_data {
                 struct ieee80211_if_wds wds;
                 struct ieee80211_if_vlan vlan;
                 struct ieee80211_if_sta sta;
+                u32 mntr_flags;
         } u;
         int channel_use;
         int channel_use_raw;
@@ -348,7 +351,6 @@ struct ieee80211_sub_if_data {
                 struct {
                         struct dentry *channel_use;
                         struct dentry *drop_unencrypted;
-                        struct dentry *ieee802_1x_pac;
                         struct dentry *state;
                         struct dentry *bssid;
                         struct dentry *prev_bssid;
@@ -367,7 +369,6 @@ struct ieee80211_sub_if_data {
                 struct {
                         struct dentry *channel_use;
                         struct dentry *drop_unencrypted;
-                        struct dentry *ieee802_1x_pac;
                         struct dentry *num_sta_ps;
                         struct dentry *dtim_count;
                         struct dentry *num_beacons;
@@ -378,13 +379,11 @@ struct ieee80211_sub_if_data {
                 struct {
                         struct dentry *channel_use;
                         struct dentry *drop_unencrypted;
-                        struct dentry *ieee802_1x_pac;
                         struct dentry *peer;
                 } wds;
                 struct {
                         struct dentry *channel_use;
                         struct dentry *drop_unencrypted;
-                        struct dentry *ieee802_1x_pac;
                 } vlan;
                 struct {
                         struct dentry *mode;
@@ -407,6 +406,8 @@ struct ieee80211_sub_if_data *vif_to_sdata(struct ieee80211_vif *p)
 enum {
         IEEE80211_RX_MSG        = 1,
         IEEE80211_TX_STATUS_MSG = 2,
+        IEEE80211_DELBA_MSG     = 3,
+        IEEE80211_ADDBA_MSG     = 4,
 };
 
 struct ieee80211_local {
@@ -417,12 +418,11 @@ struct ieee80211_local {
 
         const struct ieee80211_ops *ops;
 
-        /* List of registered struct ieee80211_hw_mode */
-        struct list_head modes_list;
-
         struct net_device *mdev; /* wmaster# - "master" 802.11 device */
         int open_count;
-        int monitors;
+        int monitors, cooked_mntrs;
+        /* number of interfaces with corresponding FIF_ flags */
+        int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss;
         unsigned int filter_flags; /* FIF_* */
         struct iw_statistics wstats;
         u8 wstats_flags;
@@ -450,8 +450,8 @@ struct ieee80211_local {
         struct sta_info *sta_hash[STA_HASH_SIZE];
         struct timer_list sta_cleanup;
 
-        unsigned long state[NUM_TX_DATA_QUEUES];
-        struct ieee80211_tx_stored_packet pending_packet[NUM_TX_DATA_QUEUES];
+        unsigned long state[NUM_TX_DATA_QUEUES_AMPDU];
+        struct ieee80211_tx_stored_packet pending_packet[NUM_TX_DATA_QUEUES_AMPDU];
         struct tasklet_struct tx_pending_tasklet;
 
         /* number of interfaces with corresponding IFF_ flags */
@@ -459,11 +459,6 @@ struct ieee80211_local {
 
         struct rate_control_ref *rate_ctrl;
 
-        /* Supported and basic rate filters for different modes. These are
-         * pointers to -1 terminated lists and rates in 100 kbps units. */
-        int *supp_rates[NUM_IEEE80211_MODES];
-        int *basic_rates[NUM_IEEE80211_MODES];
-
         int rts_threshold;
         int fragmentation_threshold;
         int short_retry_limit; /* dot11ShortRetryLimit */
@@ -477,21 +472,18 @@ struct ieee80211_local {
                              * deliver multicast frames both back to wireless
                              * media and to the local net stack */
 
-        ieee80211_rx_handler *rx_pre_handlers;
-        ieee80211_rx_handler *rx_handlers;
-        ieee80211_tx_handler *tx_handlers;
-
         struct list_head interfaces;
 
         bool sta_sw_scanning;
         bool sta_hw_scanning;
         int scan_channel_idx;
+        enum ieee80211_band scan_band;
+
         enum { SCAN_SET_CHANNEL, SCAN_SEND_PROBE } scan_state;
         unsigned long last_scan_completed;
         struct delayed_work scan_work;
         struct net_device *scan_dev;
         struct ieee80211_channel *oper_channel, *scan_channel;
-        struct ieee80211_hw_mode *oper_hw_mode, *scan_hw_mode;
         u8 scan_ssid[IEEE80211_MAX_SSID_LEN];
         size_t scan_ssid_len;
         struct list_head sta_bss_list;
@@ -560,14 +552,8 @@ struct ieee80211_local {
         int wifi_wme_noack_test;
         unsigned int wmm_acm; /* bit field of ACM bits (BIT(802.1D tag)) */
 
-        unsigned int enabled_modes; /* bitfield of allowed modes;
-                                      * (1 << MODE_*) */
-        unsigned int hw_modes; /* bitfield of supported hardware modes;
-                                * (1 << MODE_*) */
-
 #ifdef CONFIG_MAC80211_DEBUGFS
         struct local_debugfsdentries {
-                struct dentry *channel;
                 struct dentry *frequency;
                 struct dentry *antenna_sel_tx;
                 struct dentry *antenna_sel_rx;
@@ -577,9 +563,7 @@ struct ieee80211_local {
                 struct dentry *short_retry_limit;
                 struct dentry *long_retry_limit;
                 struct dentry *total_ps_buffered;
-                struct dentry *mode;
                 struct dentry *wep_iv;
-                struct dentry *modes;
                 struct dentry *statistics;
                 struct local_debugfsdentries_statsdentries {
                         struct dentry *transmitted_fragment_count;
@@ -627,6 +611,12 @@ struct ieee80211_local {
 #endif
 };
 
+/* this struct represents 802.11n's RA/TID combination */
+struct ieee80211_ra_tid {
+        u8 ra[ETH_ALEN];
+        u16 tid;
+};
+
 static inline struct ieee80211_local *hw_to_local(
         struct ieee80211_hw *hw)
 {
@@ -650,57 +640,6 @@ struct sta_attribute {
         ssize_t (*store)(struct sta_info *, const char *buf, size_t count);
 };
 
-static inline void __bss_tim_set(struct ieee80211_if_ap *bss, u16 aid)
-{
-        /*
-         * This format has been mandated by the IEEE specifications,
-         * so this line may not be changed to use the __set_bit() format.
-         */
-        bss->tim[aid / 8] |= (1 << (aid % 8));
-}
-
-static inline void bss_tim_set(struct ieee80211_local *local,
-                               struct ieee80211_if_ap *bss, u16 aid)
-{
-        read_lock_bh(&local->sta_lock);
-        __bss_tim_set(bss, aid);
-        read_unlock_bh(&local->sta_lock);
-}
-
-static inline void __bss_tim_clear(struct ieee80211_if_ap *bss, u16 aid)
-{
-        /*
-         * This format has been mandated by the IEEE specifications,
-         * so this line may not be changed to use the __clear_bit() format.
-         */
-        bss->tim[aid / 8] &= ~(1 << (aid % 8));
-}
-
-static inline void bss_tim_clear(struct ieee80211_local *local,
-                                 struct ieee80211_if_ap *bss, u16 aid)
-{
-        read_lock_bh(&local->sta_lock);
-        __bss_tim_clear(bss, aid);
-        read_unlock_bh(&local->sta_lock);
-}
-
-/**
- * ieee80211_is_erp_rate - Check if a rate is an ERP rate
- * @phymode: The PHY-mode for this rate (MODE_IEEE80211...)
- * @rate: Transmission rate to check, in 100 kbps
- *
- * Check if a given rate is an Extended Rate PHY (ERP) rate.
- */
-static inline int ieee80211_is_erp_rate(int phymode, int rate)
-{
-        if (phymode == MODE_IEEE80211G) {
-                if (rate != 10 && rate != 20 &&
-                    rate != 55 && rate != 110)
-                        return 1;
-        }
-        return 0;
-}
-
 static inline int ieee80211_bssid_match(const u8 *raddr, const u8 *addr)
 {
         return compare_ether_addr(raddr, addr) == 0 ||
@@ -712,13 +651,9 @@ static inline int ieee80211_bssid_match(const u8 *raddr, const u8 *addr)
 int ieee80211_hw_config(struct ieee80211_local *local);
 int ieee80211_if_config(struct net_device *dev);
 int ieee80211_if_config_beacon(struct net_device *dev);
-void ieee80211_prepare_rates(struct ieee80211_local *local,
-                             struct ieee80211_hw_mode *mode);
 void ieee80211_tx_set_iswep(struct ieee80211_txrx_data *tx);
 int ieee80211_if_update_wds(struct net_device *dev, u8 *remote_addr);
 void ieee80211_if_setup(struct net_device *dev);
-struct ieee80211_rate *ieee80211_get_rate(struct ieee80211_local *local,
-                                          int phymode, int hwrate);
 int ieee80211_hw_config_ht(struct ieee80211_local *local, int enable_ht,
                            struct ieee80211_ht_info *req_ht_cap,
                            struct ieee80211_ht_bss_info *req_bss_cap);
@@ -749,7 +684,7 @@ extern const struct iw_handler_def ieee80211_iw_handler_def;
 /* ieee80211_ioctl.c */
 int ieee80211_set_compression(struct ieee80211_local *local,
                               struct net_device *dev, struct sta_info *sta);
-int ieee80211_set_channel(struct ieee80211_local *local, int channel, int freq);
+int ieee80211_set_freq(struct ieee80211_local *local, int freq);
 /* ieee80211_sta.c */
 void ieee80211_sta_timer(unsigned long data);
 void ieee80211_sta_work(struct work_struct *work);
@@ -763,9 +698,9 @@ int ieee80211_sta_req_scan(struct net_device *dev, u8 *ssid, size_t ssid_len);
 void ieee80211_sta_req_auth(struct net_device *dev,
                             struct ieee80211_if_sta *ifsta);
 int ieee80211_sta_scan_results(struct net_device *dev, char *buf, size_t len);
-ieee80211_txrx_result ieee80211_sta_rx_scan(struct net_device *dev,
-                                            struct sk_buff *skb,
-                           struct ieee80211_rx_status *rx_status);
+ieee80211_rx_result ieee80211_sta_rx_scan(
+        struct net_device *dev, struct sk_buff *skb,
+        struct ieee80211_rx_status *rx_status);
 void ieee80211_rx_bss_list_init(struct net_device *dev);
 void ieee80211_rx_bss_list_deinit(struct net_device *dev);
 int ieee80211_sta_set_extra_ie(struct net_device *dev, char *ie, size_t len);
@@ -782,9 +717,15 @@ int ieee80211_ht_cap_ie_to_ht_info(struct ieee80211_ht_cap *ht_cap_ie,
 int ieee80211_ht_addt_info_ie_to_ht_bss_info(
                         struct ieee80211_ht_addt_info *ht_add_info_ie,
                         struct ieee80211_ht_bss_info *bss_info);
+void ieee80211_send_addba_request(struct net_device *dev, const u8 *da,
+                                  u16 tid, u8 dialog_token, u16 start_seq_num,
+                                  u16 agg_size, u16 timeout);
+void ieee80211_send_delba(struct net_device *dev, const u8 *da, u16 tid,
+                                u16 initiator, u16 reason_code);
 void ieee80211_sta_stop_rx_ba_session(struct net_device *dev, u8 *da,
                                 u16 tid, u16 initiator, u16 reason);
 void sta_rx_agg_session_timer_expired(unsigned long data);
+void sta_addba_resp_timer_expired(unsigned long data);
 /* ieee80211_iface.c */
 int ieee80211_if_add(struct net_device *dev, const char *name,
                      struct net_device **new_dev, int type);
@@ -796,16 +737,7 @@ int ieee80211_if_remove(struct net_device *dev, const char *name, int id);
 void ieee80211_if_free(struct net_device *dev);
 void ieee80211_if_sdata_init(struct ieee80211_sub_if_data *sdata);
 
-/* regdomain.c */
-void ieee80211_regdomain_init(void);
-void ieee80211_set_default_regdomain(struct ieee80211_hw_mode *mode);
-
-/* rx handling */
-extern ieee80211_rx_handler ieee80211_rx_pre_handlers[];
-extern ieee80211_rx_handler ieee80211_rx_handlers[];
-
 /* tx handling */
-extern ieee80211_tx_handler ieee80211_tx_handlers[];
 void ieee80211_clear_tx_pending(struct ieee80211_local *local);
 void ieee80211_tx_pending(unsigned long data);
 int ieee80211_master_start_xmit(struct sk_buff *skb, struct net_device *dev);
diff --git a/net/mac80211/ieee80211_iface.c b/net/mac80211/ieee80211_iface.c
index 92f1eb2da311..0d6824bca92b 100644
--- a/net/mac80211/ieee80211_iface.c
+++ b/net/mac80211/ieee80211_iface.c
@@ -118,6 +118,8 @@ void ieee80211_if_set_type(struct net_device *dev, int type)
         sdata->bss = NULL;
         sdata->vif.type = type;
 
+        sdata->basic_rates = 0;
+
         switch (type) {
         case IEEE80211_IF_TYPE_WDS:
                 /* nothing special */
@@ -158,6 +160,8 @@ void ieee80211_if_set_type(struct net_device *dev, int type)
         case IEEE80211_IF_TYPE_MNTR:
                 dev->type = ARPHRD_IEEE80211_RADIOTAP;
                 dev->hard_start_xmit = ieee80211_monitor_start_xmit;
+                sdata->u.mntr_flags = MONITOR_FLAG_CONTROL |
+                                      MONITOR_FLAG_OTHER_BSS;
                 break;
         default:
                 printk(KERN_WARNING "%s: %s: Unknown interface type 0x%x",
@@ -189,6 +193,7 @@ void ieee80211_if_reinit(struct net_device *dev)
                 /* Remove all virtual interfaces that use this BSS
                  * as their sdata->bss */
                 struct ieee80211_sub_if_data *tsdata, *n;
+                struct beacon_data *beacon;
 
                 list_for_each_entry_safe(tsdata, n, &local->interfaces, list) {
                         if (tsdata != sdata && tsdata->bss == &sdata->u.ap) {
@@ -206,7 +211,10 @@ void ieee80211_if_reinit(struct net_device *dev)
                         }
                 }
 
-                kfree(sdata->u.ap.beacon);
+                beacon = sdata->u.ap.beacon;
+                rcu_assign_pointer(sdata->u.ap.beacon, NULL);
+                synchronize_rcu();
+                kfree(beacon);
 
                 while ((skb = skb_dequeue(&sdata->u.ap.ps_bc_buf))) {
                         local->total_ps_buffered--;
diff --git a/net/mac80211/ieee80211_ioctl.c b/net/mac80211/ieee80211_ioctl.c
index 5024d3733834..7551db3f3abc 100644
--- a/net/mac80211/ieee80211_ioctl.c
+++ b/net/mac80211/ieee80211_ioctl.c
@@ -33,8 +33,8 @@ static int ieee80211_set_encryption(struct net_device *dev, u8 *sta_addr,
                                     size_t key_len)
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        int ret = 0;
-        struct sta_info *sta;
+        int ret;
+        struct sta_info *sta = NULL;
         struct ieee80211_key *key;
         struct ieee80211_sub_if_data *sdata;
 
@@ -46,58 +46,64 @@ static int ieee80211_set_encryption(struct net_device *dev, u8 *sta_addr,
                 return -EINVAL;
         }
 
-        if (is_broadcast_ether_addr(sta_addr)) {
-                sta = NULL;
-                key = sdata->keys[idx];
-        } else {
-                set_tx_key = 0;
-                /*
-                 * According to the standard, the key index of a pairwise
-                 * key must be zero. However, some AP are broken when it
-                 * comes to WEP key indices, so we work around this.
-                 */
-                if (idx != 0 && alg != ALG_WEP) {
-                        printk(KERN_DEBUG "%s: set_encrypt - non-zero idx for "
-                               "individual key\n", dev->name);
-                        return -EINVAL;
+        if (remove) {
+                if (is_broadcast_ether_addr(sta_addr)) {
+                        key = sdata->keys[idx];
+                } else {
+                        sta = sta_info_get(local, sta_addr);
+                        if (!sta) {
+                                ret = -ENOENT;
+                                key = NULL;
+                                goto err_out;
+                        }
+
+                        key = sta->key;
                 }
 
-                sta = sta_info_get(local, sta_addr);
-                if (!sta) {
-#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-                        DECLARE_MAC_BUF(mac);
-                        printk(KERN_DEBUG "%s: set_encrypt - unknown addr "
-                               "%s\n",
-                               dev->name, print_mac(mac, sta_addr));
-#endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
+                if (!key)
+                        ret = -ENOENT;
+                else
+                        ret = 0;
+        } else {
+                key = ieee80211_key_alloc(alg, idx, key_len, _key);
+                if (!key)
+                        return -ENOMEM;
 
-                        return -ENOENT;
+                if (!is_broadcast_ether_addr(sta_addr)) {
+                        set_tx_key = 0;
+                        /*
+                         * According to the standard, the key index of a
+                         * pairwise key must be zero. However, some AP are
+                         * broken when it comes to WEP key indices, so we
+                         * work around this.
+                         */
+                        if (idx != 0 && alg != ALG_WEP) {
+                                ret = -EINVAL;
+                                goto err_out;
+                        }
+
+                        sta = sta_info_get(local, sta_addr);
+                        if (!sta) {
+                                ret = -ENOENT;
+                                goto err_out;
+                        }
                 }
 
-                key = sta->key;
-        }
+                ieee80211_key_link(key, sdata, sta);
 
-        if (remove) {
-                ieee80211_key_free(key);
+                if (set_tx_key || (!sta && !sdata->default_key && key))
+                        ieee80211_set_default_key(sdata, idx);
+
+                /* don't free key later */
                 key = NULL;
-        } else {
-                /*
-                 * Automatically frees any old key if present.
-                 */
-                key = ieee80211_key_alloc(sdata, sta, alg, idx, key_len, _key);
-                if (!key) {
-                        ret = -ENOMEM;
-                        goto err_out;
-                }
-        }
 
-        if (set_tx_key || (!sta && !sdata->default_key && key))
-                ieee80211_set_default_key(sdata, idx);
+                ret = 0;
+        }
 
-        ret = 0;
  err_out:
         if (sta)
                 sta_info_put(sta);
+        ieee80211_key_free(key);
         return ret;
 }
 
@@ -129,22 +135,7 @@ static int ieee80211_ioctl_giwname(struct net_device *dev,
                                    struct iw_request_info *info,
                                    char *name, char *extra)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-
-        switch (local->hw.conf.phymode) {
-        case MODE_IEEE80211A:
-                strcpy(name, "IEEE 802.11a");
-                break;
-        case MODE_IEEE80211B:
-                strcpy(name, "IEEE 802.11b");
-                break;
-        case MODE_IEEE80211G:
-                strcpy(name, "IEEE 802.11g");
-                break;
-        default:
-                strcpy(name, "IEEE 802.11");
-                break;
-        }
+        strcpy(name, "IEEE 802.11");
 
         return 0;
 }
@@ -156,7 +147,7 @@ static int ieee80211_ioctl_giwrange(struct net_device *dev,
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
         struct iw_range *range = (struct iw_range *) extra;
-        struct ieee80211_hw_mode *mode = NULL;
+        enum ieee80211_band band;
         int c = 0;
 
         data->length = sizeof(struct iw_range);
@@ -191,24 +182,27 @@ static int ieee80211_ioctl_giwrange(struct net_device *dev,
         range->enc_capa = IW_ENC_CAPA_WPA | IW_ENC_CAPA_WPA2 |
                           IW_ENC_CAPA_CIPHER_TKIP | IW_ENC_CAPA_CIPHER_CCMP;
 
-        list_for_each_entry(mode, &local->modes_list, list) {
-                int i = 0;
 
-                if (!(local->enabled_modes & (1 << mode->mode)) ||
-                    (local->hw_modes & local->enabled_modes &
-                     (1 << MODE_IEEE80211G) && mode->mode == MODE_IEEE80211B))
+        for (band = 0; band < IEEE80211_NUM_BANDS; band ++) {
+                int i;
+                struct ieee80211_supported_band *sband;
+
+                sband = local->hw.wiphy->bands[band];
+
+                if (!sband)
                         continue;
 
-                while (i < mode->num_channels && c < IW_MAX_FREQUENCIES) {
-                        struct ieee80211_channel *chan = &mode->channels[i];
+                for (i = 0; i < sband->n_channels && c < IW_MAX_FREQUENCIES; i++) {
+                        struct ieee80211_channel *chan = &sband->channels[i];
 
-                        if (chan->flag & IEEE80211_CHAN_W_SCAN) {
-                                range->freq[c].i = chan->chan;
-                                range->freq[c].m = chan->freq * 100000;
-                                range->freq[c].e = 1;
+                        if (!(chan->flags & IEEE80211_CHAN_DISABLED)) {
+                                range->freq[c].i =
+                                        ieee80211_frequency_to_channel(
+                                                chan->center_freq);
+                                range->freq[c].m = chan->center_freq;
+                                range->freq[c].e = 6;
                                 c++;
                         }
-                        i++;
                 }
         }
         range->num_channels = c;
@@ -294,22 +288,29 @@ static int ieee80211_ioctl_giwmode(struct net_device *dev,
         return 0;
 }
 
-int ieee80211_set_channel(struct ieee80211_local *local, int channel, int freq)
+int ieee80211_set_freq(struct ieee80211_local *local, int freqMHz)
 {
-        struct ieee80211_hw_mode *mode;
-        int c, set = 0;
+        int set = 0;
         int ret = -EINVAL;
+        enum ieee80211_band band;
+        struct ieee80211_supported_band *sband;
+        int i;
+
+        for (band = 0; band < IEEE80211_NUM_BANDS; band ++) {
+                sband = local->hw.wiphy->bands[band];
 
-        list_for_each_entry(mode, &local->modes_list, list) {
-                if (!(local->enabled_modes & (1 << mode->mode)))
+                if (!sband)
                         continue;
-                for (c = 0; c < mode->num_channels; c++) {
-                        struct ieee80211_channel *chan = &mode->channels[c];
-                        if (chan->flag & IEEE80211_CHAN_W_SCAN &&
-                            ((chan->chan == channel) || (chan->freq == freq))) {
-                                local->oper_channel = chan;
-                                local->oper_hw_mode = mode;
+
+                for (i = 0; i < sband->n_channels; i++) {
+                        struct ieee80211_channel *chan = &sband->channels[i];
+
+                        if (chan->flags & IEEE80211_CHAN_DISABLED)
+                                continue;
+
+                        if (chan->center_freq == freqMHz) {
                                 set = 1;
+                                local->oper_channel = chan;
                                 break;
                         }
                 }
@@ -347,13 +348,14 @@ static int ieee80211_ioctl_siwfreq(struct net_device *dev,
                                         IEEE80211_STA_AUTO_CHANNEL_SEL;
                         return 0;
                 } else
-                        return ieee80211_set_channel(local, freq->m, -1);
+                        return ieee80211_set_freq(local,
+                                ieee80211_channel_to_frequency(freq->m));
         } else {
                 int i, div = 1000000;
                 for (i = 0; i < freq->e; i++)
                         div /= 10;
                 if (div > 0)
-                        return ieee80211_set_channel(local, -1, freq->m / div);
+                        return ieee80211_set_freq(local, freq->m / div);
                 else
                         return -EINVAL;
         }
@@ -366,10 +368,7 @@ static int ieee80211_ioctl_giwfreq(struct net_device *dev,
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 
-        /* TODO: in station mode (Managed/Ad-hoc) might need to poll low-level
-         * driver for the current channel with firmware-based management */
-
-        freq->m = local->hw.conf.freq;
+        freq->m = local->hw.conf.channel->center_freq;
         freq->e = 6;
 
         return 0;
@@ -566,15 +565,17 @@ static int ieee80211_ioctl_siwrate(struct net_device *dev,
                                   struct iw_param *rate, char *extra)
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_hw_mode *mode;
-        int i;
+        int i, err = -EINVAL;
         u32 target_rate = rate->value / 100000;
         struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_supported_band *sband;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         if (!sdata->bss)
                 return -ENODEV;
-        mode = local->oper_hw_mode;
+
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+
         /* target_rate = -1, rate->fixed = 0 means auto only, so use all rates
          * target_rate = X, rate->fixed = 1 means only rate X
          * target_rate = X, rate->fixed = 0 means all rates <= X */
@@ -582,18 +583,20 @@ static int ieee80211_ioctl_siwrate(struct net_device *dev,
         sdata->bss->force_unicast_rateidx = -1;
         if (rate->value < 0)
                 return 0;
-        for (i=0; i < mode->num_rates; i++) {
-                struct ieee80211_rate *rates = &mode->rates[i];
-                int this_rate = rates->rate;
+
+        for (i=0; i< sband->n_bitrates; i++) {
+                struct ieee80211_rate *brate = &sband->bitrates[i];
+                int this_rate = brate->bitrate;
 
                 if (target_rate == this_rate) {
                         sdata->bss->max_ratectrl_rateidx = i;
                         if (rate->fixed)
                                 sdata->bss->force_unicast_rateidx = i;
-                        return 0;
+                        err = 0;
+                        break;
                 }
         }
-        return -EINVAL;
+        return err;
 }
 
 static int ieee80211_ioctl_giwrate(struct net_device *dev,
@@ -603,18 +606,24 @@ static int ieee80211_ioctl_giwrate(struct net_device *dev,
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
         struct sta_info *sta;
         struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_supported_band *sband;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
         if (sdata->vif.type == IEEE80211_IF_TYPE_STA)
                 sta = sta_info_get(local, sdata->u.sta.bssid);
         else
                 return -EOPNOTSUPP;
         if (!sta)
                 return -ENODEV;
-        if (sta->txrate < local->oper_hw_mode->num_rates)
-                rate->value = local->oper_hw_mode->rates[sta->txrate].rate * 100000;
+
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+
+        if (sta->txrate_idx < sband->n_bitrates)
+                rate->value = sband->bitrates[sta->txrate_idx].bitrate;
         else
                 rate->value = 0;
+        rate->value *= 100000;
         sta_info_put(sta);
         return 0;
 }
@@ -625,7 +634,7 @@ static int ieee80211_ioctl_siwtxpower(struct net_device *dev,
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
         bool need_reconfig = 0;
-        u8 new_power_level;
+        int new_power_level;
 
         if ((data->txpower.flags & IW_TXPOW_TYPE) != IW_TXPOW_DBM)
                 return -EINVAL;
@@ -635,13 +644,15 @@ static int ieee80211_ioctl_siwtxpower(struct net_device *dev,
         if (data->txpower.fixed) {
                 new_power_level = data->txpower.value;
         } else {
-                /* Automatic power level. Get the px power from the current
-                 * channel. */
-                struct ieee80211_channel* chan = local->oper_channel;
+                /*
+                 * Automatic power level. Use maximum power for the current
+                 * channel. Should be part of rate control.
+                 */
+                struct ieee80211_channel* chan = local->hw.conf.channel;
                 if (!chan)
                         return -EINVAL;
 
-                new_power_level = chan->power_level;
+                new_power_level = chan->max_power;
         }
 
         if (local->hw.conf.power_level != new_power_level) {
diff --git a/net/mac80211/ieee80211_key.h b/net/mac80211/ieee80211_key.h
index fc770e98d47b..d670e6dbfa39 100644
--- a/net/mac80211/ieee80211_key.h
+++ b/net/mac80211/ieee80211_key.h
@@ -13,6 +13,7 @@
 #include <linux/types.h>
 #include <linux/list.h>
 #include <linux/crypto.h>
+#include <linux/rcupdate.h>
 #include <net/mac80211.h>
 
 /* ALG_TKIP
@@ -45,7 +46,19 @@ struct ieee80211_local;
 struct ieee80211_sub_if_data;
 struct sta_info;
 
-#define KEY_FLAG_UPLOADED_TO_HARDWARE   (1<<0)
+/**
+ * enum ieee80211_internal_key_flags - internal key flags
+ *
+ * @KEY_FLAG_UPLOADED_TO_HARDWARE: Indicates that this key is present
+ *      in the hardware for TX crypto hardware acceleration.
+ * @KEY_FLAG_REMOVE_FROM_HARDWARE: Indicates to the key code that this
+ *      key is present in the hardware (but it cannot be used for
+ *      hardware acceleration any more!)
+ */
+enum ieee80211_internal_key_flags {
+        KEY_FLAG_UPLOADED_TO_HARDWARE   = BIT(0),
+        KEY_FLAG_REMOVE_FROM_HARDWARE   = BIT(1),
+};
 
 struct ieee80211_key {
         struct ieee80211_local *local;
@@ -112,12 +125,17 @@ struct ieee80211_key {
         struct ieee80211_key_conf conf;
 };
 
-struct ieee80211_key *ieee80211_key_alloc(struct ieee80211_sub_if_data *sdata,
-                                          struct sta_info *sta,
-                                          enum ieee80211_key_alg alg,
+struct ieee80211_key *ieee80211_key_alloc(enum ieee80211_key_alg alg,
                                           int idx,
                                           size_t key_len,
                                           const u8 *key_data);
+/*
+ * Insert a key into data structures (sdata, sta if necessary)
+ * to make it used, free old key.
+ */
+void ieee80211_key_link(struct ieee80211_key *key,
+                        struct ieee80211_sub_if_data *sdata,
+                        struct sta_info *sta);
 void ieee80211_key_free(struct ieee80211_key *key);
 void ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata, int idx);
 void ieee80211_free_keys(struct ieee80211_sub_if_data *sdata);
diff --git a/net/mac80211/ieee80211_rate.c b/net/mac80211/ieee80211_rate.c
index b957e67c5fba..ebe29b716b27 100644
--- a/net/mac80211/ieee80211_rate.c
+++ b/net/mac80211/ieee80211_rate.c
@@ -163,7 +163,8 @@ static void rate_control_release(struct kref *kref)
 }
 
 void rate_control_get_rate(struct net_device *dev,
-                           struct ieee80211_hw_mode *mode, struct sk_buff *skb,
+                           struct ieee80211_supported_band *sband,
+                           struct sk_buff *skb,
                            struct rate_selection *sel)
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
@@ -174,17 +175,17 @@ void rate_control_get_rate(struct net_device *dev,
 
         memset(sel, 0, sizeof(struct rate_selection));
 
-        ref->ops->get_rate(ref->priv, dev, mode, skb, sel);
+        ref->ops->get_rate(ref->priv, dev, sband, skb, sel);
 
         /* Select a non-ERP backup rate. */
         if (!sel->nonerp) {
-                for (i = 0; i < mode->num_rates - 1; i++) {
-                        struct ieee80211_rate *rate = &mode->rates[i];
-                        if (sel->rate->rate < rate->rate)
+                for (i = 0; i < sband->n_bitrates; i++) {
+                        struct ieee80211_rate *rate = &sband->bitrates[i];
+                        if (sel->rate->bitrate < rate->bitrate)
                                 break;
 
-                        if (rate_supported(sta, mode, i) &&
-                            !(rate->flags & IEEE80211_RATE_ERP))
+                        if (rate_supported(sta, sband->band, i) &&
+                            !(rate->flags & IEEE80211_RATE_ERP_G))
                                 sel->nonerp = rate;
                 }
         }
diff --git a/net/mac80211/ieee80211_rate.h b/net/mac80211/ieee80211_rate.h
index 73f19e8aa51c..5f9a2ca49a57 100644
--- a/net/mac80211/ieee80211_rate.h
+++ b/net/mac80211/ieee80211_rate.h
@@ -18,6 +18,7 @@
 #include "ieee80211_i.h"
 #include "sta_info.h"
 
+/* TODO: kdoc */
 struct rate_selection {
         /* Selected transmission rate */
         struct ieee80211_rate *rate;
@@ -34,7 +35,8 @@ struct rate_control_ops {
                           struct sk_buff *skb,
                           struct ieee80211_tx_status *status);
         void (*get_rate)(void *priv, struct net_device *dev,
-                         struct ieee80211_hw_mode *mode, struct sk_buff *skb,
+                         struct ieee80211_supported_band *band,
+                         struct sk_buff *skb,
                          struct rate_selection *sel);
         void (*rate_init)(void *priv, void *priv_sta,
                           struct ieee80211_local *local, struct sta_info *sta);
@@ -66,7 +68,8 @@ void ieee80211_rate_control_unregister(struct rate_control_ops *ops);
 struct rate_control_ref *rate_control_alloc(const char *name,
                                             struct ieee80211_local *local);
 void rate_control_get_rate(struct net_device *dev,
-                           struct ieee80211_hw_mode *mode, struct sk_buff *skb,
+                           struct ieee80211_supported_band *sband,
+                           struct sk_buff *skb,
                            struct rate_selection *sel);
 struct rate_control_ref *rate_control_get(struct rate_control_ref *ref);
 void rate_control_put(struct rate_control_ref *ref);
@@ -127,23 +130,23 @@ static inline void rate_control_remove_sta_debugfs(struct sta_info *sta)
 #endif
 }
 
-static inline int
-rate_supported(struct sta_info *sta, struct ieee80211_hw_mode *mode, int index)
+static inline int rate_supported(struct sta_info *sta,
+                                 enum ieee80211_band band,
+                                 int index)
 {
-        return (sta == NULL || sta->supp_rates & BIT(index)) &&
-               (mode->rates[index].flags & IEEE80211_RATE_SUPPORTED);
+        return (sta == NULL || sta->supp_rates[band] & BIT(index));
 }
 
 static inline int
-rate_lowest_index(struct ieee80211_local *local, struct ieee80211_hw_mode *mode,
+rate_lowest_index(struct ieee80211_local *local,
+                  struct ieee80211_supported_band *sband,
                   struct sta_info *sta)
 {
         int i;
 
-        for (i = 0; i < mode->num_rates; i++) {
-                if (rate_supported(sta, mode, i))
+        for (i = 0; i < sband->n_bitrates; i++)
+                if (rate_supported(sta, sband->band, i))
                         return i;
-        }
 
         /* warn when we cannot find a rate. */
         WARN_ON(1);
@@ -152,10 +155,11 @@ rate_lowest_index(struct ieee80211_local *local, struct ieee80211_hw_mode *mode,
 }
 
 static inline struct ieee80211_rate *
-rate_lowest(struct ieee80211_local *local, struct ieee80211_hw_mode *mode,
+rate_lowest(struct ieee80211_local *local,
+            struct ieee80211_supported_band *sband,
             struct sta_info *sta)
 {
-        return &mode->rates[rate_lowest_index(local, mode, sta)];
+        return &sband->bitrates[rate_lowest_index(local, sband, sta)];
 }
 
 
diff --git a/net/mac80211/ieee80211_sta.c b/net/mac80211/ieee80211_sta.c
index 9aeed5320228..ddb5832f37cb 100644
--- a/net/mac80211/ieee80211_sta.c
+++ b/net/mac80211/ieee80211_sta.c
@@ -74,7 +74,7 @@
 static void ieee80211_send_probe_req(struct net_device *dev, u8 *dst,
                                      u8 *ssid, size_t ssid_len);
 static struct ieee80211_sta_bss *
-ieee80211_rx_bss_get(struct net_device *dev, u8 *bssid, int channel,
+ieee80211_rx_bss_get(struct net_device *dev, u8 *bssid, int freq,
                      u8 *ssid, u8 ssid_len);
 static void ieee80211_rx_bss_put(struct net_device *dev,
                                  struct ieee80211_sta_bss *bss);
@@ -227,12 +227,7 @@ static void ieee802_11_parse_elems(u8 *start, size_t len,
 
 static int ecw2cw(int ecw)
 {
-        int cw = 1;
-        while (ecw > 0) {
-                cw <<= 1;
-                ecw--;
-        }
-        return cw - 1;
+        return (1 << ecw) - 1;
 }
 
 static void ieee80211_sta_wmm_params(struct net_device *dev,
@@ -297,12 +292,13 @@ static void ieee80211_sta_wmm_params(struct net_device *dev,
                 params.aifs = pos[0] & 0x0f;
                 params.cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
                 params.cw_min = ecw2cw(pos[1] & 0x0f);
-                /* TXOP is in units of 32 usec; burst_time in 0.1 ms */
-                params.burst_time = (pos[2] | (pos[3] << 8)) * 32 / 100;
+                params.txop = pos[2] | (pos[3] << 8);
+#ifdef CONFIG_MAC80211_DEBUG
                 printk(KERN_DEBUG "%s: WMM queue=%d aci=%d acm=%d aifs=%d "
-                       "cWmin=%d cWmax=%d burst=%d\n",
+                       "cWmin=%d cWmax=%d txop=%d\n",
                        dev->name, queue, aci, acm, params.aifs, params.cw_min,
-                       params.cw_max, params.burst_time);
+                       params.cw_max, params.txop);
+#endif
                 /* TODO: handle ACM (block TX, fallback to next lowest allowed
                  * AC for now) */
                 if (local->ops->conf_tx(local_to_hw(local), queue, &params)) {
@@ -466,7 +462,7 @@ static void ieee80211_set_associated(struct net_device *dev,
                         return;
 
                 bss = ieee80211_rx_bss_get(dev, ifsta->bssid,
-                                           local->hw.conf.channel,
+                                           local->hw.conf.channel->center_freq,
                                            ifsta->ssid, ifsta->ssid_len);
                 if (bss) {
                         if (bss->has_erp_value)
@@ -492,6 +488,7 @@ static void ieee80211_set_associated(struct net_device *dev,
         ifsta->last_probe = jiffies;
         ieee80211_led_assoc(local, assoc);
 
