175 files changed, 21960 insertions, 7592 deletions

diff --git a/MAINTAINERS b/MAINTAINERS
index 22af4965c16c..866253d7abd7 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3583,9 +3583,12 @@ M:	"John W. Linville" <linville@tuxdriver.com>
 L:      linux-wireless@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6.git
 S:      Maintained
+F:      net/mac80211/
+F:      net/rfkill/
 F:      net/wireless/
 F:      include/net/ieee80211*
 F:      include/linux/wireless.h
+F:      drivers/net/wireless/
 
 NETWORKING DRIVERS
 L:      netdev@vger.kernel.org
@@ -5577,7 +5580,16 @@ L:	linux-wireless@vger.kernel.org
 W:      http://wireless.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-testing.git
 S:      Maintained
-F:      drivers/net/wireless/wl12xx/wl1251*
+F:      drivers/net/wireless/wl12xx/*
+X:      drivers/net/wireless/wl12xx/wl1271*
+
+WL1271 WIRELESS DRIVER
+M:      Luciano Coelho <luciano.coelho@nokia.com>
+L:      linux-wireless@vger.kernel.org
+W:      http://wireless.kernel.org
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-testing.git
+S:      Maintained
+F:      drivers/net/wireless/wl12xx/wl1271*
 
 WL3501 WIRELESS PCMCIA CARD DRIVER
 M:      Arnaldo Carvalho de Melo <acme@ghostprotocols.net>
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index af1fe4696509..7d471fca2743 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -233,6 +233,11 @@ void usbnet_skb_return (struct usbnet *dev, struct sk_buff *skb)
 {
         int     status;
 
+        if (test_bit(EVENT_RX_PAUSED, &dev->flags)) {
+                skb_queue_tail(&dev->rxq_pause, skb);
+                return;
+        }
+
         skb->protocol = eth_type_trans (skb, dev->net);
         dev->net->stats.rx_packets++;
         dev->net->stats.rx_bytes += skb->len;
@@ -526,6 +531,41 @@ static void intr_complete (struct urb *urb)
 }
 
 /*-------------------------------------------------------------------------*/
+void usbnet_pause_rx(struct usbnet *dev)
+{
+        set_bit(EVENT_RX_PAUSED, &dev->flags);
+
+        if (netif_msg_rx_status(dev))
+                devdbg(dev, "paused rx queue enabled");
+}
+EXPORT_SYMBOL_GPL(usbnet_pause_rx);
+
+void usbnet_resume_rx(struct usbnet *dev)
+{
+        struct sk_buff *skb;
+        int num = 0;
+
+        clear_bit(EVENT_RX_PAUSED, &dev->flags);
+
+        while ((skb = skb_dequeue(&dev->rxq_pause)) != NULL) {
+                usbnet_skb_return(dev, skb);
+                num++;
+        }
+
+        tasklet_schedule(&dev->bh);
+
+        if (netif_msg_rx_status(dev))
+                devdbg(dev, "paused rx queue disabled, %d skbs requeued", num);
+}
+EXPORT_SYMBOL_GPL(usbnet_resume_rx);
+
+void usbnet_purge_paused_rxq(struct usbnet *dev)
+{
+        skb_queue_purge(&dev->rxq_pause);
+}
+EXPORT_SYMBOL_GPL(usbnet_purge_paused_rxq);
+
+/*-------------------------------------------------------------------------*/
 
 // unlink pending rx/tx; completion handlers do all other cleanup
 
@@ -623,6 +663,8 @@ int usbnet_stop (struct net_device *net)
 
         usb_kill_urb(dev->interrupt);
 
+        usbnet_purge_paused_rxq(dev);
+
         /* deferred work (task, timer, softirq) must also stop.
          * can't flush_scheduled_work() until we drop rtnl (later),
          * else workers could deadlock; so make workers a NOP.
@@ -1113,7 +1155,6 @@ static void usbnet_bh (unsigned long param)
 }
 
 
-
 /*-------------------------------------------------------------------------
  *
  * USB Device Driver support
@@ -1210,6 +1251,7 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod)
         skb_queue_head_init (&dev->rxq);
         skb_queue_head_init (&dev->txq);
         skb_queue_head_init (&dev->done);
+        skb_queue_head_init(&dev->rxq_pause);
         dev->bh.func = usbnet_bh;
         dev->bh.data = (unsigned long) dev;
         INIT_WORK (&dev->kevent, kevent);
diff --git a/drivers/net/wireless/ath/Kconfig b/drivers/net/wireless/ath/Kconfig
index 253b95a264b1..11ded150b932 100644
--- a/drivers/net/wireless/ath/Kconfig
+++ b/drivers/net/wireless/ath/Kconfig
@@ -5,9 +5,7 @@ menuconfig ATH_COMMON
         ---help---
           This will enable the support for the Atheros wireless drivers.
           ath5k, ath9k and ar9170 drivers share some common code, this option
-          enables the common ath.ko module which currently shares just common
-          regulatory EEPROM helpers but will likely be extended later to share
-          more between modules.
+          enables the common ath.ko module which shares common helpers.
 
           For more information and documentation on this module you can visit:
 
diff --git a/drivers/net/wireless/ath/ath.h b/drivers/net/wireless/ath/ath.h
new file mode 100644
index 000000000000..e284cd3ac6d4
--- /dev/null
+++ b/drivers/net/wireless/ath/ath.h
@@ -0,0 +1,30 @@
+/*
+ * Copyright (c) 2008-2009 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef ATH_H
+#define ATH_H
+
+#include <linux/skbuff.h>
+
+struct ath_common {
+        u16 cachelsz;
+};
+
+struct sk_buff *ath_rxbuf_alloc(struct ath_common *common,
+                                u32 len,
+                                gfp_t gfp_mask);
+
+#endif /* ATH_H */
diff --git a/drivers/net/wireless/ath/ath5k/ath5k.h b/drivers/net/wireless/ath/ath5k/ath5k.h
index 91375113916b..c09402eea7f3 100644
--- a/drivers/net/wireless/ath/ath5k/ath5k.h
+++ b/drivers/net/wireless/ath/ath5k/ath5k.h
@@ -919,6 +919,12 @@ enum ath5k_int {
         AR5K_INT_NOCARD = 0xffffffff
 };
 
+/* Software interrupts used for calibration */
+enum ath5k_software_interrupt {
+        AR5K_SWI_FULL_CALIBRATION = 0x01,
+        AR5K_SWI_SHORT_CALIBRATION = 0x02,
+};
+
 /*
  * Power management
  */
@@ -1123,6 +1129,15 @@ struct ath5k_hw {
         /* noise floor from last periodic calibration */
         s32                     ah_noise_floor;
 
+        /* Calibration timestamp */
+        unsigned long           ah_cal_tstamp;
+
+        /* Calibration interval (secs) */
+        u8                      ah_cal_intval;
+
+        /* Software interrupt mask */
+        u8                      ah_swi_mask;
+
         /*
          * Function pointers
          */
@@ -1157,6 +1172,7 @@ extern void ath5k_unregister_leds(struct ath5k_softc *sc);
 
 /* Reset Functions */
 extern int ath5k_hw_nic_wakeup(struct ath5k_hw *ah, int flags, bool initial);
+extern int ath5k_hw_on_hold(struct ath5k_hw *ah);
 extern int ath5k_hw_reset(struct ath5k_hw *ah, enum nl80211_iftype op_mode, struct ieee80211_channel *channel, bool change_channel);
 /* Power management functions */
 extern int ath5k_hw_set_power(struct ath5k_hw *ah, enum ath5k_power_mode mode, bool set_chip, u16 sleep_duration);
@@ -1275,6 +1291,7 @@ extern int ath5k_hw_channel(struct ath5k_hw *ah, struct ieee80211_channel *chann
 /* PHY calibration */
 extern int ath5k_hw_phy_calibrate(struct ath5k_hw *ah, struct ieee80211_channel *channel);
 extern int ath5k_hw_noise_floor_calibration(struct ath5k_hw *ah, short freq);
+extern void ath5k_hw_calibration_poll(struct ath5k_hw *ah);
 /* Spur mitigation */
 bool ath5k_hw_chan_has_spur_noise(struct ath5k_hw *ah,
                                 struct ieee80211_channel *channel);
diff --git a/drivers/net/wireless/ath/ath5k/attach.c b/drivers/net/wireless/ath/ath5k/attach.c
index 9a84d9410b27..65d438b59f64 100644
--- a/drivers/net/wireless/ath/ath5k/attach.c
+++ b/drivers/net/wireless/ath/ath5k/attach.c
@@ -145,7 +145,7 @@ struct ath5k_hw *ath5k_hw_attach(struct ath5k_softc *sc, u8 mac_version)
                 goto err_free;
 
         /* Bring device out of sleep and reset it's units */
-        ret = ath5k_hw_nic_wakeup(ah, CHANNEL_B, true);
+        ret = ath5k_hw_nic_wakeup(ah, 0, true);
         if (ret)
                 goto err_free;
 
@@ -253,28 +253,6 @@ struct ath5k_hw *ath5k_hw_attach(struct ath5k_softc *sc, u8 mac_version)
         }
 
         /*
-         * Write PCI-E power save settings
-         */
-        if ((ah->ah_version == AR5K_AR5212) && (pdev->is_pcie)) {
-                ath5k_hw_reg_write(ah, 0x9248fc00, AR5K_PCIE_SERDES);
-                ath5k_hw_reg_write(ah, 0x24924924, AR5K_PCIE_SERDES);
-                /* Shut off RX when elecidle is asserted */
-                ath5k_hw_reg_write(ah, 0x28000039, AR5K_PCIE_SERDES);
-                ath5k_hw_reg_write(ah, 0x53160824, AR5K_PCIE_SERDES);
-                /* TODO: EEPROM work */
-                ath5k_hw_reg_write(ah, 0xe5980579, AR5K_PCIE_SERDES);
-                /* Shut off PLL and CLKREQ active in L1 */
-                ath5k_hw_reg_write(ah, 0x001defff, AR5K_PCIE_SERDES);
-                /* Preserce other settings */
-                ath5k_hw_reg_write(ah, 0x1aaabe40, AR5K_PCIE_SERDES);
-                ath5k_hw_reg_write(ah, 0xbe105554, AR5K_PCIE_SERDES);
-                ath5k_hw_reg_write(ah, 0x000e3007, AR5K_PCIE_SERDES);
-                /* Reset SERDES to load new settings */
-                ath5k_hw_reg_write(ah, 0x00000000, AR5K_PCIE_SERDES_RESET);
-                mdelay(1);
-        }
-
-        /*
          * POST
          */
         ret = ath5k_hw_post(ah);
@@ -283,7 +261,7 @@ struct ath5k_hw *ath5k_hw_attach(struct ath5k_softc *sc, u8 mac_version)
 
         /* Enable pci core retry fix on Hainan (5213A) and later chips */
         if (srev >= AR5K_SREV_AR5213A)
-                ath5k_hw_reg_write(ah, AR5K_PCICFG_RETRY_FIX, AR5K_PCICFG);
+                AR5K_REG_ENABLE_BITS(ah, AR5K_PCICFG, AR5K_PCICFG_RETRY_FIX);
 
         /*
          * Get card capabilities, calibration values etc
@@ -295,6 +273,40 @@ struct ath5k_hw *ath5k_hw_attach(struct ath5k_softc *sc, u8 mac_version)
                 goto err_free;
         }
 
+        /*
+         * Write PCI-E power save settings
+         */
+        if ((ah->ah_version == AR5K_AR5212) && (pdev->is_pcie)) {
+                struct ath5k_eeprom_info *ee = &ah->ah_capabilities.cap_eeprom;
+
+                ath5k_hw_reg_write(ah, 0x9248fc00, AR5K_PCIE_SERDES);
+                ath5k_hw_reg_write(ah, 0x24924924, AR5K_PCIE_SERDES);
+
+                /* Shut off RX when elecidle is asserted */
+                ath5k_hw_reg_write(ah, 0x28000039, AR5K_PCIE_SERDES);
+                ath5k_hw_reg_write(ah, 0x53160824, AR5K_PCIE_SERDES);
+
+                /* If serdes programing is enabled, increase PCI-E
+                 * tx power for systems with long trace from host
+                 * to minicard connector. */
+                if (ee->ee_serdes)
+                        ath5k_hw_reg_write(ah, 0xe5980579, AR5K_PCIE_SERDES);
+                else
+                        ath5k_hw_reg_write(ah, 0xf6800579, AR5K_PCIE_SERDES);
+
+                /* Shut off PLL and CLKREQ active in L1 */
+                ath5k_hw_reg_write(ah, 0x001defff, AR5K_PCIE_SERDES);
+
+                /* Preserve other settings */
+                ath5k_hw_reg_write(ah, 0x1aaabe40, AR5K_PCIE_SERDES);
+                ath5k_hw_reg_write(ah, 0xbe105554, AR5K_PCIE_SERDES);
+                ath5k_hw_reg_write(ah, 0x000e3007, AR5K_PCIE_SERDES);
+
+                /* Reset SERDES to load new settings */
+                ath5k_hw_reg_write(ah, 0x00000000, AR5K_PCIE_SERDES_RESET);
+                mdelay(1);
+        }
+
         /* Get misc capabilities */
         ret = ath5k_hw_set_capabilities(ah);
         if (ret) {
diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
index 3a1c156d275f..2b3cf39dd4b1 100644
--- a/drivers/net/wireless/ath/ath5k/base.c
+++ b/drivers/net/wireless/ath/ath5k/base.c
@@ -59,7 +59,7 @@
 #include "reg.h"
 #include "debug.h"
 
-static int ath5k_calinterval = 10; /* Calibrate PHY every 10 secs (TODO: Fixme) */
+static u8 ath5k_calinterval = 10; /* Calibrate PHY every 10 secs (TODO: Fixme) */
 static int modparam_nohwcrypt;
 module_param_named(nohwcrypt, modparam_nohwcrypt, bool, S_IRUGO);
 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
@@ -376,7 +376,7 @@ static int 	ath5k_stop_hw(struct ath5k_softc *sc);
 static irqreturn_t ath5k_intr(int irq, void *dev_id);
 static void     ath5k_tasklet_reset(unsigned long data);
 
-static void     ath5k_calibrate(unsigned long data);
+static void     ath5k_tasklet_calibrate(unsigned long data);
 
 /*
  * Module init/exit functions
@@ -471,7 +471,7 @@ ath5k_pci_probe(struct pci_dev *pdev,
                  * DMA to work so force a reasonable value here if it
                  * comes up zero.
                  */
-                csz = L1_CACHE_BYTES / sizeof(u32);
+                csz = L1_CACHE_BYTES >> 2;
                 pci_write_config_byte(pdev, PCI_CACHE_LINE_SIZE, csz);
         }
         /*
@@ -544,7 +544,7 @@ ath5k_pci_probe(struct pci_dev *pdev,
         __set_bit(ATH_STAT_INVALID, sc->status);
 
         sc->iobase = mem; /* So we can unmap it on detach */
-        sc->cachelsz = csz * sizeof(u32); /* convert to bytes */
+        sc->common.cachelsz = csz << 2; /* convert to bytes */
         sc->opmode = NL80211_IFTYPE_STATION;
         sc->bintval = 1000;
         mutex_init(&sc->lock);
@@ -799,8 +799,8 @@ ath5k_attach(struct pci_dev *pdev, struct ieee80211_hw *hw)
         tasklet_init(&sc->rxtq, ath5k_tasklet_rx, (unsigned long)sc);
         tasklet_init(&sc->txtq, ath5k_tasklet_tx, (unsigned long)sc);
         tasklet_init(&sc->restq, ath5k_tasklet_reset, (unsigned long)sc);
+        tasklet_init(&sc->calib, ath5k_tasklet_calibrate, (unsigned long)sc);
         tasklet_init(&sc->beacontq, ath5k_tasklet_beacon, (unsigned long)sc);
-        setup_timer(&sc->calib_tim, ath5k_calibrate, (unsigned long)sc);
 
         ret = ath5k_eeprom_read_mac(ah, mac);
         if (ret) {
@@ -1071,10 +1071,9 @@ ath5k_setup_bands(struct ieee80211_hw *hw)
 }
 
 /*
- * Set/change channels.  If the channel is really being changed,
- * it's done by reseting the chip.  To accomplish this we must
- * first cleanup any pending DMA, then restart stuff after a la
- * ath5k_init.
+ * Set/change channels. We always reset the chip.
+ * To accomplish this we must first cleanup any pending DMA,
+ * then restart stuff after a la  ath5k_init.
  *
  * Called with sc->lock.
  */
@@ -1084,19 +1083,13 @@ ath5k_chan_set(struct ath5k_softc *sc, struct ieee80211_channel *chan)
         ATH5K_DBG(sc, ATH5K_DEBUG_RESET, "(%u MHz) -> (%u MHz)\n",
                 sc->curchan->center_freq, chan->center_freq);
 
-        if (chan->center_freq != sc->curchan->center_freq ||
-                chan->hw_value != sc->curchan->hw_value) {
-
-                /*
-                 * To switch channels clear any pending DMA operations;
-                 * wait long enough for the RX fifo to drain, reset the
-                 * hardware at the new frequency, and then re-enable
-                 * the relevant bits of the h/w.
-                 */
-                return ath5k_reset(sc, chan);
-        }
-
-        return 0;
+        /*
+         * To switch channels clear any pending DMA operations;
+         * wait long enough for the RX fifo to drain, reset the
+         * hardware at the new frequency, and then re-enable
+         * the relevant bits of the h/w.
+         */
+        return ath5k_reset(sc, chan);
 }
 
 static void
@@ -1158,27 +1151,20 @@ static
 struct sk_buff *ath5k_rx_skb_alloc(struct ath5k_softc *sc, dma_addr_t *skb_addr)
 {
         struct sk_buff *skb;
-        unsigned int off;
 
         /*
          * Allocate buffer with headroom_needed space for the
          * fake physical layer header at the start.
          */
-        skb = dev_alloc_skb(sc->rxbufsize + sc->cachelsz - 1);
+        skb = ath_rxbuf_alloc(&sc->common,
+                              sc->rxbufsize + sc->common.cachelsz - 1,
+                              GFP_ATOMIC);
 
         if (!skb) {
                 ATH5K_ERR(sc, "can't alloc skbuff of size %u\n",
-                                sc->rxbufsize + sc->cachelsz - 1);
+                                sc->rxbufsize + sc->common.cachelsz - 1);
                 return NULL;
         }
-        /*
-         * Cache-line-align.  This is important (for the
-         * 5210 at least) as not doing so causes bogus data
-         * in rx'd frames.
-         */
-        off = ((unsigned long)skb->data) % sc->cachelsz;
-        if (off != 0)
-                skb_reserve(skb, sc->cachelsz - off);
 
         *skb_addr = pci_map_single(sc->pdev,
                 skb->data, sc->rxbufsize, PCI_DMA_FROMDEVICE);
@@ -1620,10 +1606,10 @@ ath5k_rx_start(struct ath5k_softc *sc)
         struct ath5k_buf *bf;
         int ret;
 
-        sc->rxbufsize = roundup(IEEE80211_MAX_LEN, sc->cachelsz);
+        sc->rxbufsize = roundup(IEEE80211_MAX_LEN, sc->common.cachelsz);
 
         ATH5K_DBG(sc, ATH5K_DEBUG_RESET, "cachelsz %u rxbufsize %u\n",
-                sc->cachelsz, sc->rxbufsize);
+                sc->common.cachelsz, sc->rxbufsize);
 
         spin_lock_bh(&sc->rxbuflock);
         sc->rxlink = NULL;
@@ -2371,7 +2357,7 @@ ath5k_init(struct ath5k_softc *sc)
         sc->curband = &sc->sbands[sc->curchan->band];
         sc->imask = AR5K_INT_RXOK | AR5K_INT_RXERR | AR5K_INT_RXEOL |
                 AR5K_INT_RXORN | AR5K_INT_TXDESC | AR5K_INT_TXEOL |
-                AR5K_INT_FATAL | AR5K_INT_GLOBAL;
+                AR5K_INT_FATAL | AR5K_INT_GLOBAL | AR5K_INT_SWI;
         ret = ath5k_reset(sc, NULL);
         if (ret)
                 goto done;
@@ -2388,8 +2374,8 @@ ath5k_init(struct ath5k_softc *sc)
         /* Set ack to be sent at low bit-rates */
         ath5k_hw_set_ack_bitrate_high(ah, false);
 
-        mod_timer(&sc->calib_tim, round_jiffies(jiffies +
-                        msecs_to_jiffies(ath5k_calinterval * 1000)));
+        /* Set PHY calibration inteval */
+        ah->ah_cal_intval = ath5k_calinterval;
 
         ret = 0;
 done:
@@ -2453,37 +2439,39 @@ ath5k_stop_hw(struct ath5k_softc *sc)
         ret = ath5k_stop_locked(sc);
         if (ret == 0 && !test_bit(ATH_STAT_INVALID, sc->status)) {
                 /*
-                 * Set the chip in full sleep mode.  Note that we are
-                 * careful to do this only when bringing the interface
-                 * completely to a stop.  When the chip is in this state
-                 * it must be carefully woken up or references to
-                 * registers in the PCI clock domain may freeze the bus
-                 * (and system).  This varies by chip and is mostly an
-                 * issue with newer parts that go to sleep more quickly.
-                 */
-                if (sc->ah->ah_mac_srev >= 0x78) {
-                        /*
-                         * XXX
-                         * don't put newer MAC revisions > 7.8 to sleep because
-                         * of the above mentioned problems
-                         */
-                        ATH5K_DBG(sc, ATH5K_DEBUG_RESET, "mac version > 7.8, "
-                                "not putting device to sleep\n");
-                } else {
-                        ATH5K_DBG(sc, ATH5K_DEBUG_RESET,
-                                "putting device to full sleep\n");
-                        ath5k_hw_set_power(sc->ah, AR5K_PM_FULL_SLEEP, true, 0);
-                }
+                 * Don't set the card in full sleep mode!
+                 *
+                 * a) When the device is in this state it must be carefully
+                 * woken up or references to registers in the PCI clock
+                 * domain may freeze the bus (and system).  This varies
+                 * by chip and is mostly an issue with newer parts
+                 * (madwifi sources mentioned srev >= 0x78) that go to
+                 * sleep more quickly.
+                 *
+                 * b) On older chips full sleep results a weird behaviour
+                 * during wakeup. I tested various cards with srev < 0x78
+                 * and they don't wake up after module reload, a second
+                 * module reload is needed to bring the card up again.
+                 *
+                 * Until we figure out what's going on don't enable
+                 * full chip reset on any chip (this is what Legacy HAL
+                 * and Sam's HAL do anyway). Instead Perform a full reset
+                 * on the device (same as initial state after attach) and
+                 * leave it idle (keep MAC/BB on warm reset) */
+                ret = ath5k_hw_on_hold(sc->ah);
+
+                ATH5K_DBG(sc, ATH5K_DEBUG_RESET,
+                                "putting device to sleep\n");
         }
         ath5k_txbuf_free(sc, sc->bbuf);
 
         mmiowb();
         mutex_unlock(&sc->lock);
 
-        del_timer_sync(&sc->calib_tim);
         tasklet_kill(&sc->rxtq);
         tasklet_kill(&sc->txtq);
         tasklet_kill(&sc->restq);
+        tasklet_kill(&sc->calib);
         tasklet_kill(&sc->beacontq);
 
         ath5k_rfkill_hw_stop(sc->ah);
@@ -2539,6 +2527,9 @@ ath5k_intr(int irq, void *dev_id)
                         if (status & AR5K_INT_BMISS) {
                                 /* TODO */
                         }
+                        if (status & AR5K_INT_SWI) {
+                                tasklet_schedule(&sc->calib);
+                        }
                         if (status & AR5K_INT_MIB) {
                                 /*
                                  * These stats are also used for ANI i think
@@ -2555,6 +2546,8 @@ ath5k_intr(int irq, void *dev_id)
         if (unlikely(!counter))
                 ATH5K_WARN(sc, "too many interrupts, giving up for now\n");
 
+        ath5k_hw_calibration_poll(ah);
+
         return IRQ_HANDLED;
 }
 
@@ -2571,11 +2564,19 @@ ath5k_tasklet_reset(unsigned long data)
  * for temperature/environment changes.
  */
 static void
-ath5k_calibrate(unsigned long data)
+ath5k_tasklet_calibrate(unsigned long data)
 {
         struct ath5k_softc *sc = (void *)data;
         struct ath5k_hw *ah = sc->ah;
 
+        /* Only full calibration for now */
+        if (ah->ah_swi_mask != AR5K_SWI_FULL_CALIBRATION)
+                return;
+
+        /* Stop queues so that calibration
+         * doesn't interfere with tx */
+        ieee80211_stop_queues(sc->hw);
+
         ATH5K_DBG(sc, ATH5K_DEBUG_CALIBRATE, "channel %u/%x\n",
                 ieee80211_frequency_to_channel(sc->curchan->center_freq),
                 sc->curchan->hw_value);
@@ -2593,8 +2594,11 @@ ath5k_calibrate(unsigned long data)
                         ieee80211_frequency_to_channel(
                                 sc->curchan->center_freq));
 
-        mod_timer(&sc->calib_tim, round_jiffies(jiffies +
-                        msecs_to_jiffies(ath5k_calinterval * 1000)));
+        ah->ah_swi_mask = 0;
+
+        /* Wake queues */
+        ieee80211_wake_queues(sc->hw);
+
 }
 
 
@@ -2811,9 +2815,11 @@ ath5k_config(struct ieee80211_hw *hw, u32 changed)
 
         mutex_lock(&sc->lock);
 
-        ret = ath5k_chan_set(sc, conf->channel);
-        if (ret < 0)
-                goto unlock;
+        if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
+                ret = ath5k_chan_set(sc, conf->channel);
+                if (ret < 0)
+                        goto unlock;
+        }
 
         if ((changed & IEEE80211_CONF_CHANGE_POWER) &&
         (sc->power_level != conf->power_level)) {
diff --git a/drivers/net/wireless/ath/ath5k/base.h b/drivers/net/wireless/ath/ath5k/base.h
index 778e422946ab..25a72a85aaa5 100644
--- a/drivers/net/wireless/ath/ath5k/base.h
+++ b/drivers/net/wireless/ath/ath5k/base.h
@@ -50,6 +50,7 @@
 
 #include "ath5k.h"
 #include "debug.h"
+#include "../ath.h"
 
 #define ATH_RXBUF       40              /* number of RX buffers */
 #define ATH_TXBUF       200             /* number of TX buffers */
@@ -112,6 +113,7 @@ struct ath5k_rfkill {
  * associated with an instance of a device */
 struct ath5k_softc {
         struct pci_dev          *pdev;          /* for dma mapping */
+        struct ath_common       common;
         void __iomem            *iobase;        /* address of the device */
         struct mutex            lock;           /* dev-level lock */
         struct ieee80211_tx_queue_stats tx_stats[AR5K_NUM_TX_QUEUES];
@@ -134,7 +136,6 @@ struct ath5k_softc {
         struct ath5k_desc       *desc;          /* TX/RX descriptors */
         dma_addr_t              desc_daddr;     /* DMA (physical) address */
         size_t                  desc_len;       /* size of TX/RX descriptors */
-        u16                     cachelsz;       /* cache line size */
 
         DECLARE_BITMAP(status, 5);
 #define ATH_STAT_INVALID        0               /* disable hardware accesses */
@@ -177,6 +178,8 @@ struct ath5k_softc {
 
         struct ath5k_rfkill     rf_kill;
 
+        struct tasklet_struct   calib;          /* calibration tasklet */
+
         spinlock_t              block;          /* protects beacon */
         struct tasklet_struct   beacontq;       /* beacon intr tasklet */
         struct ath5k_buf        *bbuf;          /* beacon buffer */
@@ -187,7 +190,6 @@ struct ath5k_softc {
         unsigned int            nexttbtt;       /* next beacon time in TU */
         struct ath5k_txq        *cabq;          /* content after beacon */
 
-        struct timer_list       calib_tim;      /* calibration timer */
         int                     power_level;    /* Requested tx power in dbm */
         bool                    assoc;          /* assocate state */
         bool                    enable_beacon;  /* true if beacons are on */
diff --git a/drivers/net/wireless/ath/ath5k/eeprom.c b/drivers/net/wireless/ath/ath5k/eeprom.c
index c56b494d417a..8af477dd6fc7 100644
--- a/drivers/net/wireless/ath/ath5k/eeprom.c
+++ b/drivers/net/wireless/ath/ath5k/eeprom.c
@@ -167,6 +167,16 @@ ath5k_eeprom_init_header(struct ath5k_hw *ah)
         ee->ee_rfkill_pin = (u8) AR5K_REG_MS(val, AR5K_EEPROM_RFKILL_GPIO_SEL);
         ee->ee_rfkill_pol = val & AR5K_EEPROM_RFKILL_POLARITY ? true : false;
 
+        /* Check if PCIE_OFFSET points to PCIE_SERDES_SECTION
+         * and enable serdes programming if needed.
+         *
+         * XXX: Serdes values seem to be fixed so
+         * no need to read them here, we write them
+         * during ath5k_hw_attach */
+        AR5K_EEPROM_READ(AR5K_EEPROM_PCIE_OFFSET, val);
+        ee->ee_serdes = (val == AR5K_EEPROM_PCIE_SERDES_SECTION) ?
+                                                        true : false;
+
         return 0;
 }
 
diff --git a/drivers/net/wireless/ath/ath5k/eeprom.h b/drivers/net/wireless/ath/ath5k/eeprom.h
index 64be73a5edae..0123f3521a0b 100644
--- a/drivers/net/wireless/ath/ath5k/eeprom.h
+++ b/drivers/net/wireless/ath/ath5k/eeprom.h
@@ -19,6 +19,9 @@
 /*
  * Common ar5xxx EEPROM data offsets (set these on AR5K_EEPROM_BASE)
  */
+#define AR5K_EEPROM_PCIE_OFFSET         0x02    /* Contains offset to PCI-E infos */
+#define AR5K_EEPROM_PCIE_SERDES_SECTION 0x40    /* PCIE_OFFSET points here when
+                                                 * SERDES infos are present */
 #define AR5K_EEPROM_MAGIC               0x003d  /* EEPROM Magic number */
 #define AR5K_EEPROM_MAGIC_VALUE         0x5aa5  /* Default - found on EEPROM */
 #define AR5K_EEPROM_MAGIC_5212          0x0000145c /* 5212 */
@@ -391,6 +394,7 @@ struct ath5k_eeprom_info {
         u8      ee_rfkill_pin;
         bool    ee_rfkill_pol;
         bool    ee_is_hb63;
+        bool    ee_serdes;
         u16     ee_misc0;
         u16     ee_misc1;
         u16     ee_misc2;
diff --git a/drivers/net/wireless/ath/ath5k/phy.c b/drivers/net/wireless/ath/ath5k/phy.c
index 2075ba993966..298fcf015227 100644
--- a/drivers/net/wireless/ath/ath5k/phy.c
+++ b/drivers/net/wireless/ath/ath5k/phy.c
@@ -740,13 +740,22 @@ int ath5k_hw_rfregs_init(struct ath5k_hw *ah, struct ieee80211_channel *channel,
                                                 AR5K_RF_XPD_GAIN, true);
 
                 } else {
-                        /* TODO: Set high and low gain bits */
-                        ath5k_hw_rfb_op(ah, rf_regs,
-                                                ee->ee_x_gain[ee_mode],
+                        u8 *pdg_curve_to_idx = ee->ee_pdc_to_idx[ee_mode];
+                        if (ee->ee_pd_gains[ee_mode] > 1) {
+                                ath5k_hw_rfb_op(ah, rf_regs,
+                                                pdg_curve_to_idx[0],
                                                 AR5K_RF_PD_GAIN_LO, true);
-                        ath5k_hw_rfb_op(ah, rf_regs,
-                                                ee->ee_x_gain[ee_mode],
+                                ath5k_hw_rfb_op(ah, rf_regs,
+                                                pdg_curve_to_idx[1],
                                                 AR5K_RF_PD_GAIN_HI, true);
+                        } else {
+                                ath5k_hw_rfb_op(ah, rf_regs,
+                                                pdg_curve_to_idx[0],
+                                                AR5K_RF_PD_GAIN_LO, true);
+                                ath5k_hw_rfb_op(ah, rf_regs,
+                                                pdg_curve_to_idx[0],
+                                                AR5K_RF_PD_GAIN_HI, true);
+                        }
 
                         /* Lower synth voltage on Rev 2 */
                         ath5k_hw_rfb_op(ah, rf_regs, 2,
@@ -1095,6 +1104,29 @@ int ath5k_hw_channel(struct ath5k_hw *ah, struct ieee80211_channel *channel)
   PHY calibration
 \*****************/
 
+void
+ath5k_hw_calibration_poll(struct ath5k_hw *ah)
+{
+        /* Calibration interval in jiffies */
+        unsigned long cal_intval;
+
+        cal_intval = msecs_to_jiffies(ah->ah_cal_intval * 1000);
+
+        /* Initialize timestamp if needed */
+        if (!ah->ah_cal_tstamp)
+                ah->ah_cal_tstamp = jiffies;
+
+        /* For now we always do full calibration
+         * Mark software interrupt mask and fire software
+         * interrupt (bit gets auto-cleared) */
+        if (time_is_before_eq_jiffies(ah->ah_cal_tstamp + cal_intval)) {
+                ah->ah_cal_tstamp = jiffies;
+                ah->ah_swi_mask = AR5K_SWI_FULL_CALIBRATION;
+                AR5K_REG_ENABLE_BITS(ah, AR5K_CR, AR5K_CR_SWI);
+        }
+
+}
+
 /**
  * ath5k_hw_noise_floor_calibration - perform PHY noise floor calibration
  *
@@ -1896,8 +1928,9 @@ ath5k_get_linear_pcdac_min(const u8 *stepL, const u8 *stepR,
         s16 min_pwrL, min_pwrR;
         s16 pwr_i;
 
-        if (WARN_ON(stepL[0] == stepL[1] || stepR[0] == stepR[1]))
-                return 0;
+        /* Some vendors write the same pcdac value twice !!! */
+        if (stepL[0] == stepL[1] || stepR[0] == stepR[1])
+                return max(pwrL[0], pwrR[0]);
 
         if (pwrL[0] == pwrL[1])
                 min_pwrL = pwrL[0];
diff --git a/drivers/net/wireless/ath/ath5k/qcu.c b/drivers/net/wireless/ath/ath5k/qcu.c
index 6d5aaf00d8bb..eeebb9aef206 100644
--- a/drivers/net/wireless/ath/ath5k/qcu.c
+++ b/drivers/net/wireless/ath/ath5k/qcu.c
@@ -362,7 +362,7 @@ int ath5k_hw_reset_tx_queue(struct ath5k_hw *ah, unsigned int queue)
                 }
 
                 if (tq->tqi_ready_time &&
-                (tq->tqi_type != AR5K_TX_QUEUE_ID_CAB))
+                (tq->tqi_type != AR5K_TX_QUEUE_CAB))
                         ath5k_hw_reg_write(ah, AR5K_REG_SM(tq->tqi_ready_time,
                                 AR5K_QCU_RDYTIMECFG_INTVAL) |
                                 AR5K_QCU_RDYTIMECFG_ENABLE,
diff --git a/drivers/net/wireless/ath/ath5k/reset.c b/drivers/net/wireless/ath/ath5k/reset.c
index 86733fdb4774..34e13c700849 100644
--- a/drivers/net/wireless/ath/ath5k/reset.c
+++ b/drivers/net/wireless/ath/ath5k/reset.c
@@ -258,29 +258,35 @@ int ath5k_hw_set_power(struct ath5k_hw *ah, enum ath5k_power_mode mode,
                 if (!set_chip)
                         goto commit;
 
-                /* Preserve sleep duration */
                 data = ath5k_hw_reg_read(ah, AR5K_SLEEP_CTL);
+
+                /* If card is down we 'll get 0xffff... so we
+                 * need to clean this up before we write the register
+                 */
                 if (data & 0xffc00000)
                         data = 0;
                 else
-                        data = data & 0xfffcffff;
+                        /* Preserve sleep duration etc */
+                        data = data & ~AR5K_SLEEP_CTL_SLE;
 
-                ath5k_hw_reg_write(ah, data, AR5K_SLEEP_CTL);
+                ath5k_hw_reg_write(ah, data | AR5K_SLEEP_CTL_SLE_WAKE,
+                                                        AR5K_SLEEP_CTL);
                 udelay(15);
 
-                for (i = 50; i > 0; i--) {
+                for (i = 200; i > 0; i--) {
                         /* Check if the chip did wake up */
                         if ((ath5k_hw_reg_read(ah, AR5K_PCICFG) &
                                         AR5K_PCICFG_SPWR_DN) == 0)
                                 break;
 
                         /* Wait a bit and retry */
-                        udelay(200);
-                        ath5k_hw_reg_write(ah, data, AR5K_SLEEP_CTL);
+                        udelay(50);
+                        ath5k_hw_reg_write(ah, data | AR5K_SLEEP_CTL_SLE_WAKE,
+                                                        AR5K_SLEEP_CTL);
                 }
 
                 /* Fail if the chip didn't wake up */
-                if (i <= 0)
+                if (i == 0)
                         return -EIO;
 
                 break;
@@ -296,6 +302,64 @@ commit:
 }
 
 /*
+ * Put device on hold
+ *
+ * Put MAC and Baseband on warm reset and
+ * keep that state (don't clean sleep control
+ * register). After this MAC and Baseband are
+ * disabled and a full reset is needed to come
+ * back. This way we save as much power as possible
+ * without puting the card on full sleep.
+ */
+int ath5k_hw_on_hold(struct ath5k_hw *ah)
+{
+        struct pci_dev *pdev = ah->ah_sc->pdev;
+        u32 bus_flags;
+        int ret;
+
+        /* Make sure device is awake */
+        ret = ath5k_hw_set_power(ah, AR5K_PM_AWAKE, true, 0);
+        if (ret) {
+                ATH5K_ERR(ah->ah_sc, "failed to wakeup the MAC Chip\n");
+                return ret;
+        }
+
+        /*
+         * Put chipset on warm reset...
+         *
+         * Note: puting PCI core on warm reset on PCI-E cards
+         * results card to hang and always return 0xffff... so
+         * we ingore that flag for PCI-E cards. On PCI cards
+         * this flag gets cleared after 64 PCI clocks.
+         */
+        bus_flags = (pdev->is_pcie) ? 0 : AR5K_RESET_CTL_PCI;
+
+        if (ah->ah_version == AR5K_AR5210) {
+                ret = ath5k_hw_nic_reset(ah, AR5K_RESET_CTL_PCU |
+                        AR5K_RESET_CTL_MAC | AR5K_RESET_CTL_DMA |
+                        AR5K_RESET_CTL_PHY | AR5K_RESET_CTL_PCI);
+                        mdelay(2);
+        } else {
+                ret = ath5k_hw_nic_reset(ah, AR5K_RESET_CTL_PCU |
+                        AR5K_RESET_CTL_BASEBAND | bus_flags);
+        }
+
+        if (ret) {
+                ATH5K_ERR(ah->ah_sc, "failed to put device on warm reset\n");
+                return -EIO;
+        }
+
+        /* ...wakeup again!*/
+        ret = ath5k_hw_set_power(ah, AR5K_PM_AWAKE, true, 0);
+        if (ret) {
+                ATH5K_ERR(ah->ah_sc, "failed to put device on hold\n");
+                return ret;
+        }
+
+        return ret;
+}
+
+/*
  * Bring up MAC + PHY Chips and program PLL
  * TODO: Half/Quarter rate support
  */
@@ -318,6 +382,50 @@ int ath5k_hw_nic_wakeup(struct ath5k_hw *ah, int flags, bool initial)
                 return ret;
         }
 
+        /*
+         * Put chipset on warm reset...
+         *
+         * Note: puting PCI core on warm reset on PCI-E cards
+         * results card to hang and always return 0xffff... so
+         * we ingore that flag for PCI-E cards. On PCI cards
+         * this flag gets cleared after 64 PCI clocks.
+         */
+        bus_flags = (pdev->is_pcie) ? 0 : AR5K_RESET_CTL_PCI;
+
+        if (ah->ah_version == AR5K_AR5210) {
+                ret = ath5k_hw_nic_reset(ah, AR5K_RESET_CTL_PCU |
+                        AR5K_RESET_CTL_MAC | AR5K_RESET_CTL_DMA |
+                        AR5K_RESET_CTL_PHY | AR5K_RESET_CTL_PCI);
+                        mdelay(2);
+        } else {
+                ret = ath5k_hw_nic_reset(ah, AR5K_RESET_CTL_PCU |
+                        AR5K_RESET_CTL_BASEBAND | bus_flags);
+        }
+
+        if (ret) {
+                ATH5K_ERR(ah->ah_sc, "failed to reset the MAC Chip\n");
+                return -EIO;
+        }
+
+        /* ...wakeup again!...*/
+        ret = ath5k_hw_set_power(ah, AR5K_PM_AWAKE, true, 0);
+        if (ret) {
+                ATH5K_ERR(ah->ah_sc, "failed to resume the MAC Chip\n");
+                return ret;
+        }
+
+        /* ...clear reset control register and pull device out of
+         * warm reset */
+        if (ath5k_hw_nic_reset(ah, 0)) {
+                ATH5K_ERR(ah->ah_sc, "failed to warm reset the MAC Chip\n");
+                return -EIO;
+        }
+
+        /* On initialization skip PLL programming since we don't have
+         * a channel / mode set yet */
+        if (initial)
+                return 0;
+
         if (ah->ah_version != AR5K_AR5210) {
                 /*
                  * Get channel mode flags
@@ -383,39 +491,6 @@ int ath5k_hw_nic_wakeup(struct ath5k_hw *ah, int flags, bool initial)
                                         AR5K_PHY_TURBO);
         }
 
-        /* reseting PCI on PCI-E cards results card to hang
-         * and always return 0xffff... so we ingore that flag
-         * for PCI-E cards */
-        bus_flags = (pdev->is_pcie) ? 0 : AR5K_RESET_CTL_PCI;
-
-        /* Reset chipset */
-        if (ah->ah_version == AR5K_AR5210) {
-                ret = ath5k_hw_nic_reset(ah, AR5K_RESET_CTL_PCU |
-                        AR5K_RESET_CTL_MAC | AR5K_RESET_CTL_DMA |
-                        AR5K_RESET_CTL_PHY | AR5K_RESET_CTL_PCI);
-                        mdelay(2);
-        } else {
-                ret = ath5k_hw_nic_reset(ah, AR5K_RESET_CTL_PCU |
-                        AR5K_RESET_CTL_BASEBAND | bus_flags);
-        }
-        if (ret) {
-                ATH5K_ERR(ah->ah_sc, "failed to reset the MAC Chip\n");
-                return -EIO;
-        }
-
-        /* ...wakeup again!*/
-        ret = ath5k_hw_set_power(ah, AR5K_PM_AWAKE, true, 0);
-        if (ret) {
-                ATH5K_ERR(ah->ah_sc, "failed to resume the MAC Chip\n");
-                return ret;
-        }
-
-        /* ...final warm reset */
-        if (ath5k_hw_nic_reset(ah, 0)) {
-                ATH5K_ERR(ah->ah_sc, "failed to warm reset the MAC Chip\n");
-                return -EIO;
-        }
-
         if (ah->ah_version != AR5K_AR5210) {
 
                 /* ...update PLL if needed */
diff --git a/drivers/net/wireless/ath/ath9k/Kconfig b/drivers/net/wireless/ath/ath9k/Kconfig
index 2cb72f8c32d7..ef5f59c4dd80 100644
--- a/drivers/net/wireless/ath/ath9k/Kconfig
+++ b/drivers/net/wireless/ath/ath9k/Kconfig
@@ -6,7 +6,13 @@ config ATH9K
         select NEW_LEDS
         ---help---
           This module adds support for wireless adapters based on
-          Atheros IEEE 802.11n AR5008 and AR9001 family of chipsets.
+          Atheros IEEE 802.11n AR5008, AR9001 and AR9002 family
+          of chipsets. For a specific list of supported external
+          cards, laptops that already ship with these cards and
+          APs that come with these cards refer to to ath9k wiki
+          products page:
+
+          http://wireless.kernel.org/en/users/Drivers/ath9k/products
 
           If you choose to build a module, it'll be called ath9k.
 
diff --git a/drivers/net/wireless/ath/ath9k/Makefile b/drivers/net/wireless/ath/ath9k/Makefile
index 783bc39eb2ff..28443e05ec10 100644
--- a/drivers/net/wireless/ath/ath9k/Makefile
+++ b/drivers/net/wireless/ath/ath9k/Makefile
@@ -1,5 +1,8 @@
 ath9k-y +=      hw.o \
                 eeprom.o \
+                eeprom_def.o \
+                eeprom_4k.o \
+                eeprom_9287.o \
                 mac.o \
                 calib.o \
                 ani.o \
diff --git a/drivers/net/wireless/ath/ath9k/ani.c b/drivers/net/wireless/ath/ath9k/ani.c
index b7093126dbb8..f264097a2f4e 100644
--- a/drivers/net/wireless/ath/ath9k/ani.c
+++ b/drivers/net/wireless/ath/ath9k/ani.c
@@ -236,36 +236,35 @@ static void ath9k_ani_restart(struct ath_hw *ah)
                 return;
 
         aniState = ah->curani;
-
         aniState->listenTime = 0;
-        if (ah->has_hw_phycounters) {
-                if (aniState->ofdmTrigHigh > AR_PHY_COUNTMAX) {
-                        aniState->ofdmPhyErrBase = 0;
-                        DPRINTF(ah->ah_sc, ATH_DBG_ANI,
-                                "OFDM Trigger is too high for hw counters\n");
-                } else {
-                        aniState->ofdmPhyErrBase =
-                                AR_PHY_COUNTMAX - aniState->ofdmTrigHigh;
-                }
-                if (aniState->cckTrigHigh > AR_PHY_COUNTMAX) {
-                        aniState->cckPhyErrBase = 0;
-                        DPRINTF(ah->ah_sc, ATH_DBG_ANI,
-                                "CCK Trigger is too high for hw counters\n");
-                } else {
-                        aniState->cckPhyErrBase =
-                                AR_PHY_COUNTMAX - aniState->cckTrigHigh;
-                }
+
+        if (aniState->ofdmTrigHigh > AR_PHY_COUNTMAX) {
+                aniState->ofdmPhyErrBase = 0;
                 DPRINTF(ah->ah_sc, ATH_DBG_ANI,
-                        "Writing ofdmbase=%u   cckbase=%u\n",
-                        aniState->ofdmPhyErrBase,
-                        aniState->cckPhyErrBase);
-                REG_WRITE(ah, AR_PHY_ERR_1, aniState->ofdmPhyErrBase);
-                REG_WRITE(ah, AR_PHY_ERR_2, aniState->cckPhyErrBase);
-                REG_WRITE(ah, AR_PHY_ERR_MASK_1, AR_PHY_ERR_OFDM_TIMING);
-                REG_WRITE(ah, AR_PHY_ERR_MASK_2, AR_PHY_ERR_CCK_TIMING);
-
-                ath9k_hw_update_mibstats(ah, &ah->ah_mibStats);
+                        "OFDM Trigger is too high for hw counters\n");
+        } else {
+                aniState->ofdmPhyErrBase =
+                        AR_PHY_COUNTMAX - aniState->ofdmTrigHigh;
+        }
+        if (aniState->cckTrigHigh > AR_PHY_COUNTMAX) {
+                aniState->cckPhyErrBase = 0;
+                DPRINTF(ah->ah_sc, ATH_DBG_ANI,
+                        "CCK Trigger is too high for hw counters\n");
+        } else {
+                aniState->cckPhyErrBase =
+                        AR_PHY_COUNTMAX - aniState->cckTrigHigh;
         }
+        DPRINTF(ah->ah_sc, ATH_DBG_ANI,
+                "Writing ofdmbase=%u   cckbase=%u\n",
+                aniState->ofdmPhyErrBase,
+                aniState->cckPhyErrBase);
+        REG_WRITE(ah, AR_PHY_ERR_1, aniState->ofdmPhyErrBase);
+        REG_WRITE(ah, AR_PHY_ERR_2, aniState->cckPhyErrBase);
+        REG_WRITE(ah, AR_PHY_ERR_MASK_1, AR_PHY_ERR_OFDM_TIMING);
+        REG_WRITE(ah, AR_PHY_ERR_MASK_2, AR_PHY_ERR_CCK_TIMING);
+
+        ath9k_hw_update_mibstats(ah, &ah->ah_mibStats);
+
         aniState->ofdmPhyErrCount = 0;
         aniState->cckPhyErrCount = 0;
 }
@@ -530,18 +529,12 @@ void ath9k_ani_reset(struct ath_hw *ah)
         if (aniState->firstepLevel != 0)
                 ath9k_hw_ani_control(ah, ATH9K_ANI_FIRSTEP_LEVEL,
                                      aniState->firstepLevel);
-        if (ah->has_hw_phycounters) {
-                ath9k_hw_setrxfilter(ah, ath9k_hw_getrxfilter(ah) &
-                                     ~ATH9K_RX_FILTER_PHYERR);
-                ath9k_ani_restart(ah);
-                REG_WRITE(ah, AR_PHY_ERR_MASK_1, AR_PHY_ERR_OFDM_TIMING);
-                REG_WRITE(ah, AR_PHY_ERR_MASK_2, AR_PHY_ERR_CCK_TIMING);
 
-        } else {
-                ath9k_ani_restart(ah);
-                ath9k_hw_setrxfilter(ah, ath9k_hw_getrxfilter(ah) |
-                                     ATH9K_RX_FILTER_PHYERR);
-        }
+        ath9k_hw_setrxfilter(ah, ath9k_hw_getrxfilter(ah) &
+                             ~ATH9K_RX_FILTER_PHYERR);
+        ath9k_ani_restart(ah);
+        REG_WRITE(ah, AR_PHY_ERR_MASK_1, AR_PHY_ERR_OFDM_TIMING);
+        REG_WRITE(ah, AR_PHY_ERR_MASK_2, AR_PHY_ERR_CCK_TIMING);
 }
 
 void ath9k_hw_ani_monitor(struct ath_hw *ah,
@@ -550,6 +543,8 @@ void ath9k_hw_ani_monitor(struct ath_hw *ah,
 {
         struct ar5416AniState *aniState;
         int32_t listenTime;
+        u32 phyCnt1, phyCnt2;
+        u32 ofdmPhyErrCnt, cckPhyErrCnt;
 
         if (!DO_ANI(ah))
                 return;
@@ -566,50 +561,45 @@ void ath9k_hw_ani_monitor(struct ath_hw *ah,
 
         aniState->listenTime += listenTime;
 
-        if (ah->has_hw_phycounters) {
-                u32 phyCnt1, phyCnt2;
-                u32 ofdmPhyErrCnt, cckPhyErrCnt;
+        ath9k_hw_update_mibstats(ah, &ah->ah_mibStats);
 
-                ath9k_hw_update_mibstats(ah, &ah->ah_mibStats);
-
-                phyCnt1 = REG_READ(ah, AR_PHY_ERR_1);
-                phyCnt2 = REG_READ(ah, AR_PHY_ERR_2);
-
-                if (phyCnt1 < aniState->ofdmPhyErrBase ||
-                    phyCnt2 < aniState->cckPhyErrBase) {
-                        if (phyCnt1 < aniState->ofdmPhyErrBase) {
-                                DPRINTF(ah->ah_sc, ATH_DBG_ANI,
-                                        "phyCnt1 0x%x, resetting "
-                                        "counter value to 0x%x\n",
-                                        phyCnt1, aniState->ofdmPhyErrBase);
-                                REG_WRITE(ah, AR_PHY_ERR_1,
-                                          aniState->ofdmPhyErrBase);
-                                REG_WRITE(ah, AR_PHY_ERR_MASK_1,
-                                          AR_PHY_ERR_OFDM_TIMING);
-                        }
-                        if (phyCnt2 < aniState->cckPhyErrBase) {
-                                DPRINTF(ah->ah_sc, ATH_DBG_ANI,
-                                        "phyCnt2 0x%x, resetting "
-                                        "counter value to 0x%x\n",
-                                        phyCnt2, aniState->cckPhyErrBase);
-                                REG_WRITE(ah, AR_PHY_ERR_2,
-                                          aniState->cckPhyErrBase);
-                                REG_WRITE(ah, AR_PHY_ERR_MASK_2,
-                                          AR_PHY_ERR_CCK_TIMING);
-                        }
-                        return;
+        phyCnt1 = REG_READ(ah, AR_PHY_ERR_1);
+        phyCnt2 = REG_READ(ah, AR_PHY_ERR_2);
+
+        if (phyCnt1 < aniState->ofdmPhyErrBase ||
+            phyCnt2 < aniState->cckPhyErrBase) {
+                if (phyCnt1 < aniState->ofdmPhyErrBase) {
+                        DPRINTF(ah->ah_sc, ATH_DBG_ANI,
+                                "phyCnt1 0x%x, resetting "
+                                "counter value to 0x%x\n",
+                                phyCnt1, aniState->ofdmPhyErrBase);
+                        REG_WRITE(ah, AR_PHY_ERR_1,
+                                  aniState->ofdmPhyErrBase);
+                        REG_WRITE(ah, AR_PHY_ERR_MASK_1,
+                                  AR_PHY_ERR_OFDM_TIMING);
+                }
+                if (phyCnt2 < aniState->cckPhyErrBase) {
+                        DPRINTF(ah->ah_sc, ATH_DBG_ANI,
+                                "phyCnt2 0x%x, resetting "
+                                "counter value to 0x%x\n",
+                                phyCnt2, aniState->cckPhyErrBase);
+                        REG_WRITE(ah, AR_PHY_ERR_2,
+                                  aniState->cckPhyErrBase);
+                        REG_WRITE(ah, AR_PHY_ERR_MASK_2,
+                                  AR_PHY_ERR_CCK_TIMING);
                 }
+                return;
+        }
 
-                ofdmPhyErrCnt = phyCnt1 - aniState->ofdmPhyErrBase;
-                ah->stats.ast_ani_ofdmerrs +=
-                        ofdmPhyErrCnt - aniState->ofdmPhyErrCount;
-                aniState->ofdmPhyErrCount = ofdmPhyErrCnt;
+        ofdmPhyErrCnt = phyCnt1 - aniState->ofdmPhyErrBase;
+        ah->stats.ast_ani_ofdmerrs +=
+                ofdmPhyErrCnt - aniState->ofdmPhyErrCount;
+        aniState->ofdmPhyErrCount = ofdmPhyErrCnt;
 
-                cckPhyErrCnt = phyCnt2 - aniState->cckPhyErrBase;
-                ah->stats.ast_ani_cckerrs +=
-                        cckPhyErrCnt - aniState->cckPhyErrCount;
-                aniState->cckPhyErrCount = cckPhyErrCnt;
-        }
+        cckPhyErrCnt = phyCnt2 - aniState->cckPhyErrBase;
+        ah->stats.ast_ani_cckerrs +=
+                cckPhyErrCnt - aniState->cckPhyErrCount;
+        aniState->cckPhyErrCount = cckPhyErrCnt;
 
         if (aniState->listenTime > 5 * ah->aniperiod) {
                 if (aniState->ofdmPhyErrCount <= aniState->listenTime *
@@ -632,11 +622,6 @@ void ath9k_hw_ani_monitor(struct ath_hw *ah,
         }
 }
 
-bool ath9k_hw_phycounters(struct ath_hw *ah)
-{
-        return ah->has_hw_phycounters ? true : false;
-}
-
 void ath9k_enable_mib_counters(struct ath_hw *ah)
 {
         DPRINTF(ah->ah_sc, ATH_DBG_ANI, "Enable MIB counters\n");
@@ -781,9 +766,7 @@ void ath9k_hw_ani_init(struct ath_hw *ah)
 {
         int i;
 
-        DPRINTF(ah->ah_sc, ATH_DBG_ANI, "Attach ANI\n");
-
-        ah->has_hw_phycounters = 1;
+        DPRINTF(ah->ah_sc, ATH_DBG_ANI, "Initialize ANI\n");
 
         memset(ah->ani, 0, sizeof(ah->ani));
         for (i = 0; i < ARRAY_SIZE(ah->ani); i++) {
@@ -799,24 +782,22 @@ void ath9k_hw_ani_init(struct ath_hw *ah)
                         ATH9K_ANI_CCK_WEAK_SIG_THR;
                 ah->ani[i].spurImmunityLevel = ATH9K_ANI_SPUR_IMMUNE_LVL;
                 ah->ani[i].firstepLevel = ATH9K_ANI_FIRSTEP_LVL;
-                if (ah->has_hw_phycounters) {
-                        ah->ani[i].ofdmPhyErrBase =
-                                AR_PHY_COUNTMAX - ATH9K_ANI_OFDM_TRIG_HIGH;
-                        ah->ani[i].cckPhyErrBase =
-                                AR_PHY_COUNTMAX - ATH9K_ANI_CCK_TRIG_HIGH;
-                }
-        }
-        if (ah->has_hw_phycounters) {
-                DPRINTF(ah->ah_sc, ATH_DBG_ANI,
-                        "Setting OfdmErrBase = 0x%08x\n",
-                        ah->ani[0].ofdmPhyErrBase);
-                DPRINTF(ah->ah_sc, ATH_DBG_ANI, "Setting cckErrBase = 0x%08x\n",
-                        ah->ani[0].cckPhyErrBase);
-
-                REG_WRITE(ah, AR_PHY_ERR_1, ah->ani[0].ofdmPhyErrBase);
-                REG_WRITE(ah, AR_PHY_ERR_2, ah->ani[0].cckPhyErrBase);
-                ath9k_enable_mib_counters(ah);
+                ah->ani[i].ofdmPhyErrBase =
+                        AR_PHY_COUNTMAX - ATH9K_ANI_OFDM_TRIG_HIGH;
+                ah->ani[i].cckPhyErrBase =
+                        AR_PHY_COUNTMAX - ATH9K_ANI_CCK_TRIG_HIGH;
         }
+
+        DPRINTF(ah->ah_sc, ATH_DBG_ANI,
+                "Setting OfdmErrBase = 0x%08x\n",
+                ah->ani[0].ofdmPhyErrBase);
+        DPRINTF(ah->ah_sc, ATH_DBG_ANI, "Setting cckErrBase = 0x%08x\n",
+                ah->ani[0].cckPhyErrBase);
+
+        REG_WRITE(ah, AR_PHY_ERR_1, ah->ani[0].ofdmPhyErrBase);
+        REG_WRITE(ah, AR_PHY_ERR_2, ah->ani[0].cckPhyErrBase);
+        ath9k_enable_mib_counters(ah);
+
         ah->aniperiod = ATH9K_ANI_PERIOD;
         if (ah->config.enable_ani)
                 ah->proc_phyerr |= HAL_PROCESS_ANI;
@@ -826,9 +807,7 @@ void ath9k_hw_ani_disable(struct ath_hw *ah)
 {
         DPRINTF(ah->ah_sc, ATH_DBG_ANI, "Disabling ANI\n");
 
-        if (ah->has_hw_phycounters) {
-                ath9k_hw_disable_mib_counters(ah);
-                REG_WRITE(ah, AR_PHY_ERR_1, 0);
-                REG_WRITE(ah, AR_PHY_ERR_2, 0);
-        }
+        ath9k_hw_disable_mib_counters(ah);
+        REG_WRITE(ah, AR_PHY_ERR_1, 0);
+        REG_WRITE(ah, AR_PHY_ERR_2, 0);
 }
diff --git a/drivers/net/wireless/ath/ath9k/ani.h b/drivers/net/wireless/ath/ath9k/ani.h
index a36b7bb7c42a..119924511f85 100644
--- a/drivers/net/wireless/ath/ath9k/ani.h
+++ b/drivers/net/wireless/ath/ath9k/ani.h
@@ -124,7 +124,6 @@ void ath9k_ani_reset(struct ath_hw *ah);
 void ath9k_hw_ani_monitor(struct ath_hw *ah,
                           const struct ath9k_node_stats *stats,
                           struct ath9k_channel *chan);
-bool ath9k_hw_phycounters(struct ath_hw *ah);
 void ath9k_enable_mib_counters(struct ath_hw *ah);
 void ath9k_hw_disable_mib_counters(struct ath_hw *ah);
 u32 ath9k_hw_GetMibCycleCountsPct(struct ath_hw *ah, u32 *rxc_pcnt,
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index 7a5a157e15c4..2fd663c01b8e 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -25,6 +25,7 @@
 #include "hw.h"
 #include "rc.h"
 #include "debug.h"
+#include "../ath.h"
 
 struct ath_node;
 
@@ -532,6 +533,8 @@ struct ath_softc {
         struct ieee80211_hw *hw;
         struct device *dev;
 
+        struct ath_common common;
+
         spinlock_t wiphy_lock; /* spinlock to protect ath_wiphy data */
         struct ath_wiphy *pri_wiphy;
         struct ath_wiphy **sec_wiphy; /* secondary wiphys (virtual radios); may
@@ -564,7 +567,6 @@ struct ath_softc {
         u32 sc_flags; /* SC_OP_* */
         u16 curtxpow;
         u16 curaid;
-        u16 cachelsz;
         u8 nbcnvifs;
         u16 nvifs;
         u8 tx_chainmask;
diff --git a/drivers/net/wireless/ath/ath9k/eeprom.c b/drivers/net/wireless/ath/ath9k/eeprom.c
index 4cb64a0900bb..958948bc73fd 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom.c
@@ -16,9 +16,16 @@
 
 #include "ath9k.h"
 
-static void ath9k_hw_analog_shift_rmw(struct ath_hw *ah,
-                                      u32 reg, u32 mask,
-                                      u32 shift, u32 val)
+static inline u16 ath9k_hw_fbin2freq(u8 fbin, bool is2GHz)
+{
+        if (fbin == AR5416_BCHAN_UNUSED)
+                return fbin;
+
+        return (u16) ((is2GHz) ? (2300 + fbin) : (4800 + 5 * fbin));
+}
+
+void ath9k_hw_analog_shift_rmw(struct ath_hw *ah, u32 reg, u32 mask,
+                               u32 shift, u32 val)
 {
         u32 regVal;
 
@@ -33,19 +40,8 @@ static void ath9k_hw_analog_shift_rmw(struct ath_hw *ah,
         return;
 }
 
-static inline u16 ath9k_hw_fbin2freq(u8 fbin, bool is2GHz)
-{
-
-        if (fbin == AR5416_BCHAN_UNUSED)
-                return fbin;
-
-        return (u16) ((is2GHz) ? (2300 + fbin) : (4800 + 5 * fbin));
-}
-
-static inline int16_t ath9k_hw_interpolate(u16 target,
-                                           u16 srcLeft, u16 srcRight,
-                                           int16_t targetLeft,
-                                           int16_t targetRight)
+int16_t ath9k_hw_interpolate(u16 target, u16 srcLeft, u16 srcRight,
+                             int16_t targetLeft, int16_t targetRight)
 {
         int16_t rv;
 
@@ -59,9 +55,8 @@ static inline int16_t ath9k_hw_interpolate(u16 target,
         return rv;
 }
 
-static inline bool ath9k_hw_get_lower_upper_index(u8 target, u8 *pList,
-                                                  u16 listSize, u16 *indexL,
-                                                  u16 *indexR)
+bool ath9k_hw_get_lower_upper_index(u8 target, u8 *pList, u16 listSize,
+                                    u16 *indexL, u16 *indexR)
 {
         u16 i;
 
@@ -88,16 +83,16 @@ static inline bool ath9k_hw_get_lower_upper_index(u8 target, u8 *pList,
         return false;
 }
 
-static inline bool ath9k_hw_nvram_read(struct ath_hw *ah, u32 off, u16 *data)
+bool ath9k_hw_nvram_read(struct ath_hw *ah, u32 off, u16 *data)
 {
         struct ath_softc *sc = ah->ah_sc;
 
         return sc->bus_ops->eeprom_read(ah, off, data);
 }
 
-static inline bool ath9k_hw_fill_vpd_table(u8 pwrMin, u8 pwrMax, u8 *pPwrList,
-                                           u8 *pVpdList, u16 numIntercepts,
-                                           u8 *pRetVpdList)
+void ath9k_hw_fill_vpd_table(u8 pwrMin, u8 pwrMax, u8 *pPwrList,
+                             u8 *pVpdList, u16 numIntercepts,
+                             u8 *pRetVpdList)
 {
         u16 i, k;
         u8 currPwr = pwrMin;
@@ -120,16 +115,14 @@ static inline bool ath9k_hw_fill_vpd_table(u8 pwrMin, u8 pwrMax, u8 *pPwrList,
                 pRetVpdList[i] = (u8) k;
                 currPwr += 2;
         }
-
-        return true;
 }
 
-static void ath9k_hw_get_legacy_target_powers(struct ath_hw *ah,
-                                      struct ath9k_channel *chan,
-                                      struct cal_target_power_leg *powInfo,
-                                      u16 numChannels,
-                                      struct cal_target_power_leg *pNewPower,
-                                      u16 numRates, bool isExtTarget)
+void ath9k_hw_get_legacy_target_powers(struct ath_hw *ah,
+                                       struct ath9k_channel *chan,
+                                       struct cal_target_power_leg *powInfo,
+                                       u16 numChannels,
+                                       struct cal_target_power_leg *pNewPower,
+                                       u16 numRates, bool isExtTarget)
 {
         struct chan_centers centers;
         u16 clo, chi;
@@ -179,75 +172,12 @@ static void ath9k_hw_get_legacy_target_powers(struct ath_hw *ah,
         }
 }
 
-static void ath9k_get_txgain_index(struct ath_hw *ah,
-                struct ath9k_channel *chan,
-                struct calDataPerFreqOpLoop *rawDatasetOpLoop,
-                u8 *calChans,  u16 availPiers, u8 *pwr, u8 *pcdacIdx)
-{
-        u8 pcdac, i = 0;
-        u16 idxL = 0, idxR = 0, numPiers;
-        bool match;
-        struct chan_centers centers;
-
-        ath9k_hw_get_channel_centers(ah, chan, &centers);
-
-        for (numPiers = 0; numPiers < availPiers; numPiers++)
-                if (calChans[numPiers] == AR5416_BCHAN_UNUSED)
-                        break;
-
-        match = ath9k_hw_get_lower_upper_index(
-                        (u8)FREQ2FBIN(centers.synth_center, IS_CHAN_2GHZ(chan)),
-                        calChans, numPiers, &idxL, &idxR);
-        if (match) {
-                pcdac = rawDatasetOpLoop[idxL].pcdac[0][0];
-                *pwr = rawDatasetOpLoop[idxL].pwrPdg[0][0];
-        } else {
-                pcdac = rawDatasetOpLoop[idxR].pcdac[0][0];
-                *pwr = (rawDatasetOpLoop[idxL].pwrPdg[0][0] +
-                                rawDatasetOpLoop[idxR].pwrPdg[0][0])/2;
-        }
-
-        while (pcdac > ah->originalGain[i] &&
-                        i < (AR9280_TX_GAIN_TABLE_SIZE - 1))
-                i++;
-
-        *pcdacIdx = i;
-        return;
-}
-
-static void ath9k_olc_get_pdadcs(struct ath_hw *ah,
-                                u32 initTxGain,
-                                int txPower,
-                                u8 *pPDADCValues)
-{
-        u32 i;
-        u32 offset;
-
-        REG_RMW_FIELD(ah, AR_PHY_TX_PWRCTRL6_0,
-                        AR_PHY_TX_PWRCTRL_ERR_EST_MODE, 3);
-        REG_RMW_FIELD(ah, AR_PHY_TX_PWRCTRL6_1,
-                        AR_PHY_TX_PWRCTRL_ERR_EST_MODE, 3);
-
-        REG_RMW_FIELD(ah, AR_PHY_TX_PWRCTRL7,
-                        AR_PHY_TX_PWRCTRL_INIT_TX_GAIN, initTxGain);
-
-        offset = txPower;
-        for (i = 0; i < AR5416_NUM_PDADC_VALUES; i++)
-                if (i < offset)
-                        pPDADCValues[i] = 0x0;
-                else
-                        pPDADCValues[i] = 0xFF;
-}
-
-
-
-
-static void ath9k_hw_get_target_powers(struct ath_hw *ah,
-                                       struct ath9k_channel *chan,
-                                       struct cal_target_power_ht *powInfo,
-                                       u16 numChannels,
-                                       struct cal_target_power_ht *pNewPower,
-                                       u16 numRates, bool isHt40Target)
+void ath9k_hw_get_target_powers(struct ath_hw *ah,
+                                struct ath9k_channel *chan,
+                                struct cal_target_power_ht *powInfo,
+                                u16 numChannels,
+                                struct cal_target_power_ht *pNewPower,
+                                u16 numRates, bool isHt40Target)
 {
         struct chan_centers centers;
         u16 clo, chi;
@@ -297,9 +227,8 @@ static void ath9k_hw_get_target_powers(struct ath_hw *ah,
         }
 }
 
-static u16 ath9k_hw_get_max_edge_power(u16 freq,
-                                       struct cal_ctl_edges *pRdEdgesPower,
-                                       bool is2GHz, int num_band_edges)
+u16 ath9k_hw_get_max_edge_power(u16 freq, struct cal_ctl_edges *pRdEdgesPower,
+                                bool is2GHz, int num_band_edges)
 {
         u16 twiceMaxEdgePower = AR5416_MAX_RATE_POWER;
         int i;
@@ -325,3743 +254,10 @@ static u16 ath9k_hw_get_max_edge_power(u16 freq,
         return twiceMaxEdgePower;
 }
 