+        sdata->bss_conf.assoc = assoc;
         ieee80211_bss_info_change_notify(sdata, changed);
 }
 
@@ -592,7 +589,6 @@ static void ieee80211_send_assoc(struct net_device *dev,
                                  struct ieee80211_if_sta *ifsta)
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_hw_mode *mode;
         struct sk_buff *skb;
         struct ieee80211_mgmt *mgmt;
         u8 *pos, *ies;
@@ -600,6 +596,7 @@ static void ieee80211_send_assoc(struct net_device *dev,
         u16 capab;
         struct ieee80211_sta_bss *bss;
         int wmm = 0;
+        struct ieee80211_supported_band *sband;
 
         skb = dev_alloc_skb(local->hw.extra_tx_headroom +
                             sizeof(*mgmt) + 200 + ifsta->extra_ie_len +
@@ -611,13 +608,19 @@ static void ieee80211_send_assoc(struct net_device *dev,
         }
         skb_reserve(skb, local->hw.extra_tx_headroom);
 
-        mode = local->oper_hw_mode;
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+
         capab = ifsta->capab;
-        if (mode->mode == MODE_IEEE80211G) {
-                capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME |
-                        WLAN_CAPABILITY_SHORT_PREAMBLE;
+
+        if (local->hw.conf.channel->band == IEEE80211_BAND_2GHZ) {
+                if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE))
+                        capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
+                if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_PREAMBLE_INCAPABLE))
+                        capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
         }
-        bss = ieee80211_rx_bss_get(dev, ifsta->bssid, local->hw.conf.channel,
+
+        bss = ieee80211_rx_bss_get(dev, ifsta->bssid,
+                                   local->hw.conf.channel->center_freq,
                                    ifsta->ssid, ifsta->ssid_len);
         if (bss) {
                 if (bss->capability & WLAN_CAPABILITY_PRIVACY)
@@ -656,23 +659,23 @@ static void ieee80211_send_assoc(struct net_device *dev,
         *pos++ = ifsta->ssid_len;
         memcpy(pos, ifsta->ssid, ifsta->ssid_len);
 
-        len = mode->num_rates;
+        len = sband->n_bitrates;
         if (len > 8)
                 len = 8;
         pos = skb_put(skb, len + 2);
         *pos++ = WLAN_EID_SUPP_RATES;
         *pos++ = len;
         for (i = 0; i < len; i++) {
-                int rate = mode->rates[i].rate;
+                int rate = sband->bitrates[i].bitrate;
                 *pos++ = (u8) (rate / 5);
         }
 
-        if (mode->num_rates > len) {
-                pos = skb_put(skb, mode->num_rates - len + 2);
+        if (sband->n_bitrates > len) {
+                pos = skb_put(skb, sband->n_bitrates - len + 2);
                 *pos++ = WLAN_EID_EXT_SUPP_RATES;
-                *pos++ = mode->num_rates - len;
-                for (i = len; i < mode->num_rates; i++) {
-                        int rate = mode->rates[i].rate;
+                *pos++ = sband->n_bitrates - len;
+                for (i = len; i < sband->n_bitrates; i++) {
+                        int rate = sband->bitrates[i].bitrate;
                         *pos++ = (u8) (rate / 5);
                 }
         }
@@ -695,17 +698,18 @@ static void ieee80211_send_assoc(struct net_device *dev,
                 *pos++ = 0;
         }
         /* wmm support is a must to HT */
-        if (wmm && mode->ht_info.ht_supported) {
-                __le16 tmp = cpu_to_le16(mode->ht_info.cap);
+        if (wmm && sband->ht_info.ht_supported) {
+                __le16 tmp = cpu_to_le16(sband->ht_info.cap);
                 pos = skb_put(skb, sizeof(struct ieee80211_ht_cap)+2);
                 *pos++ = WLAN_EID_HT_CAPABILITY;
                 *pos++ = sizeof(struct ieee80211_ht_cap);
                 memset(pos, 0, sizeof(struct ieee80211_ht_cap));
                 memcpy(pos, &tmp, sizeof(u16));
                 pos += sizeof(u16);
-                *pos++ = (mode->ht_info.ampdu_factor |
-                                (mode->ht_info.ampdu_density << 2));
-                memcpy(pos, mode->ht_info.supp_mcs_set, 16);
+                /* TODO: needs a define here for << 2 */
+                *pos++ = sband->ht_info.ampdu_factor |
+                         (sband->ht_info.ampdu_density << 2);
+                memcpy(pos, sband->ht_info.supp_mcs_set, 16);
         }
 
         kfree(ifsta->assocreq_ies);
@@ -788,7 +792,8 @@ static int ieee80211_privacy_mismatch(struct net_device *dev,
         if (!ifsta || (ifsta->flags & IEEE80211_STA_MIXED_CELL))
                 return 0;
 
-        bss = ieee80211_rx_bss_get(dev, ifsta->bssid, local->hw.conf.channel,
+        bss = ieee80211_rx_bss_get(dev, ifsta->bssid,
+                                   local->hw.conf.channel->center_freq,
                                    ifsta->ssid, ifsta->ssid_len);
         if (!bss)
                 return 0;
@@ -898,7 +903,7 @@ static void ieee80211_send_probe_req(struct net_device *dev, u8 *dst,
                                      u8 *ssid, size_t ssid_len)
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_hw_mode *mode;
+        struct ieee80211_supported_band *sband;
         struct sk_buff *skb;
         struct ieee80211_mgmt *mgmt;
         u8 *pos, *supp_rates, *esupp_rates = NULL;
@@ -932,11 +937,10 @@ static void ieee80211_send_probe_req(struct net_device *dev, u8 *dst,
         supp_rates = skb_put(skb, 2);
         supp_rates[0] = WLAN_EID_SUPP_RATES;
         supp_rates[1] = 0;
-        mode = local->oper_hw_mode;
-        for (i = 0; i < mode->num_rates; i++) {
-                struct ieee80211_rate *rate = &mode->rates[i];
-                if (!(rate->flags & IEEE80211_RATE_SUPPORTED))
-                        continue;
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+
+        for (i = 0; i < sband->n_bitrates; i++) {
+                struct ieee80211_rate *rate = &sband->bitrates[i];
                 if (esupp_rates) {
                         pos = skb_put(skb, 1);
                         esupp_rates[1]++;
@@ -949,7 +953,7 @@ static void ieee80211_send_probe_req(struct net_device *dev, u8 *dst,
                         pos = skb_put(skb, 1);
                         supp_rates[1]++;
                 }
-                *pos = rate->rate / 5;
+                *pos = rate->bitrate / 5;
         }
 
         ieee80211_sta_tx(dev, skb, 0);
@@ -1044,6 +1048,58 @@ static void ieee80211_send_addba_resp(struct net_device *dev, u8 *da, u16 tid,
         return;
 }
 
+void ieee80211_send_addba_request(struct net_device *dev, const u8 *da,
+                                u16 tid, u8 dialog_token, u16 start_seq_num,
+                                u16 agg_size, u16 timeout)
+{
+        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_if_sta *ifsta = &sdata->u.sta;
+        struct sk_buff *skb;
+        struct ieee80211_mgmt *mgmt;
+        u16 capab;
+
+        skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom + 1 +
+                                sizeof(mgmt->u.action.u.addba_req));
+
+
+        if (!skb) {
+                printk(KERN_ERR "%s: failed to allocate buffer "
+                                "for addba request frame\n", dev->name);
+                return;
+        }
+        skb_reserve(skb, local->hw.extra_tx_headroom);
+        mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
+        memset(mgmt, 0, 24);
+        memcpy(mgmt->da, da, ETH_ALEN);
+        memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
+        if (sdata->vif.type == IEEE80211_IF_TYPE_AP)
+                memcpy(mgmt->bssid, dev->dev_addr, ETH_ALEN);
+        else
+                memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
+
+        mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
+                                        IEEE80211_STYPE_ACTION);
+
+        skb_put(skb, 1 + sizeof(mgmt->u.action.u.addba_req));
+
+        mgmt->u.action.category = WLAN_CATEGORY_BACK;
+        mgmt->u.action.u.addba_req.action_code = WLAN_ACTION_ADDBA_REQ;
+
+        mgmt->u.action.u.addba_req.dialog_token = dialog_token;
+        capab = (u16)(1 << 1);          /* bit 1 aggregation policy */
+        capab |= (u16)(tid << 2);       /* bit 5:2 TID number */
+        capab |= (u16)(agg_size << 6);  /* bit 15:6 max size of aggergation */
+
+        mgmt->u.action.u.addba_req.capab = cpu_to_le16(capab);
+
+        mgmt->u.action.u.addba_req.timeout = cpu_to_le16(timeout);
+        mgmt->u.action.u.addba_req.start_seq_num =
+                                        cpu_to_le16(start_seq_num << 4);
+
+        ieee80211_sta_tx(dev, skb, 0);
+}
+
 static void ieee80211_sta_process_addba_request(struct net_device *dev,
                                                 struct ieee80211_mgmt *mgmt,
                                                 size_t len)
@@ -1093,9 +1149,11 @@ static void ieee80211_sta_process_addba_request(struct net_device *dev,
         }
         /* determine default buffer size */
         if (buf_size == 0) {
-                struct ieee80211_hw_mode *mode = conf->mode;
+                struct ieee80211_supported_band *sband;
+
+                sband = local->hw.wiphy->bands[conf->channel->band];
                 buf_size = IEEE80211_MIN_AMPDU_BUF;
-                buf_size = buf_size << mode->ht_info.ampdu_factor;
+                buf_size = buf_size << sband->ht_info.ampdu_factor;
         }
 
         tid_agg_rx = &sta->ampdu_mlme.tid_rx[tid];
@@ -1127,7 +1185,7 @@ static void ieee80211_sta_process_addba_request(struct net_device *dev,
 
         if (local->ops->ampdu_action)
                 ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_RX_START,
-                                               sta->addr, tid, start_seq_num);
+                                               sta->addr, tid, &start_seq_num);
 #ifdef CONFIG_MAC80211_HT_DEBUG
         printk(KERN_DEBUG "Rx A-MPDU on tid %d result %d", tid, ret);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
@@ -1155,8 +1213,80 @@ end_no_lock:
         sta_info_put(sta);
 }
 
-static void ieee80211_send_delba(struct net_device *dev, const u8 *da, u16 tid,
-                                 u16 initiator, u16 reason_code)
+static void ieee80211_sta_process_addba_resp(struct net_device *dev,
+                                             struct ieee80211_mgmt *mgmt,
+                                             size_t len)
+{
+        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_hw *hw = &local->hw;
+        struct sta_info *sta;
+        u16 capab;
+        u16 tid;
+        u8 *state;
+
+        sta = sta_info_get(local, mgmt->sa);
+        if (!sta)
+                return;
+
+        capab = le16_to_cpu(mgmt->u.action.u.addba_resp.capab);
+        tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
+
+        state = &sta->ampdu_mlme.tid_tx[tid].state;
+
+        spin_lock_bh(&sta->ampdu_mlme.ampdu_tx);
+
+        if (mgmt->u.action.u.addba_resp.dialog_token !=
+                sta->ampdu_mlme.tid_tx[tid].dialog_token) {
+                spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "wrong addBA response token, tid %d\n", tid);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+                sta_info_put(sta);
+                return;
+        }
+
+        del_timer_sync(&sta->ampdu_mlme.tid_tx[tid].addba_resp_timer);
+#ifdef CONFIG_MAC80211_HT_DEBUG
+        printk(KERN_DEBUG "switched off addBA timer for tid %d \n", tid);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+        if (le16_to_cpu(mgmt->u.action.u.addba_resp.status)
+                        == WLAN_STATUS_SUCCESS) {
+                if (!(*state & HT_ADDBA_REQUESTED_MSK)) {
+                        spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
+                        printk(KERN_DEBUG "state not HT_ADDBA_REQUESTED_MSK:"
+                                "%d\n", *state);
+                        sta_info_put(sta);
+                        return;
+                }
+
+                if (*state & HT_ADDBA_RECEIVED_MSK)
+                        printk(KERN_DEBUG "double addBA response\n");
+
+                *state |= HT_ADDBA_RECEIVED_MSK;
+                sta->ampdu_mlme.tid_tx[tid].addba_req_num = 0;
+
+                if (*state == HT_AGG_STATE_OPERATIONAL) {
+                        printk(KERN_DEBUG "Aggregation on for tid %d \n", tid);
+                        ieee80211_wake_queue(hw, sta->tid_to_tx_q[tid]);
+                }
+
+                spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
+                printk(KERN_DEBUG "recipient accepted agg: tid %d \n", tid);
+        } else {
+                printk(KERN_DEBUG "recipient rejected agg: tid %d \n", tid);
+
+                sta->ampdu_mlme.tid_tx[tid].addba_req_num++;
+                /* this will allow the state check in stop_BA_session */
+                *state = HT_AGG_STATE_OPERATIONAL;
+                spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
+                ieee80211_stop_tx_ba_session(hw, sta->addr, tid,
+                                             WLAN_BACK_INITIATOR);
+        }
+        sta_info_put(sta);
+}
+
+void ieee80211_send_delba(struct net_device *dev, const u8 *da, u16 tid,
+                          u16 initiator, u16 reason_code)
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
@@ -1229,7 +1359,7 @@ void ieee80211_sta_stop_rx_ba_session(struct net_device *dev, u8 *ra, u16 tid,
         BUG_ON(!local->ops->ampdu_action);
 
         ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_RX_STOP,
-                                        ra, tid, EINVAL);
+                                        ra, tid, NULL);
         if (ret)
                 printk(KERN_DEBUG "HW problem - can not stop rx "
                                 "aggergation for tid %d\n", tid);
@@ -1258,6 +1388,7 @@ void ieee80211_sta_stop_rx_ba_session(struct net_device *dev, u8 *ra, u16 tid,
         sta_info_put(sta);
 }
 
+
 static void ieee80211_sta_process_delba(struct net_device *dev,
                         struct ieee80211_mgmt *mgmt, size_t len)
 {
@@ -1277,14 +1408,70 @@ static void ieee80211_sta_process_delba(struct net_device *dev,
 
 #ifdef CONFIG_MAC80211_HT_DEBUG
         if (net_ratelimit())
-                printk(KERN_DEBUG "delba from %s on tid %d reason code %d\n",
-                        print_mac(mac, mgmt->sa), tid,
+                printk(KERN_DEBUG "delba from %s (%s) tid %d reason code %d\n",
+                        print_mac(mac, mgmt->sa),
+                        initiator ? "recipient" : "initiator", tid,
                         mgmt->u.action.u.delba.reason_code);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
 
         if (initiator == WLAN_BACK_INITIATOR)
                 ieee80211_sta_stop_rx_ba_session(dev, sta->addr, tid,
                                                  WLAN_BACK_INITIATOR, 0);
+        else { /* WLAN_BACK_RECIPIENT */
+                spin_lock_bh(&sta->ampdu_mlme.ampdu_tx);
+                sta->ampdu_mlme.tid_tx[tid].state =
+                                HT_AGG_STATE_OPERATIONAL;
+                spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
+                ieee80211_stop_tx_ba_session(&local->hw, sta->addr, tid,
+                                             WLAN_BACK_RECIPIENT);
+        }
+        sta_info_put(sta);
+}
+
+/*
+ * After sending add Block Ack request we activated a timer until
+ * add Block Ack response will arrive from the recipient.
+ * If this timer expires sta_addba_resp_timer_expired will be executed.
+ */
+void sta_addba_resp_timer_expired(unsigned long data)
+{
+        /* not an elegant detour, but there is no choice as the timer passes
+         * only one argument, and both sta_info and TID are needed, so init
+         * flow in sta_info_add gives the TID as data, while the timer_to_id
+         * array gives the sta through container_of */
+        u16 tid = *(int *)data;
+        struct sta_info *temp_sta = container_of((void *)data,
+                struct sta_info, timer_to_tid[tid]);
+
+        struct ieee80211_local *local = temp_sta->local;
+        struct ieee80211_hw *hw = &local->hw;
+        struct sta_info *sta;
+        u8 *state;
+
+        sta = sta_info_get(local, temp_sta->addr);
+        if (!sta)
+                return;
+
+        state = &sta->ampdu_mlme.tid_tx[tid].state;
+        /* check if the TID waits for addBA response */
+        spin_lock_bh(&sta->ampdu_mlme.ampdu_tx);
+        if (!(*state & HT_ADDBA_REQUESTED_MSK)) {
+                spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
+                *state = HT_AGG_STATE_IDLE;
+                printk(KERN_DEBUG "timer expired on tid %d but we are not "
+                                "expecting addBA response there", tid);
+                goto timer_expired_exit;
+        }
+
+        printk(KERN_DEBUG "addBA response timer expired on tid %d\n", tid);
+
+        /* go through the state check in stop_BA_session */
+        *state = HT_AGG_STATE_OPERATIONAL;
+        spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
+        ieee80211_stop_tx_ba_session(hw, temp_sta->addr, tid,
+                                     WLAN_BACK_INITIATOR);
+
+timer_expired_exit:
         sta_info_put(sta);
 }
 
@@ -1536,15 +1723,16 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_local *local = sdata->local;
         struct net_device *dev = sdata->dev;
-        struct ieee80211_hw_mode *mode;
+        struct ieee80211_supported_band *sband;
         struct sta_info *sta;
-        u32 rates;
+        u64 rates, basic_rates;
         u16 capab_info, status_code, aid;
         struct ieee802_11_elems elems;
         struct ieee80211_bss_conf *bss_conf = &sdata->bss_conf;
         u8 *pos;
         int i, j;
         DECLARE_MAC_BUF(mac);
+        bool have_higher_than_11mbit = false;
 
         /* AssocResp and ReassocResp have identical structure, so process both
          * of them in this function. */
@@ -1614,22 +1802,18 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
         if (ifsta->assocresp_ies)
                 memcpy(ifsta->assocresp_ies, pos, ifsta->assocresp_ies_len);
 
-        /* set AID, ieee80211_set_associated() will tell the driver */
-        bss_conf->aid = aid;
-        ieee80211_set_associated(dev, ifsta, 1);
-
         /* Add STA entry for the AP */
         sta = sta_info_get(local, ifsta->bssid);
         if (!sta) {
                 struct ieee80211_sta_bss *bss;
                 sta = sta_info_add(local, dev, ifsta->bssid, GFP_KERNEL);
-                if (!sta) {
+                if (IS_ERR(sta)) {
                         printk(KERN_DEBUG "%s: failed to add STA entry for the"
-                               " AP\n", dev->name);
+                               " AP (error %ld)\n", dev->name, PTR_ERR(sta));
                         return;
                 }
                 bss = ieee80211_rx_bss_get(dev, ifsta->bssid,
-                                           local->hw.conf.channel,
+                                           local->hw.conf.channel->center_freq,
                                            ifsta->ssid, ifsta->ssid_len);
                 if (bss) {
                         sta->last_rssi = bss->rssi;
@@ -1640,23 +1824,50 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
         }
 
         sta->dev = dev;
-        sta->flags |= WLAN_STA_AUTH | WLAN_STA_ASSOC | WLAN_STA_ASSOC_AP;
+        sta->flags |= WLAN_STA_AUTH | WLAN_STA_ASSOC | WLAN_STA_ASSOC_AP |
+                      WLAN_STA_AUTHORIZED;
 
         rates = 0;
-        mode = local->oper_hw_mode;
+        basic_rates = 0;
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+
         for (i = 0; i < elems.supp_rates_len; i++) {
                 int rate = (elems.supp_rates[i] & 0x7f) * 5;
-                for (j = 0; j < mode->num_rates; j++)
-                        if (mode->rates[j].rate == rate)
+
+                if (rate > 110)
+                        have_higher_than_11mbit = true;
+
+                for (j = 0; j < sband->n_bitrates; j++) {
+                        if (sband->bitrates[j].bitrate == rate)
                                 rates |= BIT(j);
+                        if (elems.supp_rates[i] & 0x80)
+                                basic_rates |= BIT(j);
+                }
         }
+
         for (i = 0; i < elems.ext_supp_rates_len; i++) {
                 int rate = (elems.ext_supp_rates[i] & 0x7f) * 5;
-                for (j = 0; j < mode->num_rates; j++)
-                        if (mode->rates[j].rate == rate)
+
+                if (rate > 110)
+                        have_higher_than_11mbit = true;
+
+                for (j = 0; j < sband->n_bitrates; j++) {
+                        if (sband->bitrates[j].bitrate == rate)
                                 rates |= BIT(j);
+                        if (elems.ext_supp_rates[i] & 0x80)
+                                basic_rates |= BIT(j);
+                }
         }
-        sta->supp_rates = rates;
+
+        sta->supp_rates[local->hw.conf.channel->band] = rates;
+        sdata->basic_rates = basic_rates;
+
+        /* cf. IEEE 802.11 9.2.12 */
+        if (local->hw.conf.channel->band == IEEE80211_BAND_2GHZ &&
+            have_higher_than_11mbit)
+                sdata->flags |= IEEE80211_SDATA_OPERATING_GMODE;
+        else
+                sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;
 
         if (elems.ht_cap_elem && elems.ht_info_elem && elems.wmm_param &&
             local->ops->conf_ht) {
@@ -1679,6 +1890,9 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
                                          elems.wmm_param_len);
         }
 
+        /* set AID, ieee80211_set_associated() will tell the driver */
+        bss_conf->aid = aid;
+        ieee80211_set_associated(dev, ifsta, 1);
 
         sta_info_put(sta);
 
@@ -1719,7 +1933,7 @@ static void __ieee80211_rx_bss_hash_del(struct net_device *dev,
 
 
 static struct ieee80211_sta_bss *
-ieee80211_rx_bss_add(struct net_device *dev, u8 *bssid, int channel,
+ieee80211_rx_bss_add(struct net_device *dev, u8 *bssid, int freq,
                      u8 *ssid, u8 ssid_len)
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
@@ -1731,7 +1945,7 @@ ieee80211_rx_bss_add(struct net_device *dev, u8 *bssid, int channel,
         atomic_inc(&bss->users);
         atomic_inc(&bss->users);
         memcpy(bss->bssid, bssid, ETH_ALEN);
-        bss->channel = channel;
+        bss->freq = freq;
         if (ssid && ssid_len <= IEEE80211_MAX_SSID_LEN) {
                 memcpy(bss->ssid, ssid, ssid_len);
                 bss->ssid_len = ssid_len;
@@ -1747,7 +1961,7 @@ ieee80211_rx_bss_add(struct net_device *dev, u8 *bssid, int channel,
 
 
 static struct ieee80211_sta_bss *
-ieee80211_rx_bss_get(struct net_device *dev, u8 *bssid, int channel,
+ieee80211_rx_bss_get(struct net_device *dev, u8 *bssid, int freq,
                      u8 *ssid, u8 ssid_len)
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
@@ -1757,7 +1971,7 @@ ieee80211_rx_bss_get(struct net_device *dev, u8 *bssid, int channel,
         bss = local->sta_bss_hash[STA_HASH(bssid)];
         while (bss) {
                 if (!memcmp(bss->bssid, bssid, ETH_ALEN) &&
-                    bss->channel == channel &&
+                    bss->freq == freq &&
                     bss->ssid_len == ssid_len &&
                     (ssid_len == 0 || !memcmp(bss->ssid, ssid, ssid_len))) {
                         atomic_inc(&bss->users);
@@ -1813,6 +2027,165 @@ void ieee80211_rx_bss_list_deinit(struct net_device *dev)
 }
 
 
+static int ieee80211_sta_join_ibss(struct net_device *dev,
+                                   struct ieee80211_if_sta *ifsta,
+                                   struct ieee80211_sta_bss *bss)
+{
+        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        int res, rates, i, j;
+        struct sk_buff *skb;
+        struct ieee80211_mgmt *mgmt;
+        struct ieee80211_tx_control control;
+        struct rate_selection ratesel;
+        u8 *pos;
+        struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_supported_band *sband;
+
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+
+        /* Remove possible STA entries from other IBSS networks. */
+        sta_info_flush(local, NULL);
+
+        if (local->ops->reset_tsf) {
+                /* Reset own TSF to allow time synchronization work. */
+                local->ops->reset_tsf(local_to_hw(local));
+        }
+        memcpy(ifsta->bssid, bss->bssid, ETH_ALEN);
+        res = ieee80211_if_config(dev);
+        if (res)
+                return res;
+
+        local->hw.conf.beacon_int = bss->beacon_int >= 10 ? bss->beacon_int : 10;
+
+        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        sdata->drop_unencrypted = bss->capability &
+                WLAN_CAPABILITY_PRIVACY ? 1 : 0;
+
+        res = ieee80211_set_freq(local, bss->freq);
+
+        if (local->oper_channel->flags & IEEE80211_CHAN_NO_IBSS) {
+                printk(KERN_DEBUG "%s: IBSS not allowed on frequency "
+                       "%d MHz\n", dev->name, local->oper_channel->center_freq);
+                return -1;
+        }
+
+        /* Set beacon template */
+        skb = dev_alloc_skb(local->hw.extra_tx_headroom + 400);
+        do {
+                if (!skb)
+                        break;
+
+                skb_reserve(skb, local->hw.extra_tx_headroom);
+
+                mgmt = (struct ieee80211_mgmt *)
+                        skb_put(skb, 24 + sizeof(mgmt->u.beacon));
+                memset(mgmt, 0, 24 + sizeof(mgmt->u.beacon));
+                mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
+                                                   IEEE80211_STYPE_BEACON);
+                memset(mgmt->da, 0xff, ETH_ALEN);
+                memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
+                memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
+                mgmt->u.beacon.beacon_int =
+                        cpu_to_le16(local->hw.conf.beacon_int);
+                mgmt->u.beacon.capab_info = cpu_to_le16(bss->capability);
+
+                pos = skb_put(skb, 2 + ifsta->ssid_len);
+                *pos++ = WLAN_EID_SSID;
+                *pos++ = ifsta->ssid_len;
+                memcpy(pos, ifsta->ssid, ifsta->ssid_len);
+
+                rates = bss->supp_rates_len;
+                if (rates > 8)
+                        rates = 8;
+                pos = skb_put(skb, 2 + rates);
+                *pos++ = WLAN_EID_SUPP_RATES;
+                *pos++ = rates;
+                memcpy(pos, bss->supp_rates, rates);
+
+                if (bss->band == IEEE80211_BAND_2GHZ) {
+                        pos = skb_put(skb, 2 + 1);
+                        *pos++ = WLAN_EID_DS_PARAMS;
+                        *pos++ = 1;
+                        *pos++ = ieee80211_frequency_to_channel(bss->freq);
+                }
+
+                pos = skb_put(skb, 2 + 2);
+                *pos++ = WLAN_EID_IBSS_PARAMS;
+                *pos++ = 2;
+                /* FIX: set ATIM window based on scan results */
+                *pos++ = 0;
+                *pos++ = 0;
+
+                if (bss->supp_rates_len > 8) {
+                        rates = bss->supp_rates_len - 8;
+                        pos = skb_put(skb, 2 + rates);
+                        *pos++ = WLAN_EID_EXT_SUPP_RATES;
+                        *pos++ = rates;
+                        memcpy(pos, &bss->supp_rates[8], rates);
+                }
+
+                memset(&control, 0, sizeof(control));
+                rate_control_get_rate(dev, sband, skb, &ratesel);
+                if (!ratesel.rate) {
+                        printk(KERN_DEBUG "%s: Failed to determine TX rate "
+                               "for IBSS beacon\n", dev->name);
+                        break;
+                }
+                control.vif = &sdata->vif;
+                control.tx_rate = ratesel.rate;
+                if (sdata->bss_conf.use_short_preamble &&
+                    ratesel.rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
+                        control.flags |= IEEE80211_TXCTL_SHORT_PREAMBLE;
+                control.antenna_sel_tx = local->hw.conf.antenna_sel_tx;
+                control.flags |= IEEE80211_TXCTL_NO_ACK;
+                control.retry_limit = 1;
+
+                ifsta->probe_resp = skb_copy(skb, GFP_ATOMIC);
+                if (ifsta->probe_resp) {
+                        mgmt = (struct ieee80211_mgmt *)
+                                ifsta->probe_resp->data;
+                        mgmt->frame_control =
+                                IEEE80211_FC(IEEE80211_FTYPE_MGMT,
+                                             IEEE80211_STYPE_PROBE_RESP);
+                } else {
+                        printk(KERN_DEBUG "%s: Could not allocate ProbeResp "
+                               "template for IBSS\n", dev->name);
+                }
+
+                if (local->ops->beacon_update &&
+                    local->ops->beacon_update(local_to_hw(local),
+                                             skb, &control) == 0) {
+                        printk(KERN_DEBUG "%s: Configured IBSS beacon "
+                               "template\n", dev->name);
+                        skb = NULL;
+                }
+
+                rates = 0;
+                sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+                for (i = 0; i < bss->supp_rates_len; i++) {
+                        int bitrate = (bss->supp_rates[i] & 0x7f) * 5;
+                        for (j = 0; j < sband->n_bitrates; j++)
+                                if (sband->bitrates[j].bitrate == bitrate)
+                                        rates |= BIT(j);
+                }
+                ifsta->supp_rates_bits[local->hw.conf.channel->band] = rates;
+        } while (0);
+
+        if (skb) {
+                printk(KERN_DEBUG "%s: Failed to configure IBSS beacon "
+                       "template\n", dev->name);
+                dev_kfree_skb(skb);
+        }
+
+        ifsta->state = IEEE80211_IBSS_JOINED;
+        mod_timer(&ifsta->timer, jiffies + IEEE80211_IBSS_MERGE_INTERVAL);
+
+        ieee80211_rx_bss_put(dev, bss);
+
+        return res;
+}
+
+
 static void ieee80211_rx_bss_info(struct net_device *dev,
                                   struct ieee80211_mgmt *mgmt,
                                   size_t len,
@@ -1822,11 +2195,11 @@ static void ieee80211_rx_bss_info(struct net_device *dev,
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
         struct ieee802_11_elems elems;
         size_t baselen;
-        int channel, clen;
+        int freq, clen;
         struct ieee80211_sta_bss *bss;
         struct sta_info *sta;
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        u64 timestamp;
+        u64 beacon_timestamp, rx_timestamp;
         DECLARE_MAC_BUF(mac);
         DECLARE_MAC_BUF(mac2);
 
@@ -1843,56 +2216,28 @@ static void ieee80211_rx_bss_info(struct net_device *dev,
         if (baselen > len)
                 return;
 
-        timestamp = le64_to_cpu(mgmt->u.beacon.timestamp);
-
-        if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS && beacon &&
-            memcmp(mgmt->bssid, sdata->u.sta.bssid, ETH_ALEN) == 0) {
-#ifdef CONFIG_MAC80211_IBSS_DEBUG
-                static unsigned long last_tsf_debug = 0;
-                u64 tsf;
-                if (local->ops->get_tsf)
-                        tsf = local->ops->get_tsf(local_to_hw(local));
-                else
-                        tsf = -1LLU;
-                if (time_after(jiffies, last_tsf_debug + 5 * HZ)) {
-                        printk(KERN_DEBUG "RX beacon SA=%s BSSID="
-                               "%s TSF=0x%llx BCN=0x%llx diff=%lld "
-                               "@%lu\n",
-                               print_mac(mac, mgmt->sa), print_mac(mac2, mgmt->bssid),
-                               (unsigned long long)tsf,
-                               (unsigned long long)timestamp,
-                               (unsigned long long)(tsf - timestamp),
-                               jiffies);
-                        last_tsf_debug = jiffies;
-                }
-#endif /* CONFIG_MAC80211_IBSS_DEBUG */
-        }
-
+        beacon_timestamp = le64_to_cpu(mgmt->u.beacon.timestamp);
         ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen, &elems);
 
         if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS && elems.supp_rates &&
             memcmp(mgmt->bssid, sdata->u.sta.bssid, ETH_ALEN) == 0 &&
             (sta = sta_info_get(local, mgmt->sa))) {
-                struct ieee80211_hw_mode *mode;
-                struct ieee80211_rate *rates;
+                struct ieee80211_supported_band *sband;
+                struct ieee80211_rate *bitrates;
                 size_t num_rates;
-                u32 supp_rates, prev_rates;
+                u64 supp_rates, prev_rates;
                 int i, j;
 
-                mode = local->sta_sw_scanning ?
-                       local->scan_hw_mode : local->oper_hw_mode;
+                sband = local->hw.wiphy->bands[rx_status->band];
 
-                if (local->sta_hw_scanning) {
-                        /* search for the correct mode matches the beacon */
-                        list_for_each_entry(mode, &local->modes_list, list)
-                                if (mode->mode == rx_status->phymode)
-                                        break;
-
-                        if (mode == NULL)
-                                mode = local->oper_hw_mode;
+                if (!sband) {
+                        WARN_ON(1);
+                        sband = local->hw.wiphy->bands[
+                                        local->hw.conf.channel->band];
                 }
-                rates = mode->rates;
-                num_rates = mode->num_rates;
+
+                bitrates = sband->bitrates;
+                num_rates = sband->n_bitrates;
 
                 supp_rates = 0;
                 for (i = 0; i < elems.supp_rates_len +
@@ -1906,24 +2251,27 @@ static void ieee80211_rx_bss_info(struct net_device *dev,
                                         [i - elems.supp_rates_len];
                         own_rate = 5 * (rate & 0x7f);
                         for (j = 0; j < num_rates; j++)
-                                if (rates[j].rate == own_rate)
+                                if (bitrates[j].bitrate == own_rate)
                                         supp_rates |= BIT(j);
                 }
 
-                prev_rates = sta->supp_rates;
-                sta->supp_rates &= supp_rates;
-                if (sta->supp_rates == 0) {
+                prev_rates = sta->supp_rates[rx_status->band];
+                sta->supp_rates[rx_status->band] &= supp_rates;
+                if (sta->supp_rates[rx_status->band] == 0) {
                         /* No matching rates - this should not really happen.
                          * Make sure that at least one rate is marked
                          * supported to avoid issues with TX rate ctrl. */
-                        sta->supp_rates = sdata->u.sta.supp_rates_bits;
+                        sta->supp_rates[rx_status->band] =
+                                sdata->u.sta.supp_rates_bits[rx_status->band];
                 }
-                if (sta->supp_rates != prev_rates) {
+                if (sta->supp_rates[rx_status->band] != prev_rates) {
                         printk(KERN_DEBUG "%s: updated supp_rates set for "
-                               "%s based on beacon info (0x%x & 0x%x -> "
-                               "0x%x)\n",
-                               dev->name, print_mac(mac, sta->addr), prev_rates,
-                               supp_rates, sta->supp_rates);
+                               "%s based on beacon info (0x%llx & 0x%llx -> "
+                               "0x%llx)\n",
+                               dev->name, print_mac(mac, sta->addr),
+                               (unsigned long long) prev_rates,
+                               (unsigned long long) supp_rates,
+                               (unsigned long long) sta->supp_rates[rx_status->band]);
                 }
                 sta_info_put(sta);
         }
@@ -1932,14 +2280,14 @@ static void ieee80211_rx_bss_info(struct net_device *dev,
                 return;
 
         if (elems.ds_params && elems.ds_params_len == 1)
-                channel = elems.ds_params[0];
+                freq = ieee80211_channel_to_frequency(elems.ds_params[0]);
         else
-                channel = rx_status->channel;
+                freq = rx_status->freq;
 
-        bss = ieee80211_rx_bss_get(dev, mgmt->bssid, channel,
+        bss = ieee80211_rx_bss_get(dev, mgmt->bssid, freq,
                                    elems.ssid, elems.ssid_len);
         if (!bss) {
-                bss = ieee80211_rx_bss_add(dev, mgmt->bssid, channel,
+                bss = ieee80211_rx_bss_add(dev, mgmt->bssid, freq,
                                            elems.ssid, elems.ssid_len);
                 if (!bss)
                         return;
@@ -1952,8 +2300,12 @@ static void ieee80211_rx_bss_info(struct net_device *dev,
 #endif
         }
 
-        if (bss->probe_resp && beacon) {
-                /* Do not allow beacon to override data from Probe Response. */
+        bss->band = rx_status->band;
+
+        if (sdata->vif.type != IEEE80211_IF_TYPE_IBSS &&
+            bss->probe_resp && beacon) {
+                /* STA mode:
+                 * Do not allow beacon to override data from Probe Response. */
                 ieee80211_rx_bss_put(dev, bss);
                 return;
         }
@@ -2050,27 +2402,69 @@ static void ieee80211_rx_bss_info(struct net_device *dev,
                 bss->ht_ie_len = 0;
         }
 
-        bss->hw_mode = rx_status->phymode;
-        bss->freq = rx_status->freq;
-        if (channel != rx_status->channel &&
-            (bss->hw_mode == MODE_IEEE80211G ||
-             bss->hw_mode == MODE_IEEE80211B) &&
-            channel >= 1 && channel <= 14) {
-                static const int freq_list[] = {
-                        2412, 2417, 2422, 2427, 2432, 2437, 2442,
-                        2447, 2452, 2457, 2462, 2467, 2472, 2484
-                };
-                /* IEEE 802.11g/b mode can receive packets from neighboring
-                 * channels, so map the channel into frequency. */
-                bss->freq = freq_list[channel - 1];
-        }
-        bss->timestamp = timestamp;
+        bss->timestamp = beacon_timestamp;
         bss->last_update = jiffies;
         bss->rssi = rx_status->ssi;
         bss->signal = rx_status->signal;
         bss->noise = rx_status->noise;
         if (!beacon)
                 bss->probe_resp++;
+
+        /* check if we need to merge IBSS */
+        if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS && beacon &&
+            !local->sta_sw_scanning && !local->sta_hw_scanning &&
+            bss->capability & WLAN_CAPABILITY_IBSS &&
+            bss->freq == local->oper_channel->center_freq &&
+            elems.ssid_len == sdata->u.sta.ssid_len &&
+            memcmp(elems.ssid, sdata->u.sta.ssid, sdata->u.sta.ssid_len) == 0) {
+                if (rx_status->flag & RX_FLAG_TSFT) {
+                        /* in order for correct IBSS merging we need mactime
+                         *
+                         * since mactime is defined as the time the first data
+                         * symbol of the frame hits the PHY, and the timestamp
+                         * of the beacon is defined as "the time that the data
+                         * symbol containing the first bit of the timestamp is
+                         * transmitted to the PHY plus the transmitting STA’s
+                         * delays through its local PHY from the MAC-PHY
+                         * interface to its interface with the WM"
+                         * (802.11 11.1.2) - equals the time this bit arrives at
+                         * the receiver - we have to take into account the
+                         * offset between the two.
+                         * e.g: at 1 MBit that means mactime is 192 usec earlier
+                         * (=24 bytes * 8 usecs/byte) than the beacon timestamp.
+                         */
+                        int rate = local->hw.wiphy->bands[rx_status->band]->
+                                        bitrates[rx_status->rate_idx].bitrate;
+                        rx_timestamp = rx_status->mactime + (24 * 8 * 10 / rate);
+                } else if (local && local->ops && local->ops->get_tsf)
+                        /* second best option: get current TSF */
+                        rx_timestamp = local->ops->get_tsf(local_to_hw(local));
+                else
+                        /* can't merge without knowing the TSF */
+                        rx_timestamp = -1LLU;
+#ifdef CONFIG_MAC80211_IBSS_DEBUG
+                printk(KERN_DEBUG "RX beacon SA=%s BSSID="
+                       "%s TSF=0x%llx BCN=0x%llx diff=%lld @%lu\n",
+                       print_mac(mac, mgmt->sa),
+                       print_mac(mac2, mgmt->bssid),
+                       (unsigned long long)rx_timestamp,
+                       (unsigned long long)beacon_timestamp,
+                       (unsigned long long)(rx_timestamp - beacon_timestamp),
+                       jiffies);
+#endif /* CONFIG_MAC80211_IBSS_DEBUG */
+                if (beacon_timestamp > rx_timestamp) {
+#ifndef CONFIG_MAC80211_IBSS_DEBUG
+                        if (net_ratelimit())
+#endif
+                                printk(KERN_DEBUG "%s: beacon TSF higher than "
+                                       "local TSF - IBSS merge with BSSID %s\n",
+                                       dev->name, print_mac(mac, mgmt->bssid));
+                        ieee80211_sta_join_ibss(dev, &sdata->u.sta, bss);
+                        ieee80211_ibss_add_sta(dev, NULL,
+                                               mgmt->bssid, mgmt->sa);
+                }
+        }
+
         ieee80211_rx_bss_put(dev, bss);
 }
 
@@ -2235,6 +2629,12 @@ static void ieee80211_rx_mgmt_action(struct net_device *dev,
                                 break;
                         ieee80211_sta_process_addba_request(dev, mgmt, len);
                         break;
+                case WLAN_ACTION_ADDBA_RESP:
+                        if (len < (IEEE80211_MIN_ACTION_SIZE +
+                                   sizeof(mgmt->u.action.u.addba_resp)))
+                                break;
+                        ieee80211_sta_process_addba_resp(dev, mgmt, len);
+                        break;
                 case WLAN_ACTION_DELBA:
                         if (len < (IEEE80211_MIN_ACTION_SIZE +
                                    sizeof(mgmt->u.action.u.delba)))
@@ -2348,7 +2748,7 @@ static void ieee80211_sta_rx_queued_mgmt(struct net_device *dev,
 }
 
 
-ieee80211_txrx_result
+ieee80211_rx_result
 ieee80211_sta_rx_scan(struct net_device *dev, struct sk_buff *skb,
                       struct ieee80211_rx_status *rx_status)
 {
@@ -2356,31 +2756,31 @@ ieee80211_sta_rx_scan(struct net_device *dev, struct sk_buff *skb,
         u16 fc;
 
         if (skb->len < 2)
-                return TXRX_DROP;
+                return RX_DROP_UNUSABLE;
 
         mgmt = (struct ieee80211_mgmt *) skb->data;
         fc = le16_to_cpu(mgmt->frame_control);
 
         if ((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_CTL)
-                return TXRX_CONTINUE;
+                return RX_CONTINUE;
 
         if (skb->len < 24)
-                return TXRX_DROP;
+                return RX_DROP_MONITOR;
 
         if ((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_MGMT) {
                 if ((fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_PROBE_RESP) {
                         ieee80211_rx_mgmt_probe_resp(dev, mgmt,
                                                      skb->len, rx_status);
                         dev_kfree_skb(skb);
-                        return TXRX_QUEUED;
+                        return RX_QUEUED;
                 } else if ((fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_BEACON) {
                         ieee80211_rx_mgmt_beacon(dev, mgmt, skb->len,
                                                  rx_status);
                         dev_kfree_skb(skb);
-                        return TXRX_QUEUED;
+                        return RX_QUEUED;
                 }
         }
-        return TXRX_CONTINUE;
+        return RX_CONTINUE;
 }
 
 
@@ -2629,7 +3029,7 @@ static int ieee80211_sta_config_auth(struct net_device *dev,
         }
 
         spin_lock_bh(&local->sta_bss_lock);
-        freq = local->oper_channel->freq;
+        freq = local->oper_channel->center_freq;
         list_for_each_entry(bss, &local->sta_bss_list, list) {
                 if (!(bss->capability & WLAN_CAPABILITY_ESS))
                         continue;
@@ -2660,7 +3060,7 @@ static int ieee80211_sta_config_auth(struct net_device *dev,
         spin_unlock_bh(&local->sta_bss_lock);
 
         if (selected) {
-                ieee80211_set_channel(local, -1, selected->freq);
+                ieee80211_set_freq(local, selected->freq);
                 if (!(ifsta->flags & IEEE80211_STA_SSID_SET))
                         ieee80211_sta_set_ssid(dev, selected->ssid,
                                                selected->ssid_len);
@@ -2684,162 +3084,6 @@ static int ieee80211_sta_config_auth(struct net_device *dev,
         return -1;
 }
 
-static int ieee80211_sta_join_ibss(struct net_device *dev,
-                                   struct ieee80211_if_sta *ifsta,
-                                   struct ieee80211_sta_bss *bss)
-{
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        int res, rates, i, j;
-        struct sk_buff *skb;
-        struct ieee80211_mgmt *mgmt;
-        struct ieee80211_tx_control control;
-        struct ieee80211_hw_mode *mode;
-        struct rate_selection ratesel;
-        u8 *pos;
-        struct ieee80211_sub_if_data *sdata;
-
-        /* Remove possible STA entries from other IBSS networks. */
-        sta_info_flush(local, NULL);
-
-        if (local->ops->reset_tsf) {
-                /* Reset own TSF to allow time synchronization work. */
-                local->ops->reset_tsf(local_to_hw(local));
-        }
-        memcpy(ifsta->bssid, bss->bssid, ETH_ALEN);
-        res = ieee80211_if_config(dev);
-        if (res)
-                return res;
-
-        local->hw.conf.beacon_int = bss->beacon_int >= 10 ? bss->beacon_int : 10;
-
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        sdata->drop_unencrypted = bss->capability &
-                WLAN_CAPABILITY_PRIVACY ? 1 : 0;
-
-        res = ieee80211_set_channel(local, -1, bss->freq);
-
-        if (!(local->oper_channel->flag & IEEE80211_CHAN_W_IBSS)) {
-                printk(KERN_DEBUG "%s: IBSS not allowed on channel %d "
-                       "(%d MHz)\n", dev->name, local->hw.conf.channel,
-                       local->hw.conf.freq);
-                return -1;
-        }
-
-        /* Set beacon template based on scan results */
-        skb = dev_alloc_skb(local->hw.extra_tx_headroom + 400);
-        do {
-                if (!skb)
-                        break;
-
-                skb_reserve(skb, local->hw.extra_tx_headroom);
-
-                mgmt = (struct ieee80211_mgmt *)
-                        skb_put(skb, 24 + sizeof(mgmt->u.beacon));
-                memset(mgmt, 0, 24 + sizeof(mgmt->u.beacon));
-                mgmt->frame_control = IEEE80211_FC(IEEE80211_FTYPE_MGMT,
-                                                   IEEE80211_STYPE_BEACON);
-                memset(mgmt->da, 0xff, ETH_ALEN);
-                memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN);
-                memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
-                mgmt->u.beacon.beacon_int =
-                        cpu_to_le16(local->hw.conf.beacon_int);
-                mgmt->u.beacon.capab_info = cpu_to_le16(bss->capability);
-
-                pos = skb_put(skb, 2 + ifsta->ssid_len);
-                *pos++ = WLAN_EID_SSID;
-                *pos++ = ifsta->ssid_len;
-                memcpy(pos, ifsta->ssid, ifsta->ssid_len);
-
-                rates = bss->supp_rates_len;
-                if (rates > 8)
-                        rates = 8;
-                pos = skb_put(skb, 2 + rates);
-                *pos++ = WLAN_EID_SUPP_RATES;
-                *pos++ = rates;
-                memcpy(pos, bss->supp_rates, rates);
-
-                pos = skb_put(skb, 2 + 1);
-                *pos++ = WLAN_EID_DS_PARAMS;
-                *pos++ = 1;
-                *pos++ = bss->channel;
-
-                pos = skb_put(skb, 2 + 2);
-                *pos++ = WLAN_EID_IBSS_PARAMS;
-                *pos++ = 2;
-                /* FIX: set ATIM window based on scan results */
-                *pos++ = 0;
-                *pos++ = 0;
-
-                if (bss->supp_rates_len > 8) {
-                        rates = bss->supp_rates_len - 8;
-                        pos = skb_put(skb, 2 + rates);
-                        *pos++ = WLAN_EID_EXT_SUPP_RATES;
-                        *pos++ = rates;
-                        memcpy(pos, &bss->supp_rates[8], rates);
-                }
-
-                memset(&control, 0, sizeof(control));
-                rate_control_get_rate(dev, local->oper_hw_mode, skb, &ratesel);
-                if (!ratesel.rate) {
-                        printk(KERN_DEBUG "%s: Failed to determine TX rate "
-                               "for IBSS beacon\n", dev->name);
-                        break;
-                }
-                control.vif = &sdata->vif;
-                control.tx_rate =
-                        (sdata->bss_conf.use_short_preamble &&
-                        (ratesel.rate->flags & IEEE80211_RATE_PREAMBLE2)) ?
-                        ratesel.rate->val2 : ratesel.rate->val;
-                control.antenna_sel_tx = local->hw.conf.antenna_sel_tx;
-                control.power_level = local->hw.conf.power_level;
-                control.flags |= IEEE80211_TXCTL_NO_ACK;
-                control.retry_limit = 1;
-
-                ifsta->probe_resp = skb_copy(skb, GFP_ATOMIC);
-                if (ifsta->probe_resp) {
-                        mgmt = (struct ieee80211_mgmt *)
-                                ifsta->probe_resp->data;
-                        mgmt->frame_control =
-                                IEEE80211_FC(IEEE80211_FTYPE_MGMT,
-                                             IEEE80211_STYPE_PROBE_RESP);
-                } else {
-                        printk(KERN_DEBUG "%s: Could not allocate ProbeResp "
-                               "template for IBSS\n", dev->name);
-                }
-
-                if (local->ops->beacon_update &&
-                    local->ops->beacon_update(local_to_hw(local),
-                                             skb, &control) == 0) {
-                        printk(KERN_DEBUG "%s: Configured IBSS beacon "
-                               "template based on scan results\n", dev->name);
-                        skb = NULL;
-                }
-
-                rates = 0;
-                mode = local->oper_hw_mode;
-                for (i = 0; i < bss->supp_rates_len; i++) {
-                        int bitrate = (bss->supp_rates[i] & 0x7f) * 5;
-                        for (j = 0; j < mode->num_rates; j++)
-                                if (mode->rates[j].rate == bitrate)
-                                        rates |= BIT(j);
-                }
-                ifsta->supp_rates_bits = rates;
-        } while (0);
-
-        if (skb) {
-                printk(KERN_DEBUG "%s: Failed to configure IBSS beacon "
-                       "template\n", dev->name);
-                dev_kfree_skb(skb);
-        }
-
-        ifsta->state = IEEE80211_IBSS_JOINED;
-        mod_timer(&ifsta->timer, jiffies + IEEE80211_IBSS_MERGE_INTERVAL);
-
-        ieee80211_rx_bss_put(dev, bss);
-
-        return res;
-}
-
 
 static int ieee80211_sta_create_ibss(struct net_device *dev,
                                      struct ieee80211_if_sta *ifsta)
@@ -2847,7 +3091,7 @@ static int ieee80211_sta_create_ibss(struct net_device *dev,
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
         struct ieee80211_sta_bss *bss;
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        struct ieee80211_hw_mode *mode;
+        struct ieee80211_supported_band *sband;
         u8 bssid[ETH_ALEN], *pos;
         int i;
         DECLARE_MAC_BUF(mac);
@@ -2869,28 +3113,28 @@ static int ieee80211_sta_create_ibss(struct net_device *dev,
         printk(KERN_DEBUG "%s: Creating new IBSS network, BSSID %s\n",
                dev->name, print_mac(mac, bssid));
 
-        bss = ieee80211_rx_bss_add(dev, bssid, local->hw.conf.channel,
+        bss = ieee80211_rx_bss_add(dev, bssid,
+                                   local->hw.conf.channel->center_freq,
                                    sdata->u.sta.ssid, sdata->u.sta.ssid_len);
         if (!bss)
                 return -ENOMEM;
 
-        mode = local->oper_hw_mode;
+        bss->band = local->hw.conf.channel->band;
+        sband = local->hw.wiphy->bands[bss->band];
 
         if (local->hw.conf.beacon_int == 0)
                 local->hw.conf.beacon_int = 100;
         bss->beacon_int = local->hw.conf.beacon_int;
-        bss->hw_mode = local->hw.conf.phymode;
-        bss->freq = local->hw.conf.freq;
         bss->last_update = jiffies;
         bss->capability = WLAN_CAPABILITY_IBSS;
         if (sdata->default_key) {
                 bss->capability |= WLAN_CAPABILITY_PRIVACY;
         } else
                 sdata->drop_unencrypted = 0;
-        bss->supp_rates_len = mode->num_rates;
+        bss->supp_rates_len = sband->n_bitrates;
         pos = bss->supp_rates;
-        for (i = 0; i < mode->num_rates; i++) {
-                int rate = mode->rates[i].rate;
+        for (i = 0; i < sband->n_bitrates; i++) {
+                int rate = sband->bitrates[i].bitrate;
                 *pos++ = (u8) (rate / 5);
         }
 
@@ -2939,7 +3183,8 @@ static int ieee80211_sta_find_ibss(struct net_device *dev,
                "%s\n", print_mac(mac, bssid), print_mac(mac2, ifsta->bssid));
 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
         if (found && memcmp(ifsta->bssid, bssid, ETH_ALEN) != 0 &&
-            (bss = ieee80211_rx_bss_get(dev, bssid, local->hw.conf.channel,
+            (bss = ieee80211_rx_bss_get(dev, bssid,
+                                        local->hw.conf.channel->center_freq,
                                         ifsta->ssid, ifsta->ssid_len))) {
                 printk(KERN_DEBUG "%s: Selected IBSS BSSID %s"
                        " based on configured SSID\n",
@@ -2967,13 +3212,13 @@ static int ieee80211_sta_find_ibss(struct net_device *dev,
                 if (time_after(jiffies, ifsta->ibss_join_req +
                                IEEE80211_IBSS_JOIN_TIMEOUT)) {
                         if ((ifsta->flags & IEEE80211_STA_CREATE_IBSS) &&
-                            local->oper_channel->flag & IEEE80211_CHAN_W_IBSS)
+                            (!(local->oper_channel->flags &
+                                        IEEE80211_CHAN_NO_IBSS)))
                                 return ieee80211_sta_create_ibss(dev, ifsta);
                         if (ifsta->flags & IEEE80211_STA_CREATE_IBSS) {
-                                printk(KERN_DEBUG "%s: IBSS not allowed on the"
-                                       " configured channel %d (%d MHz)\n",
-                                       dev->name, local->hw.conf.channel,
-                                       local->hw.conf.freq);
+                                printk(KERN_DEBUG "%s: IBSS not allowed on"
+                                       " %d MHz\n", dev->name,
+                                       local->hw.conf.channel->center_freq);
                         }
 
                         /* No IBSS found - decrease scan interval and continue
@@ -2992,7 +3237,7 @@ static int ieee80211_sta_find_ibss(struct net_device *dev,
 
 int ieee80211_sta_set_ssid(struct net_device *dev, char *ssid, size_t len)
 {
-        struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_if_sta *ifsta;
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 
@@ -3006,18 +3251,23 @@ int ieee80211_sta_set_ssid(struct net_device *dev, char *ssid, size_t len)
                 int i;
 
                 memset(&qparam, 0, sizeof(qparam));
-                /* TODO: are these ok defaults for all hw_modes? */
+
                 qparam.aifs = 2;
-                qparam.cw_min =
-                        local->hw.conf.phymode == MODE_IEEE80211B ? 31 : 15;
+
+                if (local->hw.conf.channel->band == IEEE80211_BAND_2GHZ &&
+                    !(sdata->flags & IEEE80211_SDATA_OPERATING_GMODE))
+                        qparam.cw_min = 31;
+                else
+                        qparam.cw_min = 15;
+
                 qparam.cw_max = 1023;
-                qparam.burst_time = 0;
+                qparam.txop = 0;
+
                 for (i = IEEE80211_TX_QUEUE_DATA0; i < NUM_TX_DATA_QUEUES; i++)
-                {
                         local->ops->conf_tx(local_to_hw(local),
                                            i + IEEE80211_TX_QUEUE_DATA0,
                                            &qparam);
-                }
+
                 /* IBSS uses different parameters for Beacon sending */
                 qparam.cw_min++;
                 qparam.cw_min *= 2;
@@ -3026,7 +3276,6 @@ int ieee80211_sta_set_ssid(struct net_device *dev, char *ssid, size_t len)
                                    IEEE80211_TX_QUEUE_BEACON, &qparam);
         }
 
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         ifsta = &sdata->u.sta;
 
         if (ifsta->ssid_len != len || memcmp(ifsta->ssid, ssid, len) != 0)
@@ -3185,7 +3434,7 @@ void ieee80211_sta_scan_work(struct work_struct *work)
                 container_of(work, struct ieee80211_local, scan_work.work);
         struct net_device *dev = local->scan_dev;
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        struct ieee80211_hw_mode *mode;
+        struct ieee80211_supported_band *sband;
         struct ieee80211_channel *chan;
         int skip;
         unsigned long next_delay = 0;
@@ -3195,44 +3444,59 @@ void ieee80211_sta_scan_work(struct work_struct *work)
 
         switch (local->scan_state) {
         case SCAN_SET_CHANNEL:
-                mode = local->scan_hw_mode;
-                if (local->scan_hw_mode->list.next == &local->modes_list &&
-                    local->scan_channel_idx >= mode->num_channels) {
+                /*
+                 * Get current scan band. scan_band may be IEEE80211_NUM_BANDS
+                 * after we successfully scanned the last channel of the last
+                 * band (and the last band is supported by the hw)
+                 */
+                if (local->scan_band < IEEE80211_NUM_BANDS)
+                        sband = local->hw.wiphy->bands[local->scan_band];
+                else
+                        sband = NULL;
+
+                /*
+                 * If we are at an unsupported band and have more bands
+                 * left to scan, advance to the next supported one.
+                 */
+                while (!sband && local->scan_band < IEEE80211_NUM_BANDS - 1) {
+                        local->scan_band++;
+                        sband = local->hw.wiphy->bands[local->scan_band];
+                        local->scan_channel_idx = 0;
+                }
+
+                /* if no more bands/channels left, complete scan */
+                if (!sband || local->scan_channel_idx >= sband->n_channels) {
                         ieee80211_scan_completed(local_to_hw(local));
                         return;
                 }
-                skip = !(local->enabled_modes & (1 << mode->mode));
-                chan = &mode->channels[local->scan_channel_idx];
-                if (!(chan->flag & IEEE80211_CHAN_W_SCAN) ||
+                skip = 0;
+                chan = &sband->channels[local->scan_channel_idx];
+
+                if (chan->flags & IEEE80211_CHAN_DISABLED ||
                     (sdata->vif.type == IEEE80211_IF_TYPE_IBSS &&
-                     !(chan->flag & IEEE80211_CHAN_W_IBSS)) ||
-                    (local->hw_modes & local->enabled_modes &
-                     (1 << MODE_IEEE80211G) && mode->mode == MODE_IEEE80211B))
+                     chan->flags & IEEE80211_CHAN_NO_IBSS))
                         skip = 1;
 
                 if (!skip) {
-#if 0
-                        printk(KERN_DEBUG "%s: scan channel %d (%d MHz)\n",
-                               dev->name, chan->chan, chan->freq);
-#endif
-
                         local->scan_channel = chan;
                         if (ieee80211_hw_config(local)) {
-                                printk(KERN_DEBUG "%s: failed to set channel "
-                                       "%d (%d MHz) for scan\n", dev->name,
-                                       chan->chan, chan->freq);
+                                printk(KERN_DEBUG "%s: failed to set freq to "
+                                       "%d MHz for scan\n", dev->name,
+                                       chan->center_freq);
                                 skip = 1;
                         }
                 }
 
+                /* advance state machine to next channel/band */
                 local->scan_channel_idx++;
-                if (local->scan_channel_idx >= local->scan_hw_mode->num_channels) {
-                        if (local->scan_hw_mode->list.next != &local->modes_list) {
-                                local->scan_hw_mode = list_entry(local->scan_hw_mode->list.next,
-                                                                 struct ieee80211_hw_mode,
-                                                                 list);
-                                local->scan_channel_idx = 0;
-                        }
+                if (local->scan_channel_idx >= sband->n_channels) {
+                        /*
+                         * scan_band may end up == IEEE80211_NUM_BANDS, but
+                         * we'll catch that case above and complete the scan
+                         * if that is the case.
+                         */
+                        local->scan_band++;
+                        local->scan_channel_idx = 0;
                 }
 
                 if (skip)
@@ -3243,13 +3507,14 @@ void ieee80211_sta_scan_work(struct work_struct *work)
                 local->scan_state = SCAN_SEND_PROBE;
                 break;
         case SCAN_SEND_PROBE:
-                if (local->scan_channel->flag & IEEE80211_CHAN_W_ACTIVE_SCAN) {
-                        ieee80211_send_probe_req(dev, NULL, local->scan_ssid,
-                                                 local->scan_ssid_len);
-                        next_delay = IEEE80211_CHANNEL_TIME;
-                } else
-                        next_delay = IEEE80211_PASSIVE_CHANNEL_TIME;
+                next_delay = IEEE80211_PASSIVE_CHANNEL_TIME;
                 local->scan_state = SCAN_SET_CHANNEL;
+
+                if (local->scan_channel->flags & IEEE80211_CHAN_PASSIVE_SCAN)
+                        break;
+                ieee80211_send_probe_req(dev, NULL, local->scan_ssid,
+                                         local->scan_ssid_len);
+                next_delay = IEEE80211_CHANNEL_TIME;
                 break;
         }
 
@@ -3324,10 +3589,8 @@ static int ieee80211_sta_start_scan(struct net_device *dev,
         } else
                 local->scan_ssid_len = 0;
         local->scan_state = SCAN_SET_CHANNEL;
-        local->scan_hw_mode = list_entry(local->modes_list.next,
-                                         struct ieee80211_hw_mode,
-                                         list);
         local->scan_channel_idx = 0;
+        local->scan_band = IEEE80211_BAND_2GHZ;
         local->scan_dev = dev;
 
         netif_tx_lock_bh(local->mdev);
@@ -3382,9 +3645,6 @@ ieee80211_sta_scan_result(struct net_device *dev,
                        bss->last_update + IEEE80211_SCAN_RESULT_EXPIRE))
                 return current_ev;
 
-        if (!(local->enabled_modes & (1 << bss->hw_mode)))
-                return current_ev;
-
         memset(&iwe, 0, sizeof(iwe));
         iwe.cmd = SIOCGIWAP;
         iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
@@ -3412,12 +3672,15 @@ ieee80211_sta_scan_result(struct net_device *dev,
 
         memset(&iwe, 0, sizeof(iwe));
         iwe.cmd = SIOCGIWFREQ;
-        iwe.u.freq.m = bss->channel;
-        iwe.u.freq.e = 0;
+        iwe.u.freq.m = bss->freq;
+        iwe.u.freq.e = 6;
         current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
                                           IW_EV_FREQ_LEN);
-        iwe.u.freq.m = bss->freq * 100000;
-        iwe.u.freq.e = 1;
+
+        memset(&iwe, 0, sizeof(iwe));
+        iwe.cmd = SIOCGIWFREQ;
+        iwe.u.freq.m = ieee80211_frequency_to_channel(bss->freq);
+        iwe.u.freq.e = 0;
         current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
                                           IW_EV_FREQ_LEN);
 
@@ -3557,10 +3820,13 @@ struct sta_info * ieee80211_ibss_add_sta(struct net_device *dev,
                wiphy_name(local->hw.wiphy), print_mac(mac, addr), dev->name);
 
         sta = sta_info_add(local, dev, addr, GFP_ATOMIC);
-        if (!sta)
+        if (IS_ERR(sta))
                 return NULL;
 
-        sta->supp_rates = sdata->u.sta.supp_rates_bits;
+        sta->flags |= WLAN_STA_AUTHORIZED;
+
+        sta->supp_rates[local->hw.conf.channel->band] =
+                sdata->u.sta.supp_rates_bits[local->hw.conf.channel->band];
 
         rate_control_rate_init(sta, local);
 
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index ed57fb8e82fc..eac9c59dbc4d 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -13,6 +13,7 @@
 #include <linux/etherdevice.h>
 #include <linux/list.h>
 #include <linux/rcupdate.h>
+#include <linux/rtnetlink.h>
 #include <net/mac80211.h>
 #include "ieee80211_i.h"
 #include "debugfs_key.h"
@@ -34,6 +35,10 @@
  *
  * All operations here are called under RTNL so no extra locking is
  * required.
+ *
+ * NOTE: This code requires that sta info *destruction* is done under
+ *       RTNL, otherwise it can try to access already freed STA structs
+ *       when a STA key is being freed.
  */
 
 static const u8 bcast_addr[ETH_ALEN] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
@@ -84,16 +89,25 @@ static void ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
                        key->conf.keyidx, print_mac(mac, addr), ret);
 }
 
+static void ieee80211_key_mark_hw_accel_off(struct ieee80211_key *key)
+{
+        if (key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) {
+                key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE;
+                key->flags |= KEY_FLAG_REMOVE_FROM_HARDWARE;
+        }
+}
+
 static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
 {
         const u8 *addr;
         int ret;
         DECLARE_MAC_BUF(mac);
 
-        if (!key->local->ops->set_key)
+        if (!key || !key->local->ops->set_key)
                 return;
 
-        if (!(key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE))
+        if (!(key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) &&
+            !(key->flags & KEY_FLAG_REMOVE_FROM_HARDWARE))
                 return;
 
         addr = get_mac_for_key(key);
@@ -108,12 +122,11 @@ static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
                        wiphy_name(key->local->hw.wiphy),
                        key->conf.keyidx, print_mac(mac, addr), ret);
 
-        key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE;
+        key->flags &= ~(KEY_FLAG_UPLOADED_TO_HARDWARE |
+                        KEY_FLAG_REMOVE_FROM_HARDWARE);
 }
 
-struct ieee80211_key *ieee80211_key_alloc(struct ieee80211_sub_if_data *sdata,
-                                          struct sta_info *sta,
-                                          enum ieee80211_key_alg alg,
+struct ieee80211_key *ieee80211_key_alloc(enum ieee80211_key_alg alg,
                                           int idx,
                                           size_t key_len,
                                           const u8 *key_data)
@@ -137,10 +150,7 @@ struct ieee80211_key *ieee80211_key_alloc(struct ieee80211_sub_if_data *sdata,
         key->conf.keyidx = idx;
         key->conf.keylen = key_len;
         memcpy(key->conf.key, key_data, key_len);
-
-        key->local = sdata->local;
-        key->sdata = sdata;
-        key->sta = sta;
+        INIT_LIST_HEAD(&key->list);
 
         if (alg == ALG_CCMP) {
                 /*
@@ -154,13 +164,68 @@ struct ieee80211_key *ieee80211_key_alloc(struct ieee80211_sub_if_data *sdata,
                 }
         }
 
-        ieee80211_debugfs_key_add(key->local, key);
+        return key;
+}
 
-        /* remove key first */
-        if (sta)
-                ieee80211_key_free(sta->key);
-        else
-                ieee80211_key_free(sdata->keys[idx]);
+static void __ieee80211_key_replace(struct ieee80211_sub_if_data *sdata,
+                                    struct sta_info *sta,
+                                    struct ieee80211_key *key,
+                                    struct ieee80211_key *new)
+{
+        int idx, defkey;
+
+        if (sta) {
+                rcu_assign_pointer(sta->key, new);
+        } else {
+                WARN_ON(new && key && new->conf.keyidx != key->conf.keyidx);
+
+                if (key)
+                        idx = key->conf.keyidx;
+                else
+                        idx = new->conf.keyidx;
+
+                defkey = key && sdata->default_key == key;
+
+                if (defkey && !new)
+                        ieee80211_set_default_key(sdata, -1);
+
+                rcu_assign_pointer(sdata->keys[idx], new);
+                if (new)
+                        list_add(&new->list, &sdata->key_list);
+
+                if (defkey && new)
+                        ieee80211_set_default_key(sdata, new->conf.keyidx);
+        }
+
+        if (key) {
+                ieee80211_key_mark_hw_accel_off(key);
+                /*
+                 * We'll use an empty list to indicate that the key
+                 * has already been removed.
+                 */
+                list_del_init(&key->list);
+        }
+}
+
+void ieee80211_key_link(struct ieee80211_key *key,
+                        struct ieee80211_sub_if_data *sdata,
+                        struct sta_info *sta)
+{
+        struct ieee80211_key *old_key;
+        int idx;
+
+        ASSERT_RTNL();
+        might_sleep();
+
+        BUG_ON(!sdata);
+        BUG_ON(!key);
+
+        idx = key->conf.keyidx;
+        key->local = sdata->local;
+        key->sdata = sdata;
+        key->sta = sta;
+
+        ieee80211_debugfs_key_add(key->local, key);
 
         if (sta) {
                 ieee80211_debugfs_key_sta_link(key, sta);
@@ -186,50 +251,59 @@ struct ieee80211_key *ieee80211_key_alloc(struct ieee80211_sub_if_data *sdata,
                 }
         }
 
-        /* enable hwaccel if appropriate */
-        if (netif_running(key->sdata->dev))
-                ieee80211_key_enable_hw_accel(key);
-
         if (sta)
-                rcu_assign_pointer(sta->key, key);
+                old_key = sta->key;
         else
-                rcu_assign_pointer(sdata->keys[idx], key);
+                old_key = sdata->keys[idx];
 
-        list_add(&key->list, &sdata->key_list);
+        __ieee80211_key_replace(sdata, sta, old_key, key);
 
-        return key;
+        if (old_key) {
+                synchronize_rcu();
+                ieee80211_key_free(old_key);
+        }
+
+        if (netif_running(sdata->dev))
+                ieee80211_key_enable_hw_accel(key);
 }
 
 void ieee80211_key_free(struct ieee80211_key *key)
 {
+        ASSERT_RTNL();
+        might_sleep();
+
         if (!key)
                 return;
 
-        if (key->sta) {
-                rcu_assign_pointer(key->sta->key, NULL);
-        } else {
-                if (key->sdata->default_key == key)
-                        ieee80211_set_default_key(key->sdata, -1);
-                if (key->conf.keyidx >= 0 &&
-                    key->conf.keyidx < NUM_DEFAULT_KEYS)
-                        rcu_assign_pointer(key->sdata->keys[key->conf.keyidx],
-                                           NULL);
-                else
-                        WARN_ON(1);
-        }
+        if (key->sdata) {
+                /*
+                 * Replace key with nothingness.
+                 *
+                 * Because other code may have key reference (RCU protected)
+                 * right now, we then wait for a grace period before freeing
+                 * it.
+                 * An empty list indicates it was never added to the key list
+                 * or has been removed already. It may, however, still be in
+                 * hardware for acceleration.
+                 */
+                if (!list_empty(&key->list))
+                        __ieee80211_key_replace(key->sdata, key->sta,
+                                                key, NULL);
 
-        /* wait for all key users to complete */
-        synchronize_rcu();
+                synchronize_rcu();
 
-        /* remove from hwaccel if appropriate */
-        ieee80211_key_disable_hw_accel(key);
+                /*
+                 * Remove from hwaccel if appropriate, this will
+                 * only happen when the key is actually unlinked,
+                 * it will already be done when the key was replaced.
+                 */
+                ieee80211_key_disable_hw_accel(key);
+        }
 
         if (key->conf.alg == ALG_CCMP)
                 ieee80211_aes_key_free(key->u.ccmp.tfm);
         ieee80211_debugfs_key_remove(key);
 
-        list_del(&key->list);
-
         kfree(key);
 }
 
@@ -253,6 +327,10 @@ void ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata, int idx)
 void ieee80211_free_keys(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_key *key, *tmp;
+        LIST_HEAD(tmp_list);
+
+        ASSERT_RTNL();
+        might_sleep();
 
         list_for_each_entry_safe(key, tmp, &sdata->key_list, list)
                 ieee80211_key_free(key);
@@ -262,8 +340,10 @@ void ieee80211_enable_keys(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_key *key;
 
-        WARN_ON(!netif_running(sdata->dev));
-        if (!netif_running(sdata->dev))
+        ASSERT_RTNL();
+        might_sleep();
+
+        if (WARN_ON(!netif_running(sdata->dev)))
                 return;
 
         list_for_each_entry(key, &sdata->key_list, list)
@@ -274,6 +354,9 @@ void ieee80211_disable_keys(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_key *key;
 
+        ASSERT_RTNL();
+        might_sleep();
+
         list_for_each_entry(key, &sdata->key_list, list)
                 ieee80211_key_disable_hw_accel(key);
 }
diff --git a/net/mac80211/rc80211_pid_algo.c b/net/mac80211/rc80211_pid_algo.c
index c339571632b2..9762803e4876 100644
--- a/net/mac80211/rc80211_pid_algo.c
+++ b/net/mac80211/rc80211_pid_algo.c
@@ -2,7 +2,7 @@
  * Copyright 2002-2005, Instant802 Networks, Inc.
  * Copyright 2005, Devicescape Software, Inc.
  * Copyright 2007, Mattias Nissler <mattias.nissler@gmx.de>
- * Copyright 2007, Stefano Brivio <stefano.brivio@polimi.it>
+ * Copyright 2007-2008, Stefano Brivio <stefano.brivio@polimi.it>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -64,71 +64,66 @@
  */
 