-/****************************************/
-/* EEPROM Operations for 4K sized cards */
-/****************************************/
-
-static int ath9k_hw_4k_get_eeprom_ver(struct ath_hw *ah)
-{
-        return ((ah->eeprom.map4k.baseEepHeader.version >> 12) & 0xF);
-}
-
-static int ath9k_hw_4k_get_eeprom_rev(struct ath_hw *ah)
-{
-        return ((ah->eeprom.map4k.baseEepHeader.version) & 0xFFF);
-}
-
-static bool ath9k_hw_4k_fill_eeprom(struct ath_hw *ah)
-{
-#define SIZE_EEPROM_4K (sizeof(struct ar5416_eeprom_4k) / sizeof(u16))
-        u16 *eep_data = (u16 *)&ah->eeprom.map4k;
-        int addr, eep_start_loc = 0;
-
-        eep_start_loc = 64;
-
-        if (!ath9k_hw_use_flash(ah)) {
-                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                        "Reading from EEPROM, not flash\n");
-        }
-
-        for (addr = 0; addr < SIZE_EEPROM_4K; addr++) {
-                if (!ath9k_hw_nvram_read(ah, addr + eep_start_loc, eep_data)) {
-                        DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                               "Unable to read eeprom region \n");
-                        return false;
-                }
-                eep_data++;
-        }
-
-        return true;
-#undef SIZE_EEPROM_4K
-}
-
-static int ath9k_hw_4k_check_eeprom(struct ath_hw *ah)
-{
-#define EEPROM_4K_SIZE (sizeof(struct ar5416_eeprom_4k) / sizeof(u16))
-        struct ar5416_eeprom_4k *eep =
-                (struct ar5416_eeprom_4k *) &ah->eeprom.map4k;
-        u16 *eepdata, temp, magic, magic2;
-        u32 sum = 0, el;
-        bool need_swap = false;
-        int i, addr;
-
-
-        if (!ath9k_hw_use_flash(ah)) {
-                if (!ath9k_hw_nvram_read(ah, AR5416_EEPROM_MAGIC_OFFSET,
-                                         &magic)) {
-                        DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
-                                "Reading Magic # failed\n");
-                        return false;
-                }
-
-                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                        "Read Magic = 0x%04X\n", magic);
-
-                if (magic != AR5416_EEPROM_MAGIC) {
-                        magic2 = swab16(magic);
-
-                        if (magic2 == AR5416_EEPROM_MAGIC) {
-                                need_swap = true;
-                                eepdata = (u16 *) (&ah->eeprom);
-
-                                for (addr = 0; addr < EEPROM_4K_SIZE; addr++) {
-                                        temp = swab16(*eepdata);
-                                        *eepdata = temp;
-                                        eepdata++;
-                                }
-                        } else {
-                                DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
-                                        "Invalid EEPROM Magic. "
-                                        "endianness mismatch.\n");
-                                return -EINVAL;
-                        }
-                }
-        }
-
-        DPRINTF(ah->ah_sc, ATH_DBG_EEPROM, "need_swap = %s.\n",
-                need_swap ? "True" : "False");
-
-        if (need_swap)
-                el = swab16(ah->eeprom.map4k.baseEepHeader.length);
-        else
-                el = ah->eeprom.map4k.baseEepHeader.length;
-
-        if (el > sizeof(struct ar5416_eeprom_4k))
-                el = sizeof(struct ar5416_eeprom_4k) / sizeof(u16);
-        else
-                el = el / sizeof(u16);
-
-        eepdata = (u16 *)(&ah->eeprom);
-
-        for (i = 0; i < el; i++)
-                sum ^= *eepdata++;
-
-        if (need_swap) {
-                u32 integer;
-                u16 word;
-
-                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                        "EEPROM Endianness is not native.. Changing\n");
-
-                word = swab16(eep->baseEepHeader.length);
-                eep->baseEepHeader.length = word;
-
-                word = swab16(eep->baseEepHeader.checksum);
-                eep->baseEepHeader.checksum = word;
-
-                word = swab16(eep->baseEepHeader.version);
-                eep->baseEepHeader.version = word;
-
-                word = swab16(eep->baseEepHeader.regDmn[0]);
-                eep->baseEepHeader.regDmn[0] = word;
-
-                word = swab16(eep->baseEepHeader.regDmn[1]);
-                eep->baseEepHeader.regDmn[1] = word;
-
-                word = swab16(eep->baseEepHeader.rfSilent);
-                eep->baseEepHeader.rfSilent = word;
-
-                word = swab16(eep->baseEepHeader.blueToothOptions);
-                eep->baseEepHeader.blueToothOptions = word;
-
-                word = swab16(eep->baseEepHeader.deviceCap);
-                eep->baseEepHeader.deviceCap = word;
-
-                integer = swab32(eep->modalHeader.antCtrlCommon);
-                eep->modalHeader.antCtrlCommon = integer;
-
-                for (i = 0; i < AR5416_EEP4K_MAX_CHAINS; i++) {
-                        integer = swab32(eep->modalHeader.antCtrlChain[i]);
-                        eep->modalHeader.antCtrlChain[i] = integer;
-                }
-
-                for (i = 0; i < AR5416_EEPROM_MODAL_SPURS; i++) {
-                        word = swab16(eep->modalHeader.spurChans[i].spurChan);
-                        eep->modalHeader.spurChans[i].spurChan = word;
-                }
-        }
-
-        if (sum != 0xffff || ah->eep_ops->get_eeprom_ver(ah) != AR5416_EEP_VER ||
-            ah->eep_ops->get_eeprom_rev(ah) < AR5416_EEP_NO_BACK_VER) {
-                DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
-                        "Bad EEPROM checksum 0x%x or revision 0x%04x\n",
-                        sum, ah->eep_ops->get_eeprom_ver(ah));
-                return -EINVAL;
-        }
-
-        return 0;
-#undef EEPROM_4K_SIZE
-}
-
-static u32 ath9k_hw_4k_get_eeprom(struct ath_hw *ah,
-                                  enum eeprom_param param)
-{
-        struct ar5416_eeprom_4k *eep = &ah->eeprom.map4k;
-        struct modal_eep_4k_header *pModal = &eep->modalHeader;
-        struct base_eep_header_4k *pBase = &eep->baseEepHeader;
-
-        switch (param) {
-        case EEP_NFTHRESH_2:
-                return pModal->noiseFloorThreshCh[0];
-        case AR_EEPROM_MAC(0):
-                return pBase->macAddr[0] << 8 | pBase->macAddr[1];
-        case AR_EEPROM_MAC(1):
-                return pBase->macAddr[2] << 8 | pBase->macAddr[3];
-        case AR_EEPROM_MAC(2):
-                return pBase->macAddr[4] << 8 | pBase->macAddr[5];
-        case EEP_REG_0:
-                return pBase->regDmn[0];
-        case EEP_REG_1:
-                return pBase->regDmn[1];
-        case EEP_OP_CAP:
-                return pBase->deviceCap;
-        case EEP_OP_MODE:
-                return pBase->opCapFlags;
-        case EEP_RF_SILENT:
-                return pBase->rfSilent;
-        case EEP_OB_2:
-                return pModal->ob_01;
-        case EEP_DB_2:
-                return pModal->db1_01;
-        case EEP_MINOR_REV:
-                return pBase->version & AR5416_EEP_VER_MINOR_MASK;
-        case EEP_TX_MASK:
-                return pBase->txMask;
-        case EEP_RX_MASK:
-                return pBase->rxMask;
-        case EEP_FRAC_N_5G:
-                return 0;
-        default:
-                return 0;
-        }
-}
-
-static void ath9k_hw_get_4k_gain_boundaries_pdadcs(struct ath_hw *ah,
-                                struct ath9k_channel *chan,
-                                struct cal_data_per_freq_4k *pRawDataSet,
-                                u8 *bChans, u16 availPiers,
-                                u16 tPdGainOverlap, int16_t *pMinCalPower,
-                                u16 *pPdGainBoundaries, u8 *pPDADCValues,
-                                u16 numXpdGains)
-{
-#define TMP_VAL_VPD_TABLE \
-        ((vpdTableI[i][sizeCurrVpdTable - 1] + (ss - maxIndex + 1) * vpdStep));
-        int i, j, k;
-        int16_t ss;
-        u16 idxL = 0, idxR = 0, numPiers;
-        static u8 vpdTableL[AR5416_EEP4K_NUM_PD_GAINS]
-                [AR5416_MAX_PWR_RANGE_IN_HALF_DB];
-        static u8 vpdTableR[AR5416_EEP4K_NUM_PD_GAINS]
-                [AR5416_MAX_PWR_RANGE_IN_HALF_DB];
-        static u8 vpdTableI[AR5416_EEP4K_NUM_PD_GAINS]
-                [AR5416_MAX_PWR_RANGE_IN_HALF_DB];
-
-        u8 *pVpdL, *pVpdR, *pPwrL, *pPwrR;
-        u8 minPwrT4[AR5416_EEP4K_NUM_PD_GAINS];
-        u8 maxPwrT4[AR5416_EEP4K_NUM_PD_GAINS];
-        int16_t vpdStep;
-        int16_t tmpVal;
-        u16 sizeCurrVpdTable, maxIndex, tgtIndex;
-        bool match;
-        int16_t minDelta = 0;
-        struct chan_centers centers;
-#define PD_GAIN_BOUNDARY_DEFAULT 58;
-
-        ath9k_hw_get_channel_centers(ah, chan, &centers);
-
-        for (numPiers = 0; numPiers < availPiers; numPiers++) {
-                if (bChans[numPiers] == AR5416_BCHAN_UNUSED)
-                        break;
-        }
-
-        match = ath9k_hw_get_lower_upper_index(
-                                        (u8)FREQ2FBIN(centers.synth_center,
-                                        IS_CHAN_2GHZ(chan)), bChans, numPiers,
-                                        &idxL, &idxR);
-
-        if (match) {
-                for (i = 0; i < numXpdGains; i++) {
-                        minPwrT4[i] = pRawDataSet[idxL].pwrPdg[i][0];
-                        maxPwrT4[i] = pRawDataSet[idxL].pwrPdg[i][4];
-                        ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
-                                        pRawDataSet[idxL].pwrPdg[i],
-                                        pRawDataSet[idxL].vpdPdg[i],
-                                        AR5416_EEP4K_PD_GAIN_ICEPTS,
-                                        vpdTableI[i]);
-                }
-        } else {
-                for (i = 0; i < numXpdGains; i++) {
-                        pVpdL = pRawDataSet[idxL].vpdPdg[i];
-                        pPwrL = pRawDataSet[idxL].pwrPdg[i];
-                        pVpdR = pRawDataSet[idxR].vpdPdg[i];
-                        pPwrR = pRawDataSet[idxR].pwrPdg[i];
-
-                        minPwrT4[i] = max(pPwrL[0], pPwrR[0]);
-
-                        maxPwrT4[i] =
-                                min(pPwrL[AR5416_EEP4K_PD_GAIN_ICEPTS - 1],
-                                    pPwrR[AR5416_EEP4K_PD_GAIN_ICEPTS - 1]);
-
-
-                        ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
-                                                pPwrL, pVpdL,
-                                                AR5416_EEP4K_PD_GAIN_ICEPTS,
-                                                vpdTableL[i]);
-                        ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
-                                                pPwrR, pVpdR,
-                                                AR5416_EEP4K_PD_GAIN_ICEPTS,
-                                                vpdTableR[i]);
-
-                        for (j = 0; j <= (maxPwrT4[i] - minPwrT4[i]) / 2; j++) {
-                                vpdTableI[i][j] =
-                                        (u8)(ath9k_hw_interpolate((u16)
-                                             FREQ2FBIN(centers.
-                                                       synth_center,
-                                                       IS_CHAN_2GHZ
-                                                       (chan)),
-                                             bChans[idxL], bChans[idxR],
-                                             vpdTableL[i][j], vpdTableR[i][j]));
-                        }
-                }
-        }
-
-        *pMinCalPower = (int16_t)(minPwrT4[0] / 2);
-
-        k = 0;
-
-        for (i = 0; i < numXpdGains; i++) {
-                if (i == (numXpdGains - 1))
-                        pPdGainBoundaries[i] =
-                                (u16)(maxPwrT4[i] / 2);
-                else
-                        pPdGainBoundaries[i] =
-                                (u16)((maxPwrT4[i] + minPwrT4[i + 1]) / 4);
-
-                pPdGainBoundaries[i] =
-                        min((u16)AR5416_MAX_RATE_POWER, pPdGainBoundaries[i]);
-
-                if ((i == 0) && !AR_SREV_5416_20_OR_LATER(ah)) {
-                        minDelta = pPdGainBoundaries[0] - 23;
-                        pPdGainBoundaries[0] = 23;
-                } else {
-                        minDelta = 0;
-                }
-
-                if (i == 0) {
-                        if (AR_SREV_9280_10_OR_LATER(ah))
-                                ss = (int16_t)(0 - (minPwrT4[i] / 2));
-                        else
-                                ss = 0;
-                } else {
-                        ss = (int16_t)((pPdGainBoundaries[i - 1] -
-                                        (minPwrT4[i] / 2)) -
-                                       tPdGainOverlap + 1 + minDelta);
-                }
-                vpdStep = (int16_t)(vpdTableI[i][1] - vpdTableI[i][0]);
-                vpdStep = (int16_t)((vpdStep < 1) ? 1 : vpdStep);
-
-                while ((ss < 0) && (k < (AR5416_NUM_PDADC_VALUES - 1))) {
-                        tmpVal = (int16_t)(vpdTableI[i][0] + ss * vpdStep);
-                        pPDADCValues[k++] = (u8)((tmpVal < 0) ? 0 : tmpVal);
-                        ss++;
-                }
-
-                sizeCurrVpdTable = (u8) ((maxPwrT4[i] - minPwrT4[i]) / 2 + 1);
-                tgtIndex = (u8)(pPdGainBoundaries[i] + tPdGainOverlap -
-                                (minPwrT4[i] / 2));
-                maxIndex = (tgtIndex < sizeCurrVpdTable) ?
-                        tgtIndex : sizeCurrVpdTable;
-
-                while ((ss < maxIndex) && (k < (AR5416_NUM_PDADC_VALUES - 1)))
-                        pPDADCValues[k++] = vpdTableI[i][ss++];
-
-                vpdStep = (int16_t)(vpdTableI[i][sizeCurrVpdTable - 1] -
-                                    vpdTableI[i][sizeCurrVpdTable - 2]);
-                vpdStep = (int16_t)((vpdStep < 1) ? 1 : vpdStep);
-
-                if (tgtIndex >= maxIndex) {
-                        while ((ss <= tgtIndex) &&
-                               (k < (AR5416_NUM_PDADC_VALUES - 1))) {
-                                tmpVal = (int16_t) TMP_VAL_VPD_TABLE;
-                                pPDADCValues[k++] = (u8)((tmpVal > 255) ?
-                                                         255 : tmpVal);
-                                ss++;
-                        }
-                }
-        }
-
-        while (i < AR5416_EEP4K_PD_GAINS_IN_MASK) {
-                pPdGainBoundaries[i] = PD_GAIN_BOUNDARY_DEFAULT;
-                i++;
-        }
-
-        while (k < AR5416_NUM_PDADC_VALUES) {
-                pPDADCValues[k] = pPDADCValues[k - 1];
-                k++;
-        }
-
-        return;
-#undef TMP_VAL_VPD_TABLE
-}
-
-static void ath9k_hw_set_4k_power_cal_table(struct ath_hw *ah,
-                                  struct ath9k_channel *chan,
-                                  int16_t *pTxPowerIndexOffset)
-{
-        struct ar5416_eeprom_4k *pEepData = &ah->eeprom.map4k;
-        struct cal_data_per_freq_4k *pRawDataset;
-        u8 *pCalBChans = NULL;
-        u16 pdGainOverlap_t2;
-        static u8 pdadcValues[AR5416_NUM_PDADC_VALUES];
-        u16 gainBoundaries[AR5416_EEP4K_PD_GAINS_IN_MASK];
-        u16 numPiers, i, j;
-        int16_t tMinCalPower;
-        u16 numXpdGain, xpdMask;
-        u16 xpdGainValues[AR5416_EEP4K_NUM_PD_GAINS] = { 0, 0 };
-        u32 reg32, regOffset, regChainOffset;
-
-        xpdMask = pEepData->modalHeader.xpdGain;
-
-        if ((pEepData->baseEepHeader.version & AR5416_EEP_VER_MINOR_MASK) >=
-            AR5416_EEP_MINOR_VER_2) {
-                pdGainOverlap_t2 =
-                        pEepData->modalHeader.pdGainOverlap;
-        } else {
-                pdGainOverlap_t2 = (u16)(MS(REG_READ(ah, AR_PHY_TPCRG5),
-                                            AR_PHY_TPCRG5_PD_GAIN_OVERLAP));
-        }
-
-        pCalBChans = pEepData->calFreqPier2G;
-        numPiers = AR5416_EEP4K_NUM_2G_CAL_PIERS;
-
-        numXpdGain = 0;
-
-        for (i = 1; i <= AR5416_EEP4K_PD_GAINS_IN_MASK; i++) {
-                if ((xpdMask >> (AR5416_EEP4K_PD_GAINS_IN_MASK - i)) & 1) {
-                        if (numXpdGain >= AR5416_EEP4K_NUM_PD_GAINS)
-                                break;
-                        xpdGainValues[numXpdGain] =
-                                (u16)(AR5416_EEP4K_PD_GAINS_IN_MASK - i);
-                        numXpdGain++;
-                }
-        }
-
-        REG_RMW_FIELD(ah, AR_PHY_TPCRG1, AR_PHY_TPCRG1_NUM_PD_GAIN,
-                      (numXpdGain - 1) & 0x3);
-        REG_RMW_FIELD(ah, AR_PHY_TPCRG1, AR_PHY_TPCRG1_PD_GAIN_1,
-                      xpdGainValues[0]);
-        REG_RMW_FIELD(ah, AR_PHY_TPCRG1, AR_PHY_TPCRG1_PD_GAIN_2,
-                      xpdGainValues[1]);
-        REG_RMW_FIELD(ah, AR_PHY_TPCRG1, AR_PHY_TPCRG1_PD_GAIN_3, 0);
-
-        for (i = 0; i < AR5416_EEP4K_MAX_CHAINS; i++) {
-                if (AR_SREV_5416_20_OR_LATER(ah) &&
-                    (ah->rxchainmask == 5 || ah->txchainmask == 5) &&
-                    (i != 0)) {
-                        regChainOffset = (i == 1) ? 0x2000 : 0x1000;
-                } else
-                        regChainOffset = i * 0x1000;
-
-                if (pEepData->baseEepHeader.txMask & (1 << i)) {
-                        pRawDataset = pEepData->calPierData2G[i];
-
-                        ath9k_hw_get_4k_gain_boundaries_pdadcs(ah, chan,
-                                            pRawDataset, pCalBChans,
-                                            numPiers, pdGainOverlap_t2,
-                                            &tMinCalPower, gainBoundaries,
-                                            pdadcValues, numXpdGain);
-
-                        if ((i == 0) || AR_SREV_5416_20_OR_LATER(ah)) {
-                                REG_WRITE(ah, AR_PHY_TPCRG5 + regChainOffset,
-                                          SM(pdGainOverlap_t2,
-                                             AR_PHY_TPCRG5_PD_GAIN_OVERLAP)
-                                          | SM(gainBoundaries[0],
-                                               AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_1)
-                                          | SM(gainBoundaries[1],
-                                               AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_2)
-                                          | SM(gainBoundaries[2],
-                                               AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_3)
-                                          | SM(gainBoundaries[3],
-                                       AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_4));
-                        }
-
-                        regOffset = AR_PHY_BASE + (672 << 2) + regChainOffset;
-                        for (j = 0; j < 32; j++) {
-                                reg32 = ((pdadcValues[4 * j + 0] & 0xFF) << 0) |
-                                        ((pdadcValues[4 * j + 1] & 0xFF) << 8) |
-                                        ((pdadcValues[4 * j + 2] & 0xFF) << 16)|
-                                        ((pdadcValues[4 * j + 3] & 0xFF) << 24);
-                                REG_WRITE(ah, regOffset, reg32);
-
-                                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                                        "PDADC (%d,%4x): %4.4x %8.8x\n",
-                                        i, regChainOffset, regOffset,
-                                        reg32);
-                                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                                        "PDADC: Chain %d | "
-                                        "PDADC %3d Value %3d | "
-                                        "PDADC %3d Value %3d | "
-                                        "PDADC %3d Value %3d | "
-                                        "PDADC %3d Value %3d |\n",
-                                        i, 4 * j, pdadcValues[4 * j],
-                                        4 * j + 1, pdadcValues[4 * j + 1],
-                                        4 * j + 2, pdadcValues[4 * j + 2],
-                                        4 * j + 3,
-                                        pdadcValues[4 * j + 3]);
-
-                                regOffset += 4;
-                        }
-                }
-        }
-
-        *pTxPowerIndexOffset = 0;
-}
-
-static void ath9k_hw_set_4k_power_per_rate_table(struct ath_hw *ah,
-                                                 struct ath9k_channel *chan,
-                                                 int16_t *ratesArray,
-                                                 u16 cfgCtl,
-                                                 u16 AntennaReduction,
-                                                 u16 twiceMaxRegulatoryPower,
-                                                 u16 powerLimit)
-{
-        struct ar5416_eeprom_4k *pEepData = &ah->eeprom.map4k;
-        u16 twiceMaxEdgePower = AR5416_MAX_RATE_POWER;
-        static const u16 tpScaleReductionTable[5] =
-                { 0, 3, 6, 9, AR5416_MAX_RATE_POWER };
-
-        int i;
-        int16_t twiceLargestAntenna;
-        struct cal_ctl_data_4k *rep;
-        struct cal_target_power_leg targetPowerOfdm, targetPowerCck = {
-                0, { 0, 0, 0, 0}
-        };
-        struct cal_target_power_leg targetPowerOfdmExt = {
-                0, { 0, 0, 0, 0} }, targetPowerCckExt = {
-                0, { 0, 0, 0, 0 }
-        };
-        struct cal_target_power_ht targetPowerHt20, targetPowerHt40 = {
-                0, {0, 0, 0, 0}
-        };
-        u16 scaledPower = 0, minCtlPower, maxRegAllowedPower;
-        u16 ctlModesFor11g[] =
-                { CTL_11B, CTL_11G, CTL_2GHT20, CTL_11B_EXT, CTL_11G_EXT,
-                  CTL_2GHT40
-                };
-        u16 numCtlModes, *pCtlMode, ctlMode, freq;
-        struct chan_centers centers;
-        int tx_chainmask;
-        u16 twiceMinEdgePower;
-
-        tx_chainmask = ah->txchainmask;
-
-        ath9k_hw_get_channel_centers(ah, chan, &centers);
-
-        twiceLargestAntenna = pEepData->modalHeader.antennaGainCh[0];
-
-        twiceLargestAntenna = (int16_t)min(AntennaReduction -
-                                           twiceLargestAntenna, 0);
-
-        maxRegAllowedPower = twiceMaxRegulatoryPower + twiceLargestAntenna;
-
-        if (ah->regulatory.tp_scale != ATH9K_TP_SCALE_MAX) {
-                maxRegAllowedPower -=
-                        (tpScaleReductionTable[(ah->regulatory.tp_scale)] * 2);
-        }
-
-        scaledPower = min(powerLimit, maxRegAllowedPower);
-        scaledPower = max((u16)0, scaledPower);
-
-        numCtlModes = ARRAY_SIZE(ctlModesFor11g) - SUB_NUM_CTL_MODES_AT_2G_40;
-        pCtlMode = ctlModesFor11g;
-
-        ath9k_hw_get_legacy_target_powers(ah, chan,
-                        pEepData->calTargetPowerCck,
-                        AR5416_NUM_2G_CCK_TARGET_POWERS,
-                        &targetPowerCck, 4, false);
-        ath9k_hw_get_legacy_target_powers(ah, chan,
-                        pEepData->calTargetPower2G,
-                        AR5416_NUM_2G_20_TARGET_POWERS,
-                        &targetPowerOfdm, 4, false);
-        ath9k_hw_get_target_powers(ah, chan,
-                        pEepData->calTargetPower2GHT20,
-                        AR5416_NUM_2G_20_TARGET_POWERS,
-                        &targetPowerHt20, 8, false);
-
-        if (IS_CHAN_HT40(chan)) {
-                numCtlModes = ARRAY_SIZE(ctlModesFor11g);
-                ath9k_hw_get_target_powers(ah, chan,
-                                pEepData->calTargetPower2GHT40,
-                                AR5416_NUM_2G_40_TARGET_POWERS,
-                                &targetPowerHt40, 8, true);
-                ath9k_hw_get_legacy_target_powers(ah, chan,
-                                pEepData->calTargetPowerCck,
-                                AR5416_NUM_2G_CCK_TARGET_POWERS,
-                                &targetPowerCckExt, 4, true);
-                ath9k_hw_get_legacy_target_powers(ah, chan,
-                                pEepData->calTargetPower2G,
-                                AR5416_NUM_2G_20_TARGET_POWERS,
-                                &targetPowerOfdmExt, 4, true);
-        }
-
-        for (ctlMode = 0; ctlMode < numCtlModes; ctlMode++) {
-                bool isHt40CtlMode = (pCtlMode[ctlMode] == CTL_5GHT40) ||
-                        (pCtlMode[ctlMode] == CTL_2GHT40);
-                if (isHt40CtlMode)
-                        freq = centers.synth_center;
-                else if (pCtlMode[ctlMode] & EXT_ADDITIVE)
-                        freq = centers.ext_center;
-                else
-                        freq = centers.ctl_center;
-
-                if (ah->eep_ops->get_eeprom_ver(ah) == 14 &&
-                    ah->eep_ops->get_eeprom_rev(ah) <= 2)
-                        twiceMaxEdgePower = AR5416_MAX_RATE_POWER;
-
-                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                        "LOOP-Mode ctlMode %d < %d, isHt40CtlMode %d, "
-                        "EXT_ADDITIVE %d\n",
-                        ctlMode, numCtlModes, isHt40CtlMode,
-                        (pCtlMode[ctlMode] & EXT_ADDITIVE));
-
-                for (i = 0; (i < AR5416_EEP4K_NUM_CTLS) &&
-                                pEepData->ctlIndex[i]; i++) {
-                        DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                                "  LOOP-Ctlidx %d: cfgCtl 0x%2.2x "
-                                "pCtlMode 0x%2.2x ctlIndex 0x%2.2x "
-                                "chan %d\n",
-                                i, cfgCtl, pCtlMode[ctlMode],
-                                pEepData->ctlIndex[i], chan->channel);
-
-                        if ((((cfgCtl & ~CTL_MODE_M) |
-                              (pCtlMode[ctlMode] & CTL_MODE_M)) ==
-                             pEepData->ctlIndex[i]) ||
-                            (((cfgCtl & ~CTL_MODE_M) |
-                              (pCtlMode[ctlMode] & CTL_MODE_M)) ==
-                             ((pEepData->ctlIndex[i] & CTL_MODE_M) |
-                              SD_NO_CTL))) {
-                                rep = &(pEepData->ctlData[i]);
-
-                                twiceMinEdgePower =
-                                        ath9k_hw_get_max_edge_power(freq,
-                                rep->ctlEdges[ar5416_get_ntxchains
-                                                (tx_chainmask) - 1],
-                                IS_CHAN_2GHZ(chan),
-                                AR5416_EEP4K_NUM_BAND_EDGES);
-
-                                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                                        "    MATCH-EE_IDX %d: ch %d is2 %d "
-                                        "2xMinEdge %d chainmask %d chains %d\n",
-                                        i, freq, IS_CHAN_2GHZ(chan),
-                                        twiceMinEdgePower, tx_chainmask,
-                                        ar5416_get_ntxchains
-                                        (tx_chainmask));
-                                if ((cfgCtl & ~CTL_MODE_M) == SD_NO_CTL) {
-                                        twiceMaxEdgePower =
-                                                min(twiceMaxEdgePower,
-                                                    twiceMinEdgePower);
-                                } else {
-                                        twiceMaxEdgePower = twiceMinEdgePower;
-                                        break;
-                                }
-                        }
-                }
-
-                minCtlPower = (u8)min(twiceMaxEdgePower, scaledPower);
-
-                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                        "    SEL-Min ctlMode %d pCtlMode %d "
-                        "2xMaxEdge %d sP %d minCtlPwr %d\n",
-                        ctlMode, pCtlMode[ctlMode], twiceMaxEdgePower,
-                        scaledPower, minCtlPower);
-
-                switch (pCtlMode[ctlMode]) {
-                case CTL_11B:
-                        for (i = 0; i < ARRAY_SIZE(targetPowerCck.tPow2x);
-                                        i++) {
-                                targetPowerCck.tPow2x[i] =
-                                        min((u16)targetPowerCck.tPow2x[i],
-                                            minCtlPower);
-                        }
-                        break;
-                case CTL_11G:
-                        for (i = 0; i < ARRAY_SIZE(targetPowerOfdm.tPow2x);
-                                        i++) {
-                                targetPowerOfdm.tPow2x[i] =
-                                        min((u16)targetPowerOfdm.tPow2x[i],
-                                            minCtlPower);
-                        }
-                        break;
-                case CTL_2GHT20:
-                        for (i = 0; i < ARRAY_SIZE(targetPowerHt20.tPow2x);
-                                        i++) {
-                                targetPowerHt20.tPow2x[i] =
-                                        min((u16)targetPowerHt20.tPow2x[i],
-                                            minCtlPower);
-                        }
-                        break;
-                case CTL_11B_EXT:
-                        targetPowerCckExt.tPow2x[0] = min((u16)
-                                        targetPowerCckExt.tPow2x[0],
-                                        minCtlPower);
-                        break;
-                case CTL_11G_EXT:
-                        targetPowerOfdmExt.tPow2x[0] = min((u16)
-                                        targetPowerOfdmExt.tPow2x[0],
-                                        minCtlPower);
-                        break;
-                case CTL_2GHT40:
-                        for (i = 0; i < ARRAY_SIZE(targetPowerHt40.tPow2x);
-                                        i++) {
-                                targetPowerHt40.tPow2x[i] =
-                                        min((u16)targetPowerHt40.tPow2x[i],
-                                            minCtlPower);
-                        }
-                        break;
-                default:
-                        break;
-                }
-        }
-
-        ratesArray[rate6mb] = ratesArray[rate9mb] = ratesArray[rate12mb] =
-                ratesArray[rate18mb] = ratesArray[rate24mb] =
-                targetPowerOfdm.tPow2x[0];
-        ratesArray[rate36mb] = targetPowerOfdm.tPow2x[1];
-        ratesArray[rate48mb] = targetPowerOfdm.tPow2x[2];
-        ratesArray[rate54mb] = targetPowerOfdm.tPow2x[3];
-        ratesArray[rateXr] = targetPowerOfdm.tPow2x[0];
-
-        for (i = 0; i < ARRAY_SIZE(targetPowerHt20.tPow2x); i++)
-                ratesArray[rateHt20_0 + i] = targetPowerHt20.tPow2x[i];
-
-        ratesArray[rate1l] = targetPowerCck.tPow2x[0];
-        ratesArray[rate2s] = ratesArray[rate2l] = targetPowerCck.tPow2x[1];
-        ratesArray[rate5_5s] = ratesArray[rate5_5l] = targetPowerCck.tPow2x[2];
-        ratesArray[rate11s] = ratesArray[rate11l] = targetPowerCck.tPow2x[3];
-
-        if (IS_CHAN_HT40(chan)) {
-                for (i = 0; i < ARRAY_SIZE(targetPowerHt40.tPow2x); i++) {
-                        ratesArray[rateHt40_0 + i] =
-                                targetPowerHt40.tPow2x[i];
-                }
-                ratesArray[rateDupOfdm] = targetPowerHt40.tPow2x[0];
-                ratesArray[rateDupCck] = targetPowerHt40.tPow2x[0];
-                ratesArray[rateExtOfdm] = targetPowerOfdmExt.tPow2x[0];
-                ratesArray[rateExtCck] = targetPowerCckExt.tPow2x[0];
-        }
-}
-
-static void ath9k_hw_4k_set_txpower(struct ath_hw *ah,
-                                   struct ath9k_channel *chan,
-                                   u16 cfgCtl,
-                                   u8 twiceAntennaReduction,
-                                   u8 twiceMaxRegulatoryPower,
-                                   u8 powerLimit)
-{
-        struct ar5416_eeprom_4k *pEepData = &ah->eeprom.map4k;
-        struct modal_eep_4k_header *pModal = &pEepData->modalHeader;
-        int16_t ratesArray[Ar5416RateSize];
-        int16_t txPowerIndexOffset = 0;
-        u8 ht40PowerIncForPdadc = 2;
-        int i;
-
-        memset(ratesArray, 0, sizeof(ratesArray));
-
-        if ((pEepData->baseEepHeader.version & AR5416_EEP_VER_MINOR_MASK) >=
-            AR5416_EEP_MINOR_VER_2) {
-                ht40PowerIncForPdadc = pModal->ht40PowerIncForPdadc;
-        }
-
-        ath9k_hw_set_4k_power_per_rate_table(ah, chan,
-                                               &ratesArray[0], cfgCtl,
-                                               twiceAntennaReduction,
-                                               twiceMaxRegulatoryPower,
-                                               powerLimit);
-
-        ath9k_hw_set_4k_power_cal_table(ah, chan, &txPowerIndexOffset);
-
-        for (i = 0; i < ARRAY_SIZE(ratesArray); i++) {
-                ratesArray[i] = (int16_t)(txPowerIndexOffset + ratesArray[i]);
-                if (ratesArray[i] > AR5416_MAX_RATE_POWER)
-                        ratesArray[i] = AR5416_MAX_RATE_POWER;
-        }
-
-        if (AR_SREV_9280_10_OR_LATER(ah)) {
-                for (i = 0; i < Ar5416RateSize; i++)
-                        ratesArray[i] -= AR5416_PWR_TABLE_OFFSET * 2;
-        }
-
-        REG_WRITE(ah, AR_PHY_POWER_TX_RATE1,
-                  ATH9K_POW_SM(ratesArray[rate18mb], 24)
-                  | ATH9K_POW_SM(ratesArray[rate12mb], 16)
-                  | ATH9K_POW_SM(ratesArray[rate9mb], 8)
-                  | ATH9K_POW_SM(ratesArray[rate6mb], 0));
-        REG_WRITE(ah, AR_PHY_POWER_TX_RATE2,
-                  ATH9K_POW_SM(ratesArray[rate54mb], 24)
-                  | ATH9K_POW_SM(ratesArray[rate48mb], 16)
-                  | ATH9K_POW_SM(ratesArray[rate36mb], 8)
-                  | ATH9K_POW_SM(ratesArray[rate24mb], 0));
-
-        if (IS_CHAN_2GHZ(chan)) {
-                REG_WRITE(ah, AR_PHY_POWER_TX_RATE3,
-                          ATH9K_POW_SM(ratesArray[rate2s], 24)
-                          | ATH9K_POW_SM(ratesArray[rate2l], 16)
-                          | ATH9K_POW_SM(ratesArray[rateXr], 8)
-                          | ATH9K_POW_SM(ratesArray[rate1l], 0));
-                REG_WRITE(ah, AR_PHY_POWER_TX_RATE4,
-                          ATH9K_POW_SM(ratesArray[rate11s], 24)
-                          | ATH9K_POW_SM(ratesArray[rate11l], 16)
-                          | ATH9K_POW_SM(ratesArray[rate5_5s], 8)
-                          | ATH9K_POW_SM(ratesArray[rate5_5l], 0));
-        }
-
-        REG_WRITE(ah, AR_PHY_POWER_TX_RATE5,
-                  ATH9K_POW_SM(ratesArray[rateHt20_3], 24)
-                  | ATH9K_POW_SM(ratesArray[rateHt20_2], 16)
-                  | ATH9K_POW_SM(ratesArray[rateHt20_1], 8)
-                  | ATH9K_POW_SM(ratesArray[rateHt20_0], 0));
-        REG_WRITE(ah, AR_PHY_POWER_TX_RATE6,
-                  ATH9K_POW_SM(ratesArray[rateHt20_7], 24)
-                  | ATH9K_POW_SM(ratesArray[rateHt20_6], 16)
-                  | ATH9K_POW_SM(ratesArray[rateHt20_5], 8)
-                  | ATH9K_POW_SM(ratesArray[rateHt20_4], 0));
-
-        if (IS_CHAN_HT40(chan)) {
-                REG_WRITE(ah, AR_PHY_POWER_TX_RATE7,
-                          ATH9K_POW_SM(ratesArray[rateHt40_3] +
-                                       ht40PowerIncForPdadc, 24)
-                          | ATH9K_POW_SM(ratesArray[rateHt40_2] +
-                                         ht40PowerIncForPdadc, 16)
-                          | ATH9K_POW_SM(ratesArray[rateHt40_1] +
-                                         ht40PowerIncForPdadc, 8)
-                          | ATH9K_POW_SM(ratesArray[rateHt40_0] +
-                                         ht40PowerIncForPdadc, 0));
-                REG_WRITE(ah, AR_PHY_POWER_TX_RATE8,
-                          ATH9K_POW_SM(ratesArray[rateHt40_7] +
-                                       ht40PowerIncForPdadc, 24)
-                          | ATH9K_POW_SM(ratesArray[rateHt40_6] +
-                                         ht40PowerIncForPdadc, 16)
-                          | ATH9K_POW_SM(ratesArray[rateHt40_5] +
-                                         ht40PowerIncForPdadc, 8)
-                          | ATH9K_POW_SM(ratesArray[rateHt40_4] +
-                                         ht40PowerIncForPdadc, 0));
-
-                REG_WRITE(ah, AR_PHY_POWER_TX_RATE9,
-                          ATH9K_POW_SM(ratesArray[rateExtOfdm], 24)
-                          | ATH9K_POW_SM(ratesArray[rateExtCck], 16)
-                          | ATH9K_POW_SM(ratesArray[rateDupOfdm], 8)
-                          | ATH9K_POW_SM(ratesArray[rateDupCck], 0));
-        }
-
-        i = rate6mb;
-
-        if (IS_CHAN_HT40(chan))
-                i = rateHt40_0;
-        else if (IS_CHAN_HT20(chan))
-                i = rateHt20_0;
-
-        if (AR_SREV_9280_10_OR_LATER(ah))
-                ah->regulatory.max_power_level =
-                        ratesArray[i] + AR5416_PWR_TABLE_OFFSET * 2;
-        else
-                ah->regulatory.max_power_level = ratesArray[i];
-
-}
-
-static void ath9k_hw_4k_set_addac(struct ath_hw *ah,
-                                  struct ath9k_channel *chan)
-{
-        struct modal_eep_4k_header *pModal;
-        struct ar5416_eeprom_4k *eep = &ah->eeprom.map4k;
-        u8 biaslevel;
-
-        if (ah->hw_version.macVersion != AR_SREV_VERSION_9160)
-                return;
-
-        if (ah->eep_ops->get_eeprom_rev(ah) < AR5416_EEP_MINOR_VER_7)
-                return;
-
-        pModal = &eep->modalHeader;
-
-        if (pModal->xpaBiasLvl != 0xff) {
-                biaslevel = pModal->xpaBiasLvl;
-                INI_RA(&ah->iniAddac, 7, 1) =
-                  (INI_RA(&ah->iniAddac, 7, 1) & (~0x18)) | biaslevel << 3;
-        }
-}
-
-static void ath9k_hw_4k_set_gain(struct ath_hw *ah,
-                                 struct modal_eep_4k_header *pModal,
-                                 struct ar5416_eeprom_4k *eep,
-                                 u8 txRxAttenLocal, int regChainOffset)
-{
-        REG_WRITE(ah, AR_PHY_SWITCH_CHAIN_0 + regChainOffset,
-                  pModal->antCtrlChain[0]);
-
-        REG_WRITE(ah, AR_PHY_TIMING_CTRL4(0) + regChainOffset,
-                  (REG_READ(ah, AR_PHY_TIMING_CTRL4(0) + regChainOffset) &
-                   ~(AR_PHY_TIMING_CTRL4_IQCORR_Q_Q_COFF |
-                     AR_PHY_TIMING_CTRL4_IQCORR_Q_I_COFF)) |
-                  SM(pModal->iqCalICh[0], AR_PHY_TIMING_CTRL4_IQCORR_Q_I_COFF) |
-                  SM(pModal->iqCalQCh[0], AR_PHY_TIMING_CTRL4_IQCORR_Q_Q_COFF));
-
-        if ((eep->baseEepHeader.version & AR5416_EEP_VER_MINOR_MASK) >=
-            AR5416_EEP_MINOR_VER_3) {
-                txRxAttenLocal = pModal->txRxAttenCh[0];
-
-                REG_RMW_FIELD(ah, AR_PHY_GAIN_2GHZ + regChainOffset,
-                              AR_PHY_GAIN_2GHZ_XATTEN1_MARGIN, pModal->bswMargin[0]);
-                REG_RMW_FIELD(ah, AR_PHY_GAIN_2GHZ + regChainOffset,
-                              AR_PHY_GAIN_2GHZ_XATTEN1_DB, pModal->bswAtten[0]);
-                REG_RMW_FIELD(ah, AR_PHY_GAIN_2GHZ + regChainOffset,
-                              AR_PHY_GAIN_2GHZ_XATTEN2_MARGIN,
-                              pModal->xatten2Margin[0]);
-                REG_RMW_FIELD(ah, AR_PHY_GAIN_2GHZ + regChainOffset,
-                              AR_PHY_GAIN_2GHZ_XATTEN2_DB, pModal->xatten2Db[0]);
-
-                /* Set the block 1 value to block 0 value */
-                REG_RMW_FIELD(ah, AR_PHY_GAIN_2GHZ + 0x1000,
-                              AR_PHY_GAIN_2GHZ_XATTEN1_MARGIN,
-                              pModal->bswMargin[0]);
-                REG_RMW_FIELD(ah, AR_PHY_GAIN_2GHZ + 0x1000,
-                              AR_PHY_GAIN_2GHZ_XATTEN1_DB, pModal->bswAtten[0]);
-                REG_RMW_FIELD(ah, AR_PHY_GAIN_2GHZ + 0x1000,
-                              AR_PHY_GAIN_2GHZ_XATTEN2_MARGIN,
-                              pModal->xatten2Margin[0]);
-                REG_RMW_FIELD(ah, AR_PHY_GAIN_2GHZ + 0x1000,
-                              AR_PHY_GAIN_2GHZ_XATTEN2_DB,
-                              pModal->xatten2Db[0]);
-        }
-
-        REG_RMW_FIELD(ah, AR_PHY_RXGAIN + regChainOffset,
-                      AR9280_PHY_RXGAIN_TXRX_ATTEN, txRxAttenLocal);
-        REG_RMW_FIELD(ah, AR_PHY_RXGAIN + regChainOffset,
-                      AR9280_PHY_RXGAIN_TXRX_MARGIN, pModal->rxTxMarginCh[0]);
-
-        REG_RMW_FIELD(ah, AR_PHY_RXGAIN + 0x1000,
-                      AR9280_PHY_RXGAIN_TXRX_ATTEN, txRxAttenLocal);
-        REG_RMW_FIELD(ah, AR_PHY_RXGAIN + 0x1000,
-                      AR9280_PHY_RXGAIN_TXRX_MARGIN, pModal->rxTxMarginCh[0]);
-
-        if (AR_SREV_9285_11(ah))
-                REG_WRITE(ah, AR9285_AN_TOP4, (AR9285_AN_TOP4_DEFAULT | 0x14));
-}
-
-/*
- * Read EEPROM header info and program the device for correct operation
- * given the channel value.
- */
-static void ath9k_hw_4k_set_board_values(struct ath_hw *ah,
-                                         struct ath9k_channel *chan)
-{
-        struct modal_eep_4k_header *pModal;
-        struct ar5416_eeprom_4k *eep = &ah->eeprom.map4k;
-        u8 txRxAttenLocal;
-        u8 ob[5], db1[5], db2[5];
-        u8 ant_div_control1, ant_div_control2;
-        u32 regVal;
-
-        pModal = &eep->modalHeader;
-        txRxAttenLocal = 23;
-
-        REG_WRITE(ah, AR_PHY_SWITCH_COM,
-                  ah->eep_ops->get_eeprom_antenna_cfg(ah, chan));
-
-        /* Single chain for 4K EEPROM*/
-        ath9k_hw_4k_set_gain(ah, pModal, eep, txRxAttenLocal, 0);
-
-        /* Initialize Ant Diversity settings from EEPROM */
-        if (pModal->version >= 3) {
-                ant_div_control1 = ((pModal->ob_234 >> 12) & 0xf);
-                ant_div_control2 = ((pModal->db1_234 >> 12) & 0xf);
-                regVal = REG_READ(ah, 0x99ac);
-                regVal &= (~(0x7f000000));
-                regVal |= ((ant_div_control1 & 0x1) << 24);
-                regVal |= (((ant_div_control1 >> 1) & 0x1) << 29);
-                regVal |= (((ant_div_control1 >> 2) & 0x1) << 30);
-                regVal |= ((ant_div_control2 & 0x3) << 25);
-                regVal |= (((ant_div_control2 >> 2) & 0x3) << 27);
-                REG_WRITE(ah, 0x99ac, regVal);
-                regVal = REG_READ(ah, 0x99ac);
-                regVal = REG_READ(ah, 0xa208);
-                regVal &= (~(0x1 << 13));
-                regVal |= (((ant_div_control1 >> 3) & 0x1) << 13);
-                REG_WRITE(ah, 0xa208, regVal);
-                regVal = REG_READ(ah, 0xa208);
-        }
-
-        if (pModal->version >= 2) {
-                ob[0] = (pModal->ob_01 & 0xf);
-                ob[1] = (pModal->ob_01 >> 4) & 0xf;
-                ob[2] = (pModal->ob_234 & 0xf);
-                ob[3] = ((pModal->ob_234 >> 4) & 0xf);
-                ob[4] = ((pModal->ob_234 >> 8) & 0xf);
-
-                db1[0] = (pModal->db1_01 & 0xf);
-                db1[1] = ((pModal->db1_01 >> 4) & 0xf);
-                db1[2] = (pModal->db1_234 & 0xf);
-                db1[3] = ((pModal->db1_234 >> 4) & 0xf);
-                db1[4] = ((pModal->db1_234 >> 8) & 0xf);
-
-                db2[0] = (pModal->db2_01 & 0xf);
-                db2[1] = ((pModal->db2_01 >> 4) & 0xf);
-                db2[2] = (pModal->db2_234 & 0xf);
-                db2[3] = ((pModal->db2_234 >> 4) & 0xf);
-                db2[4] = ((pModal->db2_234 >> 8) & 0xf);
-
-        } else if (pModal->version == 1) {
-                ob[0] = (pModal->ob_01 & 0xf);
-                ob[1] = ob[2] = ob[3] = ob[4] = (pModal->ob_01 >> 4) & 0xf;
-                db1[0] = (pModal->db1_01 & 0xf);
-                db1[1] = db1[2] = db1[3] =
-                        db1[4] = ((pModal->db1_01 >> 4) & 0xf);
-                db2[0] = (pModal->db2_01 & 0xf);
-                db2[1] = db2[2] = db2[3] =
-                        db2[4] = ((pModal->db2_01 >> 4) & 0xf);
-        } else {
-                int i;
-                for (i = 0; i < 5; i++) {
-                        ob[i] = pModal->ob_01;
-                        db1[i] = pModal->db1_01;
-                        db2[i] = pModal->db1_01;
-                }
-        }
-
-        if (AR_SREV_9271(ah)) {
-                ath9k_hw_analog_shift_rmw(ah,
-                                          AR9285_AN_RF2G3,
-                                          AR9271_AN_RF2G3_OB_cck,
-                                          AR9271_AN_RF2G3_OB_cck_S,
-                                          ob[0]);
-                ath9k_hw_analog_shift_rmw(ah,
-                                          AR9285_AN_RF2G3,
-                                          AR9271_AN_RF2G3_OB_psk,
-                                          AR9271_AN_RF2G3_OB_psk_S,
-                                          ob[1]);
-                ath9k_hw_analog_shift_rmw(ah,
-                                          AR9285_AN_RF2G3,
-                                          AR9271_AN_RF2G3_OB_qam,
-                                          AR9271_AN_RF2G3_OB_qam_S,
-                                          ob[2]);
-                ath9k_hw_analog_shift_rmw(ah,
-                                          AR9285_AN_RF2G3,
-                                          AR9271_AN_RF2G3_DB_1,
-                                          AR9271_AN_RF2G3_DB_1_S,
-                                          db1[0]);
-                ath9k_hw_analog_shift_rmw(ah,
-                                          AR9285_AN_RF2G4,
-                                          AR9271_AN_RF2G4_DB_2,
-                                          AR9271_AN_RF2G4_DB_2_S,
-                                          db2[0]);
-        } else {
-                ath9k_hw_analog_shift_rmw(ah,
-                                          AR9285_AN_RF2G3,
-                                          AR9285_AN_RF2G3_OB_0,
-                                          AR9285_AN_RF2G3_OB_0_S,
-                                          ob[0]);
-                ath9k_hw_analog_shift_rmw(ah,
-                                          AR9285_AN_RF2G3,
-                                          AR9285_AN_RF2G3_OB_1,
-                                          AR9285_AN_RF2G3_OB_1_S,
-                                          ob[1]);
-                ath9k_hw_analog_shift_rmw(ah,
-                                          AR9285_AN_RF2G3,
-                                          AR9285_AN_RF2G3_OB_2,
-                                          AR9285_AN_RF2G3_OB_2_S,
-                                          ob[2]);
-                ath9k_hw_analog_shift_rmw(ah,
-                                          AR9285_AN_RF2G3,
-                                          AR9285_AN_RF2G3_OB_3,
-                                          AR9285_AN_RF2G3_OB_3_S,
-                                          ob[3]);
-                ath9k_hw_analog_shift_rmw(ah,
-                                          AR9285_AN_RF2G3,
-                                          AR9285_AN_RF2G3_OB_4,
-                                          AR9285_AN_RF2G3_OB_4_S,
-                                          ob[4]);
-
-                ath9k_hw_analog_shift_rmw(ah,
-                                          AR9285_AN_RF2G3,
-                                          AR9285_AN_RF2G3_DB1_0,
-                                          AR9285_AN_RF2G3_DB1_0_S,
-                                          db1[0]);
-                ath9k_hw_analog_shift_rmw(ah,
-                                          AR9285_AN_RF2G3,
-                                          AR9285_AN_RF2G3_DB1_1,
-                                          AR9285_AN_RF2G3_DB1_1_S,
-                                          db1[1]);
-                ath9k_hw_analog_shift_rmw(ah,
-                                          AR9285_AN_RF2G3,
-                                          AR9285_AN_RF2G3_DB1_2,
-                                          AR9285_AN_RF2G3_DB1_2_S,
-                                          db1[2]);
-                ath9k_hw_analog_shift_rmw(ah,
-                                          AR9285_AN_RF2G4,
-                                          AR9285_AN_RF2G4_DB1_3,
-                                          AR9285_AN_RF2G4_DB1_3_S,
-                                          db1[3]);
-                ath9k_hw_analog_shift_rmw(ah,
-                                          AR9285_AN_RF2G4,
-                                          AR9285_AN_RF2G4_DB1_4,
-                                          AR9285_AN_RF2G4_DB1_4_S, db1[4]);
-
-                ath9k_hw_analog_shift_rmw(ah,
-                                          AR9285_AN_RF2G4,
-                                          AR9285_AN_RF2G4_DB2_0,
-                                          AR9285_AN_RF2G4_DB2_0_S,
-                                          db2[0]);
-                ath9k_hw_analog_shift_rmw(ah,
-                                          AR9285_AN_RF2G4,
-                                          AR9285_AN_RF2G4_DB2_1,
-                                          AR9285_AN_RF2G4_DB2_1_S,
-                                          db2[1]);
-                ath9k_hw_analog_shift_rmw(ah,
-                                          AR9285_AN_RF2G4,
-                                          AR9285_AN_RF2G4_DB2_2,
-                                          AR9285_AN_RF2G4_DB2_2_S,
-                                          db2[2]);
-                ath9k_hw_analog_shift_rmw(ah,
-                                          AR9285_AN_RF2G4,
-                                          AR9285_AN_RF2G4_DB2_3,
-                                          AR9285_AN_RF2G4_DB2_3_S,
-                                          db2[3]);
-                ath9k_hw_analog_shift_rmw(ah,
-                                          AR9285_AN_RF2G4,
-                                          AR9285_AN_RF2G4_DB2_4,
-                                          AR9285_AN_RF2G4_DB2_4_S,
-                                          db2[4]);
-        }
-
-
-        if (AR_SREV_9285_11(ah))
-                REG_WRITE(ah, AR9285_AN_TOP4, AR9285_AN_TOP4_DEFAULT);
-
-        REG_RMW_FIELD(ah, AR_PHY_SETTLING, AR_PHY_SETTLING_SWITCH,
-                      pModal->switchSettling);
-        REG_RMW_FIELD(ah, AR_PHY_DESIRED_SZ, AR_PHY_DESIRED_SZ_ADC,
-                      pModal->adcDesiredSize);
-
-        REG_WRITE(ah, AR_PHY_RF_CTL4,
-                  SM(pModal->txEndToXpaOff, AR_PHY_RF_CTL4_TX_END_XPAA_OFF) |
-                  SM(pModal->txEndToXpaOff, AR_PHY_RF_CTL4_TX_END_XPAB_OFF) |
-                  SM(pModal->txFrameToXpaOn, AR_PHY_RF_CTL4_FRAME_XPAA_ON)  |
-                  SM(pModal->txFrameToXpaOn, AR_PHY_RF_CTL4_FRAME_XPAB_ON));
-
-        REG_RMW_FIELD(ah, AR_PHY_RF_CTL3, AR_PHY_TX_END_TO_A2_RX_ON,
-                      pModal->txEndToRxOn);
-        REG_RMW_FIELD(ah, AR_PHY_CCA, AR9280_PHY_CCA_THRESH62,
-                      pModal->thresh62);
-        REG_RMW_FIELD(ah, AR_PHY_EXT_CCA0, AR_PHY_EXT_CCA0_THRESH62,
-                      pModal->thresh62);
-
-        if ((eep->baseEepHeader.version & AR5416_EEP_VER_MINOR_MASK) >=
-                                                AR5416_EEP_MINOR_VER_2) {
-                REG_RMW_FIELD(ah, AR_PHY_RF_CTL2, AR_PHY_TX_END_DATA_START,
-                              pModal->txFrameToDataStart);
-                REG_RMW_FIELD(ah, AR_PHY_RF_CTL2, AR_PHY_TX_END_PA_ON,
-                              pModal->txFrameToPaOn);
-        }
-
-        if ((eep->baseEepHeader.version & AR5416_EEP_VER_MINOR_MASK) >=
-                                                AR5416_EEP_MINOR_VER_3) {
-                if (IS_CHAN_HT40(chan))
-                        REG_RMW_FIELD(ah, AR_PHY_SETTLING,
-                                      AR_PHY_SETTLING_SWITCH,
-                                      pModal->swSettleHt40);
-        }
-}
-
-static u16 ath9k_hw_4k_get_eeprom_antenna_cfg(struct ath_hw *ah,
-                                              struct ath9k_channel *chan)
-{
-        struct ar5416_eeprom_4k *eep = &ah->eeprom.map4k;
-        struct modal_eep_4k_header *pModal = &eep->modalHeader;
-
-        return pModal->antCtrlCommon & 0xFFFF;
-}
-
-static u8 ath9k_hw_4k_get_num_ant_config(struct ath_hw *ah,
-                                         enum ieee80211_band freq_band)
-{
-        return 1;
-}
-
-static u16 ath9k_hw_4k_get_spur_channel(struct ath_hw *ah, u16 i, bool is2GHz)
-{
-#define EEP_MAP4K_SPURCHAN \
-        (ah->eeprom.map4k.modalHeader.spurChans[i].spurChan)
-
-        u16 spur_val = AR_NO_SPUR;
-
-        DPRINTF(ah->ah_sc, ATH_DBG_ANI,
-                "Getting spur idx %d is2Ghz. %d val %x\n",
-                i, is2GHz, ah->config.spurchans[i][is2GHz]);
-
-        switch (ah->config.spurmode) {
-        case SPUR_DISABLE:
-                break;
-        case SPUR_ENABLE_IOCTL:
-                spur_val = ah->config.spurchans[i][is2GHz];
-                DPRINTF(ah->ah_sc, ATH_DBG_ANI,
-                        "Getting spur val from new loc. %d\n", spur_val);
-                break;
-        case SPUR_ENABLE_EEPROM:
-                spur_val = EEP_MAP4K_SPURCHAN;
-                break;
-        }
-
-        return spur_val;
-
-#undef EEP_MAP4K_SPURCHAN
-}
-
-static struct eeprom_ops eep_4k_ops = {
-        .check_eeprom           = ath9k_hw_4k_check_eeprom,
-        .get_eeprom             = ath9k_hw_4k_get_eeprom,
-        .fill_eeprom            = ath9k_hw_4k_fill_eeprom,
-        .get_eeprom_ver         = ath9k_hw_4k_get_eeprom_ver,
-        .get_eeprom_rev         = ath9k_hw_4k_get_eeprom_rev,
-        .get_num_ant_config     = ath9k_hw_4k_get_num_ant_config,
-        .get_eeprom_antenna_cfg = ath9k_hw_4k_get_eeprom_antenna_cfg,
-        .set_board_values       = ath9k_hw_4k_set_board_values,
-        .set_addac              = ath9k_hw_4k_set_addac,
-        .set_txpower            = ath9k_hw_4k_set_txpower,
-        .get_spur_channel       = ath9k_hw_4k_get_spur_channel
-};
-
-/************************************************/
-/* EEPROM Operations for non-4K (Default) cards */
-/************************************************/
-
-static int ath9k_hw_def_get_eeprom_ver(struct ath_hw *ah)
-{
-        return ((ah->eeprom.def.baseEepHeader.version >> 12) & 0xF);
-}
-
-static int ath9k_hw_def_get_eeprom_rev(struct ath_hw *ah)
-{
-        return ((ah->eeprom.def.baseEepHeader.version) & 0xFFF);
-}
-
-static bool ath9k_hw_def_fill_eeprom(struct ath_hw *ah)
-{
-#define SIZE_EEPROM_DEF (sizeof(struct ar5416_eeprom_def) / sizeof(u16))
-        u16 *eep_data = (u16 *)&ah->eeprom.def;
-        int addr, ar5416_eep_start_loc = 0x100;
-
-        for (addr = 0; addr < SIZE_EEPROM_DEF; addr++) {
-                if (!ath9k_hw_nvram_read(ah, addr + ar5416_eep_start_loc,
-                                         eep_data)) {
-                        DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
-                                "Unable to read eeprom region\n");
-                        return false;
-                }
-                eep_data++;
-        }
-        return true;
-#undef SIZE_EEPROM_DEF
-}
-
-static int ath9k_hw_def_check_eeprom(struct ath_hw *ah)
-{
-        struct ar5416_eeprom_def *eep =
-                (struct ar5416_eeprom_def *) &ah->eeprom.def;
-        u16 *eepdata, temp, magic, magic2;
-        u32 sum = 0, el;
-        bool need_swap = false;
-        int i, addr, size;
-
-        if (!ath9k_hw_nvram_read(ah, AR5416_EEPROM_MAGIC_OFFSET, &magic)) {
-                DPRINTF(ah->ah_sc, ATH_DBG_FATAL, "Reading Magic # failed\n");
-                return false;
-        }
-
-        if (!ath9k_hw_use_flash(ah)) {
-                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                        "Read Magic = 0x%04X\n", magic);
-
-                if (magic != AR5416_EEPROM_MAGIC) {
-                        magic2 = swab16(magic);
-
-                        if (magic2 == AR5416_EEPROM_MAGIC) {
-                                size = sizeof(struct ar5416_eeprom_def);
-                                need_swap = true;
-                                eepdata = (u16 *) (&ah->eeprom);
-
-                                for (addr = 0; addr < size / sizeof(u16); addr++) {
-                                        temp = swab16(*eepdata);
-                                        *eepdata = temp;
-                                        eepdata++;
-                                }
-                        } else {
-                                DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
-                                        "Invalid EEPROM Magic. "
-                                        "Endianness mismatch.\n");
-                                return -EINVAL;
-                        }
-                }
-        }
-
-        DPRINTF(ah->ah_sc, ATH_DBG_EEPROM, "need_swap = %s.\n",
-                need_swap ? "True" : "False");
-
-        if (need_swap)
-                el = swab16(ah->eeprom.def.baseEepHeader.length);
-        else
-                el = ah->eeprom.def.baseEepHeader.length;
-
-        if (el > sizeof(struct ar5416_eeprom_def))
-                el = sizeof(struct ar5416_eeprom_def) / sizeof(u16);
-        else
-                el = el / sizeof(u16);
-
-        eepdata = (u16 *)(&ah->eeprom);
-
-        for (i = 0; i < el; i++)
-                sum ^= *eepdata++;
-
-        if (need_swap) {
-                u32 integer, j;
-                u16 word;
-
-                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                        "EEPROM Endianness is not native.. Changing.\n");
-
-                word = swab16(eep->baseEepHeader.length);
-                eep->baseEepHeader.length = word;
-
-                word = swab16(eep->baseEepHeader.checksum);
-                eep->baseEepHeader.checksum = word;
-
-                word = swab16(eep->baseEepHeader.version);
-                eep->baseEepHeader.version = word;
-
-                word = swab16(eep->baseEepHeader.regDmn[0]);
-                eep->baseEepHeader.regDmn[0] = word;
-
-                word = swab16(eep->baseEepHeader.regDmn[1]);
-                eep->baseEepHeader.regDmn[1] = word;
-
-                word = swab16(eep->baseEepHeader.rfSilent);
-                eep->baseEepHeader.rfSilent = word;
-
-                word = swab16(eep->baseEepHeader.blueToothOptions);
-                eep->baseEepHeader.blueToothOptions = word;
-
-                word = swab16(eep->baseEepHeader.deviceCap);
-                eep->baseEepHeader.deviceCap = word;
-
-                for (j = 0; j < ARRAY_SIZE(eep->modalHeader); j++) {
-                        struct modal_eep_header *pModal =
-                                &eep->modalHeader[j];
-                        integer = swab32(pModal->antCtrlCommon);
-                        pModal->antCtrlCommon = integer;
-
-                        for (i = 0; i < AR5416_MAX_CHAINS; i++) {
-                                integer = swab32(pModal->antCtrlChain[i]);
-                                pModal->antCtrlChain[i] = integer;
-                        }
-
-                        for (i = 0; i < AR5416_EEPROM_MODAL_SPURS; i++) {
-                                word = swab16(pModal->spurChans[i].spurChan);
-                                pModal->spurChans[i].spurChan = word;
-                        }
-                }
-        }
-
-        if (sum != 0xffff || ah->eep_ops->get_eeprom_ver(ah) != AR5416_EEP_VER ||
-            ah->eep_ops->get_eeprom_rev(ah) < AR5416_EEP_NO_BACK_VER) {
-                DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
-                        "Bad EEPROM checksum 0x%x or revision 0x%04x\n",
-                        sum, ah->eep_ops->get_eeprom_ver(ah));
-                return -EINVAL;
-        }
-
-        return 0;
-}
-
-static u32 ath9k_hw_def_get_eeprom(struct ath_hw *ah,
-                                   enum eeprom_param param)
-{
-        struct ar5416_eeprom_def *eep = &ah->eeprom.def;
-        struct modal_eep_header *pModal = eep->modalHeader;
-        struct base_eep_header *pBase = &eep->baseEepHeader;
-
-        switch (param) {
-        case EEP_NFTHRESH_5:
-                return pModal[0].noiseFloorThreshCh[0];
-        case EEP_NFTHRESH_2:
-                return pModal[1].noiseFloorThreshCh[0];
-        case AR_EEPROM_MAC(0):
-                return pBase->macAddr[0] << 8 | pBase->macAddr[1];
-        case AR_EEPROM_MAC(1):
-                return pBase->macAddr[2] << 8 | pBase->macAddr[3];
-        case AR_EEPROM_MAC(2):
-                return pBase->macAddr[4] << 8 | pBase->macAddr[5];
-        case EEP_REG_0:
-                return pBase->regDmn[0];
-        case EEP_REG_1:
-                return pBase->regDmn[1];
-        case EEP_OP_CAP:
-                return pBase->deviceCap;
-        case EEP_OP_MODE:
-                return pBase->opCapFlags;
-        case EEP_RF_SILENT:
-                return pBase->rfSilent;
-        case EEP_OB_5:
-                return pModal[0].ob;
-        case EEP_DB_5:
-                return pModal[0].db;
-        case EEP_OB_2:
-                return pModal[1].ob;
-        case EEP_DB_2:
-                return pModal[1].db;
-        case EEP_MINOR_REV:
-                return AR5416_VER_MASK;
-        case EEP_TX_MASK:
-                return pBase->txMask;
-        case EEP_RX_MASK:
-                return pBase->rxMask;
-        case EEP_RXGAIN_TYPE:
-                return pBase->rxGainType;
-        case EEP_TXGAIN_TYPE:
-                return pBase->txGainType;
-        case EEP_OL_PWRCTRL:
-                if (AR5416_VER_MASK >= AR5416_EEP_MINOR_VER_19)
-                        return pBase->openLoopPwrCntl ? true : false;
-                else
-                        return false;
-        case EEP_RC_CHAIN_MASK:
-                if (AR5416_VER_MASK >= AR5416_EEP_MINOR_VER_19)
-                        return pBase->rcChainMask;
-                else
-                        return 0;
-        case EEP_DAC_HPWR_5G:
-                if (AR5416_VER_MASK >= AR5416_EEP_MINOR_VER_20)
-                        return pBase->dacHiPwrMode_5G;
-                else
-                        return 0;
-        case EEP_FRAC_N_5G:
-                if (AR5416_VER_MASK >= AR5416_EEP_MINOR_VER_22)
-                        return pBase->frac_n_5g;
-                else
-                        return 0;
-        default:
-                return 0;
-        }
-}
-
-static void ath9k_hw_def_set_gain(struct ath_hw *ah,
-                                  struct modal_eep_header *pModal,
-                                  struct ar5416_eeprom_def *eep,
-                                  u8 txRxAttenLocal, int regChainOffset, int i)
-{
-        if (AR5416_VER_MASK >= AR5416_EEP_MINOR_VER_3) {
-                txRxAttenLocal = pModal->txRxAttenCh[i];
-
-                if (AR_SREV_9280_10_OR_LATER(ah)) {
-                        REG_RMW_FIELD(ah, AR_PHY_GAIN_2GHZ + regChainOffset,
-                              AR_PHY_GAIN_2GHZ_XATTEN1_MARGIN,
-                              pModal->bswMargin[i]);
-                        REG_RMW_FIELD(ah, AR_PHY_GAIN_2GHZ + regChainOffset,
-                              AR_PHY_GAIN_2GHZ_XATTEN1_DB,
-                              pModal->bswAtten[i]);
-                        REG_RMW_FIELD(ah, AR_PHY_GAIN_2GHZ + regChainOffset,
-                              AR_PHY_GAIN_2GHZ_XATTEN2_MARGIN,
-                              pModal->xatten2Margin[i]);
-                        REG_RMW_FIELD(ah, AR_PHY_GAIN_2GHZ + regChainOffset,
-                              AR_PHY_GAIN_2GHZ_XATTEN2_DB,
-                              pModal->xatten2Db[i]);
-                } else {
-                        REG_WRITE(ah, AR_PHY_GAIN_2GHZ + regChainOffset,
-                          (REG_READ(ah, AR_PHY_GAIN_2GHZ + regChainOffset) &
-                           ~AR_PHY_GAIN_2GHZ_BSW_MARGIN)
-                          | SM(pModal-> bswMargin[i],
-                               AR_PHY_GAIN_2GHZ_BSW_MARGIN));
-                        REG_WRITE(ah, AR_PHY_GAIN_2GHZ + regChainOffset,
-                          (REG_READ(ah, AR_PHY_GAIN_2GHZ + regChainOffset) &
-                           ~AR_PHY_GAIN_2GHZ_BSW_ATTEN)
-                          | SM(pModal->bswAtten[i],
-                               AR_PHY_GAIN_2GHZ_BSW_ATTEN));
-                }
-        }
-
-        if (AR_SREV_9280_10_OR_LATER(ah)) {
-                REG_RMW_FIELD(ah,
-                      AR_PHY_RXGAIN + regChainOffset,
-                      AR9280_PHY_RXGAIN_TXRX_ATTEN, txRxAttenLocal);
-                REG_RMW_FIELD(ah,
-                      AR_PHY_RXGAIN + regChainOffset,
-                      AR9280_PHY_RXGAIN_TXRX_MARGIN, pModal->rxTxMarginCh[i]);
-        } else {
-                REG_WRITE(ah,
-                          AR_PHY_RXGAIN + regChainOffset,
-                          (REG_READ(ah, AR_PHY_RXGAIN + regChainOffset) &
-                           ~AR_PHY_RXGAIN_TXRX_ATTEN)
-                          | SM(txRxAttenLocal, AR_PHY_RXGAIN_TXRX_ATTEN));
-                REG_WRITE(ah,
-                          AR_PHY_GAIN_2GHZ + regChainOffset,
-                          (REG_READ(ah, AR_PHY_GAIN_2GHZ + regChainOffset) &
-                           ~AR_PHY_GAIN_2GHZ_RXTX_MARGIN) |
-                          SM(pModal->rxTxMarginCh[i], AR_PHY_GAIN_2GHZ_RXTX_MARGIN));
-        }
-}
-
-static void ath9k_hw_def_set_board_values(struct ath_hw *ah,
-                                          struct ath9k_channel *chan)
-{
-        struct modal_eep_header *pModal;
-        struct ar5416_eeprom_def *eep = &ah->eeprom.def;
-        int i, regChainOffset;
-        u8 txRxAttenLocal;
-
-        pModal = &(eep->modalHeader[IS_CHAN_2GHZ(chan)]);
-        txRxAttenLocal = IS_CHAN_2GHZ(chan) ? 23 : 44;
-
-        REG_WRITE(ah, AR_PHY_SWITCH_COM,
-                  ah->eep_ops->get_eeprom_antenna_cfg(ah, chan));
-
-        for (i = 0; i < AR5416_MAX_CHAINS; i++) {
-                if (AR_SREV_9280(ah)) {
-                        if (i >= 2)
-                                break;
-                }
-
-                if (AR_SREV_5416_20_OR_LATER(ah) &&
-                    (ah->rxchainmask == 5 || ah->txchainmask == 5) && (i != 0))
-                        regChainOffset = (i == 1) ? 0x2000 : 0x1000;
-                else
-                        regChainOffset = i * 0x1000;
-
-                REG_WRITE(ah, AR_PHY_SWITCH_CHAIN_0 + regChainOffset,
-                          pModal->antCtrlChain[i]);
-
-                REG_WRITE(ah, AR_PHY_TIMING_CTRL4(0) + regChainOffset,
-                          (REG_READ(ah, AR_PHY_TIMING_CTRL4(0) + regChainOffset) &
-                           ~(AR_PHY_TIMING_CTRL4_IQCORR_Q_Q_COFF |
-                             AR_PHY_TIMING_CTRL4_IQCORR_Q_I_COFF)) |
-                          SM(pModal->iqCalICh[i],
-                             AR_PHY_TIMING_CTRL4_IQCORR_Q_I_COFF) |
-                          SM(pModal->iqCalQCh[i],
-                             AR_PHY_TIMING_CTRL4_IQCORR_Q_Q_COFF));
-
-                if ((i == 0) || AR_SREV_5416_20_OR_LATER(ah))
-                        ath9k_hw_def_set_gain(ah, pModal, eep, txRxAttenLocal,
-                                              regChainOffset, i);
-        }
-
-        if (AR_SREV_9280_10_OR_LATER(ah)) {
-                if (IS_CHAN_2GHZ(chan)) {
-                        ath9k_hw_analog_shift_rmw(ah, AR_AN_RF2G1_CH0,
-                                                  AR_AN_RF2G1_CH0_OB,
-                                                  AR_AN_RF2G1_CH0_OB_S,
-                                                  pModal->ob);
-                        ath9k_hw_analog_shift_rmw(ah, AR_AN_RF2G1_CH0,
-                                                  AR_AN_RF2G1_CH0_DB,
-                                                  AR_AN_RF2G1_CH0_DB_S,
-                                                  pModal->db);
-                        ath9k_hw_analog_shift_rmw(ah, AR_AN_RF2G1_CH1,
-                                                  AR_AN_RF2G1_CH1_OB,
-                                                  AR_AN_RF2G1_CH1_OB_S,
-                                                  pModal->ob_ch1);
-                        ath9k_hw_analog_shift_rmw(ah, AR_AN_RF2G1_CH1,
-                                                  AR_AN_RF2G1_CH1_DB,
-                                                  AR_AN_RF2G1_CH1_DB_S,
-                                                  pModal->db_ch1);
-                } else {
-                        ath9k_hw_analog_shift_rmw(ah, AR_AN_RF5G1_CH0,
-                                                  AR_AN_RF5G1_CH0_OB5,
-                                                  AR_AN_RF5G1_CH0_OB5_S,
-                                                  pModal->ob);
-                        ath9k_hw_analog_shift_rmw(ah, AR_AN_RF5G1_CH0,
-                                                  AR_AN_RF5G1_CH0_DB5,
-                                                  AR_AN_RF5G1_CH0_DB5_S,
-                                                  pModal->db);
-                        ath9k_hw_analog_shift_rmw(ah, AR_AN_RF5G1_CH1,
-                                                  AR_AN_RF5G1_CH1_OB5,
-                                                  AR_AN_RF5G1_CH1_OB5_S,
-                                                  pModal->ob_ch1);
-                        ath9k_hw_analog_shift_rmw(ah, AR_AN_RF5G1_CH1,
-                                                  AR_AN_RF5G1_CH1_DB5,
-                                                  AR_AN_RF5G1_CH1_DB5_S,
-                                                  pModal->db_ch1);
-                }
-                ath9k_hw_analog_shift_rmw(ah, AR_AN_TOP2,
-                                          AR_AN_TOP2_XPABIAS_LVL,
-                                          AR_AN_TOP2_XPABIAS_LVL_S,
-                                          pModal->xpaBiasLvl);
-                ath9k_hw_analog_shift_rmw(ah, AR_AN_TOP2,
-                                          AR_AN_TOP2_LOCALBIAS,
-                                          AR_AN_TOP2_LOCALBIAS_S,
-                                          pModal->local_bias);
-                REG_RMW_FIELD(ah, AR_PHY_XPA_CFG, AR_PHY_FORCE_XPA_CFG,
-                              pModal->force_xpaon);
-        }
-
-        REG_RMW_FIELD(ah, AR_PHY_SETTLING, AR_PHY_SETTLING_SWITCH,
-                      pModal->switchSettling);
-        REG_RMW_FIELD(ah, AR_PHY_DESIRED_SZ, AR_PHY_DESIRED_SZ_ADC,
-                      pModal->adcDesiredSize);
-
-        if (!AR_SREV_9280_10_OR_LATER(ah))
-                REG_RMW_FIELD(ah, AR_PHY_DESIRED_SZ,
-                              AR_PHY_DESIRED_SZ_PGA,
-                              pModal->pgaDesiredSize);
-
-        REG_WRITE(ah, AR_PHY_RF_CTL4,
-                  SM(pModal->txEndToXpaOff, AR_PHY_RF_CTL4_TX_END_XPAA_OFF)
-                  | SM(pModal->txEndToXpaOff,
-                       AR_PHY_RF_CTL4_TX_END_XPAB_OFF)
-                  | SM(pModal->txFrameToXpaOn,
-                       AR_PHY_RF_CTL4_FRAME_XPAA_ON)
-                  | SM(pModal->txFrameToXpaOn,
-                       AR_PHY_RF_CTL4_FRAME_XPAB_ON));
-
-        REG_RMW_FIELD(ah, AR_PHY_RF_CTL3, AR_PHY_TX_END_TO_A2_RX_ON,
-                      pModal->txEndToRxOn);
-
-        if (AR_SREV_9280_10_OR_LATER(ah)) {
-                REG_RMW_FIELD(ah, AR_PHY_CCA, AR9280_PHY_CCA_THRESH62,
-                              pModal->thresh62);
-                REG_RMW_FIELD(ah, AR_PHY_EXT_CCA0,
-                              AR_PHY_EXT_CCA0_THRESH62,
-                              pModal->thresh62);
-        } else {
-                REG_RMW_FIELD(ah, AR_PHY_CCA, AR_PHY_CCA_THRESH62,
-                              pModal->thresh62);
-                REG_RMW_FIELD(ah, AR_PHY_EXT_CCA,
-                              AR_PHY_EXT_CCA_THRESH62,
-                              pModal->thresh62);
-        }
-
-        if (AR5416_VER_MASK >= AR5416_EEP_MINOR_VER_2) {
-                REG_RMW_FIELD(ah, AR_PHY_RF_CTL2,
-                              AR_PHY_TX_END_DATA_START,
-                              pModal->txFrameToDataStart);
-                REG_RMW_FIELD(ah, AR_PHY_RF_CTL2, AR_PHY_TX_END_PA_ON,
-                              pModal->txFrameToPaOn);
-        }
-
-        if (AR5416_VER_MASK >= AR5416_EEP_MINOR_VER_3) {
-                if (IS_CHAN_HT40(chan))
-                        REG_RMW_FIELD(ah, AR_PHY_SETTLING,
-                                      AR_PHY_SETTLING_SWITCH,
-                                      pModal->swSettleHt40);
-        }
-
-        if (AR_SREV_9280_20_OR_LATER(ah) &&
-            AR5416_VER_MASK >= AR5416_EEP_MINOR_VER_19)
-                REG_RMW_FIELD(ah, AR_PHY_CCK_TX_CTRL,
-                              AR_PHY_CCK_TX_CTRL_TX_DAC_SCALE_CCK,
-                              pModal->miscBits);
-
-
-        if (AR_SREV_9280_20(ah) && AR5416_VER_MASK >= AR5416_EEP_MINOR_VER_20) {
-                if (IS_CHAN_2GHZ(chan))
-                        REG_RMW_FIELD(ah, AR_AN_TOP1, AR_AN_TOP1_DACIPMODE,
-                                        eep->baseEepHeader.dacLpMode);
-                else if (eep->baseEepHeader.dacHiPwrMode_5G)
-                        REG_RMW_FIELD(ah, AR_AN_TOP1, AR_AN_TOP1_DACIPMODE, 0);
-                else
-                        REG_RMW_FIELD(ah, AR_AN_TOP1, AR_AN_TOP1_DACIPMODE,
-                                      eep->baseEepHeader.dacLpMode);
-
-                REG_RMW_FIELD(ah, AR_PHY_FRAME_CTL, AR_PHY_FRAME_CTL_TX_CLIP,
-                              pModal->miscBits >> 2);
-
-                REG_RMW_FIELD(ah, AR_PHY_TX_PWRCTRL9,
-                              AR_PHY_TX_DESIRED_SCALE_CCK,
-                              eep->baseEepHeader.desiredScaleCCK);
-        }
-}
-
-static void ath9k_hw_def_set_addac(struct ath_hw *ah,
-                                   struct ath9k_channel *chan)
-{
-#define XPA_LVL_FREQ(cnt) (pModal->xpaBiasLvlFreq[cnt])
-        struct modal_eep_header *pModal;
-        struct ar5416_eeprom_def *eep = &ah->eeprom.def;
-        u8 biaslevel;
-
-        if (ah->hw_version.macVersion != AR_SREV_VERSION_9160)
-                return;
-
-        if (ah->eep_ops->get_eeprom_rev(ah) < AR5416_EEP_MINOR_VER_7)
-                return;
-
-        pModal = &(eep->modalHeader[IS_CHAN_2GHZ(chan)]);
-
-        if (pModal->xpaBiasLvl != 0xff) {
-                biaslevel = pModal->xpaBiasLvl;
-        } else {
-                u16 resetFreqBin, freqBin, freqCount = 0;
-                struct chan_centers centers;
-
-                ath9k_hw_get_channel_centers(ah, chan, &centers);
-
-                resetFreqBin = FREQ2FBIN(centers.synth_center,
-                                         IS_CHAN_2GHZ(chan));
-                freqBin = XPA_LVL_FREQ(0) & 0xff;
-                biaslevel = (u8) (XPA_LVL_FREQ(0) >> 14);
-
-                freqCount++;
-
-                while (freqCount < 3) {
-                        if (XPA_LVL_FREQ(freqCount) == 0x0)
-                                break;
-
-                        freqBin = XPA_LVL_FREQ(freqCount) & 0xff;
-                        if (resetFreqBin >= freqBin)
-                                biaslevel = (u8)(XPA_LVL_FREQ(freqCount) >> 14);
-                        else
-                                break;
-                        freqCount++;
-                }
-        }
-
-        if (IS_CHAN_2GHZ(chan)) {
-                INI_RA(&ah->iniAddac, 7, 1) = (INI_RA(&ah->iniAddac,
-                                        7, 1) & (~0x18)) | biaslevel << 3;
-        } else {
-                INI_RA(&ah->iniAddac, 6, 1) = (INI_RA(&ah->iniAddac,
-                                        6, 1) & (~0xc0)) | biaslevel << 6;
-        }
-#undef XPA_LVL_FREQ
-}
-
-static void ath9k_hw_get_def_gain_boundaries_pdadcs(struct ath_hw *ah,
-                                struct ath9k_channel *chan,
-                                struct cal_data_per_freq *pRawDataSet,
-                                u8 *bChans, u16 availPiers,
-                                u16 tPdGainOverlap, int16_t *pMinCalPower,
-                                u16 *pPdGainBoundaries, u8 *pPDADCValues,
-                                u16 numXpdGains)
-{
-        int i, j, k;
-        int16_t ss;
-        u16 idxL = 0, idxR = 0, numPiers;
-        static u8 vpdTableL[AR5416_NUM_PD_GAINS]
-                [AR5416_MAX_PWR_RANGE_IN_HALF_DB];
-        static u8 vpdTableR[AR5416_NUM_PD_GAINS]
-                [AR5416_MAX_PWR_RANGE_IN_HALF_DB];
-        static u8 vpdTableI[AR5416_NUM_PD_GAINS]
-                [AR5416_MAX_PWR_RANGE_IN_HALF_DB];
-
-        u8 *pVpdL, *pVpdR, *pPwrL, *pPwrR;
-        u8 minPwrT4[AR5416_NUM_PD_GAINS];
-        u8 maxPwrT4[AR5416_NUM_PD_GAINS];
-        int16_t vpdStep;
-        int16_t tmpVal;
-        u16 sizeCurrVpdTable, maxIndex, tgtIndex;
-        bool match;
-        int16_t minDelta = 0;
-        struct chan_centers centers;
-
-        ath9k_hw_get_channel_centers(ah, chan, &centers);
-
-        for (numPiers = 0; numPiers < availPiers; numPiers++) {
-                if (bChans[numPiers] == AR5416_BCHAN_UNUSED)
-                        break;
-        }
-
-        match = ath9k_hw_get_lower_upper_index((u8)FREQ2FBIN(centers.synth_center,
-                                                             IS_CHAN_2GHZ(chan)),
-                                               bChans, numPiers, &idxL, &idxR);
-
-        if (match) {
-                for (i = 0; i < numXpdGains; i++) {
-                        minPwrT4[i] = pRawDataSet[idxL].pwrPdg[i][0];
-                        maxPwrT4[i] = pRawDataSet[idxL].pwrPdg[i][4];
-                        ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
-                                        pRawDataSet[idxL].pwrPdg[i],
-                                        pRawDataSet[idxL].vpdPdg[i],
-                                        AR5416_PD_GAIN_ICEPTS,
-                                        vpdTableI[i]);
-                }
-        } else {
-                for (i = 0; i < numXpdGains; i++) {
-                        pVpdL = pRawDataSet[idxL].vpdPdg[i];
-                        pPwrL = pRawDataSet[idxL].pwrPdg[i];
-                        pVpdR = pRawDataSet[idxR].vpdPdg[i];
-                        pPwrR = pRawDataSet[idxR].pwrPdg[i];
-
-                        minPwrT4[i] = max(pPwrL[0], pPwrR[0]);
-
-                        maxPwrT4[i] =
-                                min(pPwrL[AR5416_PD_GAIN_ICEPTS - 1],
-                                    pPwrR[AR5416_PD_GAIN_ICEPTS - 1]);
-
-
-                        ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
-                                                pPwrL, pVpdL,
-                                                AR5416_PD_GAIN_ICEPTS,
-                                                vpdTableL[i]);
-                        ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
-                                                pPwrR, pVpdR,
-                                                AR5416_PD_GAIN_ICEPTS,
-                                                vpdTableR[i]);
-
-                        for (j = 0; j <= (maxPwrT4[i] - minPwrT4[i]) / 2; j++) {
-                                vpdTableI[i][j] =
-                                        (u8)(ath9k_hw_interpolate((u16)
-                                             FREQ2FBIN(centers.
-                                                       synth_center,
-                                                       IS_CHAN_2GHZ
-                                                       (chan)),
-                                             bChans[idxL], bChans[idxR],
-                                             vpdTableL[i][j], vpdTableR[i][j]));
-                        }
-                }
-        }
-
-        *pMinCalPower = (int16_t)(minPwrT4[0] / 2);
-
-        k = 0;
-
-        for (i = 0; i < numXpdGains; i++) {
-                if (i == (numXpdGains - 1))
-                        pPdGainBoundaries[i] =
-                                (u16)(maxPwrT4[i] / 2);
-                else
-                        pPdGainBoundaries[i] =
-                                (u16)((maxPwrT4[i] + minPwrT4[i + 1]) / 4);
-
-                pPdGainBoundaries[i] =
-                        min((u16)AR5416_MAX_RATE_POWER, pPdGainBoundaries[i]);
-
-                if ((i == 0) && !AR_SREV_5416_20_OR_LATER(ah)) {
-                        minDelta = pPdGainBoundaries[0] - 23;
-                        pPdGainBoundaries[0] = 23;
-                } else {
-                        minDelta = 0;
-                }
-
-                if (i == 0) {
-                        if (AR_SREV_9280_10_OR_LATER(ah))
-                                ss = (int16_t)(0 - (minPwrT4[i] / 2));
-                        else
-                                ss = 0;
-                } else {
-                        ss = (int16_t)((pPdGainBoundaries[i - 1] -
-                                        (minPwrT4[i] / 2)) -
-                                       tPdGainOverlap + 1 + minDelta);
-                }
-                vpdStep = (int16_t)(vpdTableI[i][1] - vpdTableI[i][0]);
-                vpdStep = (int16_t)((vpdStep < 1) ? 1 : vpdStep);
-
-                while ((ss < 0) && (k < (AR5416_NUM_PDADC_VALUES - 1))) {
-                        tmpVal = (int16_t)(vpdTableI[i][0] + ss * vpdStep);
-                        pPDADCValues[k++] = (u8)((tmpVal < 0) ? 0 : tmpVal);
-                        ss++;
-                }
-
-                sizeCurrVpdTable = (u8) ((maxPwrT4[i] - minPwrT4[i]) / 2 + 1);
-                tgtIndex = (u8)(pPdGainBoundaries[i] + tPdGainOverlap -
-                                (minPwrT4[i] / 2));
-                maxIndex = (tgtIndex < sizeCurrVpdTable) ?
-                        tgtIndex : sizeCurrVpdTable;
-
-                while ((ss < maxIndex) && (k < (AR5416_NUM_PDADC_VALUES - 1))) {
-                        pPDADCValues[k++] = vpdTableI[i][ss++];
-                }
-
-                vpdStep = (int16_t)(vpdTableI[i][sizeCurrVpdTable - 1] -
-                                    vpdTableI[i][sizeCurrVpdTable - 2]);
-                vpdStep = (int16_t)((vpdStep < 1) ? 1 : vpdStep);
-
-                if (tgtIndex > maxIndex) {
-                        while ((ss <= tgtIndex) &&
-                               (k < (AR5416_NUM_PDADC_VALUES - 1))) {
-                                tmpVal = (int16_t)((vpdTableI[i][sizeCurrVpdTable - 1] +
-                                                    (ss - maxIndex + 1) * vpdStep));
-                                pPDADCValues[k++] = (u8)((tmpVal > 255) ?
-                                                         255 : tmpVal);
-                                ss++;
-                        }
-                }
-        }
-
-        while (i < AR5416_PD_GAINS_IN_MASK) {
-                pPdGainBoundaries[i] = pPdGainBoundaries[i - 1];
-                i++;
-        }
-
-        while (k < AR5416_NUM_PDADC_VALUES) {
-                pPDADCValues[k] = pPDADCValues[k - 1];
-                k++;
-        }
-
-        return;
-}
-
-static void ath9k_hw_set_def_power_cal_table(struct ath_hw *ah,
-                                  struct ath9k_channel *chan,
-                                  int16_t *pTxPowerIndexOffset)
-{
-#define SM_PD_GAIN(x) SM(0x38, AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_##x)
-#define SM_PDGAIN_B(x, y) \
-                SM((gainBoundaries[x]), AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_##y)
-
-        struct ar5416_eeprom_def *pEepData = &ah->eeprom.def;
-        struct cal_data_per_freq *pRawDataset;
-        u8 *pCalBChans = NULL;
-        u16 pdGainOverlap_t2;
-        static u8 pdadcValues[AR5416_NUM_PDADC_VALUES];
-        u16 gainBoundaries[AR5416_PD_GAINS_IN_MASK];
-        u16 numPiers, i, j;
-        int16_t tMinCalPower;
-        u16 numXpdGain, xpdMask;
-        u16 xpdGainValues[AR5416_NUM_PD_GAINS] = { 0, 0, 0, 0 };
-        u32 reg32, regOffset, regChainOffset;
-        int16_t modalIdx;
-
-        modalIdx = IS_CHAN_2GHZ(chan) ? 1 : 0;
-        xpdMask = pEepData->modalHeader[modalIdx].xpdGain;
-
-        if ((pEepData->baseEepHeader.version & AR5416_EEP_VER_MINOR_MASK) >=
-            AR5416_EEP_MINOR_VER_2) {
-                pdGainOverlap_t2 =
-                        pEepData->modalHeader[modalIdx].pdGainOverlap;
-        } else {
-                pdGainOverlap_t2 = (u16)(MS(REG_READ(ah, AR_PHY_TPCRG5),
-                                            AR_PHY_TPCRG5_PD_GAIN_OVERLAP));
-        }
-
-        if (IS_CHAN_2GHZ(chan)) {
-                pCalBChans = pEepData->calFreqPier2G;
-                numPiers = AR5416_NUM_2G_CAL_PIERS;
-        } else {
-                pCalBChans = pEepData->calFreqPier5G;
-                numPiers = AR5416_NUM_5G_CAL_PIERS;
-        }
-
-        if (OLC_FOR_AR9280_20_LATER && IS_CHAN_2GHZ(chan)) {
-                pRawDataset = pEepData->calPierData2G[0];
-                ah->initPDADC = ((struct calDataPerFreqOpLoop *)
-                                 pRawDataset)->vpdPdg[0][0];
-        }
-
-        numXpdGain = 0;
-
-        for (i = 1; i <= AR5416_PD_GAINS_IN_MASK; i++) {
-                if ((xpdMask >> (AR5416_PD_GAINS_IN_MASK - i)) & 1) {
-                        if (numXpdGain >= AR5416_NUM_PD_GAINS)
-                                break;
-                        xpdGainValues[numXpdGain] =
-                                (u16)(AR5416_PD_GAINS_IN_MASK - i);
-                        numXpdGain++;
-                }
-        }
-
-        REG_RMW_FIELD(ah, AR_PHY_TPCRG1, AR_PHY_TPCRG1_NUM_PD_GAIN,
-                      (numXpdGain - 1) & 0x3);
-        REG_RMW_FIELD(ah, AR_PHY_TPCRG1, AR_PHY_TPCRG1_PD_GAIN_1,
-                      xpdGainValues[0]);
-        REG_RMW_FIELD(ah, AR_PHY_TPCRG1, AR_PHY_TPCRG1_PD_GAIN_2,
-                      xpdGainValues[1]);
-        REG_RMW_FIELD(ah, AR_PHY_TPCRG1, AR_PHY_TPCRG1_PD_GAIN_3,
-                      xpdGainValues[2]);
-
-        for (i = 0; i < AR5416_MAX_CHAINS; i++) {
-                if (AR_SREV_5416_20_OR_LATER(ah) &&
-                    (ah->rxchainmask == 5 || ah->txchainmask == 5) &&
-                    (i != 0)) {
-                        regChainOffset = (i == 1) ? 0x2000 : 0x1000;
-                } else
-                        regChainOffset = i * 0x1000;
-
-                if (pEepData->baseEepHeader.txMask & (1 << i)) {
-                        if (IS_CHAN_2GHZ(chan))
-                                pRawDataset = pEepData->calPierData2G[i];
-                        else
-                                pRawDataset = pEepData->calPierData5G[i];
-
-
-                        if (OLC_FOR_AR9280_20_LATER) {
-                                u8 pcdacIdx;
-                                u8 txPower;
-
-                                ath9k_get_txgain_index(ah, chan,
-                                (struct calDataPerFreqOpLoop *)pRawDataset,
-                                pCalBChans, numPiers, &txPower, &pcdacIdx);
-                                ath9k_olc_get_pdadcs(ah, pcdacIdx,
-                                                     txPower/2, pdadcValues);
-                        } else {
-                                ath9k_hw_get_def_gain_boundaries_pdadcs(ah,
-                                                        chan, pRawDataset,
-                                                        pCalBChans, numPiers,
-                                                        pdGainOverlap_t2,
-                                                        &tMinCalPower,
-                                                        gainBoundaries,
-                                                        pdadcValues,
-                                                        numXpdGain);
-                        }
-
-                        if ((i == 0) || AR_SREV_5416_20_OR_LATER(ah)) {
-                                if (OLC_FOR_AR9280_20_LATER) {
-                                        REG_WRITE(ah,
-                                                AR_PHY_TPCRG5 + regChainOffset,
-                                                SM(0x6,
-                                                AR_PHY_TPCRG5_PD_GAIN_OVERLAP) |
-                                                SM_PD_GAIN(1) | SM_PD_GAIN(2) |
-                                                SM_PD_GAIN(3) | SM_PD_GAIN(4));
-                                } else {
-                                        REG_WRITE(ah,
-                                                AR_PHY_TPCRG5 + regChainOffset,
-                                                SM(pdGainOverlap_t2,
-                                                AR_PHY_TPCRG5_PD_GAIN_OVERLAP)|
-                                                SM_PDGAIN_B(0, 1) |
-                                                SM_PDGAIN_B(1, 2) |
-                                                SM_PDGAIN_B(2, 3) |
-                                                SM_PDGAIN_B(3, 4));
-                                }
-                        }
-
-                        regOffset = AR_PHY_BASE + (672 << 2) + regChainOffset;
-                        for (j = 0; j < 32; j++) {
-                                reg32 = ((pdadcValues[4 * j + 0] & 0xFF) << 0) |
-                                        ((pdadcValues[4 * j + 1] & 0xFF) << 8) |
-                                        ((pdadcValues[4 * j + 2] & 0xFF) << 16)|
-                                        ((pdadcValues[4 * j + 3] & 0xFF) << 24);
-                                REG_WRITE(ah, regOffset, reg32);
-
-                                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                                        "PDADC (%d,%4x): %4.4x %8.8x\n",
-                                        i, regChainOffset, regOffset,
-                                        reg32);
-                                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                                        "PDADC: Chain %d | PDADC %3d "
-                                        "Value %3d | PDADC %3d Value %3d | "
-                                        "PDADC %3d Value %3d | PDADC %3d "
-                                        "Value %3d |\n",
-                                        i, 4 * j, pdadcValues[4 * j],
-                                        4 * j + 1, pdadcValues[4 * j + 1],
-                                        4 * j + 2, pdadcValues[4 * j + 2],
-                                        4 * j + 3,
-                                        pdadcValues[4 * j + 3]);
-
-                                regOffset += 4;
-                        }
-                }
-        }
-
-        *pTxPowerIndexOffset = 0;
-#undef SM_PD_GAIN
-#undef SM_PDGAIN_B
-}
-
-static void ath9k_hw_set_def_power_per_rate_table(struct ath_hw *ah,
-                                                  struct ath9k_channel *chan,
-                                                  int16_t *ratesArray,
-                                                  u16 cfgCtl,
-                                                  u16 AntennaReduction,
-                                                  u16 twiceMaxRegulatoryPower,
-                                                  u16 powerLimit)
-{
-#define REDUCE_SCALED_POWER_BY_TWO_CHAIN     6  /* 10*log10(2)*2 */
-#define REDUCE_SCALED_POWER_BY_THREE_CHAIN   10 /* 10*log10(3)*2 */
-
-        struct ar5416_eeprom_def *pEepData = &ah->eeprom.def;
-        u16 twiceMaxEdgePower = AR5416_MAX_RATE_POWER;
-        static const u16 tpScaleReductionTable[5] =
-                { 0, 3, 6, 9, AR5416_MAX_RATE_POWER };
-
-        int i;
-        int16_t twiceLargestAntenna;
-        struct cal_ctl_data *rep;
-        struct cal_target_power_leg targetPowerOfdm, targetPowerCck = {
-                0, { 0, 0, 0, 0}
-        };
-        struct cal_target_power_leg targetPowerOfdmExt = {
-                0, { 0, 0, 0, 0} }, targetPowerCckExt = {
-                0, { 0, 0, 0, 0 }
-        };
-        struct cal_target_power_ht targetPowerHt20, targetPowerHt40 = {
-                0, {0, 0, 0, 0}
-        };
-        u16 scaledPower = 0, minCtlPower, maxRegAllowedPower;
-        u16 ctlModesFor11a[] =
-                { CTL_11A, CTL_5GHT20, CTL_11A_EXT, CTL_5GHT40 };
-        u16 ctlModesFor11g[] =
-                { CTL_11B, CTL_11G, CTL_2GHT20, CTL_11B_EXT, CTL_11G_EXT,
-                  CTL_2GHT40
-                };
-        u16 numCtlModes, *pCtlMode, ctlMode, freq;
-        struct chan_centers centers;
-        int tx_chainmask;
-        u16 twiceMinEdgePower;
-
-        tx_chainmask = ah->txchainmask;
-
-        ath9k_hw_get_channel_centers(ah, chan, &centers);
-
-        twiceLargestAntenna = max(
-                pEepData->modalHeader
-                        [IS_CHAN_2GHZ(chan)].antennaGainCh[0],
-                pEepData->modalHeader
-                        [IS_CHAN_2GHZ(chan)].antennaGainCh[1]);
-
-        twiceLargestAntenna = max((u8)twiceLargestAntenna,
-                                  pEepData->modalHeader
-                                  [IS_CHAN_2GHZ(chan)].antennaGainCh[2]);
-
-        twiceLargestAntenna = (int16_t)min(AntennaReduction -
-                                           twiceLargestAntenna, 0);
-
-        maxRegAllowedPower = twiceMaxRegulatoryPower + twiceLargestAntenna;
-
-        if (ah->regulatory.tp_scale != ATH9K_TP_SCALE_MAX) {
-                maxRegAllowedPower -=
-                        (tpScaleReductionTable[(ah->regulatory.tp_scale)] * 2);
-        }
-
-        scaledPower = min(powerLimit, maxRegAllowedPower);
-
-        switch (ar5416_get_ntxchains(tx_chainmask)) {
-        case 1:
-                break;
-        case 2:
-                scaledPower -= REDUCE_SCALED_POWER_BY_TWO_CHAIN;
-                break;
-        case 3:
-                scaledPower -= REDUCE_SCALED_POWER_BY_THREE_CHAIN;
-                break;
-        }
-
-        scaledPower = max((u16)0, scaledPower);
-
-        if (IS_CHAN_2GHZ(chan)) {
-                numCtlModes = ARRAY_SIZE(ctlModesFor11g) -
-                        SUB_NUM_CTL_MODES_AT_2G_40;
-                pCtlMode = ctlModesFor11g;
-
-                ath9k_hw_get_legacy_target_powers(ah, chan,
-                        pEepData->calTargetPowerCck,
-                        AR5416_NUM_2G_CCK_TARGET_POWERS,
-                        &targetPowerCck, 4, false);
-                ath9k_hw_get_legacy_target_powers(ah, chan,
-                        pEepData->calTargetPower2G,
-                        AR5416_NUM_2G_20_TARGET_POWERS,
-                        &targetPowerOfdm, 4, false);
-                ath9k_hw_get_target_powers(ah, chan,
-                        pEepData->calTargetPower2GHT20,
-                        AR5416_NUM_2G_20_TARGET_POWERS,
-                        &targetPowerHt20, 8, false);
-
-                if (IS_CHAN_HT40(chan)) {
-                        numCtlModes = ARRAY_SIZE(ctlModesFor11g);
-                        ath9k_hw_get_target_powers(ah, chan,
-                                pEepData->calTargetPower2GHT40,
-                                AR5416_NUM_2G_40_TARGET_POWERS,
-                                &targetPowerHt40, 8, true);
-                        ath9k_hw_get_legacy_target_powers(ah, chan,
-                                pEepData->calTargetPowerCck,
-                                AR5416_NUM_2G_CCK_TARGET_POWERS,
-                                &targetPowerCckExt, 4, true);
-                        ath9k_hw_get_legacy_target_powers(ah, chan,
-                                pEepData->calTargetPower2G,
-                                AR5416_NUM_2G_20_TARGET_POWERS,
-                                &targetPowerOfdmExt, 4, true);
-                }
-        } else {
-                numCtlModes = ARRAY_SIZE(ctlModesFor11a) -
-                        SUB_NUM_CTL_MODES_AT_5G_40;
-                pCtlMode = ctlModesFor11a;
-
-                ath9k_hw_get_legacy_target_powers(ah, chan,
-                        pEepData->calTargetPower5G,
-                        AR5416_NUM_5G_20_TARGET_POWERS,
-                        &targetPowerOfdm, 4, false);
-                ath9k_hw_get_target_powers(ah, chan,
-                        pEepData->calTargetPower5GHT20,
-                        AR5416_NUM_5G_20_TARGET_POWERS,
-                        &targetPowerHt20, 8, false);
-
-                if (IS_CHAN_HT40(chan)) {
-                        numCtlModes = ARRAY_SIZE(ctlModesFor11a);
-                        ath9k_hw_get_target_powers(ah, chan,
-                                pEepData->calTargetPower5GHT40,
-                                AR5416_NUM_5G_40_TARGET_POWERS,
-                                &targetPowerHt40, 8, true);
-                        ath9k_hw_get_legacy_target_powers(ah, chan,
-                                pEepData->calTargetPower5G,
-                                AR5416_NUM_5G_20_TARGET_POWERS,
-                                &targetPowerOfdmExt, 4, true);
-                }
-        }
-
-        for (ctlMode = 0; ctlMode < numCtlModes; ctlMode++) {
-                bool isHt40CtlMode = (pCtlMode[ctlMode] == CTL_5GHT40) ||
-                        (pCtlMode[ctlMode] == CTL_2GHT40);
-                if (isHt40CtlMode)
-                        freq = centers.synth_center;
-                else if (pCtlMode[ctlMode] & EXT_ADDITIVE)
-                        freq = centers.ext_center;
-                else
-                        freq = centers.ctl_center;
-
-                if (ah->eep_ops->get_eeprom_ver(ah) == 14 &&
-                    ah->eep_ops->get_eeprom_rev(ah) <= 2)
-                        twiceMaxEdgePower = AR5416_MAX_RATE_POWER;
-
-                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                        "LOOP-Mode ctlMode %d < %d, isHt40CtlMode %d, "
-                        "EXT_ADDITIVE %d\n",
-                        ctlMode, numCtlModes, isHt40CtlMode,
-                        (pCtlMode[ctlMode] & EXT_ADDITIVE));
-
-                for (i = 0; (i < AR5416_NUM_CTLS) && pEepData->ctlIndex[i]; i++) {
-                        DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                                "  LOOP-Ctlidx %d: cfgCtl 0x%2.2x "
-                                "pCtlMode 0x%2.2x ctlIndex 0x%2.2x "
-                                "chan %d\n",
-                                i, cfgCtl, pCtlMode[ctlMode],
-                                pEepData->ctlIndex[i], chan->channel);
-
-                        if ((((cfgCtl & ~CTL_MODE_M) |
-                              (pCtlMode[ctlMode] & CTL_MODE_M)) ==
-                             pEepData->ctlIndex[i]) ||
-                            (((cfgCtl & ~CTL_MODE_M) |
-                              (pCtlMode[ctlMode] & CTL_MODE_M)) ==
-                             ((pEepData->ctlIndex[i] & CTL_MODE_M) | SD_NO_CTL))) {
-                                rep = &(pEepData->ctlData[i]);
-
-                                twiceMinEdgePower = ath9k_hw_get_max_edge_power(freq,
-                                rep->ctlEdges[ar5416_get_ntxchains(tx_chainmask) - 1],
-                                IS_CHAN_2GHZ(chan), AR5416_NUM_BAND_EDGES);
-
-                                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                                        "    MATCH-EE_IDX %d: ch %d is2 %d "
-                                        "2xMinEdge %d chainmask %d chains %d\n",
-                                        i, freq, IS_CHAN_2GHZ(chan),
-                                        twiceMinEdgePower, tx_chainmask,
-                                        ar5416_get_ntxchains
-                                        (tx_chainmask));
-                                if ((cfgCtl & ~CTL_MODE_M) == SD_NO_CTL) {
-                                        twiceMaxEdgePower = min(twiceMaxEdgePower,
-                                                                twiceMinEdgePower);
-                                } else {
-                                        twiceMaxEdgePower = twiceMinEdgePower;
-                                        break;
-                                }
-                        }
-                }
-
-                minCtlPower = min(twiceMaxEdgePower, scaledPower);
-
-                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                        "    SEL-Min ctlMode %d pCtlMode %d "
-                        "2xMaxEdge %d sP %d minCtlPwr %d\n",
-                        ctlMode, pCtlMode[ctlMode], twiceMaxEdgePower,
-                        scaledPower, minCtlPower);
-
-                switch (pCtlMode[ctlMode]) {
-                case CTL_11B:
-                        for (i = 0; i < ARRAY_SIZE(targetPowerCck.tPow2x); i++) {
-                                targetPowerCck.tPow2x[i] =
-                                        min((u16)targetPowerCck.tPow2x[i],
-                                            minCtlPower);
-                        }
-                        break;
-                case CTL_11A:
-                case CTL_11G:
-                        for (i = 0; i < ARRAY_SIZE(targetPowerOfdm.tPow2x); i++) {
-                                targetPowerOfdm.tPow2x[i] =
-                                        min((u16)targetPowerOfdm.tPow2x[i],
-                                            minCtlPower);
-                        }
-                        break;
-                case CTL_5GHT20:
-                case CTL_2GHT20:
-                        for (i = 0; i < ARRAY_SIZE(targetPowerHt20.tPow2x); i++) {
-                                targetPowerHt20.tPow2x[i] =
-                                        min((u16)targetPowerHt20.tPow2x[i],
-                                            minCtlPower);
-                        }
-                        break;
-                case CTL_11B_EXT:
-                        targetPowerCckExt.tPow2x[0] = min((u16)
-                                        targetPowerCckExt.tPow2x[0],
-                                        minCtlPower);
-                        break;
-                case CTL_11A_EXT:
-                case CTL_11G_EXT:
-                        targetPowerOfdmExt.tPow2x[0] = min((u16)
-                                        targetPowerOfdmExt.tPow2x[0],
-                                        minCtlPower);
-                        break;
-                case CTL_5GHT40:
-                case CTL_2GHT40:
-                        for (i = 0; i < ARRAY_SIZE(targetPowerHt40.tPow2x); i++) {
-                                targetPowerHt40.tPow2x[i] =
-                                        min((u16)targetPowerHt40.tPow2x[i],
-                                            minCtlPower);
-                        }
-                        break;
-                default:
-                        break;
-                }
-        }
-
-        ratesArray[rate6mb] = ratesArray[rate9mb] = ratesArray[rate12mb] =
-                ratesArray[rate18mb] = ratesArray[rate24mb] =
-                targetPowerOfdm.tPow2x[0];
-        ratesArray[rate36mb] = targetPowerOfdm.tPow2x[1];
-        ratesArray[rate48mb] = targetPowerOfdm.tPow2x[2];
-        ratesArray[rate54mb] = targetPowerOfdm.tPow2x[3];
-        ratesArray[rateXr] = targetPowerOfdm.tPow2x[0];
-
-        for (i = 0; i < ARRAY_SIZE(targetPowerHt20.tPow2x); i++)
-                ratesArray[rateHt20_0 + i] = targetPowerHt20.tPow2x[i];
-
-        if (IS_CHAN_2GHZ(chan)) {
-                ratesArray[rate1l] = targetPowerCck.tPow2x[0];
-                ratesArray[rate2s] = ratesArray[rate2l] =
-                        targetPowerCck.tPow2x[1];
-                ratesArray[rate5_5s] = ratesArray[rate5_5l] =
-                        targetPowerCck.tPow2x[2];
-                ratesArray[rate11s] = ratesArray[rate11l] =
-                        targetPowerCck.tPow2x[3];
-        }
-        if (IS_CHAN_HT40(chan)) {
-                for (i = 0; i < ARRAY_SIZE(targetPowerHt40.tPow2x); i++) {
-                        ratesArray[rateHt40_0 + i] =
-                                targetPowerHt40.tPow2x[i];
-                }
-                ratesArray[rateDupOfdm] = targetPowerHt40.tPow2x[0];
-                ratesArray[rateDupCck] = targetPowerHt40.tPow2x[0];
-                ratesArray[rateExtOfdm] = targetPowerOfdmExt.tPow2x[0];
-                if (IS_CHAN_2GHZ(chan)) {
-                        ratesArray[rateExtCck] =
-                                targetPowerCckExt.tPow2x[0];
-                }
-        }
-}
-
-static void ath9k_hw_def_set_txpower(struct ath_hw *ah,
-                                    struct ath9k_channel *chan,
-                                    u16 cfgCtl,
-                                    u8 twiceAntennaReduction,
-                                    u8 twiceMaxRegulatoryPower,
-                                    u8 powerLimit)
-{
-#define RT_AR_DELTA(x) (ratesArray[x] - cck_ofdm_delta)
-        struct ar5416_eeprom_def *pEepData = &ah->eeprom.def;
-        struct modal_eep_header *pModal =
-                &(pEepData->modalHeader[IS_CHAN_2GHZ(chan)]);
-        int16_t ratesArray[Ar5416RateSize];
-        int16_t txPowerIndexOffset = 0;
-        u8 ht40PowerIncForPdadc = 2;
-        int i, cck_ofdm_delta = 0;
-
-        memset(ratesArray, 0, sizeof(ratesArray));
-
-        if ((pEepData->baseEepHeader.version & AR5416_EEP_VER_MINOR_MASK) >=
-            AR5416_EEP_MINOR_VER_2) {
-                ht40PowerIncForPdadc = pModal->ht40PowerIncForPdadc;
-        }
-
-        ath9k_hw_set_def_power_per_rate_table(ah, chan,
-                                               &ratesArray[0], cfgCtl,
-                                               twiceAntennaReduction,
-                                               twiceMaxRegulatoryPower,
-                                               powerLimit);
-
-        ath9k_hw_set_def_power_cal_table(ah, chan, &txPowerIndexOffset);
-
-        for (i = 0; i < ARRAY_SIZE(ratesArray); i++) {
-                ratesArray[i] = (int16_t)(txPowerIndexOffset + ratesArray[i]);
-                if (ratesArray[i] > AR5416_MAX_RATE_POWER)
-                        ratesArray[i] = AR5416_MAX_RATE_POWER;
-        }
-
-        if (AR_SREV_9280_10_OR_LATER(ah)) {
-                for (i = 0; i < Ar5416RateSize; i++)
-                        ratesArray[i] -= AR5416_PWR_TABLE_OFFSET * 2;
-        }
-
-        REG_WRITE(ah, AR_PHY_POWER_TX_RATE1,
-                  ATH9K_POW_SM(ratesArray[rate18mb], 24)
-                  | ATH9K_POW_SM(ratesArray[rate12mb], 16)
-                  | ATH9K_POW_SM(ratesArray[rate9mb], 8)
-                  | ATH9K_POW_SM(ratesArray[rate6mb], 0));
-        REG_WRITE(ah, AR_PHY_POWER_TX_RATE2,
-                  ATH9K_POW_SM(ratesArray[rate54mb], 24)
-                  | ATH9K_POW_SM(ratesArray[rate48mb], 16)
-                  | ATH9K_POW_SM(ratesArray[rate36mb], 8)
-                  | ATH9K_POW_SM(ratesArray[rate24mb], 0));
-
-        if (IS_CHAN_2GHZ(chan)) {
-                if (OLC_FOR_AR9280_20_LATER) {
-                        cck_ofdm_delta = 2;
-                        REG_WRITE(ah, AR_PHY_POWER_TX_RATE3,
-                                ATH9K_POW_SM(RT_AR_DELTA(rate2s), 24)
-                                | ATH9K_POW_SM(RT_AR_DELTA(rate2l), 16)
-                                | ATH9K_POW_SM(ratesArray[rateXr], 8)
-                                | ATH9K_POW_SM(RT_AR_DELTA(rate1l), 0));
-                        REG_WRITE(ah, AR_PHY_POWER_TX_RATE4,
-                                ATH9K_POW_SM(RT_AR_DELTA(rate11s), 24)
-                                | ATH9K_POW_SM(RT_AR_DELTA(rate11l), 16)
-                                | ATH9K_POW_SM(RT_AR_DELTA(rate5_5s), 8)
-                                | ATH9K_POW_SM(RT_AR_DELTA(rate5_5l), 0));
-                } else {
-                        REG_WRITE(ah, AR_PHY_POWER_TX_RATE3,
-                                ATH9K_POW_SM(ratesArray[rate2s], 24)
-                                | ATH9K_POW_SM(ratesArray[rate2l], 16)
-                                | ATH9K_POW_SM(ratesArray[rateXr], 8)
-                                | ATH9K_POW_SM(ratesArray[rate1l], 0));
-                        REG_WRITE(ah, AR_PHY_POWER_TX_RATE4,
-                                ATH9K_POW_SM(ratesArray[rate11s], 24)
-                                | ATH9K_POW_SM(ratesArray[rate11l], 16)
-                                | ATH9K_POW_SM(ratesArray[rate5_5s], 8)
-                                | ATH9K_POW_SM(ratesArray[rate5_5l], 0));
-                }
-        }
-
-        REG_WRITE(ah, AR_PHY_POWER_TX_RATE5,
-                  ATH9K_POW_SM(ratesArray[rateHt20_3], 24)
-                  | ATH9K_POW_SM(ratesArray[rateHt20_2], 16)
-                  | ATH9K_POW_SM(ratesArray[rateHt20_1], 8)
-                  | ATH9K_POW_SM(ratesArray[rateHt20_0], 0));
-        REG_WRITE(ah, AR_PHY_POWER_TX_RATE6,
-                  ATH9K_POW_SM(ratesArray[rateHt20_7], 24)
-                  | ATH9K_POW_SM(ratesArray[rateHt20_6], 16)
-                  | ATH9K_POW_SM(ratesArray[rateHt20_5], 8)
-                  | ATH9K_POW_SM(ratesArray[rateHt20_4], 0));
-
-        if (IS_CHAN_HT40(chan)) {
-                REG_WRITE(ah, AR_PHY_POWER_TX_RATE7,
-                          ATH9K_POW_SM(ratesArray[rateHt40_3] +
-                                       ht40PowerIncForPdadc, 24)
-                          | ATH9K_POW_SM(ratesArray[rateHt40_2] +
-                                         ht40PowerIncForPdadc, 16)
-                          | ATH9K_POW_SM(ratesArray[rateHt40_1] +
-                                         ht40PowerIncForPdadc, 8)
-                          | ATH9K_POW_SM(ratesArray[rateHt40_0] +
-                                         ht40PowerIncForPdadc, 0));
-                REG_WRITE(ah, AR_PHY_POWER_TX_RATE8,
-                          ATH9K_POW_SM(ratesArray[rateHt40_7] +
-                                       ht40PowerIncForPdadc, 24)
-                          | ATH9K_POW_SM(ratesArray[rateHt40_6] +
-                                         ht40PowerIncForPdadc, 16)
-                          | ATH9K_POW_SM(ratesArray[rateHt40_5] +
-                                         ht40PowerIncForPdadc, 8)
-                          | ATH9K_POW_SM(ratesArray[rateHt40_4] +
-                                         ht40PowerIncForPdadc, 0));
-                if (OLC_FOR_AR9280_20_LATER) {
-                        REG_WRITE(ah, AR_PHY_POWER_TX_RATE9,
-                                ATH9K_POW_SM(ratesArray[rateExtOfdm], 24)
-                                | ATH9K_POW_SM(RT_AR_DELTA(rateExtCck), 16)
-                                | ATH9K_POW_SM(ratesArray[rateDupOfdm], 8)
-                                | ATH9K_POW_SM(RT_AR_DELTA(rateDupCck), 0));
-                } else {
-                        REG_WRITE(ah, AR_PHY_POWER_TX_RATE9,
-                                ATH9K_POW_SM(ratesArray[rateExtOfdm], 24)
-                                | ATH9K_POW_SM(ratesArray[rateExtCck], 16)
-                                | ATH9K_POW_SM(ratesArray[rateDupOfdm], 8)
-                                | ATH9K_POW_SM(ratesArray[rateDupCck], 0));
-                }
-        }
-
-        REG_WRITE(ah, AR_PHY_POWER_TX_SUB,
-                  ATH9K_POW_SM(pModal->pwrDecreaseFor3Chain, 6)
-                  | ATH9K_POW_SM(pModal->pwrDecreaseFor2Chain, 0));
-
-        i = rate6mb;
-
-        if (IS_CHAN_HT40(chan))
-                i = rateHt40_0;
-        else if (IS_CHAN_HT20(chan))
-                i = rateHt20_0;
-
-        if (AR_SREV_9280_10_OR_LATER(ah))
-                ah->regulatory.max_power_level =
-                        ratesArray[i] + AR5416_PWR_TABLE_OFFSET * 2;
-        else
-                ah->regulatory.max_power_level = ratesArray[i];
-
-        switch(ar5416_get_ntxchains(ah->txchainmask)) {
-        case 1:
-                break;
-        case 2:
-                ah->regulatory.max_power_level += INCREASE_MAXPOW_BY_TWO_CHAIN;
-                break;
-        case 3:
-                ah->regulatory.max_power_level += INCREASE_MAXPOW_BY_THREE_CHAIN;
-                break;
-        default:
-                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                        "Invalid chainmask configuration\n");
-                break;
-        }
-}
-
-static u8 ath9k_hw_def_get_num_ant_config(struct ath_hw *ah,
-                                          enum ieee80211_band freq_band)
-{
-        struct ar5416_eeprom_def *eep = &ah->eeprom.def;
-        struct modal_eep_header *pModal =
-                &(eep->modalHeader[ATH9K_HAL_FREQ_BAND_2GHZ == freq_band]);
-        struct base_eep_header *pBase = &eep->baseEepHeader;
-        u8 num_ant_config;
-
-        num_ant_config = 1;
-
-        if (pBase->version >= 0x0E0D)
-                if (pModal->useAnt1)
-                        num_ant_config += 1;
-
-        return num_ant_config;
-}
-
-static u16 ath9k_hw_def_get_eeprom_antenna_cfg(struct ath_hw *ah,
-                                               struct ath9k_channel *chan)
-{
-        struct ar5416_eeprom_def *eep = &ah->eeprom.def;
-        struct modal_eep_header *pModal =
-                &(eep->modalHeader[IS_CHAN_2GHZ(chan)]);
-
-        return pModal->antCtrlCommon & 0xFFFF;
-}
-
-static u16 ath9k_hw_def_get_spur_channel(struct ath_hw *ah, u16 i, bool is2GHz)
-{
-#define EEP_DEF_SPURCHAN \
-        (ah->eeprom.def.modalHeader[is2GHz].spurChans[i].spurChan)
-
-        u16 spur_val = AR_NO_SPUR;
-
-        DPRINTF(ah->ah_sc, ATH_DBG_ANI,
-                "Getting spur idx %d is2Ghz. %d val %x\n",
-                i, is2GHz, ah->config.spurchans[i][is2GHz]);
-
-        switch (ah->config.spurmode) {
-        case SPUR_DISABLE:
-                break;
-        case SPUR_ENABLE_IOCTL:
-                spur_val = ah->config.spurchans[i][is2GHz];
-                DPRINTF(ah->ah_sc, ATH_DBG_ANI,
-                        "Getting spur val from new loc. %d\n", spur_val);
-                break;
-        case SPUR_ENABLE_EEPROM:
-                spur_val = EEP_DEF_SPURCHAN;
-                break;
-        }
-
-        return spur_val;
-
-#undef EEP_DEF_SPURCHAN
-}
-
-static struct eeprom_ops eep_def_ops = {
-        .check_eeprom           = ath9k_hw_def_check_eeprom,
-        .get_eeprom             = ath9k_hw_def_get_eeprom,
-        .fill_eeprom            = ath9k_hw_def_fill_eeprom,
-        .get_eeprom_ver         = ath9k_hw_def_get_eeprom_ver,
-        .get_eeprom_rev         = ath9k_hw_def_get_eeprom_rev,
-        .get_num_ant_config     = ath9k_hw_def_get_num_ant_config,
-        .get_eeprom_antenna_cfg = ath9k_hw_def_get_eeprom_antenna_cfg,
-        .set_board_values       = ath9k_hw_def_set_board_values,
-        .set_addac              = ath9k_hw_def_set_addac,
-        .set_txpower            = ath9k_hw_def_set_txpower,
-        .get_spur_channel       = ath9k_hw_def_get_spur_channel
-};
-
-
-static int ath9k_hw_AR9287_get_eeprom_ver(struct ath_hw *ah)
-{
-        return (ah->eeprom.map9287.baseEepHeader.version >> 12) & 0xF;
-}
-
-static int ath9k_hw_AR9287_get_eeprom_rev(struct ath_hw *ah)
-{
-        return (ah->eeprom.map9287.baseEepHeader.version) & 0xFFF;
-}
-
-static bool ath9k_hw_AR9287_fill_eeprom(struct ath_hw *ah)
-{
-        struct ar9287_eeprom *eep = &ah->eeprom.map9287;
-        u16 *eep_data;
-        int addr, eep_start_loc = AR9287_EEP_START_LOC;
-        eep_data = (u16 *)eep;
-        if (!ath9k_hw_use_flash(ah)) {
-                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                                "Reading from EEPROM, not flash\n");
-        }
-
-        for (addr = 0; addr < sizeof(struct ar9287_eeprom) / sizeof(u16);
-                        addr++) {
-                if (!ath9k_hw_nvram_read(ah, addr + eep_start_loc, eep_data)) {
-                        DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                                        "Unable to read eeprom region \n");
-                        return false;
-                }
-                eep_data++;
-        }
-        return true;
-}
-static int ath9k_hw_AR9287_check_eeprom(struct ath_hw *ah)
-{
-        u32 sum = 0, el, integer;
-        u16 temp, word, magic, magic2, *eepdata;
-        int i, addr;
-        bool need_swap = false;
-        struct ar9287_eeprom *eep = &ah->eeprom.map9287;
-
-        if (!ath9k_hw_use_flash(ah)) {
-                if (!ath9k_hw_nvram_read
-                                (ah, AR5416_EEPROM_MAGIC_OFFSET, &magic)) {
-                        DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
-                                        "Reading Magic # failed\n");
-                        return false;
-                }
-
-                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                                "Read Magic = 0x%04X\n", magic);
-                if (magic != AR5416_EEPROM_MAGIC) {
-
-
-                        magic2 = swab16(magic);
-
-                        if (magic2 == AR5416_EEPROM_MAGIC) {
-                                need_swap = true;
-                                eepdata = (u16 *)(&ah->eeprom);
-
-                                for (addr = 0;
-                                     addr < sizeof(struct ar9287_eeprom) / sizeof(u16);
-                                     addr++) {
-                                        temp = swab16(*eepdata);
-                                        *eepdata = temp;
-                                        eepdata++;
-                                }
-                        } else {
-                                DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
-                                                "Invalid EEPROM Magic. "
-                                                "endianness mismatch.\n");
-                                return -EINVAL;            }
-                }
-        }
-        DPRINTF(ah->ah_sc, ATH_DBG_EEPROM, "need_swap = %s.\n", need_swap ?
-                                           "True" : "False");
-
-        if (need_swap)
-                el = swab16(ah->eeprom.map9287.baseEepHeader.length);
-        else
-                el = ah->eeprom.map9287.baseEepHeader.length;
-
-        if (el > sizeof(struct ar9287_eeprom))
-                el = sizeof(struct ar9287_eeprom) / sizeof(u16);
-        else
-                el = el / sizeof(u16);
-
-        eepdata = (u16 *)(&ah->eeprom);
-        for (i = 0; i < el; i++)
-                sum ^= *eepdata++;
-
-        if (need_swap) {
-                word = swab16(eep->baseEepHeader.length);
-                eep->baseEepHeader.length = word;
-
-                word = swab16(eep->baseEepHeader.checksum);
-                eep->baseEepHeader.checksum = word;
-
-                word = swab16(eep->baseEepHeader.version);
-                eep->baseEepHeader.version = word;
-
-                word = swab16(eep->baseEepHeader.regDmn[0]);
-                eep->baseEepHeader.regDmn[0] = word;
-
-                word = swab16(eep->baseEepHeader.regDmn[1]);
-                eep->baseEepHeader.regDmn[1] = word;
-
-                word = swab16(eep->baseEepHeader.rfSilent);
-                eep->baseEepHeader.rfSilent = word;
-
-                word = swab16(eep->baseEepHeader.blueToothOptions);
-                eep->baseEepHeader.blueToothOptions = word;
-
-                word = swab16(eep->baseEepHeader.deviceCap);
-                eep->baseEepHeader.deviceCap = word;
-
-                integer = swab32(eep->modalHeader.antCtrlCommon);
-                eep->modalHeader.antCtrlCommon = integer;
-
-                for (i = 0; i < AR9287_MAX_CHAINS; i++) {
-                        integer = swab32(eep->modalHeader.antCtrlChain[i]);
-                        eep->modalHeader.antCtrlChain[i] = integer;
-                }
-
-                for (i = 0; i < AR9287_EEPROM_MODAL_SPURS; i++) {
-                        word = swab16(eep->modalHeader.spurChans[i].spurChan);
-                        eep->modalHeader.spurChans[i].spurChan = word;
-                }
-        }
-
-        if (sum != 0xffff || ah->eep_ops->get_eeprom_ver(ah) != AR9287_EEP_VER
-            || ah->eep_ops->get_eeprom_rev(ah) < AR5416_EEP_NO_BACK_VER) {
-                DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
-                        "Bad EEPROM checksum 0x%x or revision 0x%04x\n",
-                         sum, ah->eep_ops->get_eeprom_ver(ah));
-                return -EINVAL;
-        }
-
-        return 0;
-}
-
-static u32 ath9k_hw_AR9287_get_eeprom(struct ath_hw *ah,
-                enum eeprom_param param)
-{
-        struct ar9287_eeprom *eep = &ah->eeprom.map9287;
-        struct modal_eep_ar9287_header *pModal = &eep->modalHeader;
-        struct base_eep_ar9287_header *pBase = &eep->baseEepHeader;
-        u16 ver_minor;
-
-        ver_minor = pBase->version & AR9287_EEP_VER_MINOR_MASK;
-        switch (param) {
-        case EEP_NFTHRESH_2:
-                return pModal->noiseFloorThreshCh[0];
-        case AR_EEPROM_MAC(0):
-                return pBase->macAddr[0] << 8 | pBase->macAddr[1];
-        case AR_EEPROM_MAC(1):
-                return pBase->macAddr[2] << 8 | pBase->macAddr[3];
-        case AR_EEPROM_MAC(2):
-                return pBase->macAddr[4] << 8 | pBase->macAddr[5];
-        case EEP_REG_0:
-                return pBase->regDmn[0];
-        case EEP_REG_1:
-                return pBase->regDmn[1];
-        case EEP_OP_CAP:
-                return pBase->deviceCap;
-        case EEP_OP_MODE:
-                return pBase->opCapFlags;
-        case EEP_RF_SILENT:
-                return pBase->rfSilent;
-        case EEP_MINOR_REV:
-                return ver_minor;
-        case EEP_TX_MASK:
-                return pBase->txMask;
-        case EEP_RX_MASK:
-                return pBase->rxMask;
-        case EEP_DEV_TYPE:
-                return pBase->deviceType;
-        case EEP_OL_PWRCTRL:
-                return pBase->openLoopPwrCntl;
-        case EEP_TEMPSENSE_SLOPE:
-                if (ver_minor >= AR9287_EEP_MINOR_VER_2)
-                        return pBase->tempSensSlope;
-                else
-                        return 0;
-        case EEP_TEMPSENSE_SLOPE_PAL_ON:
-                if (ver_minor >= AR9287_EEP_MINOR_VER_3)
-                        return pBase->tempSensSlopePalOn;
-                else
-                        return 0;
-        default:
-                return 0;
-        }
-}
-
-
-static void ath9k_hw_get_AR9287_gain_boundaries_pdadcs(struct ath_hw *ah,
-                                   struct ath9k_channel *chan,
-                                   struct cal_data_per_freq_ar9287 *pRawDataSet,
-                                   u8 *bChans,  u16 availPiers,
-                                   u16 tPdGainOverlap, int16_t *pMinCalPower,
-                                   u16 *pPdGainBoundaries, u8 *pPDADCValues,
-                                   u16 numXpdGains)
-{
-#define TMP_VAL_VPD_TABLE \
-        ((vpdTableI[i][sizeCurrVpdTable - 1] + (ss - maxIndex + 1) * vpdStep));
-        int       i, j, k;
-        int16_t   ss;
-        u16  idxL = 0, idxR = 0, numPiers;
-        u8   *pVpdL, *pVpdR, *pPwrL, *pPwrR;
-        u8   minPwrT4[AR9287_NUM_PD_GAINS];
-        u8   maxPwrT4[AR9287_NUM_PD_GAINS];
-        int16_t   vpdStep;
-        int16_t   tmpVal;
-        u16  sizeCurrVpdTable, maxIndex, tgtIndex;
-        bool    match;
-        int16_t  minDelta = 0;
-        struct chan_centers centers;
-        static u8 vpdTableL[AR5416_EEP4K_NUM_PD_GAINS]
-                [AR5416_MAX_PWR_RANGE_IN_HALF_DB];
-        static u8 vpdTableR[AR5416_EEP4K_NUM_PD_GAINS]
-                [AR5416_MAX_PWR_RANGE_IN_HALF_DB];
-        static u8 vpdTableI[AR5416_EEP4K_NUM_PD_GAINS]
-                [AR5416_MAX_PWR_RANGE_IN_HALF_DB];
-
-        ath9k_hw_get_channel_centers(ah, chan, &centers);
-        for (numPiers = 0; numPiers < availPiers; numPiers++) {
-                if (bChans[numPiers] == AR9287_BCHAN_UNUSED)
-                        break;
-        }
-
-        match = ath9k_hw_get_lower_upper_index(
-                                   (u8)FREQ2FBIN(centers.synth_center,
-                                    IS_CHAN_2GHZ(chan)), bChans, numPiers,
-                                    &idxL, &idxR);
-
-        if (match) {
-                for (i = 0; i < numXpdGains; i++) {
-                        minPwrT4[i] = pRawDataSet[idxL].pwrPdg[i][0];
-                        maxPwrT4[i] = pRawDataSet[idxL].pwrPdg[i][4];
-                        ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
-                                        pRawDataSet[idxL].pwrPdg[i],
-                                        pRawDataSet[idxL].vpdPdg[i],
-                                        AR9287_PD_GAIN_ICEPTS, vpdTableI[i]);
-                }
-        } else {
-                for (i = 0; i < numXpdGains; i++) {
-                        pVpdL = pRawDataSet[idxL].vpdPdg[i];
-                        pPwrL = pRawDataSet[idxL].pwrPdg[i];
-                        pVpdR = pRawDataSet[idxR].vpdPdg[i];
-                        pPwrR = pRawDataSet[idxR].pwrPdg[i];
-
-                        minPwrT4[i] = max(pPwrL[0], pPwrR[0]);
-
-                        maxPwrT4[i] =
-                                min(pPwrL[AR9287_PD_GAIN_ICEPTS - 1],
-                                    pPwrR[AR9287_PD_GAIN_ICEPTS - 1]);
-
-                        ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
-                                        pPwrL, pVpdL,
-                                        AR9287_PD_GAIN_ICEPTS,
-                                        vpdTableL[i]);
-                        ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
-                                        pPwrR, pVpdR,
-                                        AR9287_PD_GAIN_ICEPTS,
-                                        vpdTableR[i]);
-
-                        for (j = 0; j <= (maxPwrT4[i] - minPwrT4[i]) / 2; j++) {
-                                vpdTableI[i][j] =
-                                        (u8)(ath9k_hw_interpolate((u16)
-                                        FREQ2FBIN(centers. synth_center,
-                                        IS_CHAN_2GHZ(chan)),
-                                        bChans[idxL], bChans[idxR],
-                                        vpdTableL[i][j], vpdTableR[i][j]));
-                        }
-                }
-        }
-        *pMinCalPower = (int16_t)(minPwrT4[0] / 2);
-
-        k = 0;
-        for (i = 0; i < numXpdGains; i++) {
-                if (i == (numXpdGains - 1))
-                        pPdGainBoundaries[i] = (u16)(maxPwrT4[i] / 2);
-                else
-                        pPdGainBoundaries[i] = (u16)((maxPwrT4[i] +
-                                                      minPwrT4[i+1]) / 4);
-
-                pPdGainBoundaries[i] = min((u16)AR5416_MAX_RATE_POWER,
-                                            pPdGainBoundaries[i]);
-
-
-                if ((i == 0) && !AR_SREV_5416_20_OR_LATER(ah)) {
-                        minDelta = pPdGainBoundaries[0] - 23;
-                        pPdGainBoundaries[0] = 23;
-                } else
-                        minDelta = 0;
-
-                if (i == 0) {
-                        if (AR_SREV_9280_10_OR_LATER(ah))
-                                ss = (int16_t)(0 - (minPwrT4[i] / 2));
-                        else
-                                ss = 0;
-                } else
-                        ss = (int16_t)((pPdGainBoundaries[i-1] -
-                                       (minPwrT4[i] / 2)) -
-                                       tPdGainOverlap + 1 + minDelta);
-
-                vpdStep = (int16_t)(vpdTableI[i][1] - vpdTableI[i][0]);
-                vpdStep = (int16_t)((vpdStep < 1) ? 1 : vpdStep);
-                while ((ss < 0) && (k < (AR9287_NUM_PDADC_VALUES - 1))) {
-                        tmpVal = (int16_t)(vpdTableI[i][0] + ss * vpdStep);
-                        pPDADCValues[k++] = (u8)((tmpVal < 0) ? 0 : tmpVal);
-                        ss++;
-                }
-
-                sizeCurrVpdTable = (u8)((maxPwrT4[i] - minPwrT4[i]) / 2 + 1);
-                tgtIndex = (u8)(pPdGainBoundaries[i] +
-                                tPdGainOverlap - (minPwrT4[i] / 2));
-                maxIndex = (tgtIndex < sizeCurrVpdTable) ?
-                            tgtIndex : sizeCurrVpdTable;
-
-                while ((ss < maxIndex) && (k < (AR9287_NUM_PDADC_VALUES - 1)))
-                        pPDADCValues[k++] = vpdTableI[i][ss++];
-
-                vpdStep = (int16_t)(vpdTableI[i][sizeCurrVpdTable - 1] -
-                                    vpdTableI[i][sizeCurrVpdTable - 2]);
-                vpdStep = (int16_t)((vpdStep < 1) ? 1 : vpdStep);
-                if (tgtIndex > maxIndex) {
-                        while ((ss <= tgtIndex) &&
-                                (k < (AR9287_NUM_PDADC_VALUES - 1))) {
-                                tmpVal = (int16_t) TMP_VAL_VPD_TABLE;
-                                pPDADCValues[k++] = (u8)((tmpVal > 255) ?
-                                                          255 : tmpVal);
-                                ss++;
-                        }
-                }
-        }
-
-        while (i < AR9287_PD_GAINS_IN_MASK) {
-                pPdGainBoundaries[i] = pPdGainBoundaries[i-1];
-                i++;
-        }
-
-        while (k < AR9287_NUM_PDADC_VALUES) {
-                pPDADCValues[k] = pPDADCValues[k-1];
-                k++;
-        }
-
-#undef TMP_VAL_VPD_TABLE
-}
-
-static void ar9287_eeprom_get_tx_gain_index(struct ath_hw *ah,
-                struct ath9k_channel *chan,
-                struct cal_data_op_loop_ar9287 *pRawDatasetOpLoop,
-                u8 *pCalChans,  u16 availPiers,
-                int8_t *pPwr)
-{
-        u8 pcdac, i = 0;
-        u16  idxL = 0, idxR = 0, numPiers;
-        bool match;
-        struct chan_centers centers;
-        ath9k_hw_get_channel_centers(ah, chan, &centers);
-        for (numPiers = 0; numPiers < availPiers; numPiers++) {
-                if (pCalChans[numPiers] == AR9287_BCHAN_UNUSED)
-                        break;
-        }
-
-        match = ath9k_hw_get_lower_upper_index(
-                        (u8)FREQ2FBIN(centers.synth_center, IS_CHAN_2GHZ(chan)),
-                        pCalChans, numPiers,
-                        &idxL, &idxR);
-
-        if (match) {
-                pcdac = pRawDatasetOpLoop[idxL].pcdac[0][0];
-                *pPwr = pRawDatasetOpLoop[idxL].pwrPdg[0][0];
-        } else {
-                pcdac = pRawDatasetOpLoop[idxR].pcdac[0][0];
-                *pPwr = (pRawDatasetOpLoop[idxL].pwrPdg[0][0] +
-                                pRawDatasetOpLoop[idxR].pwrPdg[0][0])/2;
-        }
-
-        while ((pcdac > ah->originalGain[i]) &&
-                        (i < (AR9280_TX_GAIN_TABLE_SIZE - 1)))
-                i++;
-}
-
-static void ar9287_eeprom_olpc_set_pdadcs(struct ath_hw *ah,
-                                          int32_t txPower, u16 chain)
-{
-        u32 tmpVal;
-        u32 a;
-
-        tmpVal = REG_READ(ah, 0xa270);
-        tmpVal = tmpVal & 0xFCFFFFFF;
-        tmpVal = tmpVal | (0x3 << 24);
-        REG_WRITE(ah, 0xa270, tmpVal);
-
-        tmpVal = REG_READ(ah, 0xb270);
-        tmpVal = tmpVal & 0xFCFFFFFF;
-        tmpVal = tmpVal | (0x3 << 24);
-        REG_WRITE(ah, 0xb270, tmpVal);
-
-        if (chain == 0) {
-                tmpVal = REG_READ(ah, 0xa398);
-                tmpVal = tmpVal & 0xff00ffff;
-                a = (txPower)&0xff;
-                tmpVal = tmpVal | (a << 16);
-                REG_WRITE(ah, 0xa398, tmpVal);
-        }
-
-        if (chain == 1) {
-                tmpVal = REG_READ(ah, 0xb398);
-                tmpVal = tmpVal & 0xff00ffff;
-                a = (txPower)&0xff;
-                tmpVal = tmpVal | (a << 16);
-                REG_WRITE(ah, 0xb398, tmpVal);
-        }
-}
-
-
-static void ath9k_hw_set_AR9287_power_cal_table(struct ath_hw *ah,
-                struct ath9k_channel *chan, int16_t *pTxPowerIndexOffset)
-{
-        struct cal_data_per_freq_ar9287 *pRawDataset;
-        struct cal_data_op_loop_ar9287 *pRawDatasetOpenLoop;
-        u8  *pCalBChans = NULL;
-        u16 pdGainOverlap_t2;
-        u8  pdadcValues[AR9287_NUM_PDADC_VALUES];
-        u16 gainBoundaries[AR9287_PD_GAINS_IN_MASK];
-        u16 numPiers = 0, i, j;
-        int16_t  tMinCalPower;
-        u16 numXpdGain, xpdMask;
-        u16 xpdGainValues[AR9287_NUM_PD_GAINS] = {0, 0, 0, 0};
-        u32 reg32, regOffset, regChainOffset;
-        int16_t   modalIdx, diff = 0;
-        struct ar9287_eeprom *pEepData = &ah->eeprom.map9287;
-        modalIdx = IS_CHAN_2GHZ(chan) ? 1 : 0;
-        xpdMask = pEepData->modalHeader.xpdGain;
-        if ((pEepData->baseEepHeader.version & AR9287_EEP_VER_MINOR_MASK) >=
-                        AR9287_EEP_MINOR_VER_2)
-                pdGainOverlap_t2 = pEepData->modalHeader.pdGainOverlap;
-        else
-                pdGainOverlap_t2 = (u16)(MS(REG_READ(ah, AR_PHY_TPCRG5),
-                                            AR_PHY_TPCRG5_PD_GAIN_OVERLAP));
-
-        if (IS_CHAN_2GHZ(chan)) {
-                pCalBChans = pEepData->calFreqPier2G;
-                numPiers = AR9287_NUM_2G_CAL_PIERS;
-                if (ath9k_hw_AR9287_get_eeprom(ah, EEP_OL_PWRCTRL)) {
-                        pRawDatasetOpenLoop =
-                                (struct cal_data_op_loop_ar9287 *)
-                                pEepData->calPierData2G[0];
-                        ah->initPDADC = pRawDatasetOpenLoop->vpdPdg[0][0];
-                }
-        }
-
-        numXpdGain = 0;
-        for (i = 1; i <= AR9287_PD_GAINS_IN_MASK; i++) {
-                if ((xpdMask >> (AR9287_PD_GAINS_IN_MASK - i)) & 1) {
-                        if (numXpdGain >= AR9287_NUM_PD_GAINS)
-                                break;
-                        xpdGainValues[numXpdGain] =
-                                (u16)(AR9287_PD_GAINS_IN_MASK-i);
-                        numXpdGain++;
-                }
-        }
-
-        REG_RMW_FIELD(ah, AR_PHY_TPCRG1, AR_PHY_TPCRG1_NUM_PD_GAIN,
-                      (numXpdGain - 1) & 0x3);
-        REG_RMW_FIELD(ah, AR_PHY_TPCRG1, AR_PHY_TPCRG1_PD_GAIN_1,
-                      xpdGainValues[0]);
-        REG_RMW_FIELD(ah, AR_PHY_TPCRG1, AR_PHY_TPCRG1_PD_GAIN_2,
-                      xpdGainValues[1]);
-        REG_RMW_FIELD(ah, AR_PHY_TPCRG1, AR_PHY_TPCRG1_PD_GAIN_3,
-                      xpdGainValues[2]);
-
-        for (i = 0; i < AR9287_MAX_CHAINS; i++) {
-                regChainOffset = i * 0x1000;
-                if (pEepData->baseEepHeader.txMask & (1 << i)) {
-                        pRawDatasetOpenLoop = (struct cal_data_op_loop_ar9287 *)
-                                               pEepData->calPierData2G[i];
-                        if (ath9k_hw_AR9287_get_eeprom(ah, EEP_OL_PWRCTRL)) {
-                                int8_t txPower;
-                                ar9287_eeprom_get_tx_gain_index(ah, chan,
-                                                          pRawDatasetOpenLoop,
-                                                          pCalBChans, numPiers,
-                                                          &txPower);
-                                ar9287_eeprom_olpc_set_pdadcs(ah, txPower, i);
-                        } else {
-                                pRawDataset =
-                                        (struct cal_data_per_freq_ar9287 *)
-                                        pEepData->calPierData2G[i];
-                                ath9k_hw_get_AR9287_gain_boundaries_pdadcs(
-                                                  ah, chan, pRawDataset,
-                                                  pCalBChans, numPiers,
-                                                  pdGainOverlap_t2,
-                                                  &tMinCalPower, gainBoundaries,
-                                                  pdadcValues, numXpdGain);
-                        }
-
-                        if (i == 0) {
-                                if (!ath9k_hw_AR9287_get_eeprom(
-                                                        ah, EEP_OL_PWRCTRL)) {
-                                        REG_WRITE(ah, AR_PHY_TPCRG5 +
-                                            regChainOffset,
-                                            SM(pdGainOverlap_t2,
-                                            AR_PHY_TPCRG5_PD_GAIN_OVERLAP) |
-                                            SM(gainBoundaries[0],
-                                             AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_1)
-                                             | SM(gainBoundaries[1],
-                                             AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_2)
-                                             | SM(gainBoundaries[2],
-                                             AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_3)
-                                             | SM(gainBoundaries[3],
-                                             AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_4));
-                                }
-                        }
-
-                        if ((int32_t)AR9287_PWR_TABLE_OFFSET_DB !=
-                                     pEepData->baseEepHeader.pwrTableOffset) {
-                                diff = (u16)
-                                       (pEepData->baseEepHeader.pwrTableOffset
-                                        - (int32_t)AR9287_PWR_TABLE_OFFSET_DB);
-                                diff *= 2;
-
-                                for (j = 0;
-                                     j < ((u16)AR9287_NUM_PDADC_VALUES-diff);
-                                     j++)
-                                        pdadcValues[j] = pdadcValues[j+diff];
-
-                                for (j = (u16)(AR9287_NUM_PDADC_VALUES-diff);
-                                     j < AR9287_NUM_PDADC_VALUES; j++)
-                                        pdadcValues[j] =
-                                          pdadcValues[
-                                          AR9287_NUM_PDADC_VALUES-diff];
-                        }
-                        if (!ath9k_hw_AR9287_get_eeprom(ah, EEP_OL_PWRCTRL)) {
-                                regOffset = AR_PHY_BASE + (672 << 2) +
-                                                           regChainOffset;
-                                for (j = 0; j < 32; j++) {
-                                        reg32 = ((pdadcValues[4*j + 0]
-                                                  & 0xFF) << 0)  |
-                                                ((pdadcValues[4*j + 1]
-                                                  & 0xFF) << 8)  |
-                                                ((pdadcValues[4*j + 2]
-                                                  & 0xFF) << 16) |
-                                                ((pdadcValues[4*j + 3]
-                                                  & 0xFF) << 24) ;
-                                        REG_WRITE(ah, regOffset, reg32);
-
-                                        DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                                                "PDADC (%d,%4x): %4.4x %8.8x\n",
-                                                i, regChainOffset, regOffset,
-                                                reg32);
-                                        DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                                                "PDADC: Chain %d | "
-                                                "PDADC %3d Value %3d | "
-                                                "PDADC %3d Value %3d | "
-                                                "PDADC %3d Value %3d | "
-                                                "PDADC %3d Value %3d |\n",
-                                                i, 4 * j, pdadcValues[4 * j],
-                                                4 * j + 1,
-                                                pdadcValues[4 * j + 1],
-                                                4 * j + 2,
-                                                pdadcValues[4 * j + 2],
-                                                4 * j + 3,
-                                                pdadcValues[4 * j + 3]);
-
-                                        regOffset += 4;
-                                }
-                        }
-                }
-        }
-
-        *pTxPowerIndexOffset = 0;
-}
-
-
-static void ath9k_hw_set_AR9287_power_per_rate_table(struct ath_hw *ah,
-                struct ath9k_channel *chan, int16_t *ratesArray, u16 cfgCtl,
-                u16 AntennaReduction, u16 twiceMaxRegulatoryPower,
-                u16 powerLimit)
-{
-#define REDUCE_SCALED_POWER_BY_TWO_CHAIN     6
-#define REDUCE_SCALED_POWER_BY_THREE_CHAIN   10
-
-        u16 twiceMaxEdgePower = AR5416_MAX_RATE_POWER;
-        static const u16 tpScaleReductionTable[5] = { 0, 3, 6, 9,
-                                                      AR5416_MAX_RATE_POWER };
-        int i;
-        int16_t  twiceLargestAntenna;
-        struct cal_ctl_data_ar9287 *rep;
-        struct cal_target_power_leg targetPowerOfdm = {0, {0, 0, 0, 0} },
-                                    targetPowerCck = {0, {0, 0, 0, 0} };
-        struct cal_target_power_leg targetPowerOfdmExt = {0, {0, 0, 0, 0} },
-                                    targetPowerCckExt = {0, {0, 0, 0, 0} };
-        struct cal_target_power_ht  targetPowerHt20,
-                                    targetPowerHt40 = {0, {0, 0, 0, 0} };
-        u16 scaledPower = 0, minCtlPower, maxRegAllowedPower;
-        u16 ctlModesFor11g[] = {CTL_11B, CTL_11G, CTL_2GHT20, CTL_11B_EXT,
-                                CTL_11G_EXT, CTL_2GHT40};
-        u16 numCtlModes = 0, *pCtlMode = NULL, ctlMode, freq;
-        struct chan_centers centers;
-        int tx_chainmask;
-        u16 twiceMinEdgePower;
-        struct ar9287_eeprom *pEepData = &ah->eeprom.map9287;
-        tx_chainmask = ah->txchainmask;
-
-        ath9k_hw_get_channel_centers(ah, chan, &centers);
-
-        twiceLargestAntenna = max(pEepData->modalHeader.antennaGainCh[0],
-                        pEepData->modalHeader.antennaGainCh[1]);
-
-        twiceLargestAntenna =  (int16_t)min((AntennaReduction) -
-                                            twiceLargestAntenna, 0);
-
-        maxRegAllowedPower = twiceMaxRegulatoryPower + twiceLargestAntenna;
-        if (ah->regulatory.tp_scale != ATH9K_TP_SCALE_MAX)
-                maxRegAllowedPower -=
-                        (tpScaleReductionTable[(ah->regulatory.tp_scale)] * 2);
-
-        scaledPower = min(powerLimit, maxRegAllowedPower);
-
-        switch (ar5416_get_ntxchains(tx_chainmask)) {
-        case 1:
-                break;
-        case 2:
-                scaledPower -= REDUCE_SCALED_POWER_BY_TWO_CHAIN;
-                break;
-        case 3:
-                scaledPower -= REDUCE_SCALED_POWER_BY_THREE_CHAIN;
-                break;
-        }
-        scaledPower = max((u16)0, scaledPower);
-
-        if (IS_CHAN_2GHZ(chan)) {
-                numCtlModes = ARRAY_SIZE(ctlModesFor11g) -
-                                         SUB_NUM_CTL_MODES_AT_2G_40;
-                pCtlMode = ctlModesFor11g;
-
-                ath9k_hw_get_legacy_target_powers(ah, chan,
-                                pEepData->calTargetPowerCck,
-                                AR9287_NUM_2G_CCK_TARGET_POWERS,
-                                &targetPowerCck, 4, false);
-                ath9k_hw_get_legacy_target_powers(ah, chan,
-                                pEepData->calTargetPower2G,
-                                AR9287_NUM_2G_20_TARGET_POWERS,
-                                &targetPowerOfdm, 4, false);
-                ath9k_hw_get_target_powers(ah, chan,
-                                pEepData->calTargetPower2GHT20,
-                                AR9287_NUM_2G_20_TARGET_POWERS,
-                                &targetPowerHt20, 8, false);
-
-                if (IS_CHAN_HT40(chan)) {
-                        numCtlModes = ARRAY_SIZE(ctlModesFor11g);
-                        ath9k_hw_get_target_powers(ah, chan,
-                                        pEepData->calTargetPower2GHT40,
-                                        AR9287_NUM_2G_40_TARGET_POWERS,
-                                        &targetPowerHt40, 8, true);
-                        ath9k_hw_get_legacy_target_powers(ah, chan,
-                                        pEepData->calTargetPowerCck,
-                                        AR9287_NUM_2G_CCK_TARGET_POWERS,
-                                        &targetPowerCckExt, 4, true);
-                        ath9k_hw_get_legacy_target_powers(ah, chan,
-                                        pEepData->calTargetPower2G,
-                                        AR9287_NUM_2G_20_TARGET_POWERS,
-                                        &targetPowerOfdmExt, 4, true);
-                }
-        }
-
-        for (ctlMode = 0; ctlMode < numCtlModes; ctlMode++) {
-
-                bool isHt40CtlMode = (pCtlMode[ctlMode] == CTL_5GHT40) ||
-                                     (pCtlMode[ctlMode] == CTL_2GHT40);
-                if (isHt40CtlMode)
-                        freq = centers.synth_center;
-                else if (pCtlMode[ctlMode] & EXT_ADDITIVE)
-                        freq = centers.ext_center;
-                else
-                        freq = centers.ctl_center;
-
-
-                if (ah->eep_ops->get_eeprom_ver(ah) == 14 &&
-                                ah->eep_ops->get_eeprom_rev(ah) <= 2)
-                        twiceMaxEdgePower = AR5416_MAX_RATE_POWER;
-                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                        "LOOP-Mode ctlMode %d < %d, isHt40CtlMode %d,"
-                         "EXT_ADDITIVE %d\n", ctlMode, numCtlModes,
-                         isHt40CtlMode, (pCtlMode[ctlMode] & EXT_ADDITIVE));
-                for (i = 0; (i < AR9287_NUM_CTLS)
-                             && pEepData->ctlIndex[i]; i++) {
-                        DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                                "LOOP-Ctlidx %d: cfgCtl 0x%2.2x"
-                                 "pCtlMode 0x%2.2x ctlIndex 0x%2.2x"
-                                 "chan %d chanctl=xxxx\n",
-                                 i, cfgCtl, pCtlMode[ctlMode],
-                                 pEepData->ctlIndex[i], chan->channel);
-
-                        if ((((cfgCtl & ~CTL_MODE_M) |
-                            (pCtlMode[ctlMode] & CTL_MODE_M)) ==
-                            pEepData->ctlIndex[i]) ||
-                            (((cfgCtl & ~CTL_MODE_M) |
-                            (pCtlMode[ctlMode] & CTL_MODE_M)) ==
-                            ((pEepData->ctlIndex[i] &
-                            CTL_MODE_M) | SD_NO_CTL))) {
-
-                                rep = &(pEepData->ctlData[i]);
-                                twiceMinEdgePower = ath9k_hw_get_max_edge_power(
-                                    freq,
-                                    rep->ctlEdges[ar5416_get_ntxchains(
-                                    tx_chainmask) - 1],
-                                    IS_CHAN_2GHZ(chan), AR5416_NUM_BAND_EDGES);
-
-                                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                                        "MATCH-EE_IDX %d: ch %d is2 %d"
-                                        "2xMinEdge %d chainmask %d chains %d\n",
-                                         i, freq, IS_CHAN_2GHZ(chan),
-                                         twiceMinEdgePower, tx_chainmask,
-                                         ar5416_get_ntxchains(tx_chainmask));
-
-                                if ((cfgCtl & ~CTL_MODE_M) == SD_NO_CTL)
-                                        twiceMaxEdgePower = min(
-                                                            twiceMaxEdgePower,
-                                                            twiceMinEdgePower);
-                                else {
-                                        twiceMaxEdgePower = twiceMinEdgePower;
-                                        break;
-                                }
-                        }
-                }
-
-                minCtlPower = (u8)min(twiceMaxEdgePower, scaledPower);
-
-                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                                "SEL-Min ctlMode %d pCtlMode %d 2xMaxEdge %d"
-                                 "sP %d minCtlPwr %d\n",
-                                 ctlMode, pCtlMode[ctlMode], twiceMaxEdgePower,
-                                 scaledPower, minCtlPower);
-
-
-                switch (pCtlMode[ctlMode]) {
-
-                case CTL_11B:
-                        for (i = 0;
-                             i < ARRAY_SIZE(targetPowerCck.tPow2x);
-                             i++) {
-                                targetPowerCck.tPow2x[i] = (u8)min(
-                                        (u16)targetPowerCck.tPow2x[i],
-                                        minCtlPower);
-                        }
-                        break;
-                case CTL_11A:
-                case CTL_11G:
-                        for (i = 0;
-                             i < ARRAY_SIZE(targetPowerOfdm.tPow2x);
-                             i++) {
-                                targetPowerOfdm.tPow2x[i] = (u8)min(
-                                        (u16)targetPowerOfdm.tPow2x[i],
-                                        minCtlPower);
-                        }
-                        break;
-                case CTL_5GHT20:
-                case CTL_2GHT20:
-                        for (i = 0;
-                             i < ARRAY_SIZE(targetPowerHt20.tPow2x);
-                             i++) {
-                                targetPowerHt20.tPow2x[i] = (u8)min(
-                                        (u16)targetPowerHt20.tPow2x[i],
-                                        minCtlPower);
-                        }
-                        break;
-                case CTL_11B_EXT:
-                        targetPowerCckExt.tPow2x[0] = (u8)min(
-                                    (u16)targetPowerCckExt.tPow2x[0],
-                                    minCtlPower);
-                        break;
-                case CTL_11A_EXT:
-                case CTL_11G_EXT:
-                        targetPowerOfdmExt.tPow2x[0] = (u8)min(
-                                    (u16)targetPowerOfdmExt.tPow2x[0],
-                                    minCtlPower);
-                        break;
-                case CTL_5GHT40:
-                case CTL_2GHT40:
-                        for (i = 0;
-                             i < ARRAY_SIZE(targetPowerHt40.tPow2x);
-                             i++) {
-                                targetPowerHt40.tPow2x[i] = (u8)min(
-                                        (u16)targetPowerHt40.tPow2x[i],
-                                        minCtlPower);
-                        }
-                        break;
-                default:
-                        break;
-                }
-        }
-
-        ratesArray[rate6mb] = ratesArray[rate9mb] = ratesArray[rate12mb] =
-                ratesArray[rate18mb] = ratesArray[rate24mb] =
-                targetPowerOfdm.tPow2x[0];
-        ratesArray[rate36mb] = targetPowerOfdm.tPow2x[1];
-        ratesArray[rate48mb] = targetPowerOfdm.tPow2x[2];
-        ratesArray[rate54mb] = targetPowerOfdm.tPow2x[3];
-        ratesArray[rateXr] = targetPowerOfdm.tPow2x[0];
-
-        for (i = 0; i < ARRAY_SIZE(targetPowerHt20.tPow2x); i++)
-                ratesArray[rateHt20_0 + i] = targetPowerHt20.tPow2x[i];
-
-        if (IS_CHAN_2GHZ(chan)) {
-                ratesArray[rate1l]  = targetPowerCck.tPow2x[0];
-                ratesArray[rate2s] = ratesArray[rate2l]  =
-                        targetPowerCck.tPow2x[1];
-                ratesArray[rate5_5s] = ratesArray[rate5_5l] =
-                        targetPowerCck.tPow2x[2];
-                ratesArray[rate11s] = ratesArray[rate11l] =
-                        targetPowerCck.tPow2x[3];
-        }
-        if (IS_CHAN_HT40(chan)) {
-                for (i = 0; i < ARRAY_SIZE(targetPowerHt40.tPow2x); i++)
-                        ratesArray[rateHt40_0 + i] = targetPowerHt40.tPow2x[i];
-
-                ratesArray[rateDupOfdm] = targetPowerHt40.tPow2x[0];
-                ratesArray[rateDupCck]  = targetPowerHt40.tPow2x[0];
-                ratesArray[rateExtOfdm] = targetPowerOfdmExt.tPow2x[0];
-                if (IS_CHAN_2GHZ(chan))
-                        ratesArray[rateExtCck]  = targetPowerCckExt.tPow2x[0];
-        }
-#undef REDUCE_SCALED_POWER_BY_TWO_CHAIN
-#undef REDUCE_SCALED_POWER_BY_THREE_CHAIN
-}
-
-static void ath9k_hw_AR9287_set_txpower(struct ath_hw *ah,
-                struct ath9k_channel *chan, u16 cfgCtl,
-                u8 twiceAntennaReduction, u8 twiceMaxRegulatoryPower,
-                u8 powerLimit)
-{
-#define INCREASE_MAXPOW_BY_TWO_CHAIN     6
-#define INCREASE_MAXPOW_BY_THREE_CHAIN   10
-        struct ar9287_eeprom *pEepData = &ah->eeprom.map9287;
-        struct modal_eep_ar9287_header *pModal = &pEepData->modalHeader;
-        int16_t ratesArray[Ar5416RateSize];
-        int16_t  txPowerIndexOffset = 0;
-        u8 ht40PowerIncForPdadc = 2;
-        int i;
-        memset(ratesArray, 0, sizeof(ratesArray));
-
-        if ((pEepData->baseEepHeader.version & AR9287_EEP_VER_MINOR_MASK) >=
-                        AR9287_EEP_MINOR_VER_2)
-                ht40PowerIncForPdadc = pModal->ht40PowerIncForPdadc;
-
-        ath9k_hw_set_AR9287_power_per_rate_table(ah, chan,
-                        &ratesArray[0], cfgCtl,
-                        twiceAntennaReduction,
-                        twiceMaxRegulatoryPower,
-                        powerLimit);
-
-
-        ath9k_hw_set_AR9287_power_cal_table(ah, chan, &txPowerIndexOffset);
-
-        for (i = 0; i < ARRAY_SIZE(ratesArray); i++) {
-                ratesArray[i] = (int16_t)(txPowerIndexOffset + ratesArray[i]);
-                if (ratesArray[i] > AR9287_MAX_RATE_POWER)
-                        ratesArray[i] = AR9287_MAX_RATE_POWER;
-        }
-
-        if (AR_SREV_9280_10_OR_LATER(ah)) {
-                for (i = 0; i < Ar5416RateSize; i++)
-                        ratesArray[i] -= AR9287_PWR_TABLE_OFFSET_DB * 2;
-        }
-
-
-        REG_WRITE(ah, AR_PHY_POWER_TX_RATE1,
-                        ATH9K_POW_SM(ratesArray[rate18mb], 24)
-                        | ATH9K_POW_SM(ratesArray[rate12mb], 16)
-                        | ATH9K_POW_SM(ratesArray[rate9mb],  8)
-                        | ATH9K_POW_SM(ratesArray[rate6mb],  0)
-                 );
-
-        REG_WRITE(ah, AR_PHY_POWER_TX_RATE2,
-                        ATH9K_POW_SM(ratesArray[rate54mb], 24)
-                        | ATH9K_POW_SM(ratesArray[rate48mb], 16)
-                        | ATH9K_POW_SM(ratesArray[rate36mb],  8)
-                        | ATH9K_POW_SM(ratesArray[rate24mb],  0)
-                 );
-
-        if (IS_CHAN_2GHZ(chan)) {
-                REG_WRITE(ah, AR_PHY_POWER_TX_RATE3,
-                                ATH9K_POW_SM(ratesArray[rate2s], 24)
-                                | ATH9K_POW_SM(ratesArray[rate2l],  16)
-                                | ATH9K_POW_SM(ratesArray[rateXr],  8)
-                                | ATH9K_POW_SM(ratesArray[rate1l],   0)
-                         );
-                REG_WRITE(ah, AR_PHY_POWER_TX_RATE4,
-                                ATH9K_POW_SM(ratesArray[rate11s], 24)
-                                | ATH9K_POW_SM(ratesArray[rate11l], 16)
-                                | ATH9K_POW_SM(ratesArray[rate5_5s],  8)
-                                | ATH9K_POW_SM(ratesArray[rate5_5l],  0)
-                         );
-        }
-
-        REG_WRITE(ah, AR_PHY_POWER_TX_RATE5,
-                        ATH9K_POW_SM(ratesArray[rateHt20_3], 24)
-                        | ATH9K_POW_SM(ratesArray[rateHt20_2],  16)
-                        | ATH9K_POW_SM(ratesArray[rateHt20_1],  8)
-                        | ATH9K_POW_SM(ratesArray[rateHt20_0],   0)
-                 );
-
-        REG_WRITE(ah, AR_PHY_POWER_TX_RATE6,
-                        ATH9K_POW_SM(ratesArray[rateHt20_7], 24)
-                        | ATH9K_POW_SM(ratesArray[rateHt20_6],  16)
-                        | ATH9K_POW_SM(ratesArray[rateHt20_5],  8)
-                        | ATH9K_POW_SM(ratesArray[rateHt20_4],   0)
-                 );
-
-        if (IS_CHAN_HT40(chan)) {
-                if (ath9k_hw_AR9287_get_eeprom(ah, EEP_OL_PWRCTRL)) {
-                        REG_WRITE(ah, AR_PHY_POWER_TX_RATE7,
-                                  ATH9K_POW_SM(ratesArray[rateHt40_3], 24)
-                                  | ATH9K_POW_SM(ratesArray[rateHt40_2],  16)
-                                  | ATH9K_POW_SM(ratesArray[rateHt40_1],  8)
-                                  | ATH9K_POW_SM(ratesArray[rateHt40_0],   0)
-                                 );
-
-                        REG_WRITE(ah, AR_PHY_POWER_TX_RATE8,
-                                  ATH9K_POW_SM(ratesArray[rateHt40_7], 24)
-                                  | ATH9K_POW_SM(ratesArray[rateHt40_6],  16)
-                                  | ATH9K_POW_SM(ratesArray[rateHt40_5],  8)
-                                  | ATH9K_POW_SM(ratesArray[rateHt40_4],   0)
-                                 );
-                } else {
-                        REG_WRITE(ah, AR_PHY_POWER_TX_RATE7,
-                                  ATH9K_POW_SM(ratesArray[rateHt40_3] +
-                                               ht40PowerIncForPdadc, 24)
-                                  | ATH9K_POW_SM(ratesArray[rateHt40_2] +
-                                               ht40PowerIncForPdadc,  16)
-                                  | ATH9K_POW_SM(ratesArray[rateHt40_1] +
-                                               ht40PowerIncForPdadc,  8)
-                                  | ATH9K_POW_SM(ratesArray[rateHt40_0] +
-                                               ht40PowerIncForPdadc,   0)
-                                 );
-
-                        REG_WRITE(ah, AR_PHY_POWER_TX_RATE8,
-                                  ATH9K_POW_SM(ratesArray[rateHt40_7] +
-                                               ht40PowerIncForPdadc, 24)
-                                  | ATH9K_POW_SM(ratesArray[rateHt40_6] +
-                                               ht40PowerIncForPdadc,  16)
-                                  | ATH9K_POW_SM(ratesArray[rateHt40_5] +
-                                               ht40PowerIncForPdadc,  8)
-                                  | ATH9K_POW_SM(ratesArray[rateHt40_4] +
-                                               ht40PowerIncForPdadc,   0)
-                                 );
-
-                }
-
-                REG_WRITE(ah, AR_PHY_POWER_TX_RATE9,
-                                ATH9K_POW_SM(ratesArray[rateExtOfdm], 24)
-                                | ATH9K_POW_SM(ratesArray[rateExtCck],  16)
-                                | ATH9K_POW_SM(ratesArray[rateDupOfdm],  8)
-                                | ATH9K_POW_SM(ratesArray[rateDupCck],   0)
-                         );
-        }
-
-
-        if (IS_CHAN_2GHZ(chan))
-                i = rate1l;
-        else
-                i = rate6mb;
-
-        if (AR_SREV_9280_10_OR_LATER(ah))
-                ah->regulatory.max_power_level =
-                        ratesArray[i] + AR9287_PWR_TABLE_OFFSET_DB * 2;
-        else
-                ah->regulatory.max_power_level = ratesArray[i];
-
-        switch (ar5416_get_ntxchains(ah->txchainmask)) {
-        case 1:
-                break;
-        case 2:
-                ah->regulatory.max_power_level +=
-                        INCREASE_MAXPOW_BY_TWO_CHAIN;
-                break;
-        case 3:
-                ah->regulatory.max_power_level +=
-                        INCREASE_MAXPOW_BY_THREE_CHAIN;
-                break;
-        default:
-                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
-                                "Invalid chainmask configuration\n");
-                break;
-        }
-}
-
-static void ath9k_hw_AR9287_set_addac(struct ath_hw *ah,
-                                      struct ath9k_channel *chan)
-{
-        return;
-}
-
-static void ath9k_hw_AR9287_set_board_values(struct ath_hw *ah,
-                                             struct ath9k_channel *chan)
-{
-        struct ar9287_eeprom *eep = &ah->eeprom.map9287;
-        struct modal_eep_ar9287_header *pModal = &eep->modalHeader;
-
-        u16 antWrites[AR9287_ANT_16S];
-        u32 regChainOffset;
-        u8 txRxAttenLocal;
-        int i, j, offset_num;
-
-        pModal = &eep->modalHeader;
-
-        antWrites[0] = (u16)((pModal->antCtrlCommon >> 28) & 0xF);
-        antWrites[1] = (u16)((pModal->antCtrlCommon >> 24) & 0xF);
-        antWrites[2] = (u16)((pModal->antCtrlCommon >> 20) & 0xF);
-        antWrites[3] = (u16)((pModal->antCtrlCommon >> 16) & 0xF);
-        antWrites[4] = (u16)((pModal->antCtrlCommon >> 12) & 0xF);
-        antWrites[5] = (u16)((pModal->antCtrlCommon >> 8) & 0xF);
-        antWrites[6] = (u16)((pModal->antCtrlCommon >> 4)  & 0xF);
-        antWrites[7] = (u16)(pModal->antCtrlCommon & 0xF);
-
-        offset_num = 8;
-
-        for (i = 0, j = offset_num; i < AR9287_MAX_CHAINS; i++) {
-                antWrites[j++] = (u16)((pModal->antCtrlChain[i] >> 28) & 0xf);
-                antWrites[j++] = (u16)((pModal->antCtrlChain[i] >> 10) & 0x3);
-                antWrites[j++] = (u16)((pModal->antCtrlChain[i] >> 8) & 0x3);
-                antWrites[j++] = 0;
-                antWrites[j++] = (u16)((pModal->antCtrlChain[i] >> 6) & 0x3);
-                antWrites[j++] = (u16)((pModal->antCtrlChain[i] >> 4) & 0x3);
-                antWrites[j++] = (u16)((pModal->antCtrlChain[i] >> 2) & 0x3);
-                antWrites[j++] = (u16)(pModal->antCtrlChain[i] & 0x3);
-        }
-
-
-        REG_WRITE(ah, AR_PHY_SWITCH_COM,
-                  ah->eep_ops->get_eeprom_antenna_cfg(ah, chan));
-
-        for (i = 0; i < AR9287_MAX_CHAINS; i++) {
-                regChainOffset = i * 0x1000;
-
-                REG_WRITE(ah, AR_PHY_SWITCH_CHAIN_0 + regChainOffset,
-                          pModal->antCtrlChain[i]);
-
-                REG_WRITE(ah, AR_PHY_TIMING_CTRL4(0) + regChainOffset,
-                          (REG_READ(ah, AR_PHY_TIMING_CTRL4(0) + regChainOffset)
-                           & ~(AR_PHY_TIMING_CTRL4_IQCORR_Q_Q_COFF |
-                           AR_PHY_TIMING_CTRL4_IQCORR_Q_I_COFF)) |
-                           SM(pModal->iqCalICh[i],
-                              AR_PHY_TIMING_CTRL4_IQCORR_Q_I_COFF) |
-                           SM(pModal->iqCalQCh[i],
-                              AR_PHY_TIMING_CTRL4_IQCORR_Q_Q_COFF));
-
-                txRxAttenLocal = pModal->txRxAttenCh[i];
-
-                REG_RMW_FIELD(ah, AR_PHY_GAIN_2GHZ + regChainOffset,
-                              AR_PHY_GAIN_2GHZ_XATTEN1_MARGIN,
-                              pModal->bswMargin[i]);
-                REG_RMW_FIELD(ah, AR_PHY_GAIN_2GHZ + regChainOffset,
-                              AR_PHY_GAIN_2GHZ_XATTEN1_DB,
-                              pModal->bswAtten[i]);
-                REG_RMW_FIELD(ah, AR_PHY_RXGAIN + regChainOffset,
-                              AR9280_PHY_RXGAIN_TXRX_ATTEN,
-                              txRxAttenLocal);
-                REG_RMW_FIELD(ah, AR_PHY_RXGAIN + regChainOffset,
-                              AR9280_PHY_RXGAIN_TXRX_MARGIN,
-                              pModal->rxTxMarginCh[i]);
-        }
-
-
-        if (IS_CHAN_HT40(chan))
-                REG_RMW_FIELD(ah, AR_PHY_SETTLING,
-                              AR_PHY_SETTLING_SWITCH, pModal->swSettleHt40);
-        else
-                REG_RMW_FIELD(ah, AR_PHY_SETTLING,
-                              AR_PHY_SETTLING_SWITCH, pModal->switchSettling);
-
-        REG_RMW_FIELD(ah, AR_PHY_DESIRED_SZ,
-                      AR_PHY_DESIRED_SZ_ADC, pModal->adcDesiredSize);
-
-        REG_WRITE(ah, AR_PHY_RF_CTL4,
-                  SM(pModal->txEndToXpaOff, AR_PHY_RF_CTL4_TX_END_XPAA_OFF)
-                  | SM(pModal->txEndToXpaOff, AR_PHY_RF_CTL4_TX_END_XPAB_OFF)
-                  | SM(pModal->txFrameToXpaOn, AR_PHY_RF_CTL4_FRAME_XPAA_ON)
-                  | SM(pModal->txFrameToXpaOn, AR_PHY_RF_CTL4_FRAME_XPAB_ON));
-
-        REG_RMW_FIELD(ah, AR_PHY_RF_CTL3,
-                      AR_PHY_TX_END_TO_A2_RX_ON, pModal->txEndToRxOn);
-
-        REG_RMW_FIELD(ah, AR_PHY_CCA,
-                      AR9280_PHY_CCA_THRESH62, pModal->thresh62);
-        REG_RMW_FIELD(ah, AR_PHY_EXT_CCA0,
-                      AR_PHY_EXT_CCA0_THRESH62, pModal->thresh62);
-
-        ath9k_hw_analog_shift_rmw(ah, AR9287_AN_RF2G3_CH0, AR9287_AN_RF2G3_DB1,
-                                  AR9287_AN_RF2G3_DB1_S, pModal->db1);
-        ath9k_hw_analog_shift_rmw(ah, AR9287_AN_RF2G3_CH0, AR9287_AN_RF2G3_DB2,
-                                  AR9287_AN_RF2G3_DB2_S, pModal->db2);
-        ath9k_hw_analog_shift_rmw(ah, AR9287_AN_RF2G3_CH0,
-                                  AR9287_AN_RF2G3_OB_CCK,
-                                  AR9287_AN_RF2G3_OB_CCK_S, pModal->ob_cck);
-        ath9k_hw_analog_shift_rmw(ah, AR9287_AN_RF2G3_CH0,
-                                  AR9287_AN_RF2G3_OB_PSK,
-                                  AR9287_AN_RF2G3_OB_PSK_S, pModal->ob_psk);
-        ath9k_hw_analog_shift_rmw(ah, AR9287_AN_RF2G3_CH0,
-                                  AR9287_AN_RF2G3_OB_QAM,
-                                  AR9287_AN_RF2G3_OB_QAM_S, pModal->ob_qam);
-        ath9k_hw_analog_shift_rmw(ah, AR9287_AN_RF2G3_CH0,
-                                  AR9287_AN_RF2G3_OB_PAL_OFF,
-                                  AR9287_AN_RF2G3_OB_PAL_OFF_S,
-                                  pModal->ob_pal_off);
-
-        ath9k_hw_analog_shift_rmw(ah, AR9287_AN_RF2G3_CH1,
-                                  AR9287_AN_RF2G3_DB1, AR9287_AN_RF2G3_DB1_S,
-                                  pModal->db1);
-        ath9k_hw_analog_shift_rmw(ah, AR9287_AN_RF2G3_CH1, AR9287_AN_RF2G3_DB2,
-                                  AR9287_AN_RF2G3_DB2_S, pModal->db2);
-        ath9k_hw_analog_shift_rmw(ah, AR9287_AN_RF2G3_CH1,
-                                  AR9287_AN_RF2G3_OB_CCK,
-                                  AR9287_AN_RF2G3_OB_CCK_S, pModal->ob_cck);
-        ath9k_hw_analog_shift_rmw(ah, AR9287_AN_RF2G3_CH1,
-                                  AR9287_AN_RF2G3_OB_PSK,
-                                  AR9287_AN_RF2G3_OB_PSK_S, pModal->ob_psk);
-        ath9k_hw_analog_shift_rmw(ah, AR9287_AN_RF2G3_CH1,
-                                  AR9287_AN_RF2G3_OB_QAM,
-                                  AR9287_AN_RF2G3_OB_QAM_S, pModal->ob_qam);
-        ath9k_hw_analog_shift_rmw(ah, AR9287_AN_RF2G3_CH1,
-                                  AR9287_AN_RF2G3_OB_PAL_OFF,
-                                  AR9287_AN_RF2G3_OB_PAL_OFF_S,
-                                  pModal->ob_pal_off);
-
-        REG_RMW_FIELD(ah, AR_PHY_RF_CTL2,
-                      AR_PHY_TX_END_DATA_START, pModal->txFrameToDataStart);
-        REG_RMW_FIELD(ah, AR_PHY_RF_CTL2,
-                      AR_PHY_TX_END_PA_ON, pModal->txFrameToPaOn);
-
-        ath9k_hw_analog_shift_rmw(ah, AR9287_AN_TOP2,
-                                  AR9287_AN_TOP2_XPABIAS_LVL,
-                                  AR9287_AN_TOP2_XPABIAS_LVL_S,
-                                  pModal->xpaBiasLvl);
-}
-
-static u8 ath9k_hw_AR9287_get_num_ant_config(struct ath_hw *ah,
-                enum ieee80211_band freq_band)
-{
-        return 1;
-}
-
-
-
-
-static u16 ath9k_hw_AR9287_get_eeprom_antenna_cfg(struct ath_hw *ah,
-                struct ath9k_channel *chan)
-{
-        struct ar9287_eeprom *eep = &ah->eeprom.map9287;
-        struct modal_eep_ar9287_header *pModal = &eep->modalHeader;
-        return pModal->antCtrlCommon & 0xFFFF;
-}
-
-
-static u16 ath9k_hw_AR9287_get_spur_channel(struct ath_hw *ah,
-                                            u16 i, bool is2GHz)
-{
-#define EEP_MAP9287_SPURCHAN \
-        (ah->eeprom.map9287.modalHeader.spurChans[i].spurChan)
-        u16 spur_val = AR_NO_SPUR;
-
-        DPRINTF(ah->ah_sc, ATH_DBG_ANI,
-                        "Getting spur idx %d is2Ghz. %d val %x\n",
-                        i, is2GHz, ah->config.spurchans[i][is2GHz]);
-
-        switch (ah->config.spurmode) {
-        case SPUR_DISABLE:
-                break;
-        case SPUR_ENABLE_IOCTL:
-                spur_val = ah->config.spurchans[i][is2GHz];
-                DPRINTF(ah->ah_sc, ATH_DBG_ANI,
-                       "Getting spur val from new loc. %d\n", spur_val);
-                break;
-        case SPUR_ENABLE_EEPROM:
-                spur_val = EEP_MAP9287_SPURCHAN;
-                break;
-        }
-
-        return spur_val;
-
-#undef EEP_MAP9287_SPURCHAN
-}
-
-static struct eeprom_ops eep_AR9287_ops = {
-        .check_eeprom           = ath9k_hw_AR9287_check_eeprom,
-        .get_eeprom             = ath9k_hw_AR9287_get_eeprom,
-        .fill_eeprom            = ath9k_hw_AR9287_fill_eeprom,
-        .get_eeprom_ver         = ath9k_hw_AR9287_get_eeprom_ver,
-        .get_eeprom_rev         = ath9k_hw_AR9287_get_eeprom_rev,
-        .get_num_ant_config     = ath9k_hw_AR9287_get_num_ant_config,
-        .get_eeprom_antenna_cfg = ath9k_hw_AR9287_get_eeprom_antenna_cfg,
-        .set_board_values       = ath9k_hw_AR9287_set_board_values,
-        .set_addac              = ath9k_hw_AR9287_set_addac,
-        .set_txpower            = ath9k_hw_AR9287_set_txpower,
-        .get_spur_channel       = ath9k_hw_AR9287_get_spur_channel
-};
-
-
 int ath9k_hw_eeprom_init(struct ath_hw *ah)
 {
         int status;
+
         if (AR_SREV_9287(ah)) {
                 ah->eep_map = EEP_MAP_AR9287;
                 ah->eep_ops = &eep_AR9287_ops;
diff --git a/drivers/net/wireless/ath/ath9k/eeprom.h b/drivers/net/wireless/ath/ath9k/eeprom.h
index db77e90ed9ab..4fe33f7eee9d 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom.h
+++ b/drivers/net/wireless/ath/ath9k/eeprom.h
@@ -385,106 +385,124 @@ struct calDataPerFreqOpLoop {
 } __packed;
 