 
-/* Shift the adjustment so that we won't switch to a lower rate if it exhibited
- * a worse failed frames behaviour and we'll choose the highest rate whose
- * failed frames behaviour is not worse than the one of the original rate
- * target. While at it, check that the adjustment is within the ranges. Then,
- * provide the new rate index. */
-static int rate_control_pid_shift_adjust(struct rc_pid_rateinfo *r,
-                                         int adj, int cur, int l)
-{
-        int i, j, k, tmp;
-
-        j = r[cur].rev_index;
-        i = j + adj;
-
-        if (i < 0)
-                return r[0].index;
-        if (i >= l - 1)
-                return r[l - 1].index;
-
-        tmp = i;
-
-        if (adj < 0) {
-                for (k = j; k >= i; k--)
-                        if (r[k].diff <= r[j].diff)
-                                tmp = k;
-        } else {
-                for (k = i + 1; k + i < l; k++)
-                        if (r[k].diff <= r[i].diff)
-                                tmp = k;
-        }
-
-        return r[tmp].index;
-}
-
+/* Adjust the rate while ensuring that we won't switch to a lower rate if it
+ * exhibited a worse failed frames behaviour and we'll choose the highest rate
+ * whose failed frames behaviour is not worse than the one of the original rate
+ * target. While at it, check that the new rate is valid. */
 static void rate_control_pid_adjust_rate(struct ieee80211_local *local,
                                          struct sta_info *sta, int adj,
                                          struct rc_pid_rateinfo *rinfo)
 {
         struct ieee80211_sub_if_data *sdata;
-        struct ieee80211_hw_mode *mode;
-        int newidx;
-        int maxrate;
-        int back = (adj > 0) ? 1 : -1;
+        struct ieee80211_supported_band *sband;
+        int cur_sorted, new_sorted, probe, tmp, n_bitrates, band;
+        int cur = sta->txrate_idx;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(sta->dev);
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+        band = sband->band;
+        n_bitrates = sband->n_bitrates;
 
-        mode = local->oper_hw_mode;
-        maxrate = sdata->bss ? sdata->bss->max_ratectrl_rateidx : -1;
+        /* Map passed arguments to sorted values. */
+        cur_sorted = rinfo[cur].rev_index;
+        new_sorted = cur_sorted + adj;
 
-        newidx = rate_control_pid_shift_adjust(rinfo, adj, sta->txrate,
-                                               mode->num_rates);
+        /* Check limits. */
+        if (new_sorted < 0)
+                new_sorted = rinfo[0].rev_index;
+        else if (new_sorted >= n_bitrates)
+                new_sorted = rinfo[n_bitrates - 1].rev_index;
 
-        while (newidx != sta->txrate) {
-                if (rate_supported(sta, mode, newidx) &&
-                    (maxrate < 0 || newidx <= maxrate)) {
-                        sta->txrate = newidx;
-                        break;
-                }
+        tmp = new_sorted;
 
-                newidx += back;
+        if (adj < 0) {
+                /* Ensure that the rate decrease isn't disadvantageous. */
+                for (probe = cur_sorted; probe >= new_sorted; probe--)
+                        if (rinfo[probe].diff <= rinfo[cur_sorted].diff &&
+                            rate_supported(sta, band, rinfo[probe].index))
+                                tmp = probe;
+        } else {
+                /* Look for rate increase with zero (or below) cost. */
+                for (probe = new_sorted + 1; probe < n_bitrates; probe++)
+                        if (rinfo[probe].diff <= rinfo[new_sorted].diff &&
+                            rate_supported(sta, band, rinfo[probe].index))
+                                tmp = probe;
         }
 
+        /* Fit the rate found to the nearest supported rate. */
+        do {
+                if (rate_supported(sta, band, rinfo[tmp].index)) {
+                        sta->txrate_idx = rinfo[tmp].index;
+                        break;
+                }
+                if (adj < 0)
+                        tmp--;
+                else
+                        tmp++;
+        } while (tmp < n_bitrates && tmp >= 0);
+
 #ifdef CONFIG_MAC80211_DEBUGFS
         rate_control_pid_event_rate_change(
                 &((struct rc_pid_sta_info *)sta->rate_ctrl_priv)->events,
-                newidx, mode->rates[newidx].rate);
+                sta->txrate_idx, sband->bitrates[sta->txrate_idx].bitrate);
 #endif
 }
 
@@ -155,7 +150,7 @@ static void rate_control_pid_sample(struct rc_pid_info *pinfo,
 {
         struct rc_pid_sta_info *spinfo = sta->rate_ctrl_priv;
         struct rc_pid_rateinfo *rinfo = pinfo->rinfo;
-        struct ieee80211_hw_mode *mode;
+        struct ieee80211_supported_band *sband;
         u32 pf;
         s32 err_avg;
         u32 err_prop;
@@ -164,7 +159,7 @@ static void rate_control_pid_sample(struct rc_pid_info *pinfo,
         int adj, i, j, tmp;
         unsigned long period;
 
-        mode = local->oper_hw_mode;
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
         spinfo = sta->rate_ctrl_priv;
 
         /* In case nothing happened during the previous control interval, turn
@@ -190,18 +185,18 @@ static void rate_control_pid_sample(struct rc_pid_info *pinfo,
         spinfo->tx_num_failed = 0;
 
         /* If we just switched rate, update the rate behaviour info. */
-        if (pinfo->oldrate != sta->txrate) {
+        if (pinfo->oldrate != sta->txrate_idx) {
 
                 i = rinfo[pinfo->oldrate].rev_index;
-                j = rinfo[sta->txrate].rev_index;
+                j = rinfo[sta->txrate_idx].rev_index;
 
                 tmp = (pf - spinfo->last_pf);
                 tmp = RC_PID_DO_ARITH_RIGHT_SHIFT(tmp, RC_PID_ARITH_SHIFT);
 
                 rinfo[j].diff = rinfo[i].diff + tmp;
-                pinfo->oldrate = sta->txrate;
+                pinfo->oldrate = sta->txrate_idx;
         }
-        rate_control_pid_normalize(pinfo, mode->num_rates);
+        rate_control_pid_normalize(pinfo, sband->n_bitrates);
 
         /* Compute the proportional, integral and derivative errors. */
         err_prop = (pinfo->target << RC_PID_ARITH_SHIFT) - pf;
@@ -242,8 +237,10 @@ static void rate_control_pid_tx_status(void *priv, struct net_device *dev,
         struct sta_info *sta;
         struct rc_pid_sta_info *spinfo;
         unsigned long period;
+        struct ieee80211_supported_band *sband;
 
         sta = sta_info_get(local, hdr->addr1);
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
 
         if (!sta)
                 return;
@@ -251,13 +248,13 @@ static void rate_control_pid_tx_status(void *priv, struct net_device *dev,
         /* Don't update the state if we're not controlling the rate. */
         sdata = IEEE80211_DEV_TO_SUB_IF(sta->dev);
         if (sdata->bss && sdata->bss->force_unicast_rateidx > -1) {
-                sta->txrate = sdata->bss->max_ratectrl_rateidx;
+                sta->txrate_idx = sdata->bss->max_ratectrl_rateidx;
                 return;
         }
 
         /* Ignore all frames that were sent with a different rate than the rate
          * we currently advise mac80211 to use. */
-        if (status->control.rate != &local->oper_hw_mode->rates[sta->txrate])
+        if (status->control.tx_rate != &sband->bitrates[sta->txrate_idx])
                 goto ignore;
 
         spinfo = sta->rate_ctrl_priv;
@@ -283,9 +280,6 @@ static void rate_control_pid_tx_status(void *priv, struct net_device *dev,
                 sta->tx_num_consecutive_failures++;
                 sta->tx_num_mpdu_fail++;
         } else {
-                sta->last_ack_rssi[0] = sta->last_ack_rssi[1];
-                sta->last_ack_rssi[1] = sta->last_ack_rssi[2];
-                sta->last_ack_rssi[2] = status->ack_signal;
                 sta->tx_num_consecutive_failures = 0;
                 sta->tx_num_mpdu_ok++;
         }
@@ -304,7 +298,7 @@ ignore:
 }
 
 static void rate_control_pid_get_rate(void *priv, struct net_device *dev,
-                                      struct ieee80211_hw_mode *mode,
+                                      struct ieee80211_supported_band *sband,
                                       struct sk_buff *skb,
                                       struct rate_selection *sel)
 {
@@ -322,7 +316,7 @@ static void rate_control_pid_get_rate(void *priv, struct net_device *dev,
         fc = le16_to_cpu(hdr->frame_control);
         if ((fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA ||
             is_multicast_ether_addr(hdr->addr1) || !sta) {
-                sel->rate = rate_lowest(local, mode, sta);
+                sel->rate = rate_lowest(local, sband, sta);
                 if (sta)
                         sta_info_put(sta);
                 return;
@@ -331,23 +325,23 @@ static void rate_control_pid_get_rate(void *priv, struct net_device *dev,
         /* If a forced rate is in effect, select it. */
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         if (sdata->bss && sdata->bss->force_unicast_rateidx > -1)
-                sta->txrate = sdata->bss->force_unicast_rateidx;
+                sta->txrate_idx = sdata->bss->force_unicast_rateidx;
 
-        rateidx = sta->txrate;
+        rateidx = sta->txrate_idx;
 
-        if (rateidx >= mode->num_rates)
-                rateidx = mode->num_rates - 1;
+        if (rateidx >= sband->n_bitrates)
+                rateidx = sband->n_bitrates - 1;
 
-        sta->last_txrate = rateidx;
+        sta->last_txrate_idx = rateidx;
 
         sta_info_put(sta);
 
-        sel->rate = &mode->rates[rateidx];
+        sel->rate = &sband->bitrates[rateidx];
 
 #ifdef CONFIG_MAC80211_DEBUGFS
         rate_control_pid_event_tx_rate(
                 &((struct rc_pid_sta_info *) sta->rate_ctrl_priv)->events,
-                rateidx, mode->rates[rateidx].rate);
+                rateidx, sband->bitrates[rateidx].bitrate);
 #endif
 }
 
@@ -359,28 +353,32 @@ static void rate_control_pid_rate_init(void *priv, void *priv_sta,
          * as we need to have IEEE 802.1X auth succeed immediately after assoc..
          * Until that method is implemented, we will use the lowest supported
          * rate as a workaround. */
-        sta->txrate = rate_lowest_index(local, local->oper_hw_mode, sta);
+        struct ieee80211_supported_band *sband;
+
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+        sta->txrate_idx = rate_lowest_index(local, sband, sta);
 }
 
 static void *rate_control_pid_alloc(struct ieee80211_local *local)
 {
         struct rc_pid_info *pinfo;
         struct rc_pid_rateinfo *rinfo;
-        struct ieee80211_hw_mode *mode;
+        struct ieee80211_supported_band *sband;
         int i, j, tmp;
         bool s;
 #ifdef CONFIG_MAC80211_DEBUGFS
         struct rc_pid_debugfs_entries *de;
 #endif
 
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+
         pinfo = kmalloc(sizeof(*pinfo), GFP_ATOMIC);
         if (!pinfo)
                 return NULL;
 
-        /* We can safely assume that oper_hw_mode won't change unless we get
+        /* We can safely assume that sband won't change unless we get
          * reinitialized. */
-        mode = local->oper_hw_mode;
-        rinfo = kmalloc(sizeof(*rinfo) * mode->num_rates, GFP_ATOMIC);
+        rinfo = kmalloc(sizeof(*rinfo) * sband->n_bitrates, GFP_ATOMIC);
         if (!rinfo) {
                 kfree(pinfo);
                 return NULL;
@@ -389,7 +387,7 @@ static void *rate_control_pid_alloc(struct ieee80211_local *local)
         /* Sort the rates. This is optimized for the most common case (i.e.
          * almost-sorted CCK+OFDM rates). Kind of bubble-sort with reversed
          * mapping too. */
-        for (i = 0; i < mode->num_rates; i++) {
+        for (i = 0; i < sband->n_bitrates; i++) {
                 rinfo[i].index = i;
                 rinfo[i].rev_index = i;
                 if (pinfo->fast_start)
@@ -397,11 +395,11 @@ static void *rate_control_pid_alloc(struct ieee80211_local *local)
                 else
                         rinfo[i].diff = i * pinfo->norm_offset;
         }
-        for (i = 1; i < mode->num_rates; i++) {
+        for (i = 1; i < sband->n_bitrates; i++) {
                 s = 0;
-                for (j = 0; j < mode->num_rates - i; j++)
-                        if (unlikely(mode->rates[rinfo[j].index].rate >
-                                     mode->rates[rinfo[j + 1].index].rate)) {
+                for (j = 0; j < sband->n_bitrates - i; j++)
+                        if (unlikely(sband->bitrates[rinfo[j].index].bitrate >
+                                     sband->bitrates[rinfo[j + 1].index].bitrate)) {
                                 tmp = rinfo[j].index;
                                 rinfo[j].index = rinfo[j + 1].index;
                                 rinfo[j + 1].index = tmp;
diff --git a/net/mac80211/rc80211_simple.c b/net/mac80211/rc80211_simple.c
index 9a78b116acff..bcc541d4b95c 100644
--- a/net/mac80211/rc80211_simple.c
+++ b/net/mac80211/rc80211_simple.c
@@ -7,6 +7,7 @@
  * published by the Free Software Foundation.
  */
 
+#include <linux/jiffies.h>
 #include <linux/init.h>
 #include <linux/netdevice.h>
 #include <linux/types.h>
@@ -35,8 +36,8 @@ static void rate_control_rate_inc(struct ieee80211_local *local,
                                   struct sta_info *sta)
 {
         struct ieee80211_sub_if_data *sdata;
-        struct ieee80211_hw_mode *mode;
-        int i = sta->txrate;
+        struct ieee80211_supported_band *sband;
+        int i = sta->txrate_idx;
         int maxrate;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(sta->dev);
@@ -45,18 +46,17 @@ static void rate_control_rate_inc(struct ieee80211_local *local,
                 return;
         }
 
-        mode = local->oper_hw_mode;
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
         maxrate = sdata->bss ? sdata->bss->max_ratectrl_rateidx : -1;
 
-        if (i > mode->num_rates)
-                i = mode->num_rates - 2;
+        if (i > sband->n_bitrates)
+                i = sband->n_bitrates - 2;
 
-        while (i + 1 < mode->num_rates) {
+        while (i + 1 < sband->n_bitrates) {
                 i++;
-                if (sta->supp_rates & BIT(i) &&
-                    mode->rates[i].flags & IEEE80211_RATE_SUPPORTED &&
+                if (rate_supported(sta, sband->band, i) &&
                     (maxrate < 0 || i <= maxrate)) {
-                        sta->txrate = i;
+                        sta->txrate_idx = i;
                         break;
                 }
         }
@@ -67,8 +67,8 @@ static void rate_control_rate_dec(struct ieee80211_local *local,
                                   struct sta_info *sta)
 {
         struct ieee80211_sub_if_data *sdata;
-        struct ieee80211_hw_mode *mode;
-        int i = sta->txrate;
+        struct ieee80211_supported_band *sband;
+        int i = sta->txrate_idx;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(sta->dev);
         if (sdata->bss && sdata->bss->force_unicast_rateidx > -1) {
@@ -76,15 +76,14 @@ static void rate_control_rate_dec(struct ieee80211_local *local,
                 return;
         }
 
-        mode = local->oper_hw_mode;
-        if (i > mode->num_rates)
-                i = mode->num_rates;
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+        if (i > sband->n_bitrates)
+                i = sband->n_bitrates;
 
         while (i > 0) {
                 i--;
-                if (sta->supp_rates & BIT(i) &&
-                    mode->rates[i].flags & IEEE80211_RATE_SUPPORTED) {
-                        sta->txrate = i;
+                if (rate_supported(sta, sband->band, i)) {
+                        sta->txrate_idx = i;
                         break;
                 }
         }
@@ -132,9 +131,6 @@ static void rate_control_simple_tx_status(void *priv, struct net_device *dev,
                 sta->tx_num_consecutive_failures++;
                 sta->tx_num_mpdu_fail++;
         } else {
-                sta->last_ack_rssi[0] = sta->last_ack_rssi[1];
-                sta->last_ack_rssi[1] = sta->last_ack_rssi[2];
-                sta->last_ack_rssi[2] = status->ack_signal;
                 sta->tx_num_consecutive_failures = 0;
                 sta->tx_num_mpdu_ok++;
         }
@@ -168,7 +164,7 @@ static void rate_control_simple_tx_status(void *priv, struct net_device *dev,
                 } else if (per_failed < RATE_CONTROL_NUM_UP) {
                         rate_control_rate_inc(local, sta);
                 }
-                srctrl->tx_avg_rate_sum += status->control.rate->rate;
+                srctrl->tx_avg_rate_sum += status->control.tx_rate->bitrate;
                 srctrl->tx_avg_rate_num++;
                 srctrl->tx_num_failures = 0;
                 srctrl->tx_num_xmit = 0;
@@ -177,7 +173,7 @@ static void rate_control_simple_tx_status(void *priv, struct net_device *dev,
                 rate_control_rate_dec(local, sta);
         }
 
-        if (srctrl->avg_rate_update + 60 * HZ < jiffies) {
+        if (time_after(jiffies, srctrl->avg_rate_update + 60 * HZ)) {
                 srctrl->avg_rate_update = jiffies;
                 if (srctrl->tx_avg_rate_num > 0) {
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
@@ -201,7 +197,7 @@ static void rate_control_simple_tx_status(void *priv, struct net_device *dev,
 
 static void
 rate_control_simple_get_rate(void *priv, struct net_device *dev,
-                             struct ieee80211_hw_mode *mode,
+                             struct ieee80211_supported_band *sband,
                              struct sk_buff *skb,
                              struct rate_selection *sel)
 {
@@ -219,7 +215,7 @@ rate_control_simple_get_rate(void *priv, struct net_device *dev,
         fc = le16_to_cpu(hdr->frame_control);
         if ((fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA ||
             is_multicast_ether_addr(hdr->addr1) || !sta) {
-                sel->rate = rate_lowest(local, mode, sta);
+                sel->rate = rate_lowest(local, sband, sta);
                 if (sta)
                         sta_info_put(sta);
                 return;
@@ -228,18 +224,18 @@ rate_control_simple_get_rate(void *priv, struct net_device *dev,
         /* If a forced rate is in effect, select it. */
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         if (sdata->bss && sdata->bss->force_unicast_rateidx > -1)
-                sta->txrate = sdata->bss->force_unicast_rateidx;
+                sta->txrate_idx = sdata->bss->force_unicast_rateidx;
 
-        rateidx = sta->txrate;
+        rateidx = sta->txrate_idx;
 
-        if (rateidx >= mode->num_rates)
-                rateidx = mode->num_rates - 1;
+        if (rateidx >= sband->n_bitrates)
+                rateidx = sband->n_bitrates - 1;
 
-        sta->last_txrate = rateidx;
+        sta->last_txrate_idx = rateidx;
 
         sta_info_put(sta);
 
-        sel->rate = &mode->rates[rateidx];
+        sel->rate = &sband->bitrates[rateidx];
 }
 
 
@@ -247,21 +243,15 @@ static void rate_control_simple_rate_init(void *priv, void *priv_sta,
                                           struct ieee80211_local *local,
                                           struct sta_info *sta)
 {
-        struct ieee80211_hw_mode *mode;
-        int i;
-        sta->txrate = 0;
-        mode = local->oper_hw_mode;
+        struct ieee80211_supported_band *sband;
+
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+
         /* TODO: This routine should consider using RSSI from previous packets
          * as we need to have IEEE 802.1X auth succeed immediately after assoc..
          * Until that method is implemented, we will use the lowest supported rate
          * as a workaround, */
-        for (i = 0; i < mode->num_rates; i++) {
-                if ((sta->supp_rates & BIT(i)) &&
-                    (mode->rates[i].flags & IEEE80211_RATE_SUPPORTED)) {
-                        sta->txrate = i;
-                        break;
-                }
-        }
+        sta->txrate_idx = rate_lowest_index(local, sband, sta);
 }
 
 
diff --git a/net/mac80211/regdomain.c b/net/mac80211/regdomain.c
deleted file mode 100644
index f42678fa62d1..000000000000
--- a/net/mac80211/regdomain.c
+++ /dev/null
@@ -1,152 +0,0 @@
-/*
- * Copyright 2002-2005, Instant802 Networks, Inc.
- * Copyright 2005-2006, Devicescape Software, Inc.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-/*
- * This regulatory domain control implementation is known to be incomplete
- * and confusing. mac80211 regulatory domain control will be significantly
- * reworked in the not-too-distant future.
- *
- * For now, drivers wishing to control which channels are and aren't available
- * are advised as follows:
- *  - set the IEEE80211_HW_DEFAULT_REG_DOMAIN_CONFIGURED flag
- *  - continue to include *ALL* possible channels in the modes registered
- *    through ieee80211_register_hwmode()
- *  - for each allowable ieee80211_channel structure registered in the above
- *    call, set the flag member to some meaningful value such as
- *    IEEE80211_CHAN_W_SCAN | IEEE80211_CHAN_W_ACTIVE_SCAN |
- *    IEEE80211_CHAN_W_IBSS.
- *  - leave flag as 0 for non-allowable channels
- *
- * The usual implementation is for a driver to read a device EEPROM to
- * determine which regulatory domain it should be operating under, then
- * looking up the allowable channels in a driver-local table, then performing
- * the above.
- */
-
-#include <linux/module.h>
-#include <linux/netdevice.h>
-#include <net/mac80211.h>
-#include "ieee80211_i.h"
-
-static int ieee80211_regdom = 0x10; /* FCC */
-module_param(ieee80211_regdom, int, 0444);
-MODULE_PARM_DESC(ieee80211_regdom, "IEEE 802.11 regulatory domain; 64=MKK");
-
-/*
- * If firmware is upgraded by the vendor, additional channels can be used based
- * on the new Japanese regulatory rules. This is indicated by setting
- * ieee80211_japan_5ghz module parameter to one when loading the 80211 kernel
- * module.
- */
-static int ieee80211_japan_5ghz /* = 0 */;
-module_param(ieee80211_japan_5ghz, int, 0444);
-MODULE_PARM_DESC(ieee80211_japan_5ghz, "Vendor-updated firmware for 5 GHz");
-
-
-struct ieee80211_channel_range {
-        short start_freq;
-        short end_freq;
-        unsigned char power_level;
-        unsigned char antenna_max;
-};
-
-static const struct ieee80211_channel_range ieee80211_fcc_channels[] = {
-        { 2412, 2462, 27, 6 } /* IEEE 802.11b/g, channels 1..11 */,
-        { 5180, 5240, 17, 6 } /* IEEE 802.11a, channels 36..48 */,
-        { 5260, 5320, 23, 6 } /* IEEE 802.11a, channels 52..64 */,
-        { 5745, 5825, 30, 6 } /* IEEE 802.11a, channels 149..165, outdoor */,
-        { 0 }
-};
-
-static const struct ieee80211_channel_range ieee80211_mkk_channels[] = {
-        { 2412, 2472, 20, 6 } /* IEEE 802.11b/g, channels 1..13 */,
-        { 5170, 5240, 20, 6 } /* IEEE 802.11a, channels 34..48 */,
-        { 5260, 5320, 20, 6 } /* IEEE 802.11a, channels 52..64 */,
-        { 0 }
-};
-
-
-static const struct ieee80211_channel_range *channel_range =
-        ieee80211_fcc_channels;
-
-
-static void ieee80211_unmask_channel(int mode, struct ieee80211_channel *chan)
-{
-        int i;
-
-        chan->flag = 0;
-
-        for (i = 0; channel_range[i].start_freq; i++) {
-                const struct ieee80211_channel_range *r = &channel_range[i];
-                if (r->start_freq <= chan->freq && r->end_freq >= chan->freq) {
-                        if (ieee80211_regdom == 64 && !ieee80211_japan_5ghz &&
-                            chan->freq >= 5260 && chan->freq <= 5320) {
-                                /*
-                                 * Skip new channels in Japan since the
-                                 * firmware was not marked having been upgraded
-                                 * by the vendor.
-                                 */
-                                continue;
-                        }
-
-                        if (ieee80211_regdom == 0x10 &&
-                            (chan->freq == 5190 || chan->freq == 5210 ||
-                             chan->freq == 5230)) {
-                                    /* Skip MKK channels when in FCC domain. */
-                                    continue;
-                        }
-
-                        chan->flag |= IEEE80211_CHAN_W_SCAN |
-                                IEEE80211_CHAN_W_ACTIVE_SCAN |
-                                IEEE80211_CHAN_W_IBSS;
-                        chan->power_level = r->power_level;
-                        chan->antenna_max = r->antenna_max;
-
-                        if (ieee80211_regdom == 64 &&
-                            (chan->freq == 5170 || chan->freq == 5190 ||
-                             chan->freq == 5210 || chan->freq == 5230)) {
-                                /*
-                                 * New regulatory rules in Japan have backwards
-                                 * compatibility with old channels in 5.15-5.25
-                                 * GHz band, but the station is not allowed to
-                                 * use active scan on these old channels.
-                                 */
-                                chan->flag &= ~IEEE80211_CHAN_W_ACTIVE_SCAN;
-                        }
-
-                        if (ieee80211_regdom == 64 &&
-                            (chan->freq == 5260 || chan->freq == 5280 ||
-                             chan->freq == 5300 || chan->freq == 5320)) {
-                                /*
-                                 * IBSS is not allowed on 5.25-5.35 GHz band
-                                 * due to radar detection requirements.
-                                 */
-                                chan->flag &= ~IEEE80211_CHAN_W_IBSS;
-                        }
-
-                        break;
-                }
-        }
-}
-
-
-void ieee80211_set_default_regdomain(struct ieee80211_hw_mode *mode)
-{
-        int c;
-        for (c = 0; c < mode->num_channels; c++)
-                ieee80211_unmask_channel(mode->mode, &mode->channels[c]);
-}
-
-
-void ieee80211_regdomain_init(void)
-{
-        if (ieee80211_regdom == 0x40)
-                channel_range = ieee80211_mkk_channels;
-}
-
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 535407d07fa4..48574f6c0e74 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -9,6 +9,7 @@
  * published by the Free Software Foundation.
  */
 
+#include <linux/jiffies.h>
 #include <linux/kernel.h>
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
@@ -82,10 +83,10 @@ static inline int should_drop_frame(struct ieee80211_rx_status *status,
  */
 static struct sk_buff *
 ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
-                     struct ieee80211_rx_status *status)
+                     struct ieee80211_rx_status *status,
+                     struct ieee80211_rate *rate)
 {
         struct ieee80211_sub_if_data *sdata;
-        struct ieee80211_rate *rate;
         int needed_headroom = 0;
         struct ieee80211_radiotap_header *rthdr;
         __le64 *rttsft = NULL;
@@ -194,14 +195,11 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
                         rtfixed->rx_flags |=
                                 cpu_to_le16(IEEE80211_RADIOTAP_F_RX_BADFCS);
 
-                rate = ieee80211_get_rate(local, status->phymode,
-                                          status->rate);
-                if (rate)
-                        rtfixed->rate = rate->rate / 5;
+                rtfixed->rate = rate->bitrate / 5;
 
                 rtfixed->chan_freq = cpu_to_le16(status->freq);
 
-                if (status->phymode == MODE_IEEE80211A)
+                if (status->band == IEEE80211_BAND_5GHZ)
                         rtfixed->chan_flags =
                                 cpu_to_le16(IEEE80211_CHAN_OFDM |
                                             IEEE80211_CHAN_5GHZ);
@@ -226,6 +224,9 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
                 if (sdata->vif.type != IEEE80211_IF_TYPE_MNTR)
                         continue;
 
+                if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES)
+                        continue;
+
                 if (prev_dev) {
                         skb2 = skb_clone(skb, GFP_ATOMIC);
                         if (skb2) {
@@ -249,15 +250,7 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
 }
 
 
-/* pre-rx handlers
- *
- * these don't have dev/sdata fields in the rx data
- * The sta value should also not be used because it may
- * be NULL even though a STA (in IBSS mode) will be added.
- */
-
-static ieee80211_txrx_result
-ieee80211_rx_h_parse_qos(struct ieee80211_txrx_data *rx)
+static void ieee80211_parse_qos(struct ieee80211_txrx_data *rx)
 {
         u8 *data = rx->skb->data;
         int tid;
@@ -290,64 +283,15 @@ ieee80211_rx_h_parse_qos(struct ieee80211_txrx_data *rx)
         /* Set skb->priority to 1d tag if highest order bit of TID is not set.
          * For now, set skb->priority to 0 for other cases. */
         rx->skb->priority = (tid > 7) ? 0 : tid;
-
-        return TXRX_CONTINUE;
 }
 
-
-static u32 ieee80211_rx_load_stats(struct ieee80211_local *local,
-                              struct sk_buff *skb,
-                              struct ieee80211_rx_status *status)
+static void ieee80211_verify_ip_alignment(struct ieee80211_txrx_data *rx)
 {
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-        u32 load = 0, hdrtime;
-        struct ieee80211_rate *rate;
-        struct ieee80211_hw_mode *mode = local->hw.conf.mode;
-        int i;
-
-        /* Estimate total channel use caused by this frame */
-
-        if (unlikely(mode->num_rates < 0))
-                return TXRX_CONTINUE;
-
-        rate = &mode->rates[0];
-        for (i = 0; i < mode->num_rates; i++) {
-                if (mode->rates[i].val == status->rate) {
-                        rate = &mode->rates[i];
-                        break;
-                }
-        }
-
-        /* 1 bit at 1 Mbit/s takes 1 usec; in channel_use values,
-         * 1 usec = 1/8 * (1080 / 10) = 13.5 */
-
-        if (mode->mode == MODE_IEEE80211A ||
-            (mode->mode == MODE_IEEE80211G &&
-             rate->flags & IEEE80211_RATE_ERP))
-                hdrtime = CHAN_UTIL_HDR_SHORT;
-        else
-                hdrtime = CHAN_UTIL_HDR_LONG;
-
-        load = hdrtime;
-        if (!is_multicast_ether_addr(hdr->addr1))
-                load += hdrtime;
-
-        load += skb->len * rate->rate_inv;
-
-        /* Divide channel_use by 8 to avoid wrapping around the counter */
-        load >>= CHAN_UTIL_SHIFT;
-
-        return load;
-}
-
 #ifdef CONFIG_MAC80211_DEBUG_PACKET_ALIGNMENT
-static ieee80211_txrx_result
-ieee80211_rx_h_verify_ip_alignment(struct ieee80211_txrx_data *rx)
-{
         int hdrlen;
 
         if (!WLAN_FC_DATA_PRESENT(rx->fc))
-                return TXRX_CONTINUE;
+                return;
 
         /*
          * Drivers are required to align the payload data in a way that
@@ -372,32 +316,55 @@ ieee80211_rx_h_verify_ip_alignment(struct ieee80211_txrx_data *rx)
         if (rx->flags & IEEE80211_TXRXD_RX_AMSDU)
                 hdrlen += ETH_HLEN;
         WARN_ON_ONCE(((unsigned long)(rx->skb->data + hdrlen)) & 3);
-
-        return TXRX_CONTINUE;
-}
 #endif
+}
 
-ieee80211_rx_handler ieee80211_rx_pre_handlers[] =
+
+static u32 ieee80211_rx_load_stats(struct ieee80211_local *local,
+                                   struct sk_buff *skb,
+                                   struct ieee80211_rx_status *status,
+                                   struct ieee80211_rate *rate)
 {
-        ieee80211_rx_h_parse_qos,
-#ifdef CONFIG_MAC80211_DEBUG_PACKET_ALIGNMENT
-        ieee80211_rx_h_verify_ip_alignment,
-#endif
-        NULL
-};
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+        u32 load = 0, hdrtime;
+
+        /* Estimate total channel use caused by this frame */
+
+        /* 1 bit at 1 Mbit/s takes 1 usec; in channel_use values,
+         * 1 usec = 1/8 * (1080 / 10) = 13.5 */
+
+        if (status->band == IEEE80211_BAND_5GHZ ||
+            (status->band == IEEE80211_BAND_5GHZ &&
+             rate->flags & IEEE80211_RATE_ERP_G))
+                hdrtime = CHAN_UTIL_HDR_SHORT;
+        else
+                hdrtime = CHAN_UTIL_HDR_LONG;
+
+        load = hdrtime;
+        if (!is_multicast_ether_addr(hdr->addr1))
+                load += hdrtime;
+
+        /* TODO: optimise again */
+        load += skb->len * CHAN_UTIL_RATE_LCM / rate->bitrate;
+
+        /* Divide channel_use by 8 to avoid wrapping around the counter */
+        load >>= CHAN_UTIL_SHIFT;
+
+        return load;
+}
 
 /* rx handlers */
 
-static ieee80211_txrx_result
+static ieee80211_rx_result
 ieee80211_rx_h_if_stats(struct ieee80211_txrx_data *rx)
 {
         if (rx->sta)
                 rx->sta->channel_use_raw += rx->u.rx.load;
         rx->sdata->channel_use_raw += rx->u.rx.load;
-        return TXRX_CONTINUE;
+        return RX_CONTINUE;
 }
 
-static ieee80211_txrx_result
+static ieee80211_rx_result
 ieee80211_rx_h_passive_scan(struct ieee80211_txrx_data *rx)
 {
         struct ieee80211_local *local = rx->local;
@@ -409,21 +376,21 @@ ieee80211_rx_h_passive_scan(struct ieee80211_txrx_data *rx)
         if (unlikely(local->sta_sw_scanning)) {
                 /* drop all the other packets during a software scan anyway */
                 if (ieee80211_sta_rx_scan(rx->dev, skb, rx->u.rx.status)
-                    != TXRX_QUEUED)
+                    != RX_QUEUED)
                         dev_kfree_skb(skb);
-                return TXRX_QUEUED;
+                return RX_QUEUED;
         }
 
         if (unlikely(rx->flags & IEEE80211_TXRXD_RXIN_SCAN)) {
                 /* scanning finished during invoking of handlers */
                 I802_DEBUG_INC(local->rx_handlers_drop_passive_scan);
-                return TXRX_DROP;
+                return RX_DROP_UNUSABLE;
         }
 
-        return TXRX_CONTINUE;
+        return RX_CONTINUE;
 }
 
-static ieee80211_txrx_result
+static ieee80211_rx_result
 ieee80211_rx_h_check(struct ieee80211_txrx_data *rx)
 {
         struct ieee80211_hdr *hdr;
@@ -438,14 +405,14 @@ ieee80211_rx_h_check(struct ieee80211_txrx_data *rx)
                                 rx->local->dot11FrameDuplicateCount++;
                                 rx->sta->num_duplicates++;
                         }
-                        return TXRX_DROP;
+                        return RX_DROP_MONITOR;
                 } else
                         rx->sta->last_seq_ctrl[rx->u.rx.queue] = hdr->seq_ctrl;
         }
 
         if (unlikely(rx->skb->len < 16)) {
                 I802_DEBUG_INC(rx->local->rx_handlers_drop_short);
-                return TXRX_DROP;
+                return RX_DROP_MONITOR;
         }
 
         /* Drop disallowed frame classes based on STA auth/assoc state;
@@ -467,23 +434,23 @@ ieee80211_rx_h_check(struct ieee80211_txrx_data *rx)
                     || !(rx->flags & IEEE80211_TXRXD_RXRA_MATCH)) {
                         /* Drop IBSS frames and frames for other hosts
                          * silently. */
-                        return TXRX_DROP;
+                        return RX_DROP_MONITOR;
                 }
 
-                return TXRX_DROP;
+                return RX_DROP_MONITOR;
         }
 
-        return TXRX_CONTINUE;
+        return RX_CONTINUE;
 }
 
 
-static ieee80211_txrx_result
+static ieee80211_rx_result
 ieee80211_rx_h_decrypt(struct ieee80211_txrx_data *rx)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
         int keyidx;
         int hdrlen;
-        ieee80211_txrx_result result = TXRX_DROP;
+        ieee80211_rx_result result = RX_DROP_UNUSABLE;
         struct ieee80211_key *stakey = NULL;
 
         /*
@@ -513,14 +480,14 @@ ieee80211_rx_h_decrypt(struct ieee80211_txrx_data *rx)
          */
 
         if (!(rx->fc & IEEE80211_FCTL_PROTECTED))
-                return TXRX_CONTINUE;
+                return RX_CONTINUE;
 
         /*
          * No point in finding a key and decrypting if the frame is neither
          * addressed to us nor a multicast frame.
          */
         if (!(rx->flags & IEEE80211_TXRXD_RXRA_MATCH))
-                return TXRX_CONTINUE;
+                return RX_CONTINUE;
 
         if (rx->sta)
                 stakey = rcu_dereference(rx->sta->key);
@@ -539,12 +506,12 @@ ieee80211_rx_h_decrypt(struct ieee80211_txrx_data *rx)
                  */
                 if ((rx->u.rx.status->flag & RX_FLAG_DECRYPTED) &&
                     (rx->u.rx.status->flag & RX_FLAG_IV_STRIPPED))
-                        return TXRX_CONTINUE;
+                        return RX_CONTINUE;
 
                 hdrlen = ieee80211_get_hdrlen(rx->fc);
 
                 if (rx->skb->len < 8 + hdrlen)
-                        return TXRX_DROP; /* TODO: count this? */
+                        return RX_DROP_UNUSABLE; /* TODO: count this? */
 
                 /*
                  * no need to call ieee80211_wep_get_keyidx,
@@ -573,7 +540,7 @@ ieee80211_rx_h_decrypt(struct ieee80211_txrx_data *rx)
                         printk(KERN_DEBUG "%s: RX protected frame,"
                                " but have no key\n", rx->dev->name);
 #endif /* CONFIG_MAC80211_DEBUG */
-                return TXRX_DROP;
+                return RX_DROP_MONITOR;
         }
 
         /* Check for weak IVs if possible */
@@ -612,7 +579,7 @@ static void ap_sta_ps_start(struct net_device *dev, struct sta_info *sta)
         if (sdata->bss)
                 atomic_inc(&sdata->bss->num_sta_ps);
         sta->flags |= WLAN_STA_PS;
-        sta->pspoll = 0;
+        sta->flags &= ~WLAN_STA_PSPOLL;
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
         printk(KERN_DEBUG "%s: STA %s aid %d enters power save mode\n",
                dev->name, print_mac(mac, sta->addr), sta->aid);
@@ -629,20 +596,20 @@ static int ap_sta_ps_end(struct net_device *dev, struct sta_info *sta)
         DECLARE_MAC_BUF(mac);
 
         sdata = IEEE80211_DEV_TO_SUB_IF(sta->dev);
+
         if (sdata->bss)
                 atomic_dec(&sdata->bss->num_sta_ps);
-        sta->flags &= ~(WLAN_STA_PS | WLAN_STA_TIM);
-        sta->pspoll = 0;
-        if (!skb_queue_empty(&sta->ps_tx_buf)) {
-                if (local->ops->set_tim)
-                        local->ops->set_tim(local_to_hw(local), sta->aid, 0);
-                if (sdata->bss)
-                        bss_tim_clear(local, sdata->bss, sta->aid);
-        }
+
+        sta->flags &= ~(WLAN_STA_PS | WLAN_STA_PSPOLL);
+
+        if (!skb_queue_empty(&sta->ps_tx_buf))
+                sta_info_clear_tim_bit(sta);
+
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
         printk(KERN_DEBUG "%s: STA %s aid %d exits power save mode\n",
                dev->name, print_mac(mac, sta->addr), sta->aid);
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
+
         /* Send all buffered frames to the station */
         while ((skb = skb_dequeue(&sta->tx_filtered)) != NULL) {
                 pkt_data = (struct ieee80211_tx_packet_data *) skb->cb;
@@ -666,7 +633,7 @@ static int ap_sta_ps_end(struct net_device *dev, struct sta_info *sta)
         return sent;
 }
 
-static ieee80211_txrx_result
+static ieee80211_rx_result
 ieee80211_rx_h_sta_process(struct ieee80211_txrx_data *rx)
 {
         struct sta_info *sta = rx->sta;
@@ -674,7 +641,7 @@ ieee80211_rx_h_sta_process(struct ieee80211_txrx_data *rx)
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
 
         if (!sta)
-                return TXRX_CONTINUE;
+                return RX_CONTINUE;
 
         /* Update last_rx only for IBSS packets which are for the current
          * BSSID to avoid keeping the current IBSS network alive in cases where
@@ -695,7 +662,7 @@ ieee80211_rx_h_sta_process(struct ieee80211_txrx_data *rx)
         }
 
         if (!(rx->flags & IEEE80211_TXRXD_RXRA_MATCH))
-                return TXRX_CONTINUE;
+                return RX_CONTINUE;
 
         sta->rx_fragments++;
         sta->rx_bytes += rx->skb->len;
@@ -722,10 +689,10 @@ ieee80211_rx_h_sta_process(struct ieee80211_txrx_data *rx)
                  * as a dropped packed. */
                 sta->rx_packets++;
                 dev_kfree_skb(rx->skb);
-                return TXRX_QUEUED;
+                return RX_QUEUED;
         }
 
-        return TXRX_CONTINUE;
+        return RX_CONTINUE;
 } /* ieee80211_rx_h_sta_process */
 
 static inline struct ieee80211_fragment_entry *
@@ -801,7 +768,7 @@ ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
                     compare_ether_addr(hdr->addr2, f_hdr->addr2) != 0)
                         continue;
 
-                if (entry->first_frag_time + 2 * HZ < jiffies) {
+                if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
                         __skb_queue_purge(&entry->skb_list);
                         continue;
                 }
@@ -811,7 +778,7 @@ ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
         return NULL;
 }
 
-static ieee80211_txrx_result
+static ieee80211_rx_result
 ieee80211_rx_h_defragment(struct ieee80211_txrx_data *rx)
 {
         struct ieee80211_hdr *hdr;
@@ -848,7 +815,7 @@ ieee80211_rx_h_defragment(struct ieee80211_txrx_data *rx)
                                rx->key->u.ccmp.rx_pn[rx->u.rx.queue],
                                CCMP_PN_LEN);
                 }
-                return TXRX_QUEUED;
+                return RX_QUEUED;
         }
 
         /* This is a fragment for a frame that should already be pending in
@@ -858,7 +825,7 @@ ieee80211_rx_h_defragment(struct ieee80211_txrx_data *rx)
                                           rx->u.rx.queue, hdr);
         if (!entry) {
                 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
-                return TXRX_DROP;
+                return RX_DROP_MONITOR;
         }
 
         /* Verify that MPDUs within one MSDU have sequential PN values.
@@ -867,7 +834,7 @@ ieee80211_rx_h_defragment(struct ieee80211_txrx_data *rx)
                 int i;
                 u8 pn[CCMP_PN_LEN], *rpn;
                 if (!rx->key || rx->key->conf.alg != ALG_CCMP)
-                        return TXRX_DROP;
+                        return RX_DROP_UNUSABLE;
                 memcpy(pn, entry->last_pn, CCMP_PN_LEN);
                 for (i = CCMP_PN_LEN - 1; i >= 0; i--) {
                         pn[i]++;
@@ -885,7 +852,7 @@ ieee80211_rx_h_defragment(struct ieee80211_txrx_data *rx)
                                        rpn[0], rpn[1], rpn[2], rpn[3], rpn[4],
                                        rpn[5], pn[0], pn[1], pn[2], pn[3],
                                        pn[4], pn[5]);
-                        return TXRX_DROP;
+                        return RX_DROP_UNUSABLE;
                 }
                 memcpy(entry->last_pn, pn, CCMP_PN_LEN);
         }
@@ -896,7 +863,7 @@ ieee80211_rx_h_defragment(struct ieee80211_txrx_data *rx)
         entry->extra_len += rx->skb->len;
         if (rx->fc & IEEE80211_FCTL_MOREFRAGS) {
                 rx->skb = NULL;
-                return TXRX_QUEUED;
+                return RX_QUEUED;
         }
 
         rx->skb = __skb_dequeue(&entry->skb_list);
@@ -906,7 +873,7 @@ ieee80211_rx_h_defragment(struct ieee80211_txrx_data *rx)
                                               GFP_ATOMIC))) {
                         I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
                         __skb_queue_purge(&entry->skb_list);
-                        return TXRX_DROP;
+                        return RX_DROP_UNUSABLE;
                 }
         }
         while ((skb = __skb_dequeue(&entry->skb_list))) {
@@ -924,10 +891,10 @@ ieee80211_rx_h_defragment(struct ieee80211_txrx_data *rx)
                 rx->local->dot11MulticastReceivedFrameCount++;
         else
                 ieee80211_led_rx(rx->local);
-        return TXRX_CONTINUE;
+        return RX_CONTINUE;
 }
 
-static ieee80211_txrx_result
+static ieee80211_rx_result
 ieee80211_rx_h_ps_poll(struct ieee80211_txrx_data *rx)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
@@ -939,11 +906,11 @@ ieee80211_rx_h_ps_poll(struct ieee80211_txrx_data *rx)
                    (rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_CTL ||
                    (rx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_PSPOLL ||
                    !(rx->flags & IEEE80211_TXRXD_RXRA_MATCH)))
-                return TXRX_CONTINUE;
+                return RX_CONTINUE;
 
         if ((sdata->vif.type != IEEE80211_IF_TYPE_AP) &&
             (sdata->vif.type != IEEE80211_IF_TYPE_VLAN))
-                return TXRX_DROP;
+                return RX_DROP_UNUSABLE;
 
         skb = skb_dequeue(&rx->sta->tx_filtered);
         if (!skb) {
@@ -958,9 +925,11 @@ ieee80211_rx_h_ps_poll(struct ieee80211_txrx_data *rx)
                 struct ieee80211_hdr *hdr =
                         (struct ieee80211_hdr *) skb->data;
 
-                /* tell TX path to send one frame even though the STA may
-                 * still remain is PS mode after this frame exchange */
-                rx->sta->pspoll = 1;
+                /*
+                 * Tell TX path to send one frame even though the STA may
+                 * still remain is PS mode after this frame exchange.
+                 */
+                rx->sta->flags |= WLAN_STA_PSPOLL;
 
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
                 printk(KERN_DEBUG "STA %s aid %d: PS Poll (entries after %d)\n",
@@ -970,38 +939,37 @@ ieee80211_rx_h_ps_poll(struct ieee80211_txrx_data *rx)
 
                 /* Use MoreData flag to indicate whether there are more
                  * buffered frames for this STA */
-                if (no_pending_pkts) {
+                if (no_pending_pkts)
                         hdr->frame_control &= cpu_to_le16(~IEEE80211_FCTL_MOREDATA);
-                        rx->sta->flags &= ~WLAN_STA_TIM;
-                } else
+                else
                         hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_MOREDATA);
 
                 dev_queue_xmit(skb);
 
-                if (no_pending_pkts) {
-                        if (rx->local->ops->set_tim)
-                                rx->local->ops->set_tim(local_to_hw(rx->local),
-                                                       rx->sta->aid, 0);
-                        if (rx->sdata->bss)
-                                bss_tim_clear(rx->local, rx->sdata->bss, rx->sta->aid);
-                }
+                if (no_pending_pkts)
+                        sta_info_clear_tim_bit(rx->sta);
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
         } else if (!rx->u.rx.sent_ps_buffered) {
+                /*
+                 * FIXME: This can be the result of a race condition between
+                 *        us expiring a frame and the station polling for it.
+                 *        Should we send it a null-func frame indicating we
+                 *        have nothing buffered for it?
+                 */
                 printk(KERN_DEBUG "%s: STA %s sent PS Poll even "
                        "though there is no buffered frames for it\n",
                        rx->dev->name, print_mac(mac, rx->sta->addr));
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
-
         }
 
-        /* Free PS Poll skb here instead of returning TXRX_DROP that would
+        /* Free PS Poll skb here instead of returning RX_DROP that would
          * count as an dropped frame. */
         dev_kfree_skb(rx->skb);
 
-        return TXRX_QUEUED;
+        return RX_QUEUED;
 }
 
-static ieee80211_txrx_result
+static ieee80211_rx_result
 ieee80211_rx_h_remove_qos_control(struct ieee80211_txrx_data *rx)
 {
         u16 fc = rx->fc;
@@ -1009,7 +977,7 @@ ieee80211_rx_h_remove_qos_control(struct ieee80211_txrx_data *rx)
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) data;
 
         if (!WLAN_FC_IS_QOS_DATA(fc))
-                return TXRX_CONTINUE;
+                return RX_CONTINUE;
 
         /* remove the qos control field, update frame type and meta-data */
         memmove(data + 2, data, ieee80211_get_hdrlen(fc) - 2);
@@ -1018,17 +986,17 @@ ieee80211_rx_h_remove_qos_control(struct ieee80211_txrx_data *rx)
         rx->fc = fc &= ~IEEE80211_STYPE_QOS_DATA;
         hdr->frame_control = cpu_to_le16(fc);
 
-        return TXRX_CONTINUE;
+        return RX_CONTINUE;
 }
 
 static int
 ieee80211_802_1x_port_control(struct ieee80211_txrx_data *rx)
 {
-        if (unlikely(rx->sdata->ieee802_1x_pac &&
-                     (!rx->sta || !(rx->sta->flags & WLAN_STA_AUTHORIZED)))) {
+        if (unlikely(!rx->sta || !(rx->sta->flags & WLAN_STA_AUTHORIZED))) {
 #ifdef CONFIG_MAC80211_DEBUG
-                printk(KERN_DEBUG "%s: dropped frame "
-                       "(unauthorized port)\n", rx->dev->name);
+                if (net_ratelimit())
+                        printk(KERN_DEBUG "%s: dropped frame "
+                               "(unauthorized port)\n", rx->dev->name);
 #endif /* CONFIG_MAC80211_DEBUG */
                 return -EACCES;
         }
@@ -1275,7 +1243,7 @@ ieee80211_deliver_skb(struct ieee80211_txrx_data *rx)
         }
 }
 
-static ieee80211_txrx_result
+static ieee80211_rx_result
 ieee80211_rx_h_amsdu(struct ieee80211_txrx_data *rx)
 {
         struct net_device *dev = rx->dev;
@@ -1291,17 +1259,17 @@ ieee80211_rx_h_amsdu(struct ieee80211_txrx_data *rx)
 
         fc = rx->fc;
         if (unlikely((fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA))
-                return TXRX_CONTINUE;
+                return RX_CONTINUE;
 
         if (unlikely(!WLAN_FC_DATA_PRESENT(fc)))
-                return TXRX_DROP;
+                return RX_DROP_MONITOR;
 
         if (!(rx->flags & IEEE80211_TXRXD_RX_AMSDU))
-                return TXRX_CONTINUE;
+                return RX_CONTINUE;
 
         err = ieee80211_data_to_8023(rx);
         if (unlikely(err))
-                return TXRX_DROP;
+                return RX_DROP_UNUSABLE;
 
         skb->dev = dev;
 
@@ -1311,7 +1279,7 @@ ieee80211_rx_h_amsdu(struct ieee80211_txrx_data *rx)
         /* skip the wrapping header */
         eth = (struct ethhdr *) skb_pull(skb, sizeof(struct ethhdr));
         if (!eth)
-                return TXRX_DROP;
+                return RX_DROP_UNUSABLE;
 
         while (skb != frame) {
                 u8 padding;
@@ -1326,7 +1294,7 @@ ieee80211_rx_h_amsdu(struct ieee80211_txrx_data *rx)
                 /* the last MSDU has no padding */
                 if (subframe_len > remaining) {
                         printk(KERN_DEBUG "%s: wrong buffer size", dev->name);
-                        return TXRX_DROP;
+                        return RX_DROP_UNUSABLE;
                 }
 
                 skb_pull(skb, sizeof(struct ethhdr));
@@ -1338,7 +1306,7 @@ ieee80211_rx_h_amsdu(struct ieee80211_txrx_data *rx)
                                               subframe_len);
 
                         if (frame == NULL)
-                                return TXRX_DROP;
+                                return RX_DROP_UNUSABLE;
 
                         skb_reserve(frame, local->hw.extra_tx_headroom +
                                     sizeof(struct ethhdr));
@@ -1351,7 +1319,7 @@ ieee80211_rx_h_amsdu(struct ieee80211_txrx_data *rx)
                                 printk(KERN_DEBUG "%s: wrong buffer size ",
                                        dev->name);
                                 dev_kfree_skb(frame);
-                                return TXRX_DROP;
+                                return RX_DROP_UNUSABLE;
                         }
                 }
 
@@ -1381,7 +1349,7 @@ ieee80211_rx_h_amsdu(struct ieee80211_txrx_data *rx)
 
                 if (!ieee80211_frame_allowed(rx)) {
                         if (skb == frame) /* last frame */
-                                return TXRX_DROP;
+                                return RX_DROP_UNUSABLE;
                         dev_kfree_skb(frame);
                         continue;
                 }
@@ -1389,10 +1357,10 @@ ieee80211_rx_h_amsdu(struct ieee80211_txrx_data *rx)
                 ieee80211_deliver_skb(rx);
         }
 
-        return TXRX_QUEUED;
+        return RX_QUEUED;
 }
 
-static ieee80211_txrx_result
+static ieee80211_rx_result
 ieee80211_rx_h_data(struct ieee80211_txrx_data *rx)
 {
         struct net_device *dev = rx->dev;
@@ -1401,17 +1369,17 @@ ieee80211_rx_h_data(struct ieee80211_txrx_data *rx)
 
         fc = rx->fc;
         if (unlikely((fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA))
-                return TXRX_CONTINUE;
+                return RX_CONTINUE;
 
         if (unlikely(!WLAN_FC_DATA_PRESENT(fc)))
-                return TXRX_DROP;
+                return RX_DROP_MONITOR;
 
         err = ieee80211_data_to_8023(rx);
         if (unlikely(err))
-                return TXRX_DROP;
+                return RX_DROP_UNUSABLE;
 
         if (!ieee80211_frame_allowed(rx))
-                return TXRX_DROP;
+                return RX_DROP_MONITOR;
 
         rx->skb->dev = dev;
 
@@ -1420,10 +1388,10 @@ ieee80211_rx_h_data(struct ieee80211_txrx_data *rx)
 
         ieee80211_deliver_skb(rx);
 
-        return TXRX_QUEUED;
+        return RX_QUEUED;
 }
 
-static ieee80211_txrx_result
+static ieee80211_rx_result
 ieee80211_rx_h_ctrl(struct ieee80211_txrx_data *rx)
 {
         struct ieee80211_local *local = rx->local;
@@ -1435,15 +1403,15 @@ ieee80211_rx_h_ctrl(struct ieee80211_txrx_data *rx)
         u16 tid;
 
         if (likely((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_CTL))
-                return TXRX_CONTINUE;
+                return RX_CONTINUE;
 
         if ((rx->fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_BACK_REQ) {
                 if (!rx->sta)
-                        return TXRX_CONTINUE;
+                        return RX_CONTINUE;
                 tid = le16_to_cpu(bar->control) >> 12;
                 tid_agg_rx = &(rx->sta->ampdu_mlme.tid_rx[tid]);
                 if (tid_agg_rx->state != HT_AGG_STATE_OPERATIONAL)
-                        return TXRX_CONTINUE;
+                        return RX_CONTINUE;
 
                 start_seq_num = le16_to_cpu(bar->start_seq_num) >> 4;
 
@@ -1460,19 +1428,19 @@ ieee80211_rx_h_ctrl(struct ieee80211_txrx_data *rx)
                 ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, NULL,
                                                  start_seq_num, 1);
                 rcu_read_unlock();
-                return TXRX_DROP;
+                return RX_DROP_UNUSABLE;
         }
 
-        return TXRX_CONTINUE;
+        return RX_CONTINUE;
 }
 
-static ieee80211_txrx_result
+static ieee80211_rx_result
 ieee80211_rx_h_mgmt(struct ieee80211_txrx_data *rx)
 {
         struct ieee80211_sub_if_data *sdata;
 
         if (!(rx->flags & IEEE80211_TXRXD_RXRA_MATCH))
-                return TXRX_DROP;
+                return RX_DROP_MONITOR;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
         if ((sdata->vif.type == IEEE80211_IF_TYPE_STA ||
@@ -1480,56 +1448,13 @@ ieee80211_rx_h_mgmt(struct ieee80211_txrx_data *rx)
             !(sdata->flags & IEEE80211_SDATA_USERSPACE_MLME))
                 ieee80211_sta_rx_mgmt(rx->dev, rx->skb, rx->u.rx.status);
         else
-                return TXRX_DROP;
+                return RX_DROP_MONITOR;
 
-        return TXRX_QUEUED;
-}
-
-static inline ieee80211_txrx_result __ieee80211_invoke_rx_handlers(
-                                struct ieee80211_local *local,
-                                ieee80211_rx_handler *handlers,
-                                struct ieee80211_txrx_data *rx,
-                                struct sta_info *sta)
-{
-        ieee80211_rx_handler *handler;
-        ieee80211_txrx_result res = TXRX_DROP;
-
-        for (handler = handlers; *handler != NULL; handler++) {
-                res = (*handler)(rx);
-
-                switch (res) {
-                case TXRX_CONTINUE:
-                        continue;
-                case TXRX_DROP:
-                        I802_DEBUG_INC(local->rx_handlers_drop);
-                        if (sta)
-                                sta->rx_dropped++;
-                        break;
-                case TXRX_QUEUED:
-                        I802_DEBUG_INC(local->rx_handlers_queued);
-                        break;
-                }
-                break;
-        }
-
-        if (res == TXRX_DROP)
-                dev_kfree_skb(rx->skb);
-        return res;
-}
-
-static inline void ieee80211_invoke_rx_handlers(struct ieee80211_local *local,
-                                                ieee80211_rx_handler *handlers,
-                                                struct ieee80211_txrx_data *rx,
-                                                struct sta_info *sta)
-{
-        if (__ieee80211_invoke_rx_handlers(local, handlers, rx, sta) ==
-            TXRX_CONTINUE)
-                dev_kfree_skb(rx->skb);
+        return RX_QUEUED;
 }
 
 static void ieee80211_rx_michael_mic_report(struct net_device *dev,
                                             struct ieee80211_hdr *hdr,
-                                            struct sta_info *sta,
                                             struct ieee80211_txrx_data *rx)
 {
         int keyidx, hdrlen;
@@ -1548,7 +1473,7 @@ static void ieee80211_rx_michael_mic_report(struct net_device *dev,
                        dev->name, print_mac(mac, hdr->addr2),
                        print_mac(mac2, hdr->addr1), keyidx);
 
-        if (!sta) {
+        if (!rx->sta) {
                 /*
                  * Some hardware seem to generate incorrect Michael MIC
                  * reports; ignore them to avoid triggering countermeasures.
@@ -1600,7 +1525,88 @@ static void ieee80211_rx_michael_mic_report(struct net_device *dev,
         rx->skb = NULL;
 }
 
-ieee80211_rx_handler ieee80211_rx_handlers[] =
+static void ieee80211_rx_cooked_monitor(struct ieee80211_txrx_data *rx)
+{
+        struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_local *local = rx->local;
+        struct ieee80211_rtap_hdr {
+                struct ieee80211_radiotap_header hdr;
+                u8 flags;
+                u8 rate;
+                __le16 chan_freq;
+                __le16 chan_flags;
+        } __attribute__ ((packed)) *rthdr;
+        struct sk_buff *skb = rx->skb, *skb2;
+        struct net_device *prev_dev = NULL;
+        struct ieee80211_rx_status *status = rx->u.rx.status;
+
+        if (rx->flags & IEEE80211_TXRXD_RX_CMNTR_REPORTED)
+                goto out_free_skb;
+
+        if (skb_headroom(skb) < sizeof(*rthdr) &&
+            pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC))
+                goto out_free_skb;
+
+        rthdr = (void *)skb_push(skb, sizeof(*rthdr));
+        memset(rthdr, 0, sizeof(*rthdr));
+        rthdr->hdr.it_len = cpu_to_le16(sizeof(*rthdr));
+        rthdr->hdr.it_present =
+                cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
+                            (1 << IEEE80211_RADIOTAP_RATE) |
+                            (1 << IEEE80211_RADIOTAP_CHANNEL));
+
+        rthdr->rate = rx->u.rx.rate->bitrate / 5;
+        rthdr->chan_freq = cpu_to_le16(status->freq);
+
+        if (status->band == IEEE80211_BAND_5GHZ)
+                rthdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_OFDM |
+                                                IEEE80211_CHAN_5GHZ);
+        else
+                rthdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_DYN |
+                                                IEEE80211_CHAN_2GHZ);
+
+        skb_set_mac_header(skb, 0);
+        skb->ip_summed = CHECKSUM_UNNECESSARY;
+        skb->pkt_type = PACKET_OTHERHOST;
+        skb->protocol = htons(ETH_P_802_2);
+
+        list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+                if (!netif_running(sdata->dev))
+                        continue;
+
+                if (sdata->vif.type != IEEE80211_IF_TYPE_MNTR ||
+                    !(sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES))
+                        continue;
+
+                if (prev_dev) {
+                        skb2 = skb_clone(skb, GFP_ATOMIC);
+                        if (skb2) {
+                                skb2->dev = prev_dev;
+                                netif_rx(skb2);
+                        }
+                }
+
+                prev_dev = sdata->dev;
+                sdata->dev->stats.rx_packets++;
+                sdata->dev->stats.rx_bytes += skb->len;
+        }
+
+        if (prev_dev) {
+                skb->dev = prev_dev;
+                netif_rx(skb);
+                skb = NULL;
+        } else
+                goto out_free_skb;
+
+        rx->flags |= IEEE80211_TXRXD_RX_CMNTR_REPORTED;
+        return;
+
+ out_free_skb:
+        dev_kfree_skb(skb);
+}
+
+typedef ieee80211_rx_result (*ieee80211_rx_handler)(struct ieee80211_txrx_data *);
+static ieee80211_rx_handler ieee80211_rx_handlers[] =
 {
         ieee80211_rx_h_if_stats,
         ieee80211_rx_h_passive_scan,
@@ -1622,6 +1628,47 @@ ieee80211_rx_handler ieee80211_rx_handlers[] =
         NULL
 };
 
+static void ieee80211_invoke_rx_handlers(struct ieee80211_sub_if_data *sdata,
+                                         struct ieee80211_txrx_data *rx,
+                                         struct sk_buff *skb)
+{
+        ieee80211_rx_handler *handler;
+        ieee80211_rx_result res = RX_DROP_MONITOR;
+
+        rx->skb = skb;
+        rx->sdata = sdata;
+        rx->dev = sdata->dev;
+
+        for (handler = ieee80211_rx_handlers; *handler != NULL; handler++) {
+                res = (*handler)(rx);
+
+                switch (res) {
+                case RX_CONTINUE:
+                        continue;
+                case RX_DROP_UNUSABLE:
+                case RX_DROP_MONITOR:
+                        I802_DEBUG_INC(sdata->local->rx_handlers_drop);
+                        if (rx->sta)
+                                rx->sta->rx_dropped++;
+                        break;
+                case RX_QUEUED:
+                        I802_DEBUG_INC(sdata->local->rx_handlers_queued);
+                        break;
+                }
+                break;
+        }
+
+        switch (res) {
+        case RX_CONTINUE:
+        case RX_DROP_MONITOR:
+                ieee80211_rx_cooked_monitor(rx);
+                break;
+        case RX_DROP_UNUSABLE:
+                dev_kfree_skb(rx->skb);
+                break;
+        }
+}
+
 /* main receive path */
 
 static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
@@ -1649,7 +1696,10 @@ static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
         case IEEE80211_IF_TYPE_IBSS:
                 if (!bssid)
                         return 0;
-                if (!ieee80211_bssid_match(bssid, sdata->u.sta.bssid)) {
+                if ((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_MGMT &&
+                    (rx->fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_BEACON)
+                        return 1;
+                else if (!ieee80211_bssid_match(bssid, sdata->u.sta.bssid)) {
                         if (!(rx->flags & IEEE80211_TXRXD_RXIN_SCAN))
                                 return 0;
                         rx->flags &= ~IEEE80211_TXRXD_RXRA_MATCH;
@@ -1707,11 +1757,11 @@ static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
 static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
                                          struct sk_buff *skb,
                                          struct ieee80211_rx_status *status,
-                                         u32 load)
+                                         u32 load,
+                                         struct ieee80211_rate *rate)
 {
         struct ieee80211_local *local = hw_to_local(hw);
         struct ieee80211_sub_if_data *sdata;
-        struct sta_info *sta;
         struct ieee80211_hdr *hdr;
         struct ieee80211_txrx_data rx;
         u16 type;
@@ -1727,40 +1777,31 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
 
         rx.u.rx.status = status;
         rx.u.rx.load = load;
+        rx.u.rx.rate = rate;
         rx.fc = le16_to_cpu(hdr->frame_control);
         type = rx.fc & IEEE80211_FCTL_FTYPE;
 
         if (type == IEEE80211_FTYPE_DATA || type == IEEE80211_FTYPE_MGMT)
                 local->dot11ReceivedFragmentCount++;
 
-        sta = rx.sta = sta_info_get(local, hdr->addr2);
-        if (sta) {
+        rx.sta = sta_info_get(local, hdr->addr2);
+        if (rx.sta) {
                 rx.dev = rx.sta->dev;
                 rx.sdata = IEEE80211_DEV_TO_SUB_IF(rx.dev);
         }
 
         if ((status->flag & RX_FLAG_MMIC_ERROR)) {
-                ieee80211_rx_michael_mic_report(local->mdev, hdr, sta, &rx);
+                ieee80211_rx_michael_mic_report(local->mdev, hdr, &rx);
                 goto end;
         }
 
         if (unlikely(local->sta_sw_scanning || local->sta_hw_scanning))
                 rx.flags |= IEEE80211_TXRXD_RXIN_SCAN;
 
-        if (__ieee80211_invoke_rx_handlers(local, local->rx_pre_handlers, &rx,
-                                           sta) != TXRX_CONTINUE)
-                goto end;
-        skb = rx.skb;
+        ieee80211_parse_qos(&rx);
+        ieee80211_verify_ip_alignment(&rx);
 
-        if (sta && !(sta->flags & (WLAN_STA_WDS | WLAN_STA_ASSOC_AP)) &&
-            !atomic_read(&local->iff_promiscs) &&
-            !is_multicast_ether_addr(hdr->addr1)) {
-                rx.flags |= IEEE80211_TXRXD_RXRA_MATCH;
-                ieee80211_invoke_rx_handlers(local, local->rx_handlers, &rx,
-                                             rx.sta);
-                sta_info_put(sta);
-                return;
-        }
+        skb = rx.skb;
 
         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
                 if (!netif_running(sdata->dev))
@@ -1772,8 +1813,6 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
                 bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type);
                 rx.flags |= IEEE80211_TXRXD_RXRA_MATCH;
                 prepares = prepare_for_handlers(sdata, bssid, &rx, hdr);
-                /* prepare_for_handlers can change sta */
-                sta = rx.sta;
 
                 if (!prepares)
                         continue;
@@ -1804,26 +1843,18 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
                         continue;
                 }
                 rx.fc = le16_to_cpu(hdr->frame_control);
-                rx.skb = skb_new;
-                rx.dev = prev->dev;
-                rx.sdata = prev;
-                ieee80211_invoke_rx_handlers(local, local->rx_handlers,
-                                             &rx, sta);
+                ieee80211_invoke_rx_handlers(prev, &rx, skb_new);
                 prev = sdata;
         }
         if (prev) {
                 rx.fc = le16_to_cpu(hdr->frame_control);
-                rx.skb = skb;
-                rx.dev = prev->dev;
-                rx.sdata = prev;
-                ieee80211_invoke_rx_handlers(local, local->rx_handlers,
-                                             &rx, sta);
+                ieee80211_invoke_rx_handlers(prev, &rx, skb);
         } else
                 dev_kfree_skb(skb);
 
  end:
-        if (sta)
-                sta_info_put(sta);
+        if (rx.sta)
+                sta_info_put(rx.sta);
 }
 
 #define SEQ_MODULO 0x1000
@@ -1859,6 +1890,8 @@ u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
         u16 head_seq_num, buf_size;
         int index;
         u32 pkt_load;
+        struct ieee80211_supported_band *sband;
+        struct ieee80211_rate *rate;
 
         buf_size = tid_agg_rx->buf_size;
         head_seq_num = tid_agg_rx->head_seq_num;
@@ -1889,12 +1922,14 @@ u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
                                 memcpy(&status,
                                         tid_agg_rx->reorder_buf[index]->cb,
                                         sizeof(status));
+                                sband = local->hw.wiphy->bands[status.band];
+                                rate = &sband->bitrates[status.rate_idx];
                                 pkt_load = ieee80211_rx_load_stats(local,
                                                 tid_agg_rx->reorder_buf[index],
-                                                &status);
+                                                &status, rate);
                                 __ieee80211_rx_handle_packet(hw,
                                         tid_agg_rx->reorder_buf[index],
-                                        &status, pkt_load);
+                                        &status, pkt_load, rate);
                                 tid_agg_rx->stored_mpdu_num--;
                                 tid_agg_rx->reorder_buf[index] = NULL;
                         }
@@ -1934,11 +1969,13 @@ u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
                 /* release the reordered frame back to stack */
                 memcpy(&status, tid_agg_rx->reorder_buf[index]->cb,
                         sizeof(status));
+                sband = local->hw.wiphy->bands[status.band];
+                rate = &sband->bitrates[status.rate_idx];
                 pkt_load = ieee80211_rx_load_stats(local,
                                         tid_agg_rx->reorder_buf[index],
-                                        &status);
+                                        &status, rate);
                 __ieee80211_rx_handle_packet(hw, tid_agg_rx->reorder_buf[index],
-                                                &status, pkt_load);
+                                             &status, pkt_load, rate);
                 tid_agg_rx->stored_mpdu_num--;
                 tid_agg_rx->reorder_buf[index] = NULL;
                 tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
@@ -2019,6 +2056,25 @@ void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
 {
         struct ieee80211_local *local = hw_to_local(hw);
         u32 pkt_load;
+        struct ieee80211_rate *rate = NULL;
+        struct ieee80211_supported_band *sband;
+
+        if (status->band < 0 ||
+            status->band > IEEE80211_NUM_BANDS) {
+                WARN_ON(1);
+                return;
+        }
+
+        sband = local->hw.wiphy->bands[status->band];
+
+        if (!sband ||
+            status->rate_idx < 0 ||
+            status->rate_idx >= sband->n_bitrates) {
+                WARN_ON(1);
+                return;
+        }
+
+        rate = &sband->bitrates[status->rate_idx];
 
         /*
          * key references and virtual interfaces are protected using RCU
@@ -2033,17 +2089,17 @@ void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
          * if it was previously present.
          * Also, frames with less than 16 bytes are dropped.
          */
-        skb = ieee80211_rx_monitor(local, skb, status);
+        skb = ieee80211_rx_monitor(local, skb, status, rate);
         if (!skb) {
                 rcu_read_unlock();
                 return;
         }
 
-        pkt_load = ieee80211_rx_load_stats(local, skb, status);
+        pkt_load = ieee80211_rx_load_stats(local, skb, status, rate);
         local->channel_use_raw += pkt_load;
 
         if (!ieee80211_rx_reorder_ampdu(local, skb))
-                __ieee80211_rx_handle_packet(hw, skb, status, pkt_load);
+                __ieee80211_rx_handle_packet(hw, skb, status, pkt_load, rate);
 
         rcu_read_unlock();
 }
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 1f74bd296357..e384e6632d97 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -55,48 +55,34 @@ static int sta_info_hash_del(struct ieee80211_local *local,
         return -ENOENT;
 }
 
-struct sta_info *sta_info_get(struct ieee80211_local *local, u8 *addr)
+/* must hold local->sta_lock */
+static struct sta_info *__sta_info_find(struct ieee80211_local *local,
+                                        u8 *addr)
 {
         struct sta_info *sta;
 
-        read_lock_bh(&local->sta_lock);
         sta = local->sta_hash[STA_HASH(addr)];
         while (sta) {
-                if (memcmp(sta->addr, addr, ETH_ALEN) == 0) {
-                        __sta_info_get(sta);
+                if (compare_ether_addr(sta->addr, addr) == 0)
                         break;
-                }
                 sta = sta->hnext;
         }
-        read_unlock_bh(&local->sta_lock);
-
         return sta;
 }
-EXPORT_SYMBOL(sta_info_get);
 