 struct modal_eep_4k_header {
-        u32  antCtrlChain[AR5416_EEP4K_MAX_CHAINS];
-        u32  antCtrlCommon;
-        u8   antennaGainCh[AR5416_EEP4K_MAX_CHAINS];
-        u8   switchSettling;
-        u8   txRxAttenCh[AR5416_EEP4K_MAX_CHAINS];
-        u8   rxTxMarginCh[AR5416_EEP4K_MAX_CHAINS];
-        u8   adcDesiredSize;
-        u8   pgaDesiredSize;
-        u8   xlnaGainCh[AR5416_EEP4K_MAX_CHAINS];
-        u8   txEndToXpaOff;
-        u8   txEndToRxOn;
-        u8   txFrameToXpaOn;
-        u8   thresh62;
-        u8   noiseFloorThreshCh[AR5416_EEP4K_MAX_CHAINS];
-        u8   xpdGain;
-        u8   xpd;
-        u8   iqCalICh[AR5416_EEP4K_MAX_CHAINS];
-        u8   iqCalQCh[AR5416_EEP4K_MAX_CHAINS];
-        u8   pdGainOverlap;
-        u8   ob_01;
-        u8   db1_01;
-        u8   xpaBiasLvl;
-        u8   txFrameToDataStart;
-        u8   txFrameToPaOn;
-        u8   ht40PowerIncForPdadc;
-        u8   bswAtten[AR5416_EEP4K_MAX_CHAINS];
-        u8   bswMargin[AR5416_EEP4K_MAX_CHAINS];
-        u8   swSettleHt40;
-        u8   xatten2Db[AR5416_EEP4K_MAX_CHAINS];
-        u8   xatten2Margin[AR5416_EEP4K_MAX_CHAINS];
-        u8   db2_01;
-        u8   version;
-        u16  ob_234;
-        u16  db1_234;
-        u16  db2_234;
-        u8   futureModal[4];
-
+        u32 antCtrlChain[AR5416_EEP4K_MAX_CHAINS];
+        u32 antCtrlCommon;
+        u8 antennaGainCh[AR5416_EEP4K_MAX_CHAINS];
+        u8 switchSettling;
+        u8 txRxAttenCh[AR5416_EEP4K_MAX_CHAINS];
+        u8 rxTxMarginCh[AR5416_EEP4K_MAX_CHAINS];
+        u8 adcDesiredSize;
+        u8 pgaDesiredSize;
+        u8 xlnaGainCh[AR5416_EEP4K_MAX_CHAINS];
+        u8 txEndToXpaOff;
+        u8 txEndToRxOn;
+        u8 txFrameToXpaOn;
+        u8 thresh62;
+        u8 noiseFloorThreshCh[AR5416_EEP4K_MAX_CHAINS];
+        u8 xpdGain;
+        u8 xpd;
+        u8 iqCalICh[AR5416_EEP4K_MAX_CHAINS];
+        u8 iqCalQCh[AR5416_EEP4K_MAX_CHAINS];
+        u8 pdGainOverlap;
+#ifdef __BIG_ENDIAN_BITFIELD
+        u8 ob_1:4, ob_0:4;
+        u8 db1_1:4, db1_0:4;
+#else
+        u8 ob_0:4, ob_1:4;
+        u8 db1_0:4, db1_1:4;
+#endif
+        u8 xpaBiasLvl;
+        u8 txFrameToDataStart;
+        u8 txFrameToPaOn;
+        u8 ht40PowerIncForPdadc;
+        u8 bswAtten[AR5416_EEP4K_MAX_CHAINS];
+        u8 bswMargin[AR5416_EEP4K_MAX_CHAINS];
+        u8 swSettleHt40;
+        u8 xatten2Db[AR5416_EEP4K_MAX_CHAINS];
+        u8 xatten2Margin[AR5416_EEP4K_MAX_CHAINS];
+#ifdef __BIG_ENDIAN_BITFIELD
+        u8 db2_1:4, db2_0:4;
+#else
+        u8 db2_0:4, db2_1:4;
+#endif
+        u8 version;
+#ifdef __BIG_ENDIAN_BITFIELD
+        u8 ob_3:4, ob_2:4;
+        u8 antdiv_ctl1:4, ob_4:4;
+        u8 db1_3:4, db1_2:4;
+        u8 antdiv_ctl2:4, db1_4:4;
+        u8 db2_2:4, db2_3:4;
+        u8 reserved:4, db2_4:4;
+#else
+        u8 ob_2:4, ob_3:4;
+        u8 ob_4:4, antdiv_ctl1:4;
+        u8 db1_2:4, db1_3:4;
+        u8 db1_4:4, antdiv_ctl2:4;
+        u8 db2_2:4, db2_3:4;
+        u8 db2_4:4, reserved:4;
+#endif
+        u8 futureModal[4];
         struct spur_chan spurChans[AR5416_EEPROM_MODAL_SPURS];
 } __packed;
 