-int sta_info_min_txrate_get(struct ieee80211_local *local)
+struct sta_info *sta_info_get(struct ieee80211_local *local, u8 *addr)
 {
         struct sta_info *sta;
-        struct ieee80211_hw_mode *mode;
-        int min_txrate = 9999999;
-        int i;
 
         read_lock_bh(&local->sta_lock);
-        mode = local->oper_hw_mode;
-        for (i = 0; i < STA_HASH_SIZE; i++) {
-                sta = local->sta_hash[i];
-                while (sta) {
-                        if (sta->txrate < min_txrate)
-                                min_txrate = sta->txrate;
-                        sta = sta->hnext;
-                }
-        }
+        sta = __sta_info_find(local, addr);
+        if (sta)
+                __sta_info_get(sta);
         read_unlock_bh(&local->sta_lock);
-        if (min_txrate == 9999999)
-                min_txrate = 0;
 
-        return mode->rates[min_txrate].rate;
+        return sta;
 }
+EXPORT_SYMBOL(sta_info_get);
 
 
 static void sta_info_release(struct kref *kref)
@@ -117,8 +103,10 @@ static void sta_info_release(struct kref *kref)
         while ((skb = skb_dequeue(&sta->tx_filtered)) != NULL) {
                 dev_kfree_skb_any(skb);
         }
-        for (i = 0; i <  STA_TID_NUM; i++)
+        for (i = 0; i <  STA_TID_NUM; i++) {
                 del_timer_sync(&sta->ampdu_mlme.tid_rx[i].session_timer);
+                del_timer_sync(&sta->ampdu_mlme.tid_tx[i].addba_resp_timer);
+        }
         rate_control_free_sta(sta->rate_ctrl, sta->rate_ctrl_priv);
         rate_control_put(sta->rate_ctrl);
         kfree(sta);
@@ -132,8 +120,8 @@ void sta_info_put(struct sta_info *sta)
 EXPORT_SYMBOL(sta_info_put);
 
 
-struct sta_info * sta_info_add(struct ieee80211_local *local,
-                               struct net_device *dev, u8 *addr, gfp_t gfp)
+struct sta_info *sta_info_add(struct ieee80211_local *local,
+                              struct net_device *dev, u8 *addr, gfp_t gfp)
 {
         struct sta_info *sta;
         int i;
@@ -141,7 +129,7 @@ struct sta_info * sta_info_add(struct ieee80211_local *local,
 
         sta = kzalloc(sizeof(*sta), gfp);
         if (!sta)
-                return NULL;
+                return ERR_PTR(-ENOMEM);
 
         kref_init(&sta->kref);
 
@@ -150,30 +138,45 @@ struct sta_info * sta_info_add(struct ieee80211_local *local,
         if (!sta->rate_ctrl_priv) {
                 rate_control_put(sta->rate_ctrl);
                 kfree(sta);
-                return NULL;
+                return ERR_PTR(-ENOMEM);
         }
 
         memcpy(sta->addr, addr, ETH_ALEN);
         sta->local = local;
         sta->dev = dev;
         spin_lock_init(&sta->ampdu_mlme.ampdu_rx);
+        spin_lock_init(&sta->ampdu_mlme.ampdu_tx);
         for (i = 0; i < STA_TID_NUM; i++) {
                 /* timer_to_tid must be initialized with identity mapping to
                  * enable session_timer's data differentiation. refer to
                  * sta_rx_agg_session_timer_expired for useage */
                 sta->timer_to_tid[i] = i;
+                /* tid to tx queue: initialize according to HW (0 is valid) */
+                sta->tid_to_tx_q[i] = local->hw.queues;
                 /* rx timers */
                 sta->ampdu_mlme.tid_rx[i].session_timer.function =
                         sta_rx_agg_session_timer_expired;
                 sta->ampdu_mlme.tid_rx[i].session_timer.data =
                         (unsigned long)&sta->timer_to_tid[i];
                 init_timer(&sta->ampdu_mlme.tid_rx[i].session_timer);
+                /* tx timers */
+                sta->ampdu_mlme.tid_tx[i].addba_resp_timer.function =
+                        sta_addba_resp_timer_expired;
+                sta->ampdu_mlme.tid_tx[i].addba_resp_timer.data =
+                        (unsigned long)&sta->timer_to_tid[i];
+                init_timer(&sta->ampdu_mlme.tid_tx[i].addba_resp_timer);
         }
         skb_queue_head_init(&sta->ps_tx_buf);
         skb_queue_head_init(&sta->tx_filtered);
-        __sta_info_get(sta);    /* sta used by caller, decremented by
-                                 * sta_info_put() */
         write_lock_bh(&local->sta_lock);
+        /* mark sta as used (by caller) */
+        __sta_info_get(sta);
+        /* check if STA exists already */
+        if (__sta_info_find(local, addr)) {
+                write_unlock_bh(&local->sta_lock);
+                sta_info_put(sta);
+                return ERR_PTR(-EEXIST);
+        }
         list_add(&sta->list, &local->sta_list);
         local->num_sta++;
         sta_info_hash_add(local, sta);
@@ -204,6 +207,64 @@ struct sta_info * sta_info_add(struct ieee80211_local *local,
         return sta;
 }
 
+static inline void __bss_tim_set(struct ieee80211_if_ap *bss, u16 aid)
+{
+        /*
+         * This format has been mandated by the IEEE specifications,
+         * so this line may not be changed to use the __set_bit() format.
+         */
+        bss->tim[aid / 8] |= (1 << (aid % 8));
+}
+
+static inline void __bss_tim_clear(struct ieee80211_if_ap *bss, u16 aid)
+{
+        /*
+         * This format has been mandated by the IEEE specifications,
+         * so this line may not be changed to use the __clear_bit() format.
+         */
+        bss->tim[aid / 8] &= ~(1 << (aid % 8));
+}
+
+static void __sta_info_set_tim_bit(struct ieee80211_if_ap *bss,
+                                   struct sta_info *sta)
+{
+        if (bss)
+                __bss_tim_set(bss, sta->aid);
+        if (sta->local->ops->set_tim)
+                sta->local->ops->set_tim(local_to_hw(sta->local), sta->aid, 1);
+}
+
+void sta_info_set_tim_bit(struct sta_info *sta)
+{
+        struct ieee80211_sub_if_data *sdata;
+
+        sdata = IEEE80211_DEV_TO_SUB_IF(sta->dev);
+
+        read_lock_bh(&sta->local->sta_lock);
+        __sta_info_set_tim_bit(sdata->bss, sta);
+        read_unlock_bh(&sta->local->sta_lock);
+}
+
+static void __sta_info_clear_tim_bit(struct ieee80211_if_ap *bss,
+                                     struct sta_info *sta)
+{
+        if (bss)
+                __bss_tim_clear(bss, sta->aid);
+        if (sta->local->ops->set_tim)
+                sta->local->ops->set_tim(local_to_hw(sta->local), sta->aid, 0);
+}
+
+void sta_info_clear_tim_bit(struct sta_info *sta)
+{
+        struct ieee80211_sub_if_data *sdata;
+
+        sdata = IEEE80211_DEV_TO_SUB_IF(sta->dev);
+
+        read_lock_bh(&sta->local->sta_lock);
+        __sta_info_clear_tim_bit(sdata->bss, sta);
+        read_unlock_bh(&sta->local->sta_lock);
+}
+
 /* Caller must hold local->sta_lock */
 void sta_info_remove(struct sta_info *sta)
 {
@@ -220,10 +281,9 @@ void sta_info_remove(struct sta_info *sta)
                 sta->flags &= ~WLAN_STA_PS;
                 if (sdata->bss)
                         atomic_dec(&sdata->bss->num_sta_ps);
+                __sta_info_clear_tim_bit(sdata->bss, sta);
         }
         local->num_sta--;
-        sta_info_remove_aid_ptr(sta);
-
 }
 
 void sta_info_free(struct sta_info *sta)
@@ -252,7 +312,7 @@ void sta_info_free(struct sta_info *sta)
 #endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
 
         ieee80211_key_free(sta->key);
-        sta->key = NULL;
+        WARN_ON(sta->key);
 
         if (local->ops->sta_notify) {
                 struct ieee80211_sub_if_data *sdata;
@@ -299,6 +359,7 @@ static void sta_info_cleanup_expire_buffered(struct ieee80211_local *local,
 {
         unsigned long flags;
         struct sk_buff *skb;
+        struct ieee80211_sub_if_data *sdata;
         DECLARE_MAC_BUF(mac);
 
         if (skb_queue_empty(&sta->ps_tx_buf))
@@ -307,21 +368,23 @@ static void sta_info_cleanup_expire_buffered(struct ieee80211_local *local,
         for (;;) {
                 spin_lock_irqsave(&sta->ps_tx_buf.lock, flags);
                 skb = skb_peek(&sta->ps_tx_buf);
-                if (sta_info_buffer_expired(local, sta, skb)) {
+                if (sta_info_buffer_expired(local, sta, skb))
                         skb = __skb_dequeue(&sta->ps_tx_buf);
-                        if (skb_queue_empty(&sta->ps_tx_buf))
-                                sta->flags &= ~WLAN_STA_TIM;
-                } else
+                else
                         skb = NULL;
                 spin_unlock_irqrestore(&sta->ps_tx_buf.lock, flags);
 
-                if (skb) {
-                        local->total_ps_buffered--;
-                        printk(KERN_DEBUG "Buffered frame expired (STA "
-                               "%s)\n", print_mac(mac, sta->addr));
-                        dev_kfree_skb(skb);
-                } else
+                if (!skb)
                         break;
+
+                sdata = IEEE80211_DEV_TO_SUB_IF(sta->dev);
+                local->total_ps_buffered--;
+                printk(KERN_DEBUG "Buffered frame expired (STA "
+                       "%s)\n", print_mac(mac, sta->addr));
+                dev_kfree_skb(skb);
+
+                if (skb_queue_empty(&sta->ps_tx_buf))
+                        sta_info_clear_tim_bit(sta);
         }
 }
 
@@ -400,23 +463,6 @@ void sta_info_stop(struct ieee80211_local *local)
         sta_info_flush(local, NULL);
 }
 
-void sta_info_remove_aid_ptr(struct sta_info *sta)
-{
-        struct ieee80211_sub_if_data *sdata;
-
-        if (sta->aid <= 0)
-                return;
-
-        sdata = IEEE80211_DEV_TO_SUB_IF(sta->dev);
-
-        if (sdata->local->ops->set_tim)
-                sdata->local->ops->set_tim(local_to_hw(sdata->local),
-                                          sta->aid, 0);
-        if (sdata->bss)
-                __bss_tim_clear(sdata->bss, sta->aid);
-}
-
-
 /**
  * sta_info_flush - flush matching STA entries from the STA table
  * @local: local interface data
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 96fe3ed95038..86eed40ada78 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -15,31 +15,72 @@
 #include <linux/kref.h>
 #include "ieee80211_key.h"
 
-/* Stations flags (struct sta_info::flags) */
-#define WLAN_STA_AUTH BIT(0)
-#define WLAN_STA_ASSOC BIT(1)
-#define WLAN_STA_PS BIT(2)
-#define WLAN_STA_TIM BIT(3) /* TIM bit is on for PS stations */
-#define WLAN_STA_PERM BIT(4) /* permanent; do not remove entry on expiration */
-#define WLAN_STA_AUTHORIZED BIT(5) /* If 802.1X is used, this flag is
-                                    * controlling whether STA is authorized to
-                                    * send and receive non-IEEE 802.1X frames
-                                    */
-#define WLAN_STA_SHORT_PREAMBLE BIT(7)
-/* whether this is an AP that we are associated with as a client */
-#define WLAN_STA_ASSOC_AP BIT(8)
-#define WLAN_STA_WME BIT(9)
-#define WLAN_STA_WDS BIT(27)
+/**
+ * enum ieee80211_sta_info_flags - Stations flags
+ *
+ * These flags are used with &struct sta_info's @flags member.
+ *
+ * @WLAN_STA_AUTH: Station is authenticated.
+ * @WLAN_STA_ASSOC: Station is associated.
+ * @WLAN_STA_PS: Station is in power-save mode
+ * @WLAN_STA_AUTHORIZED: Station is authorized to send/receive traffic.
+ *      This bit is always checked so needs to be enabled for all stations
+ *      when virtual port control is not in use.
+ * @WLAN_STA_SHORT_PREAMBLE: Station is capable of receiving short-preamble
+ *      frames.
+ * @WLAN_STA_ASSOC_AP: We're associated to that station, it is an AP.
+ * @WLAN_STA_WME: Station is a QoS-STA.
+ * @WLAN_STA_WDS: Station is one of our WDS peers.
+ * @WLAN_STA_PSPOLL: Station has just PS-polled us.
+ * @WLAN_STA_CLEAR_PS_FILT: Clear PS filter in hardware (using the
+ *      IEEE80211_TXCTL_CLEAR_PS_FILT control flag) when the next
+ *      frame to this station is transmitted.
+ */
+enum ieee80211_sta_info_flags {
+        WLAN_STA_AUTH           = 1<<0,
+        WLAN_STA_ASSOC          = 1<<1,
+        WLAN_STA_PS             = 1<<2,
+        WLAN_STA_AUTHORIZED     = 1<<3,
+        WLAN_STA_SHORT_PREAMBLE = 1<<4,
+        WLAN_STA_ASSOC_AP       = 1<<5,
+        WLAN_STA_WME            = 1<<6,
+        WLAN_STA_WDS            = 1<<7,
+        WLAN_STA_PSPOLL         = 1<<8,
+        WLAN_STA_CLEAR_PS_FILT  = 1<<9,
+};
 
 #define STA_TID_NUM 16
 #define ADDBA_RESP_INTERVAL HZ
+#define HT_AGG_MAX_RETRIES              (0x3)
 
 #define HT_AGG_STATE_INITIATOR_SHIFT    (4)
 
+#define HT_ADDBA_REQUESTED_MSK          BIT(0)
+#define HT_ADDBA_DRV_READY_MSK          BIT(1)
+#define HT_ADDBA_RECEIVED_MSK           BIT(2)
 #define HT_AGG_STATE_REQ_STOP_BA_MSK    BIT(3)
-
+#define HT_AGG_STATE_INITIATOR_MSK      BIT(HT_AGG_STATE_INITIATOR_SHIFT)
 #define HT_AGG_STATE_IDLE               (0x0)
-#define HT_AGG_STATE_OPERATIONAL        (0x7)
+#define HT_AGG_STATE_OPERATIONAL        (HT_ADDBA_REQUESTED_MSK |       \
+                                         HT_ADDBA_DRV_READY_MSK |       \
+                                         HT_ADDBA_RECEIVED_MSK)
+
+/**
+ * struct tid_ampdu_tx - TID aggregation information (Tx).
+ *
+ * @state: TID's state in session state machine.
+ * @dialog_token: dialog token for aggregation session
+ * @ssn: Starting Sequence Number expected to be aggregated.
+ * @addba_resp_timer: timer for peer's response to addba request
+ * @addba_req_num: number of times addBA request has been sent.
+ */
+struct tid_ampdu_tx {
+        u8 state;
+        u8 dialog_token;
+        u16 ssn;
+        struct timer_list addba_resp_timer;
+        u8 addba_req_num;
+};
 
 /**
  * struct tid_ampdu_rx - TID aggregation information (Rx).
@@ -69,12 +110,18 @@ struct tid_ampdu_rx {
 /**
  * struct sta_ampdu_mlme - STA aggregation information.
  *
- * @tid_agg_info_rx: aggregation info for Rx per TID
+ * @tid_rx: aggregation info for Rx per TID
+ * @tid_tx: aggregation info for Tx per TID
  * @ampdu_rx: for locking sections in aggregation Rx flow
+ * @ampdu_tx: for locking sectionsi in aggregation Tx flow
+ * @dialog_token_allocator: dialog token enumerator for each new session;
  */
 struct sta_ampdu_mlme {
         struct tid_ampdu_rx tid_rx[STA_TID_NUM];
+        struct tid_ampdu_tx tid_tx[STA_TID_NUM];
         spinlock_t ampdu_rx;
+        spinlock_t ampdu_tx;
+        u8 dialog_token_allocator;
 };
 
 struct sta_info {
@@ -90,12 +137,9 @@ struct sta_info {
 
         struct sk_buff_head ps_tx_buf; /* buffer of TX frames for station in
                                         * power saving state */
-        int pspoll; /* whether STA has send a PS Poll frame */
         struct sk_buff_head tx_filtered; /* buffer of TX frames that were
                                           * already given to low-level driver,
                                           * but were filtered */
-        int clear_dst_mask;
-
         unsigned long rx_packets, tx_packets; /* number of RX/TX MSDUs */
         unsigned long rx_bytes, tx_bytes;
         unsigned long tx_retry_failed, tx_retry_count;
@@ -104,10 +148,11 @@ struct sta_info {
         unsigned int wep_weak_iv_count; /* number of RX frames with weak IV */
 
         unsigned long last_rx;
-        u32 supp_rates; /* bitmap of supported rates in local->curr_rates */
-        int txrate; /* index in local->curr_rates */
-        int last_txrate; /* last rate used to send a frame to this STA */
-        int last_nonerp_idx;
+        /* bitmap of supported rates per band */
+        u64 supp_rates[IEEE80211_NUM_BANDS];
+        int txrate_idx;
+        /* last rates used to send a frame to this STA */
+        int last_txrate_idx, last_nonerp_txrate_idx;
 
         struct net_device *dev; /* which net device is this station associated
                                  * to */
@@ -132,8 +177,6 @@ struct sta_info {
         int last_rssi; /* RSSI of last received frame from this STA */
         int last_signal; /* signal of last received frame from this STA */
         int last_noise; /* noise of last received frame from this STA */
-        int last_ack_rssi[3]; /* RSSI of last received ACKs from this STA */
-        unsigned long last_ack;
         int channel_use;
         int channel_use_raw;
 
@@ -148,20 +191,20 @@ struct sta_info {
                                              of this STA */
         struct sta_ampdu_mlme ampdu_mlme;
         u8 timer_to_tid[STA_TID_NUM];   /* convert timer id to tid */
+        u8 tid_to_tx_q[STA_TID_NUM];    /* map tid to tx queue */
 
 #ifdef CONFIG_MAC80211_DEBUGFS
         struct sta_info_debugfsdentries {
                 struct dentry *dir;
                 struct dentry *flags;
                 struct dentry *num_ps_buf_frames;
-                struct dentry *last_ack_rssi;
-                struct dentry *last_ack_ms;
                 struct dentry *inactive_ms;
                 struct dentry *last_seq_ctrl;
 #ifdef CONFIG_MAC80211_DEBUG_COUNTERS
                 struct dentry *wme_rx_queue;
                 struct dentry *wme_tx_queue;
 #endif
+                struct dentry *agg_status;
         } debugfs;
 #endif
 };
@@ -191,16 +234,17 @@ static inline void __sta_info_get(struct sta_info *sta)
 }
 
 struct sta_info * sta_info_get(struct ieee80211_local *local, u8 *addr);
-int sta_info_min_txrate_get(struct ieee80211_local *local);
 void sta_info_put(struct sta_info *sta);
-struct sta_info * sta_info_add(struct ieee80211_local *local,
-                               struct net_device *dev, u8 *addr, gfp_t gfp);
+struct sta_info *sta_info_add(struct ieee80211_local *local,
+                              struct net_device *dev, u8 *addr, gfp_t gfp);
 void sta_info_remove(struct sta_info *sta);
 void sta_info_free(struct sta_info *sta);
 void sta_info_init(struct ieee80211_local *local);
 int sta_info_start(struct ieee80211_local *local);
 void sta_info_stop(struct ieee80211_local *local);
-void sta_info_remove_aid_ptr(struct sta_info *sta);
 void sta_info_flush(struct ieee80211_local *local, struct net_device *dev);
 
+void sta_info_set_tim_bit(struct sta_info *sta);
+void sta_info_clear_tim_bit(struct sta_info *sta);
+
 #endif /* STA_INFO_H */
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 67b509edd431..1cd58e01f1ee 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -92,9 +92,13 @@ static u16 ieee80211_duration(struct ieee80211_txrx_data *tx, int group_addr,
         int rate, mrate, erp, dur, i;
         struct ieee80211_rate *txrate = tx->u.tx.rate;
         struct ieee80211_local *local = tx->local;
-        struct ieee80211_hw_mode *mode = tx->u.tx.mode;
+        struct ieee80211_supported_band *sband;
 
-        erp = txrate->flags & IEEE80211_RATE_ERP;
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+
+        erp = 0;
+        if (tx->sdata->flags & IEEE80211_SDATA_OPERATING_GMODE)
+                erp = txrate->flags & IEEE80211_RATE_ERP_G;
 
         /*
          * data and mgmt (except PS Poll):
@@ -150,20 +154,36 @@ static u16 ieee80211_duration(struct ieee80211_txrx_data *tx, int group_addr,
          * Mandatory rates for IEEE 802.11g PHY: 1, 2, 5.5, 11, 6, 12, 24 Mbps
          */
         rate = -1;
-        mrate = 10; /* use 1 Mbps if everything fails */
-        for (i = 0; i < mode->num_rates; i++) {
-                struct ieee80211_rate *r = &mode->rates[i];
-                if (r->rate > txrate->rate)
-                        break;
+        /* use lowest available if everything fails */
+        mrate = sband->bitrates[0].bitrate;
+        for (i = 0; i < sband->n_bitrates; i++) {
+                struct ieee80211_rate *r = &sband->bitrates[i];
 
-                if (IEEE80211_RATE_MODULATION(txrate->flags) !=
-                    IEEE80211_RATE_MODULATION(r->flags))
-                        continue;
+                if (r->bitrate > txrate->bitrate)
+                        break;
 
-                if (r->flags & IEEE80211_RATE_BASIC)
-                        rate = r->rate;
-                else if (r->flags & IEEE80211_RATE_MANDATORY)
-                        mrate = r->rate;
+                if (tx->sdata->basic_rates & BIT(i))
+                        rate = r->bitrate;
+
+                switch (sband->band) {
+                case IEEE80211_BAND_2GHZ: {
+                        u32 flag;
+                        if (tx->sdata->flags & IEEE80211_SDATA_OPERATING_GMODE)
+                                flag = IEEE80211_RATE_MANDATORY_G;
+                        else
+                                flag = IEEE80211_RATE_MANDATORY_B;
+                        if (r->flags & flag)
+                                mrate = r->bitrate;
+                        break;
+                }
+                case IEEE80211_BAND_5GHZ:
+                        if (r->flags & IEEE80211_RATE_MANDATORY_A)
+                                mrate = r->bitrate;
+                        break;
+                case IEEE80211_NUM_BANDS:
+                        WARN_ON(1);
+                        break;
+                }
         }
         if (rate == -1) {
                 /* No matching basic rate found; use highest suitable mandatory
@@ -184,7 +204,7 @@ static u16 ieee80211_duration(struct ieee80211_txrx_data *tx, int group_addr,
                 dur *= 2; /* ACK + SIFS */
                 /* next fragment */
                 dur += ieee80211_frame_duration(local, next_frag_len,
-                                txrate->rate, erp,
+                                txrate->bitrate, erp,
                                 tx->sdata->bss_conf.use_short_preamble);
         }
 
@@ -212,7 +232,7 @@ static int inline is_ieee80211_device(struct net_device *dev,
 
 /* tx handlers */
 
-static ieee80211_txrx_result
+static ieee80211_tx_result
 ieee80211_tx_h_check_assoc(struct ieee80211_txrx_data *tx)
 {
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
@@ -222,15 +242,15 @@ ieee80211_tx_h_check_assoc(struct ieee80211_txrx_data *tx)
         u32 sta_flags;
 
         if (unlikely(tx->flags & IEEE80211_TXRXD_TX_INJECTED))
-                return TXRX_CONTINUE;
+                return TX_CONTINUE;
 
         if (unlikely(tx->local->sta_sw_scanning) &&
             ((tx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_MGMT ||
              (tx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_PROBE_REQ))
-                return TXRX_DROP;
+                return TX_DROP;
 
         if (tx->flags & IEEE80211_TXRXD_TXPS_BUFFERED)
-                return TXRX_CONTINUE;
+                return TX_CONTINUE;
 
         sta_flags = tx->sta ? tx->sta->flags : 0;
 
@@ -245,7 +265,7 @@ ieee80211_tx_h_check_assoc(struct ieee80211_txrx_data *tx)
                                tx->dev->name, print_mac(mac, hdr->addr1));
 #endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
                         I802_DEBUG_INC(tx->local->tx_handlers_drop_not_assoc);
-                        return TXRX_DROP;
+                        return TX_DROP;
                 }
         } else {
                 if (unlikely((tx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA &&
@@ -255,15 +275,15 @@ ieee80211_tx_h_check_assoc(struct ieee80211_txrx_data *tx)
                          * No associated STAs - no need to send multicast
                          * frames.
                          */
-                        return TXRX_DROP;
+                        return TX_DROP;
                 }
-                return TXRX_CONTINUE;
+                return TX_CONTINUE;
         }
 
-        return TXRX_CONTINUE;
+        return TX_CONTINUE;
 }
 
-static ieee80211_txrx_result
+static ieee80211_tx_result
 ieee80211_tx_h_sequence(struct ieee80211_txrx_data *tx)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
@@ -271,7 +291,7 @@ ieee80211_tx_h_sequence(struct ieee80211_txrx_data *tx)
         if (ieee80211_get_hdrlen(le16_to_cpu(hdr->frame_control)) >= 24)
                 ieee80211_include_sequence(tx->sdata, hdr);
 
-        return TXRX_CONTINUE;
+        return TX_CONTINUE;
 }
 
 /* This function is called whenever the AP is about to exceed the maximum limit
@@ -321,7 +341,7 @@ static void purge_old_ps_buffers(struct ieee80211_local *local)
                wiphy_name(local->hw.wiphy), purged);
 }
 
-static ieee80211_txrx_result
+static ieee80211_tx_result
 ieee80211_tx_h_multicast_ps_buf(struct ieee80211_txrx_data *tx)
 {
         /*
@@ -334,11 +354,11 @@ ieee80211_tx_h_multicast_ps_buf(struct ieee80211_txrx_data *tx)
 
         /* not AP/IBSS or ordered frame */
         if (!tx->sdata->bss || (tx->fc & IEEE80211_FCTL_ORDER))
-                return TXRX_CONTINUE;
+                return TX_CONTINUE;
 
         /* no stations in PS mode */
         if (!atomic_read(&tx->sdata->bss->num_sta_ps))
-                return TXRX_CONTINUE;
+                return TX_CONTINUE;
 
         /* buffered in mac80211 */
         if (tx->local->hw.flags & IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING) {
@@ -355,16 +375,16 @@ ieee80211_tx_h_multicast_ps_buf(struct ieee80211_txrx_data *tx)
                 } else
                         tx->local->total_ps_buffered++;
                 skb_queue_tail(&tx->sdata->bss->ps_bc_buf, tx->skb);
-                return TXRX_QUEUED;
+                return TX_QUEUED;
         }
 
         /* buffered in hardware */
         tx->u.tx.control->flags |= IEEE80211_TXCTL_SEND_AFTER_DTIM;
 
-        return TXRX_CONTINUE;
+        return TX_CONTINUE;
 }
 
-static ieee80211_txrx_result
+static ieee80211_tx_result
 ieee80211_tx_h_unicast_ps_buf(struct ieee80211_txrx_data *tx)
 {
         struct sta_info *sta = tx->sta;
@@ -373,9 +393,10 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_txrx_data *tx)
         if (unlikely(!sta ||
                      ((tx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_MGMT &&
                       (tx->fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_PROBE_RESP)))
-                return TXRX_CONTINUE;
+                return TX_CONTINUE;
 
-        if (unlikely((sta->flags & WLAN_STA_PS) && !sta->pspoll)) {
+        if (unlikely((sta->flags & WLAN_STA_PS) &&
+                     !(sta->flags & WLAN_STA_PSPOLL))) {
                 struct ieee80211_tx_packet_data *pkt_data;
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
                 printk(KERN_DEBUG "STA %s aid %d: PS buffer (entries "
@@ -383,7 +404,6 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_txrx_data *tx)
                        print_mac(mac, sta->addr), sta->aid,
                        skb_queue_len(&sta->ps_tx_buf));
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
-                sta->flags |= WLAN_STA_TIM;
                 if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER)
                         purge_old_ps_buffers(tx->local);
                 if (skb_queue_len(&sta->ps_tx_buf) >= STA_MAX_TX_BUFFER) {
@@ -396,18 +416,15 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_txrx_data *tx)
                         dev_kfree_skb(old);
                 } else
                         tx->local->total_ps_buffered++;
+
                 /* Queue frame to be sent after STA sends an PS Poll frame */
-                if (skb_queue_empty(&sta->ps_tx_buf)) {
-                        if (tx->local->ops->set_tim)
-                                tx->local->ops->set_tim(local_to_hw(tx->local),
-                                                       sta->aid, 1);
-                        if (tx->sdata->bss)
-                                bss_tim_set(tx->local, tx->sdata->bss, sta->aid);
-                }
+                if (skb_queue_empty(&sta->ps_tx_buf))
+                        sta_info_set_tim_bit(sta);
+
                 pkt_data = (struct ieee80211_tx_packet_data *)tx->skb->cb;
                 pkt_data->jiffies = jiffies;
                 skb_queue_tail(&sta->ps_tx_buf, tx->skb);
-                return TXRX_QUEUED;
+                return TX_QUEUED;
         }
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
         else if (unlikely(sta->flags & WLAN_STA_PS)) {
@@ -416,16 +433,16 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_txrx_data *tx)
                        print_mac(mac, sta->addr));
         }
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
-        sta->pspoll = 0;
+        sta->flags &= ~WLAN_STA_PSPOLL;
 
-        return TXRX_CONTINUE;
+        return TX_CONTINUE;
 }
 
-static ieee80211_txrx_result
+static ieee80211_tx_result
 ieee80211_tx_h_ps_buf(struct ieee80211_txrx_data *tx)
 {
         if (unlikely(tx->flags & IEEE80211_TXRXD_TXPS_BUFFERED))
-                return TXRX_CONTINUE;
+                return TX_CONTINUE;
 
         if (tx->flags & IEEE80211_TXRXD_TXUNICAST)
                 return ieee80211_tx_h_unicast_ps_buf(tx);
@@ -433,7 +450,7 @@ ieee80211_tx_h_ps_buf(struct ieee80211_txrx_data *tx)
                 return ieee80211_tx_h_multicast_ps_buf(tx);
 }
 
-static ieee80211_txrx_result
+static ieee80211_tx_result
 ieee80211_tx_h_select_key(struct ieee80211_txrx_data *tx)
 {
         struct ieee80211_key *key;
@@ -449,7 +466,7 @@ ieee80211_tx_h_select_key(struct ieee80211_txrx_data *tx)
                  !(tx->u.tx.control->flags & IEEE80211_TXCTL_EAPOL_FRAME) &&
                  !(tx->flags & IEEE80211_TXRXD_TX_INJECTED)) {
                 I802_DEBUG_INC(tx->local->tx_handlers_drop_unencrypted);
-                return TXRX_DROP;
+                return TX_DROP;
         } else
                 tx->key = NULL;
 
@@ -478,10 +495,10 @@ ieee80211_tx_h_select_key(struct ieee80211_txrx_data *tx)
         if (!tx->key || !(tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE))
                 tx->u.tx.control->flags |= IEEE80211_TXCTL_DO_NOT_ENCRYPT;
 
-        return TXRX_CONTINUE;
+        return TX_CONTINUE;
 }
 
-static ieee80211_txrx_result
+static ieee80211_tx_result
 ieee80211_tx_h_fragment(struct ieee80211_txrx_data *tx)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) tx->skb->data;
@@ -493,7 +510,7 @@ ieee80211_tx_h_fragment(struct ieee80211_txrx_data *tx)
         int frag_threshold = tx->local->fragmentation_threshold;
 
         if (!(tx->flags & IEEE80211_TXRXD_FRAGMENTED))
-                return TXRX_CONTINUE;
+                return TX_CONTINUE;
 
         first = tx->skb;
 
@@ -547,7 +564,7 @@ ieee80211_tx_h_fragment(struct ieee80211_txrx_data *tx)
         tx->u.tx.num_extra_frag = num_fragm - 1;
         tx->u.tx.extra_frag = frags;
 
-        return TXRX_CONTINUE;
+        return TX_CONTINUE;
 
  fail:
         printk(KERN_DEBUG "%s: failed to fragment frame\n", tx->dev->name);
@@ -558,14 +575,14 @@ ieee80211_tx_h_fragment(struct ieee80211_txrx_data *tx)
                 kfree(frags);
         }
         I802_DEBUG_INC(tx->local->tx_handlers_drop_fragment);
-        return TXRX_DROP;
+        return TX_DROP;
 }
 
-static ieee80211_txrx_result
+static ieee80211_tx_result
 ieee80211_tx_h_encrypt(struct ieee80211_txrx_data *tx)
 {
         if (!tx->key)
-                return TXRX_CONTINUE;
+                return TX_CONTINUE;
 
         switch (tx->key->conf.alg) {
         case ALG_WEP:
@@ -578,33 +595,35 @@ ieee80211_tx_h_encrypt(struct ieee80211_txrx_data *tx)
 
         /* not reached */
         WARN_ON(1);
-        return TXRX_DROP;
+        return TX_DROP;
 }
 
-static ieee80211_txrx_result
+static ieee80211_tx_result
 ieee80211_tx_h_rate_ctrl(struct ieee80211_txrx_data *tx)
 {
         struct rate_selection rsel;
+        struct ieee80211_supported_band *sband;
+
+        sband = tx->local->hw.wiphy->bands[tx->local->hw.conf.channel->band];
 
         if (likely(!tx->u.tx.rate)) {
-                rate_control_get_rate(tx->dev, tx->u.tx.mode, tx->skb, &rsel);
+                rate_control_get_rate(tx->dev, sband, tx->skb, &rsel);
                 tx->u.tx.rate = rsel.rate;
-                if (unlikely(rsel.probe != NULL)) {
+                if (unlikely(rsel.probe)) {
                         tx->u.tx.control->flags |=
                                 IEEE80211_TXCTL_RATE_CTRL_PROBE;
                         tx->flags |= IEEE80211_TXRXD_TXPROBE_LAST_FRAG;
-                        tx->u.tx.control->alt_retry_rate = tx->u.tx.rate->val;
+                        tx->u.tx.control->alt_retry_rate = tx->u.tx.rate;
                         tx->u.tx.rate = rsel.probe;
                 } else
-                        tx->u.tx.control->alt_retry_rate = -1;
+                        tx->u.tx.control->alt_retry_rate = NULL;
 
                 if (!tx->u.tx.rate)
-                        return TXRX_DROP;
+                        return TX_DROP;
         } else
-                tx->u.tx.control->alt_retry_rate = -1;
+                tx->u.tx.control->alt_retry_rate = NULL;
 
-        if (tx->u.tx.mode->mode == MODE_IEEE80211G &&
-            tx->sdata->bss_conf.use_cts_prot &&
+        if (tx->sdata->bss_conf.use_cts_prot &&
             (tx->flags & IEEE80211_TXRXD_FRAGMENTED) && rsel.nonerp) {
                 tx->u.tx.last_frag_rate = tx->u.tx.rate;
                 if (rsel.probe)
@@ -612,25 +631,24 @@ ieee80211_tx_h_rate_ctrl(struct ieee80211_txrx_data *tx)
                 else
                         tx->flags |= IEEE80211_TXRXD_TXPROBE_LAST_FRAG;
                 tx->u.tx.rate = rsel.nonerp;
-                tx->u.tx.control->rate = rsel.nonerp;
+                tx->u.tx.control->tx_rate = rsel.nonerp;
                 tx->u.tx.control->flags &= ~IEEE80211_TXCTL_RATE_CTRL_PROBE;
         } else {
                 tx->u.tx.last_frag_rate = tx->u.tx.rate;
-                tx->u.tx.control->rate = tx->u.tx.rate;
+                tx->u.tx.control->tx_rate = tx->u.tx.rate;
         }
-        tx->u.tx.control->tx_rate = tx->u.tx.rate->val;
+        tx->u.tx.control->tx_rate = tx->u.tx.rate;
 
-        return TXRX_CONTINUE;
+        return TX_CONTINUE;
 }
 
-static ieee80211_txrx_result
+static ieee80211_tx_result
 ieee80211_tx_h_misc(struct ieee80211_txrx_data *tx)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) tx->skb->data;
         u16 fc = le16_to_cpu(hdr->frame_control);
         u16 dur;
         struct ieee80211_tx_control *control = tx->u.tx.control;
-        struct ieee80211_hw_mode *mode = tx->u.tx.mode;
 
         if (!control->retry_limit) {
                 if (!is_multicast_ether_addr(hdr->addr1)) {
@@ -657,14 +675,14 @@ ieee80211_tx_h_misc(struct ieee80211_txrx_data *tx)
                  * frames.
                  * TODO: The last fragment could still use multiple retry
                  * rates. */
-                control->alt_retry_rate = -1;
+                control->alt_retry_rate = NULL;
         }
 
         /* Use CTS protection for unicast frames sent using extended rates if
          * there are associated non-ERP stations and RTS/CTS is not configured
          * for the frame. */
-        if (mode->mode == MODE_IEEE80211G &&
-            (tx->u.tx.rate->flags & IEEE80211_RATE_ERP) &&
+        if ((tx->sdata->flags & IEEE80211_SDATA_OPERATING_GMODE) &&
+            (tx->u.tx.rate->flags & IEEE80211_RATE_ERP_G) &&
             (tx->flags & IEEE80211_TXRXD_TXUNICAST) &&
             tx->sdata->bss_conf.use_cts_prot &&
             !(control->flags & IEEE80211_TXCTL_USE_RTS_CTS))
@@ -674,10 +692,10 @@ ieee80211_tx_h_misc(struct ieee80211_txrx_data *tx)
          * short preambles at the selected rate and short preambles are
          * available on the network at the current point in time. */
         if (((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA) &&
-            (tx->u.tx.rate->flags & IEEE80211_RATE_PREAMBLE2) &&
+            (tx->u.tx.rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
             tx->sdata->bss_conf.use_short_preamble &&
             (!tx->sta || (tx->sta->flags & WLAN_STA_SHORT_PREAMBLE))) {
-                tx->u.tx.control->tx_rate = tx->u.tx.rate->val2;
+                tx->u.tx.control->flags |= IEEE80211_TXCTL_SHORT_PREAMBLE;
         }
 
         /* Setup duration field for the first fragment of the frame. Duration
@@ -690,19 +708,33 @@ ieee80211_tx_h_misc(struct ieee80211_txrx_data *tx)
 
         if ((control->flags & IEEE80211_TXCTL_USE_RTS_CTS) ||
             (control->flags & IEEE80211_TXCTL_USE_CTS_PROTECT)) {
-                struct ieee80211_rate *rate;
+                struct ieee80211_supported_band *sband;
+                struct ieee80211_rate *rate, *baserate;
+                int idx;
+
+                sband = tx->local->hw.wiphy->bands[
+                                tx->local->hw.conf.channel->band];
 
                 /* Do not use multiple retry rates when using RTS/CTS */
-                control->alt_retry_rate = -1;
+                control->alt_retry_rate = NULL;
 
                 /* Use min(data rate, max base rate) as CTS/RTS rate */
                 rate = tx->u.tx.rate;
-                while (rate > mode->rates &&
-                       !(rate->flags & IEEE80211_RATE_BASIC))
-                        rate--;
+                baserate = NULL;
 
-                control->rts_cts_rate = rate->val;
-                control->rts_rate = rate;
+                for (idx = 0; idx < sband->n_bitrates; idx++) {
+                        if (sband->bitrates[idx].bitrate > rate->bitrate)
+                                continue;
+                        if (tx->sdata->basic_rates & BIT(idx) &&
+                            (!baserate ||
+                             (baserate->bitrate < sband->bitrates[idx].bitrate)))
+                                baserate = &sband->bitrates[idx];
+                }
+
+                if (baserate)
+                        control->rts_cts_rate = baserate;
+                else
+                        control->rts_cts_rate = &sband->bitrates[0];
         }
 
         if (tx->sta) {
@@ -719,17 +751,17 @@ ieee80211_tx_h_misc(struct ieee80211_txrx_data *tx)
                 }
         }
 
-        return TXRX_CONTINUE;
+        return TX_CONTINUE;
 }
 
-static ieee80211_txrx_result
+static ieee80211_tx_result
 ieee80211_tx_h_load_stats(struct ieee80211_txrx_data *tx)
 {
         struct ieee80211_local *local = tx->local;
-        struct ieee80211_hw_mode *mode = tx->u.tx.mode;
         struct sk_buff *skb = tx->skb;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
         u32 load = 0, hdrtime;
+        struct ieee80211_rate *rate = tx->u.tx.rate;
 
         /* TODO: this could be part of tx_status handling, so that the number
          * of retries would be known; TX rate should in that case be stored
@@ -740,9 +772,9 @@ ieee80211_tx_h_load_stats(struct ieee80211_txrx_data *tx)
         /* 1 bit at 1 Mbit/s takes 1 usec; in channel_use values,
          * 1 usec = 1/8 * (1080 / 10) = 13.5 */
 
-        if (mode->mode == MODE_IEEE80211A ||
-            (mode->mode == MODE_IEEE80211G &&
-             tx->u.tx.rate->flags & IEEE80211_RATE_ERP))
+        if (tx->u.tx.channel->band == IEEE80211_BAND_5GHZ ||
+            (tx->u.tx.channel->band == IEEE80211_BAND_2GHZ &&
+             rate->flags & IEEE80211_RATE_ERP_G))
                 hdrtime = CHAN_UTIL_HDR_SHORT;
         else
                 hdrtime = CHAN_UTIL_HDR_LONG;
@@ -756,14 +788,15 @@ ieee80211_tx_h_load_stats(struct ieee80211_txrx_data *tx)
         else if (tx->u.tx.control->flags & IEEE80211_TXCTL_USE_CTS_PROTECT)
                 load += hdrtime;
 
-        load += skb->len * tx->u.tx.rate->rate_inv;
+        /* TODO: optimise again */
+        load += skb->len * CHAN_UTIL_RATE_LCM / rate->bitrate;
 
         if (tx->u.tx.extra_frag) {
                 int i;
                 for (i = 0; i < tx->u.tx.num_extra_frag; i++) {
                         load += 2 * hdrtime;
                         load += tx->u.tx.extra_frag[i]->len *
-                                tx->u.tx.rate->rate;
+                                tx->u.tx.rate->bitrate;
                 }
         }
 
@@ -774,13 +807,12 @@ ieee80211_tx_h_load_stats(struct ieee80211_txrx_data *tx)
                 tx->sta->channel_use_raw += load;
         tx->sdata->channel_use_raw += load;
 
-        return TXRX_CONTINUE;
+        return TX_CONTINUE;
 }
 
-/* TODO: implement register/unregister functions for adding TX/RX handlers
- * into ordered list */
 
-ieee80211_tx_handler ieee80211_tx_handlers[] =
+typedef ieee80211_tx_result (*ieee80211_tx_handler)(struct ieee80211_txrx_data *);
+static ieee80211_tx_handler ieee80211_tx_handlers[] =
 {
         ieee80211_tx_h_check_assoc,
         ieee80211_tx_h_sequence,
@@ -801,7 +833,7 @@ ieee80211_tx_handler ieee80211_tx_handlers[] =
  * deal with packet injection down monitor interface
  * with Radiotap Header -- only called for monitor mode interface
  */
-static ieee80211_txrx_result
+static ieee80211_tx_result
 __ieee80211_parse_tx_radiotap(struct ieee80211_txrx_data *tx,
                               struct sk_buff *skb)
 {
@@ -816,10 +848,12 @@ __ieee80211_parse_tx_radiotap(struct ieee80211_txrx_data *tx,
         struct ieee80211_radiotap_iterator iterator;
         struct ieee80211_radiotap_header *rthdr =
                 (struct ieee80211_radiotap_header *) skb->data;
-        struct ieee80211_hw_mode *mode = tx->local->hw.conf.mode;
+        struct ieee80211_supported_band *sband;
         int ret = ieee80211_radiotap_iterator_init(&iterator, rthdr, skb->len);
         struct ieee80211_tx_control *control = tx->u.tx.control;
 
+        sband = tx->local->hw.wiphy->bands[tx->local->hw.conf.channel->band];
+
         control->flags |= IEEE80211_TXCTL_DO_NOT_ENCRYPT;
         tx->flags |= IEEE80211_TXRXD_TX_INJECTED;
         tx->flags &= ~IEEE80211_TXRXD_FRAGMENTED;
@@ -852,10 +886,12 @@ __ieee80211_parse_tx_radiotap(struct ieee80211_txrx_data *tx,
                          * ieee80211 rate int is in 100kbps units eg, 0x0a=1Mbps
                          */
                         target_rate = (*iterator.this_arg) * 5;
-                        for (i = 0; i < mode->num_rates; i++) {
-                                struct ieee80211_rate *r = &mode->rates[i];
+                        for (i = 0; i < sband->n_bitrates; i++) {
+                                struct ieee80211_rate *r;
+
+                                r = &sband->bitrates[i];
 
-                                if (r->rate == target_rate) {
+                                if (r->bitrate == target_rate) {
                                         tx->u.tx.rate = r;
                                         break;
                                 }
@@ -870,9 +906,11 @@ __ieee80211_parse_tx_radiotap(struct ieee80211_txrx_data *tx,
                         control->antenna_sel_tx = (*iterator.this_arg) + 1;
                         break;
 
+#if 0
                 case IEEE80211_RADIOTAP_DBM_TX_POWER:
                         control->power_level = *iterator.this_arg;
                         break;
+#endif
 
                 case IEEE80211_RADIOTAP_FLAGS:
                         if (*iterator.this_arg & IEEE80211_RADIOTAP_F_FCS) {
@@ -884,7 +922,7 @@ __ieee80211_parse_tx_radiotap(struct ieee80211_txrx_data *tx,
                                  * on transmission
                                  */
                                 if (skb->len < (iterator.max_length + FCS_LEN))
-                                        return TXRX_DROP;
+                                        return TX_DROP;
 
                                 skb_trim(skb, skb->len - FCS_LEN);
                         }
@@ -907,7 +945,7 @@ __ieee80211_parse_tx_radiotap(struct ieee80211_txrx_data *tx,
         }
 
         if (ret != -ENOENT) /* ie, if we didn't simply run out of fields */
-                return TXRX_DROP;
+                return TX_DROP;
 
         /*
          * remove the radiotap header
@@ -916,13 +954,13 @@ __ieee80211_parse_tx_radiotap(struct ieee80211_txrx_data *tx,
          */
         skb_pull(skb, iterator.max_length);
 
-        return TXRX_CONTINUE;
+        return TX_CONTINUE;
 }
 
 /*
  * initialises @tx
  */
-static ieee80211_txrx_result
+static ieee80211_tx_result
 __ieee80211_tx_prepare(struct ieee80211_txrx_data *tx,
                        struct sk_buff *skb,
                        struct net_device *dev,
@@ -949,8 +987,8 @@ __ieee80211_tx_prepare(struct ieee80211_txrx_data *tx,
         /* process and remove the injection radiotap header */
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         if (unlikely(sdata->vif.type == IEEE80211_IF_TYPE_MNTR)) {
-                if (__ieee80211_parse_tx_radiotap(tx, skb) == TXRX_DROP)
-                        return TXRX_DROP;
+                if (__ieee80211_parse_tx_radiotap(tx, skb) == TX_DROP)
+                        return TX_DROP;
 
                 /*
                  * __ieee80211_parse_tx_radiotap has now removed
@@ -982,10 +1020,10 @@ __ieee80211_tx_prepare(struct ieee80211_txrx_data *tx,
         }
 
         if (!tx->sta)
-                control->flags |= IEEE80211_TXCTL_CLEAR_DST_MASK;
-        else if (tx->sta->clear_dst_mask) {
-                control->flags |= IEEE80211_TXCTL_CLEAR_DST_MASK;
-                tx->sta->clear_dst_mask = 0;
+                control->flags |= IEEE80211_TXCTL_CLEAR_PS_FILT;
+        else if (tx->sta->flags & WLAN_STA_CLEAR_PS_FILT) {
+                control->flags |= IEEE80211_TXCTL_CLEAR_PS_FILT;
+                tx->sta->flags &= ~WLAN_STA_CLEAR_PS_FILT;
         }
 
         hdrlen = ieee80211_get_hdrlen(tx->fc);
@@ -995,7 +1033,7 @@ __ieee80211_tx_prepare(struct ieee80211_txrx_data *tx,
         }
         control->flags |= IEEE80211_TXCTL_FIRST_FRAGMENT;
 
-        return TXRX_CONTINUE;
+        return TX_CONTINUE;
 }
 
 /*
@@ -1046,7 +1084,7 @@ static int __ieee80211_tx(struct ieee80211_local *local, struct sk_buff *skb,
         if (tx->u.tx.extra_frag) {
                 control->flags &= ~(IEEE80211_TXCTL_USE_RTS_CTS |
                                     IEEE80211_TXCTL_USE_CTS_PROTECT |
-                                    IEEE80211_TXCTL_CLEAR_DST_MASK |
+                                    IEEE80211_TXCTL_CLEAR_PS_FILT |
                                     IEEE80211_TXCTL_FIRST_FRAGMENT);
                 for (i = 0; i < tx->u.tx.num_extra_frag; i++) {
                         if (!tx->u.tx.extra_frag[i])
@@ -1054,8 +1092,8 @@ static int __ieee80211_tx(struct ieee80211_local *local, struct sk_buff *skb,
                         if (__ieee80211_queue_stopped(local, control->queue))
                                 return IEEE80211_TX_FRAG_AGAIN;
                         if (i == tx->u.tx.num_extra_frag) {
-                                control->tx_rate = tx->u.tx.last_frag_hwrate;
-                                control->rate = tx->u.tx.last_frag_rate;
+                                control->tx_rate = tx->u.tx.last_frag_rate;
+
                                 if (tx->flags & IEEE80211_TXRXD_TXPROBE_LAST_FRAG)
                                         control->flags |=
                                                 IEEE80211_TXCTL_RATE_CTRL_PROBE;
@@ -1089,7 +1127,7 @@ static int ieee80211_tx(struct net_device *dev, struct sk_buff *skb,
         struct sta_info *sta;
         ieee80211_tx_handler *handler;
         struct ieee80211_txrx_data tx;
-        ieee80211_txrx_result res = TXRX_DROP, res_prepare;
+        ieee80211_tx_result res = TX_DROP, res_prepare;
         int ret, i;
 
         WARN_ON(__ieee80211_queue_pending(local, control->queue));
@@ -1102,7 +1140,7 @@ static int ieee80211_tx(struct net_device *dev, struct sk_buff *skb,
         /* initialises tx */
         res_prepare = __ieee80211_tx_prepare(&tx, skb, dev, control);
 
-        if (res_prepare == TXRX_DROP) {
+        if (res_prepare == TX_DROP) {
                 dev_kfree_skb(skb);
                 return 0;
         }
@@ -1114,12 +1152,12 @@ static int ieee80211_tx(struct net_device *dev, struct sk_buff *skb,
         rcu_read_lock();
 
         sta = tx.sta;
-        tx.u.tx.mode = local->hw.conf.mode;
+        tx.u.tx.channel = local->hw.conf.channel;
 
-        for (handler = local->tx_handlers; *handler != NULL;
+        for (handler = ieee80211_tx_handlers; *handler != NULL;
              handler++) {
                 res = (*handler)(&tx);
-                if (res != TXRX_CONTINUE)
+                if (res != TX_CONTINUE)
                         break;
         }
 
@@ -1128,12 +1166,12 @@ static int ieee80211_tx(struct net_device *dev, struct sk_buff *skb,
         if (sta)
                 sta_info_put(sta);
 
-        if (unlikely(res == TXRX_DROP)) {
+        if (unlikely(res == TX_DROP)) {
                 I802_DEBUG_INC(local->tx_handlers_drop);
                 goto drop;
         }
 
-        if (unlikely(res == TXRX_QUEUED)) {
+        if (unlikely(res == TX_QUEUED)) {
                 I802_DEBUG_INC(local->tx_handlers_queued);
                 rcu_read_unlock();
                 return 0;
@@ -1151,7 +1189,6 @@ static int ieee80211_tx(struct net_device *dev, struct sk_buff *skb,
                         } else {
                                 next_len = 0;
                                 tx.u.tx.rate = tx.u.tx.last_frag_rate;
-                                tx.u.tx.last_frag_hwrate = tx.u.tx.rate->val;
                         }
                         dur = ieee80211_duration(&tx, 0, next_len);
                         hdr->duration_id = cpu_to_le16(dur);
@@ -1188,7 +1225,6 @@ retry:
                 store->skb = skb;
                 store->extra_frag = tx.u.tx.extra_frag;
                 store->num_extra_frag = tx.u.tx.num_extra_frag;
-                store->last_frag_hwrate = tx.u.tx.last_frag_hwrate;
                 store->last_frag_rate = tx.u.tx.last_frag_rate;
                 store->last_frag_rate_ctrl_probe =
                         !!(tx.flags & IEEE80211_TXRXD_TXPROBE_LAST_FRAG);
@@ -1260,6 +1296,8 @@ int ieee80211_master_start_xmit(struct sk_buff *skb,
                 control.flags |= IEEE80211_TXCTL_REQUEUE;
         if (pkt_data->flags & IEEE80211_TXPD_EAPOL_FRAME)
                 control.flags |= IEEE80211_TXCTL_EAPOL_FRAME;
+        if (pkt_data->flags & IEEE80211_TXPD_AMPDU)
+                control.flags |= IEEE80211_TXCTL_AMPDU;
         control.queue = pkt_data->queue;
 
         ret = ieee80211_tx(odev, skb, &control);
@@ -1409,10 +1447,17 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
                 goto fail;
         }
 
-        sta = sta_info_get(local, hdr.addr1);
-        if (sta) {
-                sta_flags = sta->flags;
-                sta_info_put(sta);
+        /*
+         * There's no need to try to look up the destination
+         * if it is a multicast address (which can only happen
+         * in AP mode)
+         */
+        if (!is_multicast_ether_addr(hdr.addr1)) {
+                sta = sta_info_get(local, hdr.addr1);
+                if (sta) {
+                        sta_flags = sta->flags;
+                        sta_info_put(sta);
+                }
         }
 
         /* receiver is QoS enabled, use a QoS type frame */
@@ -1422,10 +1467,10 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
         }
 
         /*
-         * If port access control is enabled, drop frames to unauthorised
-         * stations unless they are EAPOL frames from the local station.
+         * Drop unicast frames to unauthorised stations unless they are
+         * EAPOL frames from the local station.
          */
-        if (unlikely(sdata->ieee802_1x_pac &&
+        if (unlikely(!is_multicast_ether_addr(hdr.addr1) &&
                      !(sta_flags & WLAN_STA_AUTHORIZED) &&
                      !(ethertype == ETH_P_PAE &&
                        compare_ether_addr(dev->dev_addr,
@@ -1598,7 +1643,6 @@ void ieee80211_tx_pending(unsigned long data)
                 tx.u.tx.control = &store->control;
                 tx.u.tx.extra_frag = store->extra_frag;
                 tx.u.tx.num_extra_frag = store->num_extra_frag;
-                tx.u.tx.last_frag_hwrate = store->last_frag_hwrate;
                 tx.u.tx.last_frag_rate = store->last_frag_rate;
                 tx.flags = 0;
                 if (store->last_frag_rate_ctrl_probe)
@@ -1701,6 +1745,9 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
         struct ieee80211_if_ap *ap = NULL;
         struct rate_selection rsel;
         struct beacon_data *beacon;
+        struct ieee80211_supported_band *sband;
+
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
 
         rcu_read_lock();
 
@@ -1739,8 +1786,7 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
                        beacon->tail_len);
 
         if (control) {
-                rate_control_get_rate(local->mdev, local->oper_hw_mode, skb,
-                                      &rsel);
+                rate_control_get_rate(local->mdev, sband, skb, &rsel);
                 if (!rsel.rate) {
                         if (net_ratelimit()) {
                                 printk(KERN_DEBUG "%s: ieee80211_beacon_get: "
@@ -1753,15 +1799,14 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
                 }
 
                 control->vif = vif;
-                control->tx_rate =
-                        (sdata->bss_conf.use_short_preamble &&
-                        (rsel.rate->flags & IEEE80211_RATE_PREAMBLE2)) ?
-                        rsel.rate->val2 : rsel.rate->val;
+                control->tx_rate = rsel.rate;
+                if (sdata->bss_conf.use_short_preamble &&
+                    rsel.rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
+                        control->flags |= IEEE80211_TXCTL_SHORT_PREAMBLE;
                 control->antenna_sel_tx = local->hw.conf.antenna_sel_tx;
-                control->power_level = local->hw.conf.power_level;
                 control->flags |= IEEE80211_TXCTL_NO_ACK;
                 control->retry_limit = 1;
-                control->flags |= IEEE80211_TXCTL_CLEAR_DST_MASK;
+                control->flags |= IEEE80211_TXCTL_CLEAR_PS_FILT;
         }
 
         ap->num_beacons++;
@@ -1815,7 +1860,7 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
         struct sta_info *sta;
         ieee80211_tx_handler *handler;
         struct ieee80211_txrx_data tx;
-        ieee80211_txrx_result res = TXRX_DROP;
+        ieee80211_tx_result res = TX_DROP;
         struct net_device *bdev;
         struct ieee80211_sub_if_data *sdata;
         struct ieee80211_if_ap *bss = NULL;
@@ -1863,20 +1908,20 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
         }
         sta = tx.sta;
         tx.flags |= IEEE80211_TXRXD_TXPS_BUFFERED;
-        tx.u.tx.mode = local->hw.conf.mode;
+        tx.u.tx.channel = local->hw.conf.channel;
 
-        for (handler = local->tx_handlers; *handler != NULL; handler++) {
+        for (handler = ieee80211_tx_handlers; *handler != NULL; handler++) {
                 res = (*handler)(&tx);
-                if (res == TXRX_DROP || res == TXRX_QUEUED)
+                if (res == TX_DROP || res == TX_QUEUED)
                         break;
         }
         skb = tx.skb; /* handlers are allowed to change skb */
 
-        if (res == TXRX_DROP) {
+        if (res == TX_DROP) {
                 I802_DEBUG_INC(local->tx_handlers_drop);
                 dev_kfree_skb(skb);
                 skb = NULL;
-        } else if (res == TXRX_QUEUED) {
+        } else if (res == TX_QUEUED) {
                 I802_DEBUG_INC(local->tx_handlers_queued);
                 skb = NULL;
         }
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 5e631ce98d7e..f64804fed0a9 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -41,92 +41,6 @@ const unsigned char bridge_tunnel_header[] =
         { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0xf8 };
 
 
-static int rate_list_match(const int *rate_list, int rate)
-{
-        int i;
-
-        if (!rate_list)
-                return 0;
-
-        for (i = 0; rate_list[i] >= 0; i++)
-                if (rate_list[i] == rate)
-                        return 1;
-
-        return 0;
-}
-
-void ieee80211_prepare_rates(struct ieee80211_local *local,
-                             struct ieee80211_hw_mode *mode)
-{
-        int i;
-
-        for (i = 0; i < mode->num_rates; i++) {
-                struct ieee80211_rate *rate = &mode->rates[i];
-
-                rate->flags &= ~(IEEE80211_RATE_SUPPORTED |
-                                 IEEE80211_RATE_BASIC);
-
-                if (local->supp_rates[mode->mode]) {
-                        if (!rate_list_match(local->supp_rates[mode->mode],
-                                             rate->rate))
-                                continue;
-                }
-
-                rate->flags |= IEEE80211_RATE_SUPPORTED;
-
-                /* Use configured basic rate set if it is available. If not,
-                 * use defaults that are sane for most cases. */
-                if (local->basic_rates[mode->mode]) {
-                        if (rate_list_match(local->basic_rates[mode->mode],
-                                            rate->rate))
-                                rate->flags |= IEEE80211_RATE_BASIC;
-                } else switch (mode->mode) {
-                case MODE_IEEE80211A:
-                        if (rate->rate == 60 || rate->rate == 120 ||
-                            rate->rate == 240)
-                                rate->flags |= IEEE80211_RATE_BASIC;
-                        break;
-                case MODE_IEEE80211B:
-                        if (rate->rate == 10 || rate->rate == 20)
-                                rate->flags |= IEEE80211_RATE_BASIC;
-                        break;
-                case MODE_IEEE80211G:
-                        if (rate->rate == 10 || rate->rate == 20 ||
-                            rate->rate == 55 || rate->rate == 110)
-                                rate->flags |= IEEE80211_RATE_BASIC;
-                        break;
-                case NUM_IEEE80211_MODES:
-                        /* not useful */
-                        break;
-                }
-
-                /* Set ERP and MANDATORY flags based on phymode */
-                switch (mode->mode) {
-                case MODE_IEEE80211A:
-                        if (rate->rate == 60 || rate->rate == 120 ||
-                            rate->rate == 240)
-                                rate->flags |= IEEE80211_RATE_MANDATORY;
-                        break;
-                case MODE_IEEE80211B:
-                        if (rate->rate == 10)
-                                rate->flags |= IEEE80211_RATE_MANDATORY;
-                        break;
-                case MODE_IEEE80211G:
-                        if (rate->rate == 10 || rate->rate == 20 ||
-                            rate->rate == 55 || rate->rate == 110 ||
-                            rate->rate == 60 || rate->rate == 120 ||
-                            rate->rate == 240)
-                                rate->flags |= IEEE80211_RATE_MANDATORY;
-                        break;
-                case NUM_IEEE80211_MODES:
-                        /* not useful */
-                        break;
-                }
-                if (ieee80211_is_erp_rate(mode->mode, rate->rate))
-                        rate->flags |= IEEE80211_RATE_ERP;
-        }
-}
-
 u8 *ieee80211_get_bssid(struct ieee80211_hdr *hdr, size_t len,
                         enum ieee80211_if_types type)
 {
@@ -262,7 +176,7 @@ int ieee80211_frame_duration(struct ieee80211_local *local, size_t len,
          * DIV_ROUND_UP() operations.
          */
 
-        if (local->hw.conf.phymode == MODE_IEEE80211A || erp) {
+        if (local->hw.conf.channel->band == IEEE80211_BAND_5GHZ || erp) {
                 /*
                  * OFDM:
                  *
@@ -304,15 +218,19 @@ int ieee80211_frame_duration(struct ieee80211_local *local, size_t len,
 /* Exported duration function for driver use */
 __le16 ieee80211_generic_frame_duration(struct ieee80211_hw *hw,
                                         struct ieee80211_vif *vif,
-                                        size_t frame_len, int rate)
+                                        size_t frame_len,
+                                        struct ieee80211_rate *rate)
 {
         struct ieee80211_local *local = hw_to_local(hw);
         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
         u16 dur;
         int erp;
 
-        erp = ieee80211_is_erp_rate(hw->conf.phymode, rate);
-        dur = ieee80211_frame_duration(local, frame_len, rate, erp,
+        erp = 0;
+        if (sdata->flags & IEEE80211_SDATA_OPERATING_GMODE)
+                erp = rate->flags & IEEE80211_RATE_ERP_G;
+
+        dur = ieee80211_frame_duration(local, frame_len, rate->bitrate, erp,
                                        sdata->bss_conf.use_short_preamble);
 
         return cpu_to_le16(dur);
@@ -332,17 +250,20 @@ __le16 ieee80211_rts_duration(struct ieee80211_hw *hw,
 
         short_preamble = sdata->bss_conf.use_short_preamble;
 
-        rate = frame_txctl->rts_rate;
-        erp = !!(rate->flags & IEEE80211_RATE_ERP);
+        rate = frame_txctl->rts_cts_rate;
+
+        erp = 0;
+        if (sdata->flags & IEEE80211_SDATA_OPERATING_GMODE)
+                erp = rate->flags & IEEE80211_RATE_ERP_G;
 
         /* CTS duration */
-        dur = ieee80211_frame_duration(local, 10, rate->rate,
+        dur = ieee80211_frame_duration(local, 10, rate->bitrate,
                                        erp, short_preamble);
         /* Data frame duration */
-        dur += ieee80211_frame_duration(local, frame_len, rate->rate,
+        dur += ieee80211_frame_duration(local, frame_len, rate->bitrate,
                                         erp, short_preamble);
         /* ACK duration */
-        dur += ieee80211_frame_duration(local, 10, rate->rate,
+        dur += ieee80211_frame_duration(local, 10, rate->bitrate,
                                         erp, short_preamble);
 
         return cpu_to_le16(dur);
@@ -363,15 +284,17 @@ __le16 ieee80211_ctstoself_duration(struct ieee80211_hw *hw,
 
         short_preamble = sdata->bss_conf.use_short_preamble;
 
-        rate = frame_txctl->rts_rate;
-        erp = !!(rate->flags & IEEE80211_RATE_ERP);
+        rate = frame_txctl->rts_cts_rate;
+        erp = 0;
+        if (sdata->flags & IEEE80211_SDATA_OPERATING_GMODE)
+                erp = rate->flags & IEEE80211_RATE_ERP_G;
 
         /* Data frame duration */
-        dur = ieee80211_frame_duration(local, frame_len, rate->rate,
+        dur = ieee80211_frame_duration(local, frame_len, rate->bitrate,
                                        erp, short_preamble);
         if (!(frame_txctl->flags & IEEE80211_TXCTL_NO_ACK)) {
                 /* ACK duration */
-                dur += ieee80211_frame_duration(local, 10, rate->rate,
+                dur += ieee80211_frame_duration(local, 10, rate->bitrate,
                                                 erp, short_preamble);
         }
 
@@ -379,27 +302,6 @@ __le16 ieee80211_ctstoself_duration(struct ieee80211_hw *hw,
 }
 EXPORT_SYMBOL(ieee80211_ctstoself_duration);
 
-struct ieee80211_rate *
-ieee80211_get_rate(struct ieee80211_local *local, int phymode, int hw_rate)
-{
-        struct ieee80211_hw_mode *mode;
-        int r;
-
-        list_for_each_entry(mode, &local->modes_list, list) {
-                if (mode->mode != phymode)
-                        continue;
-                for (r = 0; r < mode->num_rates; r++) {
-                        struct ieee80211_rate *rate = &mode->rates[r];
-                        if (rate->val == hw_rate ||
-                            (rate->flags & IEEE80211_RATE_PREAMBLE2 &&
-                             rate->val2 == hw_rate))
-                                return rate;
-                }
-        }
-
-        return NULL;
-}
-
 void ieee80211_wake_queue(struct ieee80211_hw *hw, int queue)
 {
         struct ieee80211_local *local = hw_to_local(hw);
diff --git a/net/mac80211/wep.c b/net/mac80211/wep.c
index a0cff72a580b..a33ef5cfa9ad 100644
--- a/net/mac80211/wep.c
+++ b/net/mac80211/wep.c
@@ -305,13 +305,13 @@ u8 * ieee80211_wep_is_weak_iv(struct sk_buff *skb, struct ieee80211_key *key)
         return NULL;
 }
 
-ieee80211_txrx_result
+ieee80211_rx_result
 ieee80211_crypto_wep_decrypt(struct ieee80211_txrx_data *rx)
 {
         if ((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA &&
             ((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_MGMT ||
              (rx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_AUTH))
-                return TXRX_CONTINUE;
+                return RX_CONTINUE;
 
         if (!(rx->u.rx.status->flag & RX_FLAG_DECRYPTED)) {
                 if (ieee80211_wep_decrypt(rx->local, rx->skb, rx->key)) {
@@ -320,7 +320,7 @@ ieee80211_crypto_wep_decrypt(struct ieee80211_txrx_data *rx)
                                 printk(KERN_DEBUG "%s: RX WEP frame, decrypt "
                                        "failed\n", rx->dev->name);
 #endif /* CONFIG_MAC80211_DEBUG */
-                        return TXRX_DROP;
+                        return RX_DROP_UNUSABLE;
                 }
         } else if (!(rx->u.rx.status->flag & RX_FLAG_IV_STRIPPED)) {
                 ieee80211_wep_remove_iv(rx->local, rx->skb, rx->key);
@@ -328,7 +328,7 @@ ieee80211_crypto_wep_decrypt(struct ieee80211_txrx_data *rx)
                 skb_trim(rx->skb, rx->skb->len - 4);
         }
 
-        return TXRX_CONTINUE;
+        return RX_CONTINUE;
 }
 
 static int wep_encrypt_skb(struct ieee80211_txrx_data *tx, struct sk_buff *skb)
@@ -346,7 +346,7 @@ static int wep_encrypt_skb(struct ieee80211_txrx_data *tx, struct sk_buff *skb)
         return 0;
 }
 
-ieee80211_txrx_result
+ieee80211_tx_result
 ieee80211_crypto_wep_encrypt(struct ieee80211_txrx_data *tx)
 {
         tx->u.tx.control->iv_len = WEP_IV_LEN;
@@ -355,7 +355,7 @@ ieee80211_crypto_wep_encrypt(struct ieee80211_txrx_data *tx)
 
         if (wep_encrypt_skb(tx, tx->skb) < 0) {
                 I802_DEBUG_INC(tx->local->tx_handlers_drop_wep);
-                return TXRX_DROP;
+                return TX_DROP;
         }
 
         if (tx->u.tx.extra_frag) {
@@ -364,10 +364,10 @@ ieee80211_crypto_wep_encrypt(struct ieee80211_txrx_data *tx)
                         if (wep_encrypt_skb(tx, tx->u.tx.extra_frag[i]) < 0) {
                                 I802_DEBUG_INC(tx->local->
                                                tx_handlers_drop_wep);
-                                return TXRX_DROP;
+                                return TX_DROP;
                         }
                 }
         }
 
-        return TXRX_CONTINUE;
+        return TX_CONTINUE;
 }
diff --git a/net/mac80211/wep.h b/net/mac80211/wep.h
index 785fbb4e0dd7..43aef50cd0d6 100644
--- a/net/mac80211/wep.h
+++ b/net/mac80211/wep.h
@@ -28,9 +28,9 @@ int ieee80211_wep_decrypt(struct ieee80211_local *local, struct sk_buff *skb,
                           struct ieee80211_key *key);
 u8 * ieee80211_wep_is_weak_iv(struct sk_buff *skb, struct ieee80211_key *key);
 
-ieee80211_txrx_result
+ieee80211_rx_result
 ieee80211_crypto_wep_decrypt(struct ieee80211_txrx_data *rx);
-ieee80211_txrx_result
+ieee80211_tx_result
 ieee80211_crypto_wep_encrypt(struct ieee80211_txrx_data *tx);
 
 #endif /* WEP_H */
diff --git a/net/mac80211/wme.c b/net/mac80211/wme.c
index 4e236599dd31..8cc036decc82 100644
--- a/net/mac80211/wme.c
+++ b/net/mac80211/wme.c
@@ -19,10 +19,13 @@
 #include "wme.h"
 
 /* maximum number of hardware queues we support. */
-#define TC_80211_MAX_QUEUES 8
+#define TC_80211_MAX_QUEUES 16
+
+const int ieee802_1d_to_ac[8] = { 2, 3, 3, 2, 1, 1, 0, 0 };
 
 struct ieee80211_sched_data
 {
+        unsigned long qdisc_pool[BITS_TO_LONGS(TC_80211_MAX_QUEUES)];
         struct tcf_proto *filter_list;
         struct Qdisc *queues[TC_80211_MAX_QUEUES];
         struct sk_buff_head requeued[TC_80211_MAX_QUEUES];
@@ -98,7 +101,6 @@ static inline int classify80211(struct sk_buff *skb, struct Qdisc *qd)
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
         unsigned short fc = le16_to_cpu(hdr->frame_control);
         int qos;
-        const int ieee802_1d_to_ac[8] = { 2, 3, 3, 2, 1, 1, 0, 0 };
 