 struct base_eep_ar9287_header {
-    u16  length;
-    u16  checksum;
-    u16  version;
-    u8 opCapFlags;
-    u8   eepMisc;
-    u16  regDmn[2];
-    u8   macAddr[6];
-    u8   rxMask;
-    u8   txMask;
-    u16  rfSilent;
-    u16  blueToothOptions;
-    u16  deviceCap;
-    u32  binBuildNumber;
-    u8   deviceType;
-    u8   openLoopPwrCntl;
-    int8_t    pwrTableOffset;
-    int8_t     tempSensSlope;
-    int8_t     tempSensSlopePalOn;
-    u8   futureBase[29];
+        u16 length;
+        u16 checksum;
+        u16 version;
+        u8 opCapFlags;
+        u8 eepMisc;
+        u16 regDmn[2];
+        u8 macAddr[6];
+        u8 rxMask;
+        u8 txMask;
+        u16 rfSilent;
+        u16 blueToothOptions;
+        u16 deviceCap;
+        u32 binBuildNumber;
+        u8 deviceType;
+        u8 openLoopPwrCntl;
+        int8_t pwrTableOffset;
+        int8_t tempSensSlope;
+        int8_t tempSensSlopePalOn;
+        u8 futureBase[29];
 } __packed;
 
 struct modal_eep_ar9287_header {
-    u32  antCtrlChain[AR9287_MAX_CHAINS];
-    u32  antCtrlCommon;
-    int8_t    antennaGainCh[AR9287_MAX_CHAINS];
-    u8   switchSettling;
-    u8   txRxAttenCh[AR9287_MAX_CHAINS];
-    u8   rxTxMarginCh[AR9287_MAX_CHAINS];
-    int8_t    adcDesiredSize;
-    u8   txEndToXpaOff;
-    u8   txEndToRxOn;
-    u8   txFrameToXpaOn;
-    u8   thresh62;
-    int8_t    noiseFloorThreshCh[AR9287_MAX_CHAINS];
-    u8   xpdGain;
-    u8   xpd;
-    int8_t    iqCalICh[AR9287_MAX_CHAINS];
-    int8_t    iqCalQCh[AR9287_MAX_CHAINS];
-    u8   pdGainOverlap;
-    u8   xpaBiasLvl;
-    u8   txFrameToDataStart;
-    u8   txFrameToPaOn;
-    u8   ht40PowerIncForPdadc;
-    u8   bswAtten[AR9287_MAX_CHAINS];
-    u8   bswMargin[AR9287_MAX_CHAINS];
-    u8   swSettleHt40;
-        u8   version;
-    u8   db1;
-    u8   db2;
-    u8   ob_cck;
-    u8   ob_psk;
-    u8   ob_qam;
-    u8   ob_pal_off;
-    u8   futureModal[30];
-    struct spur_chan spurChans[AR9287_EEPROM_MODAL_SPURS];
+        u32 antCtrlChain[AR9287_MAX_CHAINS];
+        u32 antCtrlCommon;
+        int8_t antennaGainCh[AR9287_MAX_CHAINS];
+        u8 switchSettling;
+        u8 txRxAttenCh[AR9287_MAX_CHAINS];
+        u8 rxTxMarginCh[AR9287_MAX_CHAINS];
+        int8_t adcDesiredSize;
+        u8 txEndToXpaOff;
+        u8 txEndToRxOn;
+        u8 txFrameToXpaOn;
+        u8 thresh62;
+        int8_t noiseFloorThreshCh[AR9287_MAX_CHAINS];
+        u8 xpdGain;
+        u8 xpd;
+        int8_t iqCalICh[AR9287_MAX_CHAINS];
+        int8_t iqCalQCh[AR9287_MAX_CHAINS];
+        u8 pdGainOverlap;
+        u8 xpaBiasLvl;
+        u8 txFrameToDataStart;
+        u8 txFrameToPaOn;
+        u8 ht40PowerIncForPdadc;
+        u8 bswAtten[AR9287_MAX_CHAINS];
+        u8 bswMargin[AR9287_MAX_CHAINS];
+        u8 swSettleHt40;
+        u8 version;
+        u8 db1;
+        u8 db2;
+        u8 ob_cck;
+        u8 ob_psk;
+        u8 ob_qam;
+        u8 ob_pal_off;
+        u8 futureModal[30];
+        struct spur_chan spurChans[AR9287_EEPROM_MODAL_SPURS];
 } __packed;
 