         /* see if frame is data or non data frame */
         if (unlikely((fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA)) {
@@ -146,9 +148,25 @@ static int wme_qdiscop_enqueue(struct sk_buff *skb, struct Qdisc* qd)
         unsigned short fc = le16_to_cpu(hdr->frame_control);
         struct Qdisc *qdisc;
         int err, queue;
+        struct sta_info *sta;
+        u8 tid;
 
         if (pkt_data->flags & IEEE80211_TXPD_REQUEUE) {
-                skb_queue_tail(&q->requeued[pkt_data->queue], skb);
+                queue = pkt_data->queue;
+                sta = sta_info_get(local, hdr->addr1);
+                tid = skb->priority & QOS_CONTROL_TAG1D_MASK;
+                if (sta) {
+                        int ampdu_queue = sta->tid_to_tx_q[tid];
+                        if ((ampdu_queue < local->hw.queues) &&
+                            test_bit(ampdu_queue, q->qdisc_pool)) {
+                                queue = ampdu_queue;
+                                pkt_data->flags |= IEEE80211_TXPD_AMPDU;
+                        } else {
+                                pkt_data->flags &= ~IEEE80211_TXPD_AMPDU;
+                        }
+                        sta_info_put(sta);
+                }
+                skb_queue_tail(&q->requeued[queue], skb);
                 qd->q.qlen++;
                 return 0;
         }
@@ -159,14 +177,28 @@ static int wme_qdiscop_enqueue(struct sk_buff *skb, struct Qdisc* qd)
          */
         if (WLAN_FC_IS_QOS_DATA(fc)) {
                 u8 *p = skb->data + ieee80211_get_hdrlen(fc) - 2;
-                u8 qos_hdr = skb->priority & QOS_CONTROL_TAG1D_MASK;
+                u8 ack_policy = 0;
+                tid = skb->priority & QOS_CONTROL_TAG1D_MASK;
                 if (local->wifi_wme_noack_test)
-                        qos_hdr |= QOS_CONTROL_ACK_POLICY_NOACK <<
+                        ack_policy |= QOS_CONTROL_ACK_POLICY_NOACK <<
                                         QOS_CONTROL_ACK_POLICY_SHIFT;
                 /* qos header is 2 bytes, second reserved */
-                *p = qos_hdr;
+                *p = ack_policy | tid;
                 p++;
                 *p = 0;
+
+                sta = sta_info_get(local, hdr->addr1);
+                if (sta) {
+                        int ampdu_queue = sta->tid_to_tx_q[tid];
+                        if ((ampdu_queue < local->hw.queues) &&
+                                test_bit(ampdu_queue, q->qdisc_pool)) {
+                                queue = ampdu_queue;
+                                pkt_data->flags |= IEEE80211_TXPD_AMPDU;
+                        } else {
+                                pkt_data->flags &= ~IEEE80211_TXPD_AMPDU;
+                        }
+                        sta_info_put(sta);
+                }
         }
 
         if (unlikely(queue >= local->hw.queues)) {
@@ -184,6 +216,7 @@ static int wme_qdiscop_enqueue(struct sk_buff *skb, struct Qdisc* qd)
                         kfree_skb(skb);
                         err = NET_XMIT_DROP;
         } else {
+                tid = skb->priority & QOS_CONTROL_TAG1D_MASK;
                 pkt_data->queue = (unsigned int) queue;
                 qdisc = q->queues[queue];
                 err = qdisc->enqueue(skb, qdisc);
@@ -235,10 +268,11 @@ static struct sk_buff *wme_qdiscop_dequeue(struct Qdisc* qd)
         /* check all the h/w queues in numeric/priority order */
         for (queue = 0; queue < hw->queues; queue++) {
                 /* see if there is room in this hardware queue */
-                if (test_bit(IEEE80211_LINK_STATE_XOFF,
-                             &local->state[queue]) ||
-                    test_bit(IEEE80211_LINK_STATE_PENDING,
-                             &local->state[queue]))
+                if ((test_bit(IEEE80211_LINK_STATE_XOFF,
+                                &local->state[queue])) ||
+                    (test_bit(IEEE80211_LINK_STATE_PENDING,
+                                &local->state[queue])) ||
+                         (!test_bit(queue, q->qdisc_pool)))
                         continue;
 
                 /* there is space - try and get a frame */
@@ -360,6 +394,10 @@ static int wme_qdiscop_init(struct Qdisc *qd, struct nlattr *opt)
                 }
         }
 
+        /* reserve all legacy QoS queues */
+        for (i = 0; i < min(IEEE80211_TX_QUEUE_DATA4, queues); i++)
+                set_bit(i, q->qdisc_pool);
+
         return err;
 }
 
@@ -605,3 +643,80 @@ void ieee80211_wme_unregister(void)
 {
         unregister_qdisc(&wme_qdisc_ops);
 }
+
+int ieee80211_ht_agg_queue_add(struct ieee80211_local *local,
+                        struct sta_info *sta, u16 tid)
+{
+        int i;
+        struct ieee80211_sched_data *q =
+                        qdisc_priv(local->mdev->qdisc_sleeping);
+        DECLARE_MAC_BUF(mac);
+
+        /* prepare the filter and save it for the SW queue
+         * matching the recieved HW queue */
+
+        /* try to get a Qdisc from the pool */
+        for (i = IEEE80211_TX_QUEUE_BEACON; i < local->hw.queues; i++)
+                if (!test_and_set_bit(i, q->qdisc_pool)) {
+                        ieee80211_stop_queue(local_to_hw(local), i);
+                        sta->tid_to_tx_q[tid] = i;
+
+                        /* IF there are already pending packets
+                         * on this tid first we need to drain them
+                         * on the previous queue
+                         * since HT is strict in order */
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                        if (net_ratelimit())
+                                printk(KERN_DEBUG "allocated aggregation queue"
+                                        " %d tid %d addr %s pool=0x%lX",
+                                        i, tid, print_mac(mac, sta->addr),
+                                        q->qdisc_pool[0]);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+                        return 0;
+                }
+
+        return -EAGAIN;
+}
+
+/**
+ * the caller needs to hold local->mdev->queue_lock
+ */
+void ieee80211_ht_agg_queue_remove(struct ieee80211_local *local,
+                                   struct sta_info *sta, u16 tid,
+                                   u8 requeue)
+{
+        struct ieee80211_sched_data *q =
+                qdisc_priv(local->mdev->qdisc_sleeping);
+        int agg_queue = sta->tid_to_tx_q[tid];
+
+        /* return the qdisc to the pool */
+        clear_bit(agg_queue, q->qdisc_pool);
+        sta->tid_to_tx_q[tid] = local->hw.queues;
+
+        if (requeue)
+                ieee80211_requeue(local, agg_queue);
+        else
+                q->queues[agg_queue]->ops->reset(q->queues[agg_queue]);
+}
+
+void ieee80211_requeue(struct ieee80211_local *local, int queue)
+{
+        struct Qdisc *root_qd = local->mdev->qdisc_sleeping;
+        struct ieee80211_sched_data *q = qdisc_priv(root_qd);
+        struct Qdisc *qdisc = q->queues[queue];
+        struct sk_buff *skb = NULL;
+        u32 len = qdisc->q.qlen;
+
+        if (!qdisc || !qdisc->dequeue)
+                return;
+
+        printk(KERN_DEBUG "requeue: qlen = %d\n", qdisc->q.qlen);
+        for (len = qdisc->q.qlen; len > 0; len--) {
+                skb = qdisc->dequeue(qdisc);
+                root_qd->q.qlen--;
+                /* packet will be classified again and */
+                /* skb->packet_data->queue will be overridden if needed */
+                if (skb)
+                        wme_qdiscop_enqueue(skb, root_qd);
+        }
+}
diff --git a/net/mac80211/wme.h b/net/mac80211/wme.h
index 76c713a6450c..fcc6b05508cc 100644
--- a/net/mac80211/wme.h
+++ b/net/mac80211/wme.h
@@ -24,6 +24,8 @@
 
 #define QOS_CONTROL_TAG1D_MASK 0x07
 
+extern const int ieee802_1d_to_ac[8];
+
 static inline int WLAN_FC_IS_QOS_DATA(u16 fc)
 {
         return (fc & 0x8C) == 0x88;
@@ -32,7 +34,12 @@ static inline int WLAN_FC_IS_QOS_DATA(u16 fc)
 #ifdef CONFIG_NET_SCHED
 void ieee80211_install_qdisc(struct net_device *dev);
 int ieee80211_qdisc_installed(struct net_device *dev);
-
+int ieee80211_ht_agg_queue_add(struct ieee80211_local *local,
+                               struct sta_info *sta, u16 tid);
+void ieee80211_ht_agg_queue_remove(struct ieee80211_local *local,
+                                   struct sta_info *sta, u16 tid,
+                                   u8 requeue);
+void ieee80211_requeue(struct ieee80211_local *local, int queue);
 int ieee80211_wme_register(void);
 void ieee80211_wme_unregister(void);
 #else
@@ -43,7 +50,19 @@ static inline int ieee80211_qdisc_installed(struct net_device *dev)
 {
         return 0;
 }
-
+static inline int ieee80211_ht_agg_queue_add(struct ieee80211_local *local,
+                                             struct sta_info *sta, u16 tid)
+{
+        return -EAGAIN;
+}
+static inline void ieee80211_ht_agg_queue_remove(struct ieee80211_local *local,
+                                                 struct sta_info *sta, u16 tid,
+                                                 u8 requeue)
+{
+}
+static inline void ieee80211_requeue(struct ieee80211_local *local, int queue)
+{
+}
 static inline int ieee80211_wme_register(void)
 {
         return 0;
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index 6f04311cf0a0..b35e51c6ce0c 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -70,7 +70,7 @@ static int ieee80211_get_hdr_info(const struct sk_buff *skb, u8 **sa, u8 **da,
 }
 
 
-ieee80211_txrx_result
+ieee80211_tx_result
 ieee80211_tx_h_michael_mic_add(struct ieee80211_txrx_data *tx)
 {
         u8 *data, *sa, *da, *key, *mic, qos_tid;
@@ -84,10 +84,10 @@ ieee80211_tx_h_michael_mic_add(struct ieee80211_txrx_data *tx)
 
         if (!tx->key || tx->key->conf.alg != ALG_TKIP || skb->len < 24 ||
             !WLAN_FC_DATA_PRESENT(fc))
-                return TXRX_CONTINUE;
+                return TX_CONTINUE;
 
         if (ieee80211_get_hdr_info(skb, &sa, &da, &qos_tid, &data, &data_len))
-                return TXRX_DROP;
+                return TX_DROP;
 
         if ((tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) &&
             !(tx->flags & IEEE80211_TXRXD_FRAGMENTED) &&
@@ -95,7 +95,7 @@ ieee80211_tx_h_michael_mic_add(struct ieee80211_txrx_data *tx)
             !wpa_test) {
                 /* hwaccel - with no need for preallocated room for Michael MIC
                  */
-                return TXRX_CONTINUE;
+                return TX_CONTINUE;
         }
 
         if (skb_tailroom(skb) < MICHAEL_MIC_LEN) {
@@ -105,7 +105,7 @@ ieee80211_tx_h_michael_mic_add(struct ieee80211_txrx_data *tx)
                                               GFP_ATOMIC))) {
                         printk(KERN_DEBUG "%s: failed to allocate more memory "
                                "for Michael MIC\n", tx->dev->name);
-                        return TXRX_DROP;
+                        return TX_DROP;
                 }
         }
 
@@ -119,11 +119,11 @@ ieee80211_tx_h_michael_mic_add(struct ieee80211_txrx_data *tx)
         mic = skb_put(skb, MICHAEL_MIC_LEN);
         michael_mic(key, da, sa, qos_tid & 0x0f, data, data_len, mic);
 
-        return TXRX_CONTINUE;
+        return TX_CONTINUE;
 }
 
 
-ieee80211_txrx_result
+ieee80211_rx_result
 ieee80211_rx_h_michael_mic_verify(struct ieee80211_txrx_data *rx)
 {
         u8 *data, *sa, *da, *key = NULL, qos_tid;
@@ -140,15 +140,15 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_txrx_data *rx)
          * No way to verify the MIC if the hardware stripped it
          */
         if (rx->u.rx.status->flag & RX_FLAG_MMIC_STRIPPED)
-                return TXRX_CONTINUE;
+                return RX_CONTINUE;
 
         if (!rx->key || rx->key->conf.alg != ALG_TKIP ||
             !(rx->fc & IEEE80211_FCTL_PROTECTED) || !WLAN_FC_DATA_PRESENT(fc))
-                return TXRX_CONTINUE;
+                return RX_CONTINUE;
 
         if (ieee80211_get_hdr_info(skb, &sa, &da, &qos_tid, &data, &data_len)
             || data_len < MICHAEL_MIC_LEN)
-                return TXRX_DROP;
+                return RX_DROP_UNUSABLE;
 
         data_len -= MICHAEL_MIC_LEN;
 
@@ -162,14 +162,14 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_txrx_data *rx)
         michael_mic(key, da, sa, qos_tid & 0x0f, data, data_len, mic);
         if (memcmp(mic, data + data_len, MICHAEL_MIC_LEN) != 0 || wpa_test) {
                 if (!(rx->flags & IEEE80211_TXRXD_RXRA_MATCH))
-                        return TXRX_DROP;
+                        return RX_DROP_UNUSABLE;
 
                 printk(KERN_DEBUG "%s: invalid Michael MIC in data frame from "
                        "%s\n", rx->dev->name, print_mac(mac, sa));
 
                 mac80211_ev_michael_mic_failure(rx->dev, rx->key->conf.keyidx,
                                                 (void *) skb->data);
-                return TXRX_DROP;
+                return RX_DROP_UNUSABLE;
         }
 
         /* remove Michael MIC from payload */
@@ -179,7 +179,7 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_txrx_data *rx)
         rx->key->u.tkip.iv32_rx[rx->u.rx.queue] = rx->u.rx.tkip_iv32;
         rx->key->u.tkip.iv16_rx[rx->u.rx.queue] = rx->u.rx.tkip_iv16;
 
-        return TXRX_CONTINUE;
+        return RX_CONTINUE;
 }
 
 
@@ -242,7 +242,7 @@ static int tkip_encrypt_skb(struct ieee80211_txrx_data *tx,
 }
 
 
-ieee80211_txrx_result
+ieee80211_tx_result
 ieee80211_crypto_tkip_encrypt(struct ieee80211_txrx_data *tx)
 {
         struct sk_buff *skb = tx->skb;
@@ -257,26 +257,26 @@ ieee80211_crypto_tkip_encrypt(struct ieee80211_txrx_data *tx)
             !wpa_test) {
                 /* hwaccel - with no need for preallocated room for IV/ICV */
                 tx->u.tx.control->key_idx = tx->key->conf.hw_key_idx;
-                return TXRX_CONTINUE;
+                return TX_CONTINUE;
         }
 
         if (tkip_encrypt_skb(tx, skb, test) < 0)
-                return TXRX_DROP;
+                return TX_DROP;
 
         if (tx->u.tx.extra_frag) {
                 int i;
                 for (i = 0; i < tx->u.tx.num_extra_frag; i++) {
                         if (tkip_encrypt_skb(tx, tx->u.tx.extra_frag[i], test)
                             < 0)
-                                return TXRX_DROP;
+                                return TX_DROP;
                 }
         }
 
-        return TXRX_CONTINUE;
+        return TX_CONTINUE;
 }
 
 
-ieee80211_txrx_result
+ieee80211_rx_result
 ieee80211_crypto_tkip_decrypt(struct ieee80211_txrx_data *rx)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
@@ -290,10 +290,10 @@ ieee80211_crypto_tkip_decrypt(struct ieee80211_txrx_data *rx)
         hdrlen = ieee80211_get_hdrlen(fc);
 
         if ((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA)
-                return TXRX_CONTINUE;
+                return RX_CONTINUE;
 
         if (!rx->sta || skb->len - hdrlen < 12)
-                return TXRX_DROP;
+                return RX_DROP_UNUSABLE;
 
         if (rx->u.rx.status->flag & RX_FLAG_DECRYPTED) {
                 if (rx->u.rx.status->flag & RX_FLAG_IV_STRIPPED) {
@@ -302,7 +302,7 @@ ieee80211_crypto_tkip_decrypt(struct ieee80211_txrx_data *rx)
                          * replay protection, and stripped the ICV/IV so
                          * we cannot do any checks here.
                          */
-                        return TXRX_CONTINUE;
+                        return RX_CONTINUE;
                 }
 
                 /* let TKIP code verify IV, but skip decryption */
@@ -322,7 +322,7 @@ ieee80211_crypto_tkip_decrypt(struct ieee80211_txrx_data *rx)
                                "frame from %s (res=%d)\n", rx->dev->name,
                                print_mac(mac, rx->sta->addr), res);
 #endif /* CONFIG_MAC80211_DEBUG */
-                return TXRX_DROP;
+                return RX_DROP_UNUSABLE;
         }
 
         /* Trim ICV */
@@ -332,7 +332,7 @@ ieee80211_crypto_tkip_decrypt(struct ieee80211_txrx_data *rx)
         memmove(skb->data + TKIP_IV_LEN, skb->data, hdrlen);
         skb_pull(skb, TKIP_IV_LEN);
 
-        return TXRX_CONTINUE;
+        return RX_CONTINUE;
 }
 
 
@@ -491,7 +491,7 @@ static int ccmp_encrypt_skb(struct ieee80211_txrx_data *tx,
 }
 
 
-ieee80211_txrx_result
+ieee80211_tx_result
 ieee80211_crypto_ccmp_encrypt(struct ieee80211_txrx_data *tx)
 {
         struct sk_buff *skb = tx->skb;
@@ -506,26 +506,26 @@ ieee80211_crypto_ccmp_encrypt(struct ieee80211_txrx_data *tx)
                 /* hwaccel - with no need for preallocated room for CCMP "
                  * header or MIC fields */
                 tx->u.tx.control->key_idx = tx->key->conf.hw_key_idx;
-                return TXRX_CONTINUE;
+                return TX_CONTINUE;
         }
 
         if (ccmp_encrypt_skb(tx, skb, test) < 0)
-                return TXRX_DROP;
+                return TX_DROP;
 
         if (tx->u.tx.extra_frag) {
                 int i;
                 for (i = 0; i < tx->u.tx.num_extra_frag; i++) {
                         if (ccmp_encrypt_skb(tx, tx->u.tx.extra_frag[i], test)
                             < 0)
-                                return TXRX_DROP;
+                                return TX_DROP;
                 }
         }
 
-        return TXRX_CONTINUE;
+        return TX_CONTINUE;
 }
 
 
-ieee80211_txrx_result
+ieee80211_rx_result
 ieee80211_crypto_ccmp_decrypt(struct ieee80211_txrx_data *rx)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
@@ -541,15 +541,15 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_txrx_data *rx)
         hdrlen = ieee80211_get_hdrlen(fc);
 
         if ((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA)
-                return TXRX_CONTINUE;
+                return RX_CONTINUE;
 
         data_len = skb->len - hdrlen - CCMP_HDR_LEN - CCMP_MIC_LEN;
         if (!rx->sta || data_len < 0)
-                return TXRX_DROP;
+                return RX_DROP_UNUSABLE;
 
         if ((rx->u.rx.status->flag & RX_FLAG_DECRYPTED) &&
             (rx->u.rx.status->flag & RX_FLAG_IV_STRIPPED))
-                return TXRX_CONTINUE;
+                return RX_CONTINUE;
 
         (void) ccmp_hdr2pn(pn, skb->data + hdrlen);
 
@@ -565,7 +565,7 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_txrx_data *rx)
                        ppn[0], ppn[1], ppn[2], ppn[3], ppn[4], ppn[5]);
 #endif /* CONFIG_MAC80211_DEBUG */
                 key->u.ccmp.replays++;
-                return TXRX_DROP;
+                return RX_DROP_UNUSABLE;
         }
 
         if (!(rx->u.rx.status->flag & RX_FLAG_DECRYPTED)) {
@@ -589,7 +589,7 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_txrx_data *rx)
                                        "for RX frame from %s\n", rx->dev->name,
                                        print_mac(mac, rx->sta->addr));
 #endif /* CONFIG_MAC80211_DEBUG */
-                        return TXRX_DROP;
+                        return RX_DROP_UNUSABLE;
                 }
         }
 
@@ -600,5 +600,5 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_txrx_data *rx)
         memmove(skb->data + CCMP_HDR_LEN, skb->data, hdrlen);
         skb_pull(skb, CCMP_HDR_LEN);
 
-        return TXRX_CONTINUE;
+        return RX_CONTINUE;
 }
diff --git a/net/mac80211/wpa.h b/net/mac80211/wpa.h
index 49d80cf0cd75..16e4dba4aa70 100644
--- a/net/mac80211/wpa.h
+++ b/net/mac80211/wpa.h
@@ -13,19 +13,19 @@
 #include <linux/types.h>
 #include "ieee80211_i.h"
 
-ieee80211_txrx_result
+ieee80211_tx_result
 ieee80211_tx_h_michael_mic_add(struct ieee80211_txrx_data *tx);
-ieee80211_txrx_result
+ieee80211_rx_result
 ieee80211_rx_h_michael_mic_verify(struct ieee80211_txrx_data *rx);
 
-ieee80211_txrx_result
+ieee80211_tx_result
 ieee80211_crypto_tkip_encrypt(struct ieee80211_txrx_data *tx);
-ieee80211_txrx_result
+ieee80211_rx_result
 ieee80211_crypto_tkip_decrypt(struct ieee80211_txrx_data *rx);
 
-ieee80211_txrx_result
+ieee80211_tx_result
 ieee80211_crypto_ccmp_encrypt(struct ieee80211_txrx_data *tx);
-ieee80211_txrx_result
+ieee80211_rx_result
 ieee80211_crypto_ccmp_decrypt(struct ieee80211_txrx_data *rx);
 
 #endif /* WPA_H */
diff --git a/net/wireless/Makefile b/net/wireless/Makefile
index 65710a42e5a7..b9f943c45f3b 100644
--- a/net/wireless/Makefile
+++ b/net/wireless/Makefile
@@ -1,5 +1,5 @@
 obj-$(CONFIG_WIRELESS_EXT) += wext.o
 obj-$(CONFIG_CFG80211) += cfg80211.o
 
-cfg80211-y += core.o sysfs.o radiotap.o
+cfg80211-y += core.o sysfs.o radiotap.o util.o reg.o
 cfg80211-$(CONFIG_NL80211) += nl80211.o
diff --git a/net/wireless/core.c b/net/wireless/core.c
index cfc5fc5f9e75..80afacdae46c 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -232,6 +232,47 @@ int wiphy_register(struct wiphy *wiphy)
 {
         struct cfg80211_registered_device *drv = wiphy_to_dev(wiphy);
         int res;
+        enum ieee80211_band band;
+        struct ieee80211_supported_band *sband;
+        bool have_band = false;
+        int i;
+
+        /* sanity check supported bands/channels */
+        for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
+                sband = wiphy->bands[band];
+                if (!sband)
+                        continue;
+
+                sband->band = band;
+
+                if (!sband->n_channels || !sband->n_bitrates) {
+                        WARN_ON(1);
+                        return -EINVAL;
+                }
+
+                for (i = 0; i < sband->n_channels; i++) {
+                        sband->channels[i].orig_flags =
+                                sband->channels[i].flags;
+                        sband->channels[i].orig_mag =
+                                sband->channels[i].max_antenna_gain;
+                        sband->channels[i].orig_mpwr =
+                                sband->channels[i].max_power;
+                        sband->channels[i].band = band;
+                }
+
+                have_band = true;
+        }
+
+        if (!have_band) {
+                WARN_ON(1);
+                return -EINVAL;
+        }
+
+        /* check and set up bitrates */
+        ieee80211_set_bitrate_flags(wiphy);
+
+        /* set up regulatory info */
+        wiphy_update_regulatory(wiphy);
 
         mutex_lock(&cfg80211_drv_mutex);
 
diff --git a/net/wireless/core.h b/net/wireless/core.h
index eb0f846b40df..7a02c356d63d 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -78,4 +78,7 @@ extern void cfg80211_dev_free(struct cfg80211_registered_device *drv);
 extern int cfg80211_dev_rename(struct cfg80211_registered_device *drv,
                                char *newname);
 
+void ieee80211_set_bitrate_flags(struct wiphy *wiphy);
+void wiphy_update_regulatory(struct wiphy *wiphy);
+
 #endif /* __NET_WIRELESS_CORE_H */
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index e3a214f63f91..5b3474798b8d 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -82,6 +82,7 @@ static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
                                                .len = NL80211_MAX_SUPP_RATES },
         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
+        [NL80211_ATTR_MNTR_FLAGS] = { .type = NLA_NESTED },
 };
 
 /* message building helper */
@@ -98,6 +99,13 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
                               struct cfg80211_registered_device *dev)
 {
         void *hdr;
+        struct nlattr *nl_bands, *nl_band;
+        struct nlattr *nl_freqs, *nl_freq;
+        struct nlattr *nl_rates, *nl_rate;
+        enum ieee80211_band band;
+        struct ieee80211_channel *chan;
+        struct ieee80211_rate *rate;
+        int i;
 
         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
         if (!hdr)
@@ -105,6 +113,73 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 
         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->idx);
         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
+
+        nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
+        if (!nl_bands)
+                goto nla_put_failure;
+
+        for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
+                if (!dev->wiphy.bands[band])
+                        continue;
+
+                nl_band = nla_nest_start(msg, band);
+                if (!nl_band)
+                        goto nla_put_failure;
+
+                /* add frequencies */
+                nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
+                if (!nl_freqs)
+                        goto nla_put_failure;
+
+                for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
+                        nl_freq = nla_nest_start(msg, i);
+                        if (!nl_freq)
+                                goto nla_put_failure;
+
+                        chan = &dev->wiphy.bands[band]->channels[i];
+                        NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
+                                    chan->center_freq);
+
+                        if (chan->flags & IEEE80211_CHAN_DISABLED)
+                                NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
+                        if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
+                                NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
+                        if (chan->flags & IEEE80211_CHAN_NO_IBSS)
+                                NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
+                        if (chan->flags & IEEE80211_CHAN_RADAR)
+                                NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
+
+                        nla_nest_end(msg, nl_freq);
+                }
+
+                nla_nest_end(msg, nl_freqs);
+
+                /* add bitrates */
+                nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
+                if (!nl_rates)
+                        goto nla_put_failure;
+
+                for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
+                        nl_rate = nla_nest_start(msg, i);
+                        if (!nl_rate)
+                                goto nla_put_failure;
+
+                        rate = &dev->wiphy.bands[band]->bitrates[i];
+                        NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
+                                    rate->bitrate);
+                        if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
+                                NLA_PUT_FLAG(msg,
+                                        NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
+
+                        nla_nest_end(msg, nl_rate);
+                }
+
+                nla_nest_end(msg, nl_rates);
+
+                nla_nest_end(msg, nl_band);
+        }
+        nla_nest_end(msg, nl_bands);
+
         return genlmsg_end(msg, hdr);
 
  nla_put_failure:
@@ -262,12 +337,42 @@ static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
         return -ENOBUFS;
 }
 
+static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
+        [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
+        [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
+        [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
+        [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
+        [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
+};
+
+static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
+{
+        struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
+        int flag;
+
+        *mntrflags = 0;
+
+        if (!nla)
+                return -EINVAL;
+
+        if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
+                             nla, mntr_flags_policy))
+                return -EINVAL;
+
+        for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
+                if (flags[flag])
+                        *mntrflags |= (1<<flag);
+
+        return 0;
+}
+
 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
 {
         struct cfg80211_registered_device *drv;
         int err, ifindex;
         enum nl80211_iftype type;
         struct net_device *dev;
+        u32 flags;
 
         if (info->attrs[NL80211_ATTR_IFTYPE]) {
                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
@@ -288,7 +393,11 @@ static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
         }
 
         rtnl_lock();
-        err = drv->ops->change_virtual_intf(&drv->wiphy, ifindex, type);
+        err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
+                                  info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
+                                  &flags);
+        err = drv->ops->change_virtual_intf(&drv->wiphy, ifindex,
+                                            type, err ? NULL : &flags);
         rtnl_unlock();
 
  unlock:
@@ -301,6 +410,7 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
         struct cfg80211_registered_device *drv;
         int err;
         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
+        u32 flags;
 
         if (!info->attrs[NL80211_ATTR_IFNAME])
                 return -EINVAL;
@@ -321,8 +431,12 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
         }
 
         rtnl_lock();
+        err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
+                                  info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
+                                  &flags);
         err = drv->ops->add_virtual_intf(&drv->wiphy,
-                nla_data(info->attrs[NL80211_ATTR_IFNAME]), type);
+                nla_data(info->attrs[NL80211_ATTR_IFNAME]),
+                type, err ? NULL : &flags);
         rtnl_unlock();
 
  unlock:
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
new file mode 100644
index 000000000000..8cc6037eb2ae
--- /dev/null
+++ b/net/wireless/reg.c
@@ -0,0 +1,159 @@
+/*
+ * Copyright 2002-2005, Instant802 Networks, Inc.
+ * Copyright 2005-2006, Devicescape Software, Inc.
+ * Copyright 2007       Johannes Berg <johannes@sipsolutions.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+/*
+ * This regulatory domain control implementation is highly incomplete, it
+ * only exists for the purpose of not regressing mac80211.
+ *
+ * For now, drivers can restrict the set of allowed channels by either
+ * not registering those channels or setting the IEEE80211_CHAN_DISABLED
+ * flag; that flag will only be *set* by this code, never *cleared.
+ *
+ * The usual implementation is for a driver to read a device EEPROM to
+ * determine which regulatory domain it should be operating under, then
+ * looking up the allowable channels in a driver-local table and finally
+ * registering those channels in the wiphy structure.
+ *
+ * Alternatively, drivers that trust the regulatory domain control here
+ * will register a complete set of capabilities and the control code
+ * will restrict the set by setting the IEEE80211_CHAN_* flags.
+ */
+#include <linux/kernel.h>
+#include <net/wireless.h>
+#include "core.h"
+
+static char *ieee80211_regdom = "US";
+module_param(ieee80211_regdom, charp, 0444);
+MODULE_PARM_DESC(ieee80211_regdom, "IEEE 802.11 regulatory domain code");
+
+struct ieee80211_channel_range {
+        short start_freq;
+        short end_freq;
+        int max_power;
+        int max_antenna_gain;
+        u32 flags;
+};
+
+struct ieee80211_regdomain {
+        const char *code;
+        const struct ieee80211_channel_range *ranges;
+        int n_ranges;
+};
+
+#define RANGE_PWR(_start, _end, _pwr, _ag, _flags)      \
+        { _start, _end, _pwr, _ag, _flags }
+
+
+/*
+ * Ideally, in the future, these definitions will be loaded from a
+ * userspace table via some daemon.
+ */
+static const struct ieee80211_channel_range ieee80211_US_channels[] = {
+        /* IEEE 802.11b/g, channels 1..11 */
+        RANGE_PWR(2412, 2462, 27, 6, 0),
+        /* IEEE 802.11a, channel 36*/
+        RANGE_PWR(5180, 5180, 23, 6, 0),
+        /* IEEE 802.11a, channel 40*/
+        RANGE_PWR(5200, 5200, 23, 6, 0),
+        /* IEEE 802.11a, channel 44*/
+        RANGE_PWR(5220, 5220, 23, 6, 0),
+        /* IEEE 802.11a, channels 48..64 */
+        RANGE_PWR(5240, 5320, 23, 6, 0),
+        /* IEEE 802.11a, channels 149..165, outdoor */
+        RANGE_PWR(5745, 5825, 30, 6, 0),
+};
+
+static const struct ieee80211_channel_range ieee80211_JP_channels[] = {
+        /* IEEE 802.11b/g, channels 1..14 */
+        RANGE_PWR(2412, 2484, 20, 6, 0),
+        /* IEEE 802.11a, channels 34..48 */
+        RANGE_PWR(5170, 5240, 20, 6, IEEE80211_CHAN_PASSIVE_SCAN),
+        /* IEEE 802.11a, channels 52..64 */
+        RANGE_PWR(5260, 5320, 20, 6, IEEE80211_CHAN_NO_IBSS |
+                                     IEEE80211_CHAN_RADAR),
+};
+
+#define REGDOM(_code)                                                   \
+        {                                                               \
+                .code = __stringify(_code),                             \
+                .ranges = ieee80211_ ##_code## _channels,               \
+                .n_ranges = ARRAY_SIZE(ieee80211_ ##_code## _channels), \
+        }
+
+static const struct ieee80211_regdomain ieee80211_regdoms[] = {
+        REGDOM(US),
+        REGDOM(JP),
+};
+
+
+static const struct ieee80211_regdomain *get_regdom(void)
+{
+        static const struct ieee80211_channel_range
+        ieee80211_world_channels[] = {
+                /* IEEE 802.11b/g, channels 1..11 */
+                RANGE_PWR(2412, 2462, 27, 6, 0),
+        };
+        static const struct ieee80211_regdomain regdom_world = REGDOM(world);
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(ieee80211_regdoms); i++)
+                if (strcmp(ieee80211_regdom, ieee80211_regdoms[i].code) == 0)
+                        return &ieee80211_regdoms[i];
+
+        return &regdom_world;
+}
+
+
+static void handle_channel(struct ieee80211_channel *chan,
+                           const struct ieee80211_regdomain *rd)
+{
+        int i;
+        u32 flags = chan->orig_flags;
+        const struct ieee80211_channel_range *rg = NULL;
+
+        for (i = 0; i < rd->n_ranges; i++) {
+                if (rd->ranges[i].start_freq <= chan->center_freq &&
+                    chan->center_freq <= rd->ranges[i].end_freq) {
+                        rg = &rd->ranges[i];
+                        break;
+                }
+        }
+
+        if (!rg) {
+                /* not found */
+                flags |= IEEE80211_CHAN_DISABLED;
+                chan->flags = flags;
+                return;
+        }
+
+        chan->flags = flags;
+        chan->max_antenna_gain = min(chan->orig_mag,
+                                         rg->max_antenna_gain);
+        chan->max_power = min(chan->orig_mpwr, rg->max_power);
+}
+
+static void handle_band(struct ieee80211_supported_band *sband,
+                        const struct ieee80211_regdomain *rd)
+{
+        int i;
+
+        for (i = 0; i < sband->n_channels; i++)
+                handle_channel(&sband->channels[i], rd);
+}
+
+void wiphy_update_regulatory(struct wiphy *wiphy)
+{
+        enum ieee80211_band band;
+        const struct ieee80211_regdomain *rd = get_regdom();
+
+        for (band = 0; band < IEEE80211_NUM_BANDS; band++)
+                if (wiphy->bands[band])
+                        handle_band(wiphy->bands[band], rd);
+}
diff --git a/net/wireless/util.c b/net/wireless/util.c
new file mode 100644
index 000000000000..77336c22fcf2
--- /dev/null
+++ b/net/wireless/util.c
@@ -0,0 +1,98 @@
+/*
+ * Wireless utility functions
+ *
+ * Copyright 2007       Johannes Berg <johannes@sipsolutions.net>
+ */
+#include <net/wireless.h>
+#include <asm/bitops.h>
+#include "core.h"
+
+int ieee80211_channel_to_frequency(int chan)
+{
+        if (chan < 14)
+                return 2407 + chan * 5;
+
+        if (chan == 14)
+                return 2484;
+
+        /* FIXME: 802.11j 17.3.8.3.2 */
+        return (chan + 1000) * 5;
+}
+EXPORT_SYMBOL(ieee80211_channel_to_frequency);
+
+int ieee80211_frequency_to_channel(int freq)
+{
+        if (freq == 2484)
+                return 14;
+
+        if (freq < 2484)
+                return (freq - 2407) / 5;
+
+        /* FIXME: 802.11j 17.3.8.3.2 */
+        return freq/5 - 1000;
+}
+EXPORT_SYMBOL(ieee80211_frequency_to_channel);
+
+static void set_mandatory_flags_band(struct ieee80211_supported_band *sband,
+                                     enum ieee80211_band band)
+{
+        int i, want;
+
+        switch (band) {
+        case IEEE80211_BAND_5GHZ:
+                want = 3;
+                for (i = 0; i < sband->n_bitrates; i++) {
+                        if (sband->bitrates[i].bitrate == 60 ||
+                            sband->bitrates[i].bitrate == 120 ||
+                            sband->bitrates[i].bitrate == 240) {
+                                sband->bitrates[i].flags |=
+                                        IEEE80211_RATE_MANDATORY_A;
+                                want--;
+                        }
+                }
+                WARN_ON(want);
+                break;
+        case IEEE80211_BAND_2GHZ:
+                want = 7;
+                for (i = 0; i < sband->n_bitrates; i++) {
+                        if (sband->bitrates[i].bitrate == 10) {
+                                sband->bitrates[i].flags |=
+                                        IEEE80211_RATE_MANDATORY_B |
+                                        IEEE80211_RATE_MANDATORY_G;
+                                want--;
+                        }
+
+                        if (sband->bitrates[i].bitrate == 20 ||
+                            sband->bitrates[i].bitrate == 55 ||
+                            sband->bitrates[i].bitrate == 110 ||
+                            sband->bitrates[i].bitrate == 60 ||
+                            sband->bitrates[i].bitrate == 120 ||
+                            sband->bitrates[i].bitrate == 240) {
+                                sband->bitrates[i].flags |=
+                                        IEEE80211_RATE_MANDATORY_G;
+                                want--;
+                        }
+
+                        if (sband->bitrates[i].bitrate != 10 &&
+                            sband->bitrates[i].bitrate != 20 &&
+                            sband->bitrates[i].bitrate != 55 &&
+                            sband->bitrates[i].bitrate != 110)
+                                sband->bitrates[i].flags |=
+                                        IEEE80211_RATE_ERP_G;
+                }
+                WARN_ON(want != 0 && want != 3 && want != 6);
+                break;
+        case IEEE80211_NUM_BANDS:
+                WARN_ON(1);
+                break;
+        }
+}
+
+void ieee80211_set_bitrate_flags(struct wiphy *wiphy)
+{
+        enum ieee80211_band band;
+
+        for (band = 0; band < IEEE80211_NUM_BANDS; band++)
+                if (wiphy->bands[band])
+                        set_mandatory_flags_band(wiphy->bands[band], band);
+}