-
-
 struct cal_data_per_freq {
         u8 pwrPdg[AR5416_NUM_PD_GAINS][AR5416_PD_GAIN_ICEPTS];
         u8 vpdPdg[AR5416_NUM_PD_GAINS][AR5416_PD_GAIN_ICEPTS];
@@ -525,7 +543,6 @@ struct cal_data_op_loop_ar9287 {
         u8 empty[2][5];
 } __packed;
 
-
 struct cal_data_per_freq_ar9287 {
         u8 pwrPdg[AR9287_NUM_PD_GAINS][AR9287_PD_GAIN_ICEPTS];
         u8 vpdPdg[AR9287_NUM_PD_GAINS][AR9287_PD_GAIN_ICEPTS];
@@ -601,26 +618,25 @@ struct ar5416_eeprom_4k {
 } __packed;
 
 struct ar9287_eeprom {
-        struct base_eep_ar9287_header  baseEepHeader;
+        struct base_eep_ar9287_header baseEepHeader;
         u8 custData[AR9287_DATA_SZ];
         struct modal_eep_ar9287_header modalHeader;
         u8 calFreqPier2G[AR9287_NUM_2G_CAL_PIERS];
         union cal_data_per_freq_ar9287_u
-         calPierData2G[AR9287_MAX_CHAINS][AR9287_NUM_2G_CAL_PIERS];
+        calPierData2G[AR9287_MAX_CHAINS][AR9287_NUM_2G_CAL_PIERS];
         struct cal_target_power_leg
-         calTargetPowerCck[AR9287_NUM_2G_CCK_TARGET_POWERS];
+        calTargetPowerCck[AR9287_NUM_2G_CCK_TARGET_POWERS];
         struct cal_target_power_leg
-         calTargetPower2G[AR9287_NUM_2G_20_TARGET_POWERS];
+        calTargetPower2G[AR9287_NUM_2G_20_TARGET_POWERS];
         struct cal_target_power_ht
-         calTargetPower2GHT20[AR9287_NUM_2G_20_TARGET_POWERS];
+        calTargetPower2GHT20[AR9287_NUM_2G_20_TARGET_POWERS];
         struct cal_target_power_ht
-         calTargetPower2GHT40[AR9287_NUM_2G_40_TARGET_POWERS];
+        calTargetPower2GHT40[AR9287_NUM_2G_40_TARGET_POWERS];
         u8 ctlIndex[AR9287_NUM_CTLS];
         struct cal_ctl_data_ar9287 ctlData[AR9287_NUM_CTLS];
         u8 padding;
 } __packed;
 
-
 enum reg_ext_bitmap {
         REG_EXT_JAPAN_MIDBAND = 1,
         REG_EXT_FCC_DFS_HT40 = 2,
@@ -661,10 +677,39 @@ struct eeprom_ops {
         u16 (*get_spur_channel)(struct ath_hw *ah, u16 i, bool is2GHz);
 };
 
+void ath9k_hw_analog_shift_rmw(struct ath_hw *ah, u32 reg, u32 mask,
+                               u32 shift, u32 val);
+int16_t ath9k_hw_interpolate(u16 target, u16 srcLeft, u16 srcRight,
+                             int16_t targetLeft,
+                             int16_t targetRight);
+bool ath9k_hw_get_lower_upper_index(u8 target, u8 *pList, u16 listSize,
+                                    u16 *indexL, u16 *indexR);
+bool ath9k_hw_nvram_read(struct ath_hw *ah, u32 off, u16 *data);
+void ath9k_hw_fill_vpd_table(u8 pwrMin, u8 pwrMax, u8 *pPwrList,
+                             u8 *pVpdList, u16 numIntercepts,
+                             u8 *pRetVpdList);
+void ath9k_hw_get_legacy_target_powers(struct ath_hw *ah,
+                                       struct ath9k_channel *chan,
+                                       struct cal_target_power_leg *powInfo,
+                                       u16 numChannels,
+                                       struct cal_target_power_leg *pNewPower,
+                                       u16 numRates, bool isExtTarget);
+void ath9k_hw_get_target_powers(struct ath_hw *ah,
+                                struct ath9k_channel *chan,
+                                struct cal_target_power_ht *powInfo,
+                                u16 numChannels,
+                                struct cal_target_power_ht *pNewPower,
+                                u16 numRates, bool isHt40Target);
+u16 ath9k_hw_get_max_edge_power(u16 freq, struct cal_ctl_edges *pRdEdgesPower,
+                                bool is2GHz, int num_band_edges);
+int ath9k_hw_eeprom_init(struct ath_hw *ah);
+
 #define ar5416_get_ntxchains(_txchainmask)                      \
         (((_txchainmask >> 2) & 1) +                            \
          ((_txchainmask >> 1) & 1) + (_txchainmask & 1))
 
-int ath9k_hw_eeprom_init(struct ath_hw *ah);
+extern const struct eeprom_ops eep_def_ops;
+extern const struct eeprom_ops eep_4k_ops;
+extern const struct eeprom_ops eep_AR9287_ops;
 
 #endif /* EEPROM_H */
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_4k.c b/drivers/net/wireless/ath/ath9k/eeprom_4k.c
new file mode 100644
index 000000000000..d34dd23e806a
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/eeprom_4k.c
@@ -0,0 +1,1186 @@
+/*
+ * Copyright (c) 2008-2009 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "ath9k.h"
+
+static int ath9k_hw_4k_get_eeprom_ver(struct ath_hw *ah)
+{
+        return ((ah->eeprom.map4k.baseEepHeader.version >> 12) & 0xF);
+}
+
+static int ath9k_hw_4k_get_eeprom_rev(struct ath_hw *ah)
+{
+        return ((ah->eeprom.map4k.baseEepHeader.version) & 0xFFF);
+}
+
+static bool ath9k_hw_4k_fill_eeprom(struct ath_hw *ah)
+{
+#define SIZE_EEPROM_4K (sizeof(struct ar5416_eeprom_4k) / sizeof(u16))
+        u16 *eep_data = (u16 *)&ah->eeprom.map4k;
+        int addr, eep_start_loc = 0;
+
+        eep_start_loc = 64;
+
+        if (!ath9k_hw_use_flash(ah)) {
+                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
+                        "Reading from EEPROM, not flash\n");
+        }
+
+        for (addr = 0; addr < SIZE_EEPROM_4K; addr++) {
+                if (!ath9k_hw_nvram_read(ah, addr + eep_start_loc, eep_data)) {
+                        DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
+                               "Unable to read eeprom region \n");
+                        return false;
+                }
+                eep_data++;
+        }
+
+        return true;
+#undef SIZE_EEPROM_4K
+}
+
+static int ath9k_hw_4k_check_eeprom(struct ath_hw *ah)
+{
+#define EEPROM_4K_SIZE (sizeof(struct ar5416_eeprom_4k) / sizeof(u16))
+        struct ar5416_eeprom_4k *eep =
+                (struct ar5416_eeprom_4k *) &ah->eeprom.map4k;
+        u16 *eepdata, temp, magic, magic2;
+        u32 sum = 0, el;
+        bool need_swap = false;
+        int i, addr;
+
+
+        if (!ath9k_hw_use_flash(ah)) {
+                if (!ath9k_hw_nvram_read(ah, AR5416_EEPROM_MAGIC_OFFSET,
+                                         &magic)) {
+                        DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
+                                "Reading Magic # failed\n");
+                        return false;
+                }
+
+                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
+                        "Read Magic = 0x%04X\n", magic);
+
+                if (magic != AR5416_EEPROM_MAGIC) {
+                        magic2 = swab16(magic);
+
+                        if (magic2 == AR5416_EEPROM_MAGIC) {
+                                need_swap = true;
+                                eepdata = (u16 *) (&ah->eeprom);
+
+                                for (addr = 0; addr < EEPROM_4K_SIZE; addr++) {
+                                        temp = swab16(*eepdata);
+                                        *eepdata = temp;
+                                        eepdata++;
+                                }
+                        } else {
+                                DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
+                                        "Invalid EEPROM Magic. "
+                                        "endianness mismatch.\n");
+                                return -EINVAL;
+                        }
+                }
+        }
+
+        DPRINTF(ah->ah_sc, ATH_DBG_EEPROM, "need_swap = %s.\n",
+                need_swap ? "True" : "False");
+
+        if (need_swap)
+                el = swab16(ah->eeprom.map4k.baseEepHeader.length);
+        else
+                el = ah->eeprom.map4k.baseEepHeader.length;
+
+        if (el > sizeof(struct ar5416_eeprom_4k))
+                el = sizeof(struct ar5416_eeprom_4k) / sizeof(u16);
+        else
+                el = el / sizeof(u16);
+
+        eepdata = (u16 *)(&ah->eeprom);
+
+        for (i = 0; i < el; i++)
+                sum ^= *eepdata++;
+
+        if (need_swap) {
+                u32 integer;
+                u16 word;
+
+                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
+                        "EEPROM Endianness is not native.. Changing\n");
+
+                word = swab16(eep->baseEepHeader.length);
+                eep->baseEepHeader.length = word;
+
+                word = swab16(eep->baseEepHeader.checksum);
+                eep->baseEepHeader.checksum = word;
+
+                word = swab16(eep->baseEepHeader.version);
+                eep->baseEepHeader.version = word;
+
+                word = swab16(eep->baseEepHeader.regDmn[0]);
+                eep->baseEepHeader.regDmn[0] = word;
+
+                word = swab16(eep->baseEepHeader.regDmn[1]);
+                eep->baseEepHeader.regDmn[1] = word;
+
+                word = swab16(eep->baseEepHeader.rfSilent);
+                eep->baseEepHeader.rfSilent = word;
+
+                word = swab16(eep->baseEepHeader.blueToothOptions);
+                eep->baseEepHeader.blueToothOptions = word;
+
+                word = swab16(eep->baseEepHeader.deviceCap);
+                eep->baseEepHeader.deviceCap = word;
+
+                integer = swab32(eep->modalHeader.antCtrlCommon);
+                eep->modalHeader.antCtrlCommon = integer;
+
+                for (i = 0; i < AR5416_EEP4K_MAX_CHAINS; i++) {
+                        integer = swab32(eep->modalHeader.antCtrlChain[i]);
+                        eep->modalHeader.antCtrlChain[i] = integer;
+                }
+
+                for (i = 0; i < AR5416_EEPROM_MODAL_SPURS; i++) {
+                        word = swab16(eep->modalHeader.spurChans[i].spurChan);
+                        eep->modalHeader.spurChans[i].spurChan = word;
+                }
+        }
+
+        if (sum != 0xffff || ah->eep_ops->get_eeprom_ver(ah) != AR5416_EEP_VER ||
+            ah->eep_ops->get_eeprom_rev(ah) < AR5416_EEP_NO_BACK_VER) {
+                DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
+                        "Bad EEPROM checksum 0x%x or revision 0x%04x\n",
+                        sum, ah->eep_ops->get_eeprom_ver(ah));
+                return -EINVAL;
+        }
+
+        return 0;
+#undef EEPROM_4K_SIZE
+}
+
+static u32 ath9k_hw_4k_get_eeprom(struct ath_hw *ah,
+                                  enum eeprom_param param)
+{
+        struct ar5416_eeprom_4k *eep = &ah->eeprom.map4k;
+        struct modal_eep_4k_header *pModal = &eep->modalHeader;
+        struct base_eep_header_4k *pBase = &eep->baseEepHeader;
+
+        switch (param) {
+        case EEP_NFTHRESH_2:
+                return pModal->noiseFloorThreshCh[0];
+        case AR_EEPROM_MAC(0):
+                return pBase->macAddr[0] << 8 | pBase->macAddr[1];
+        case AR_EEPROM_MAC(1):
+                return pBase->macAddr[2] << 8 | pBase->macAddr[3];
+        case AR_EEPROM_MAC(2):
+                return pBase->macAddr[4] << 8 | pBase->macAddr[5];
+        case EEP_REG_0:
+                return pBase->regDmn[0];
+        case EEP_REG_1:
+                return pBase->regDmn[1];
+        case EEP_OP_CAP:
+                return pBase->deviceCap;
+        case EEP_OP_MODE:
+                return pBase->opCapFlags;
+        case EEP_RF_SILENT:
+                return pBase->rfSilent;
+        case EEP_OB_2:
+                return pModal->ob_0;
+        case EEP_DB_2:
+                return pModal->db1_1;
+        case EEP_MINOR_REV:
+                return pBase->version & AR5416_EEP_VER_MINOR_MASK;
+        case EEP_TX_MASK:
+                return pBase->txMask;
+        case EEP_RX_MASK:
+                return pBase->rxMask;
+        case EEP_FRAC_N_5G:
+                return 0;
+        default:
+                return 0;
+        }
+}
+
+static void ath9k_hw_get_4k_gain_boundaries_pdadcs(struct ath_hw *ah,
+                                struct ath9k_channel *chan,
+                                struct cal_data_per_freq_4k *pRawDataSet,
+                                u8 *bChans, u16 availPiers,
+                                u16 tPdGainOverlap, int16_t *pMinCalPower,
+                                u16 *pPdGainBoundaries, u8 *pPDADCValues,
+                                u16 numXpdGains)
+{
+#define TMP_VAL_VPD_TABLE \
+        ((vpdTableI[i][sizeCurrVpdTable - 1] + (ss - maxIndex + 1) * vpdStep));
+        int i, j, k;
+        int16_t ss;
+        u16 idxL = 0, idxR = 0, numPiers;
+        static u8 vpdTableL[AR5416_EEP4K_NUM_PD_GAINS]
+                [AR5416_MAX_PWR_RANGE_IN_HALF_DB];
+        static u8 vpdTableR[AR5416_EEP4K_NUM_PD_GAINS]
+                [AR5416_MAX_PWR_RANGE_IN_HALF_DB];
+        static u8 vpdTableI[AR5416_EEP4K_NUM_PD_GAINS]
+                [AR5416_MAX_PWR_RANGE_IN_HALF_DB];
+
+        u8 *pVpdL, *pVpdR, *pPwrL, *pPwrR;
+        u8 minPwrT4[AR5416_EEP4K_NUM_PD_GAINS];
+        u8 maxPwrT4[AR5416_EEP4K_NUM_PD_GAINS];
+        int16_t vpdStep;
+        int16_t tmpVal;
+        u16 sizeCurrVpdTable, maxIndex, tgtIndex;
+        bool match;
+        int16_t minDelta = 0;
+        struct chan_centers centers;
+#define PD_GAIN_BOUNDARY_DEFAULT 58;
+
+        ath9k_hw_get_channel_centers(ah, chan, &centers);
+
+        for (numPiers = 0; numPiers < availPiers; numPiers++) {
+                if (bChans[numPiers] == AR5416_BCHAN_UNUSED)
+                        break;
+        }
+
+        match = ath9k_hw_get_lower_upper_index(
+                                        (u8)FREQ2FBIN(centers.synth_center,
+                                        IS_CHAN_2GHZ(chan)), bChans, numPiers,
+                                        &idxL, &idxR);
+
+        if (match) {
+                for (i = 0; i < numXpdGains; i++) {
+                        minPwrT4[i] = pRawDataSet[idxL].pwrPdg[i][0];
+                        maxPwrT4[i] = pRawDataSet[idxL].pwrPdg[i][4];
+                        ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
+                                        pRawDataSet[idxL].pwrPdg[i],
+                                        pRawDataSet[idxL].vpdPdg[i],
+                                        AR5416_EEP4K_PD_GAIN_ICEPTS,
+                                        vpdTableI[i]);
+                }
+        } else {
+                for (i = 0; i < numXpdGains; i++) {
+                        pVpdL = pRawDataSet[idxL].vpdPdg[i];
+                        pPwrL = pRawDataSet[idxL].pwrPdg[i];
+                        pVpdR = pRawDataSet[idxR].vpdPdg[i];
+                        pPwrR = pRawDataSet[idxR].pwrPdg[i];
+
+                        minPwrT4[i] = max(pPwrL[0], pPwrR[0]);
+
+                        maxPwrT4[i] =
+                                min(pPwrL[AR5416_EEP4K_PD_GAIN_ICEPTS - 1],
+                                    pPwrR[AR5416_EEP4K_PD_GAIN_ICEPTS - 1]);
+
+
+                        ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
+                                                pPwrL, pVpdL,
+                                                AR5416_EEP4K_PD_GAIN_ICEPTS,
+                                                vpdTableL[i]);
+                        ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
+                                                pPwrR, pVpdR,
+                                                AR5416_EEP4K_PD_GAIN_ICEPTS,
+                                                vpdTableR[i]);
+
+                        for (j = 0; j <= (maxPwrT4[i] - minPwrT4[i]) / 2; j++) {
+                                vpdTableI[i][j] =
+                                        (u8)(ath9k_hw_interpolate((u16)
+                                             FREQ2FBIN(centers.
+                                                       synth_center,
+                                                       IS_CHAN_2GHZ
+                                                       (chan)),
+                                             bChans[idxL], bChans[idxR],
+                                             vpdTableL[i][j], vpdTableR[i][j]));
+                        }
+                }
+        }
+
+        *pMinCalPower = (int16_t)(minPwrT4[0] / 2);
+
+        k = 0;
+
+        for (i = 0; i < numXpdGains; i++) {
+                if (i == (numXpdGains - 1))
+                        pPdGainBoundaries[i] =
+                                (u16)(maxPwrT4[i] / 2);
+                else
+                        pPdGainBoundaries[i] =
+                                (u16)((maxPwrT4[i] + minPwrT4[i + 1]) / 4);
+
+                pPdGainBoundaries[i] =
+                        min((u16)AR5416_MAX_RATE_POWER, pPdGainBoundaries[i]);
+
+                if ((i == 0) && !AR_SREV_5416_20_OR_LATER(ah)) {
+                        minDelta = pPdGainBoundaries[0] - 23;
+                        pPdGainBoundaries[0] = 23;
+                } else {
+                        minDelta = 0;
+                }
+
+                if (i == 0) {
+                        if (AR_SREV_9280_10_OR_LATER(ah))
+                                ss = (int16_t)(0 - (minPwrT4[i] / 2));
+                        else
+                                ss = 0;
+                } else {
+                        ss = (int16_t)((pPdGainBoundaries[i - 1] -
+                                        (minPwrT4[i] / 2)) -
+                                       tPdGainOverlap + 1 + minDelta);
+                }
+                vpdStep = (int16_t)(vpdTableI[i][1] - vpdTableI[i][0]);
+                vpdStep = (int16_t)((vpdStep < 1) ? 1 : vpdStep);
+
+                while ((ss < 0) && (k < (AR5416_NUM_PDADC_VALUES - 1))) {
+                        tmpVal = (int16_t)(vpdTableI[i][0] + ss * vpdStep);
+                        pPDADCValues[k++] = (u8)((tmpVal < 0) ? 0 : tmpVal);
+                        ss++;
+                }
+
+                sizeCurrVpdTable = (u8) ((maxPwrT4[i] - minPwrT4[i]) / 2 + 1);
+                tgtIndex = (u8)(pPdGainBoundaries[i] + tPdGainOverlap -
+                                (minPwrT4[i] / 2));
+                maxIndex = (tgtIndex < sizeCurrVpdTable) ?
+                        tgtIndex : sizeCurrVpdTable;
+
+                while ((ss < maxIndex) && (k < (AR5416_NUM_PDADC_VALUES - 1)))
+                        pPDADCValues[k++] = vpdTableI[i][ss++];
+
+                vpdStep = (int16_t)(vpdTableI[i][sizeCurrVpdTable - 1] -
+                                    vpdTableI[i][sizeCurrVpdTable - 2]);
+                vpdStep = (int16_t)((vpdStep < 1) ? 1 : vpdStep);
+
+                if (tgtIndex >= maxIndex) {
+                        while ((ss <= tgtIndex) &&
+                               (k < (AR5416_NUM_PDADC_VALUES - 1))) {
+                                tmpVal = (int16_t) TMP_VAL_VPD_TABLE;
+                                pPDADCValues[k++] = (u8)((tmpVal > 255) ?
+                                                         255 : tmpVal);
+                                ss++;
+                        }
+                }
+        }
+
+        while (i < AR5416_EEP4K_PD_GAINS_IN_MASK) {
+                pPdGainBoundaries[i] = PD_GAIN_BOUNDARY_DEFAULT;
+                i++;
+        }
+
+        while (k < AR5416_NUM_PDADC_VALUES) {
+                pPDADCValues[k] = pPDADCValues[k - 1];
+                k++;
+        }
+
+        return;
+#undef TMP_VAL_VPD_TABLE
+}
+
+static void ath9k_hw_set_4k_power_cal_table(struct ath_hw *ah,
+                                  struct ath9k_channel *chan,
+                                  int16_t *pTxPowerIndexOffset)
+{
+        struct ar5416_eeprom_4k *pEepData = &ah->eeprom.map4k;
+        struct cal_data_per_freq_4k *pRawDataset;
+        u8 *pCalBChans = NULL;
+        u16 pdGainOverlap_t2;
+        static u8 pdadcValues[AR5416_NUM_PDADC_VALUES];
+        u16 gainBoundaries[AR5416_EEP4K_PD_GAINS_IN_MASK];
+        u16 numPiers, i, j;
+        int16_t tMinCalPower;
+        u16 numXpdGain, xpdMask;
+        u16 xpdGainValues[AR5416_EEP4K_NUM_PD_GAINS] = { 0, 0 };
+        u32 reg32, regOffset, regChainOffset;
+
+        xpdMask = pEepData->modalHeader.xpdGain;
+
+        if ((pEepData->baseEepHeader.version & AR5416_EEP_VER_MINOR_MASK) >=
+            AR5416_EEP_MINOR_VER_2) {
+                pdGainOverlap_t2 =
+                        pEepData->modalHeader.pdGainOverlap;
+        } else {
+                pdGainOverlap_t2 = (u16)(MS(REG_READ(ah, AR_PHY_TPCRG5),
+                                            AR_PHY_TPCRG5_PD_GAIN_OVERLAP));
+        }
+
+        pCalBChans = pEepData->calFreqPier2G;
+        numPiers = AR5416_EEP4K_NUM_2G_CAL_PIERS;
+
+        numXpdGain = 0;
+
+        for (i = 1; i <= AR5416_EEP4K_PD_GAINS_IN_MASK; i++) {
+                if ((xpdMask >> (AR5416_EEP4K_PD_GAINS_IN_MASK - i)) & 1) {
+                        if (numXpdGain >= AR5416_EEP4K_NUM_PD_GAINS)
+                                break;
+                        xpdGainValues[numXpdGain] =
+                                (u16)(AR5416_EEP4K_PD_GAINS_IN_MASK - i);
+                        numXpdGain++;
+                }
+        }
+
+        REG_RMW_FIELD(ah, AR_PHY_TPCRG1, AR_PHY_TPCRG1_NUM_PD_GAIN,
+                      (numXpdGain - 1) & 0x3);
+        REG_RMW_FIELD(ah, AR_PHY_TPCRG1, AR_PHY_TPCRG1_PD_GAIN_1,
+                      xpdGainValues[0]);
+        REG_RMW_FIELD(ah, AR_PHY_TPCRG1, AR_PHY_TPCRG1_PD_GAIN_2,
+                      xpdGainValues[1]);
+        REG_RMW_FIELD(ah, AR_PHY_TPCRG1, AR_PHY_TPCRG1_PD_GAIN_3, 0);
+
+        for (i = 0; i < AR5416_EEP4K_MAX_CHAINS; i++) {
+                if (AR_SREV_5416_20_OR_LATER(ah) &&
+                    (ah->rxchainmask == 5 || ah->txchainmask == 5) &&
+                    (i != 0)) {
+                        regChainOffset = (i == 1) ? 0x2000 : 0x1000;
+                } else
+                        regChainOffset = i * 0x1000;
+
+                if (pEepData->baseEepHeader.txMask & (1 << i)) {
+                        pRawDataset = pEepData->calPierData2G[i];
+
+                        ath9k_hw_get_4k_gain_boundaries_pdadcs(ah, chan,
+                                            pRawDataset, pCalBChans,
+                                            numPiers, pdGainOverlap_t2,
+                                            &tMinCalPower, gainBoundaries,
+                                            pdadcValues, numXpdGain);
+
+                        if ((i == 0) || AR_SREV_5416_20_OR_LATER(ah)) {
+                                REG_WRITE(ah, AR_PHY_TPCRG5 + regChainOffset,
+                                          SM(pdGainOverlap_t2,
+                                             AR_PHY_TPCRG5_PD_GAIN_OVERLAP)
+                                          | SM(gainBoundaries[0],
+                                               AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_1)
+                                          | SM(gainBoundaries[1],
+                                               AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_2)
+                                          | SM(gainBoundaries[2],
+                                               AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_3)
+                                          | SM(gainBoundaries[3],
+                                       AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_4));
+                        }
+
+                        regOffset = AR_PHY_BASE + (672 << 2) + regChainOffset;
+                        for (j = 0; j < 32; j++) {
+                                reg32 = ((pdadcValues[4 * j + 0] & 0xFF) << 0) |
+                                        ((pdadcValues[4 * j + 1] & 0xFF) << 8) |
+                                        ((pdadcValues[4 * j + 2] & 0xFF) << 16)|
+                                        ((pdadcValues[4 * j + 3] & 0xFF) << 24);
+                                REG_WRITE(ah, regOffset, reg32);
+
+                                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
+                                        "PDADC (%d,%4x): %4.4x %8.8x\n",
+                                        i, regChainOffset, regOffset,
+                                        reg32);
+                                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
+                                        "PDADC: Chain %d | "
+                                        "PDADC %3d Value %3d | "
+                                        "PDADC %3d Value %3d | "
+                                        "PDADC %3d Value %3d | "
+                                        "PDADC %3d Value %3d |\n",
+                                        i, 4 * j, pdadcValues[4 * j],
+                                        4 * j + 1, pdadcValues[4 * j + 1],
+                                        4 * j + 2, pdadcValues[4 * j + 2],
+                                        4 * j + 3,
+                                        pdadcValues[4 * j + 3]);
+
+                                regOffset += 4;
+                        }
+                }
+        }
+
+        *pTxPowerIndexOffset = 0;
+}
+
+static void ath9k_hw_set_4k_power_per_rate_table(struct ath_hw *ah,
+                                                 struct ath9k_channel *chan,
+                                                 int16_t *ratesArray,
+                                                 u16 cfgCtl,
+                                                 u16 AntennaReduction,
+                                                 u16 twiceMaxRegulatoryPower,
+                                                 u16 powerLimit)
+{
+#define CMP_TEST_GRP \
+        (((cfgCtl & ~CTL_MODE_M)| (pCtlMode[ctlMode] & CTL_MODE_M)) ==  \
+         pEepData->ctlIndex[i])                                         \
+        || (((cfgCtl & ~CTL_MODE_M) | (pCtlMode[ctlMode] & CTL_MODE_M)) == \
+            ((pEepData->ctlIndex[i] & CTL_MODE_M) | SD_NO_CTL))
+
+        int i;
+        int16_t twiceLargestAntenna;
+        u16 twiceMinEdgePower;
+        u16 twiceMaxEdgePower = AR5416_MAX_RATE_POWER;
+        u16 scaledPower = 0, minCtlPower, maxRegAllowedPower;
+        u16 numCtlModes, *pCtlMode, ctlMode, freq;
+        struct chan_centers centers;
+        struct cal_ctl_data_4k *rep;
+        struct ar5416_eeprom_4k *pEepData = &ah->eeprom.map4k;
+        static const u16 tpScaleReductionTable[5] =
+                { 0, 3, 6, 9, AR5416_MAX_RATE_POWER };
+        struct cal_target_power_leg targetPowerOfdm, targetPowerCck = {
+                0, { 0, 0, 0, 0}
+        };
+        struct cal_target_power_leg targetPowerOfdmExt = {
+                0, { 0, 0, 0, 0} }, targetPowerCckExt = {
+                0, { 0, 0, 0, 0 }
+        };
+        struct cal_target_power_ht targetPowerHt20, targetPowerHt40 = {
+                0, {0, 0, 0, 0}
+        };
+        u16 ctlModesFor11g[] =
+                { CTL_11B, CTL_11G, CTL_2GHT20, CTL_11B_EXT, CTL_11G_EXT,
+                  CTL_2GHT40
+                };
+
+        ath9k_hw_get_channel_centers(ah, chan, &centers);
+
+        twiceLargestAntenna = pEepData->modalHeader.antennaGainCh[0];
+        twiceLargestAntenna = (int16_t)min(AntennaReduction -
+                                           twiceLargestAntenna, 0);
+
+        maxRegAllowedPower = twiceMaxRegulatoryPower + twiceLargestAntenna;
+        if (ah->regulatory.tp_scale != ATH9K_TP_SCALE_MAX) {
+                maxRegAllowedPower -=
+                        (tpScaleReductionTable[(ah->regulatory.tp_scale)] * 2);
+        }
+
+        scaledPower = min(powerLimit, maxRegAllowedPower);
+        scaledPower = max((u16)0, scaledPower);
+
+        numCtlModes = ARRAY_SIZE(ctlModesFor11g) - SUB_NUM_CTL_MODES_AT_2G_40;
+        pCtlMode = ctlModesFor11g;
+
+        ath9k_hw_get_legacy_target_powers(ah, chan,
+                        pEepData->calTargetPowerCck,
+                        AR5416_NUM_2G_CCK_TARGET_POWERS,
+                        &targetPowerCck, 4, false);
+        ath9k_hw_get_legacy_target_powers(ah, chan,
+                        pEepData->calTargetPower2G,
+                        AR5416_NUM_2G_20_TARGET_POWERS,
+                        &targetPowerOfdm, 4, false);
+        ath9k_hw_get_target_powers(ah, chan,
+                        pEepData->calTargetPower2GHT20,
+                        AR5416_NUM_2G_20_TARGET_POWERS,
+                        &targetPowerHt20, 8, false);
+
+        if (IS_CHAN_HT40(chan)) {
+                numCtlModes = ARRAY_SIZE(ctlModesFor11g);
+                ath9k_hw_get_target_powers(ah, chan,
+                                pEepData->calTargetPower2GHT40,
+                                AR5416_NUM_2G_40_TARGET_POWERS,
+                                &targetPowerHt40, 8, true);
+                ath9k_hw_get_legacy_target_powers(ah, chan,
+                                pEepData->calTargetPowerCck,
+                                AR5416_NUM_2G_CCK_TARGET_POWERS,
+                                &targetPowerCckExt, 4, true);
+                ath9k_hw_get_legacy_target_powers(ah, chan,
+                                pEepData->calTargetPower2G,
+                                AR5416_NUM_2G_20_TARGET_POWERS,
+                                &targetPowerOfdmExt, 4, true);
+        }
+
+        for (ctlMode = 0; ctlMode < numCtlModes; ctlMode++) {
+                bool isHt40CtlMode = (pCtlMode[ctlMode] == CTL_5GHT40) ||
+                        (pCtlMode[ctlMode] == CTL_2GHT40);
+
+                if (isHt40CtlMode)
+                        freq = centers.synth_center;
+                else if (pCtlMode[ctlMode] & EXT_ADDITIVE)
+                        freq = centers.ext_center;
+                else
+                        freq = centers.ctl_center;
+
+                if (ah->eep_ops->get_eeprom_ver(ah) == 14 &&
+                    ah->eep_ops->get_eeprom_rev(ah) <= 2)
+                        twiceMaxEdgePower = AR5416_MAX_RATE_POWER;
+
+                for (i = 0; (i < AR5416_EEP4K_NUM_CTLS) &&
+                             pEepData->ctlIndex[i]; i++) {
+
+                        if (CMP_TEST_GRP) {
+                                rep = &(pEepData->ctlData[i]);
+
+                                twiceMinEdgePower = ath9k_hw_get_max_edge_power(
+                                        freq,
+                                        rep->ctlEdges[
+                                        ar5416_get_ntxchains(ah->txchainmask) - 1],
+                                        IS_CHAN_2GHZ(chan),
+                                        AR5416_EEP4K_NUM_BAND_EDGES);
+
+                                if ((cfgCtl & ~CTL_MODE_M) == SD_NO_CTL) {
+                                        twiceMaxEdgePower =
+                                                min(twiceMaxEdgePower,
+                                                    twiceMinEdgePower);
+                                } else {
+                                        twiceMaxEdgePower = twiceMinEdgePower;
+                                        break;
+                                }
+                        }
+                }
+
+                minCtlPower = (u8)min(twiceMaxEdgePower, scaledPower);
+
+                switch (pCtlMode[ctlMode]) {
+                case CTL_11B:
+                        for (i = 0; i < ARRAY_SIZE(targetPowerCck.tPow2x); i++) {
+                                targetPowerCck.tPow2x[i] =
+                                        min((u16)targetPowerCck.tPow2x[i],
+                                            minCtlPower);
+                        }
+                        break;
+                case CTL_11G:
+                        for (i = 0; i < ARRAY_SIZE(targetPowerOfdm.tPow2x); i++) {
+                                targetPowerOfdm.tPow2x[i] =
+                                        min((u16)targetPowerOfdm.tPow2x[i],
+                                            minCtlPower);
+                        }
+                        break;
+                case CTL_2GHT20:
+                        for (i = 0; i < ARRAY_SIZE(targetPowerHt20.tPow2x); i++) {
+                                targetPowerHt20.tPow2x[i] =
+                                        min((u16)targetPowerHt20.tPow2x[i],
+                                            minCtlPower);
+                        }
+                        break;
+                case CTL_11B_EXT:
+                        targetPowerCckExt.tPow2x[0] =
+                                min((u16)targetPowerCckExt.tPow2x[0],
+                                    minCtlPower);
+                        break;
+                case CTL_11G_EXT:
+                        targetPowerOfdmExt.tPow2x[0] =
+                                min((u16)targetPowerOfdmExt.tPow2x[0],
+                                    minCtlPower);
+                        break;
+                case CTL_2GHT40:
+                        for (i = 0; i < ARRAY_SIZE(targetPowerHt40.tPow2x); i++) {
+                                targetPowerHt40.tPow2x[i] =
+                                        min((u16)targetPowerHt40.tPow2x[i],
+                                            minCtlPower);
+                        }
+                        break;
+                default:
+                        break;
+                }
+        }
+
+        ratesArray[rate6mb] =
+        ratesArray[rate9mb] =
+        ratesArray[rate12mb] =
+        ratesArray[rate18mb] =
+        ratesArray[rate24mb] =
+        targetPowerOfdm.tPow2x[0];
+
+        ratesArray[rate36mb] = targetPowerOfdm.tPow2x[1];
+        ratesArray[rate48mb] = targetPowerOfdm.tPow2x[2];
+        ratesArray[rate54mb] = targetPowerOfdm.tPow2x[3];
+        ratesArray[rateXr] = targetPowerOfdm.tPow2x[0];
+
+        for (i = 0; i < ARRAY_SIZE(targetPowerHt20.tPow2x); i++)
+                ratesArray[rateHt20_0 + i] = targetPowerHt20.tPow2x[i];
+
+        ratesArray[rate1l] = targetPowerCck.tPow2x[0];
+        ratesArray[rate2s] = ratesArray[rate2l] = targetPowerCck.tPow2x[1];
+        ratesArray[rate5_5s] = ratesArray[rate5_5l] = targetPowerCck.tPow2x[2];
+        ratesArray[rate11s] = ratesArray[rate11l] = targetPowerCck.tPow2x[3];
+
+        if (IS_CHAN_HT40(chan)) {
+                for (i = 0; i < ARRAY_SIZE(targetPowerHt40.tPow2x); i++) {
+                        ratesArray[rateHt40_0 + i] =
+                                targetPowerHt40.tPow2x[i];
+                }
+                ratesArray[rateDupOfdm] = targetPowerHt40.tPow2x[0];
+                ratesArray[rateDupCck] = targetPowerHt40.tPow2x[0];
+                ratesArray[rateExtOfdm] = targetPowerOfdmExt.tPow2x[0];
+                ratesArray[rateExtCck] = targetPowerCckExt.tPow2x[0];
+        }
+
+#undef CMP_TEST_GRP
+}
+
+static void ath9k_hw_4k_set_txpower(struct ath_hw *ah,
+                                    struct ath9k_channel *chan,
+                                    u16 cfgCtl,
+                                    u8 twiceAntennaReduction,
+                                    u8 twiceMaxRegulatoryPower,
+                                    u8 powerLimit)
+{
+        struct ar5416_eeprom_4k *pEepData = &ah->eeprom.map4k;
+        struct modal_eep_4k_header *pModal = &pEepData->modalHeader;
+        int16_t ratesArray[Ar5416RateSize];
+        int16_t txPowerIndexOffset = 0;
+        u8 ht40PowerIncForPdadc = 2;
+        int i;
+
+        memset(ratesArray, 0, sizeof(ratesArray));
+
+        if ((pEepData->baseEepHeader.version & AR5416_EEP_VER_MINOR_MASK) >=
+            AR5416_EEP_MINOR_VER_2) {
+                ht40PowerIncForPdadc = pModal->ht40PowerIncForPdadc;
+        }
+
+        ath9k_hw_set_4k_power_per_rate_table(ah, chan,
+                                             &ratesArray[0], cfgCtl,
+                                             twiceAntennaReduction,
+                                             twiceMaxRegulatoryPower,
+                                             powerLimit);
+
+        ath9k_hw_set_4k_power_cal_table(ah, chan, &txPowerIndexOffset);
+
+        for (i = 0; i < ARRAY_SIZE(ratesArray); i++) {
+                ratesArray[i] = (int16_t)(txPowerIndexOffset + ratesArray[i]);
+                if (ratesArray[i] > AR5416_MAX_RATE_POWER)
+                        ratesArray[i] = AR5416_MAX_RATE_POWER;
+        }
+
+
+        /* Update regulatory */
+
+        i = rate6mb;
+        if (IS_CHAN_HT40(chan))
+                i = rateHt40_0;
+        else if (IS_CHAN_HT20(chan))
+                i = rateHt20_0;
+
+        ah->regulatory.max_power_level = ratesArray[i];
+
+        if (AR_SREV_9280_10_OR_LATER(ah)) {
+                for (i = 0; i < Ar5416RateSize; i++)
+                        ratesArray[i] -= AR5416_PWR_TABLE_OFFSET * 2;
+        }
+
+        /* OFDM power per rate */
+        REG_WRITE(ah, AR_PHY_POWER_TX_RATE1,
+                  ATH9K_POW_SM(ratesArray[rate18mb], 24)
+                  | ATH9K_POW_SM(ratesArray[rate12mb], 16)
+                  | ATH9K_POW_SM(ratesArray[rate9mb], 8)
+                  | ATH9K_POW_SM(ratesArray[rate6mb], 0));
+        REG_WRITE(ah, AR_PHY_POWER_TX_RATE2,
+                  ATH9K_POW_SM(ratesArray[rate54mb], 24)
+                  | ATH9K_POW_SM(ratesArray[rate48mb], 16)
+                  | ATH9K_POW_SM(ratesArray[rate36mb], 8)
+                  | ATH9K_POW_SM(ratesArray[rate24mb], 0));
+
+        /* CCK power per rate */
+        REG_WRITE(ah, AR_PHY_POWER_TX_RATE3,
+                  ATH9K_POW_SM(ratesArray[rate2s], 24)
+                  | ATH9K_POW_SM(ratesArray[rate2l], 16)
+                  | ATH9K_POW_SM(ratesArray[rateXr], 8)
+                  | ATH9K_POW_SM(ratesArray[rate1l], 0));
+        REG_WRITE(ah, AR_PHY_POWER_TX_RATE4,
+                  ATH9K_POW_SM(ratesArray[rate11s], 24)
+                  | ATH9K_POW_SM(ratesArray[rate11l], 16)
+                  | ATH9K_POW_SM(ratesArray[rate5_5s], 8)
+                  | ATH9K_POW_SM(ratesArray[rate5_5l], 0));
+
+        /* HT20 power per rate */
+        REG_WRITE(ah, AR_PHY_POWER_TX_RATE5,
+                  ATH9K_POW_SM(ratesArray[rateHt20_3], 24)
+                  | ATH9K_POW_SM(ratesArray[rateHt20_2], 16)
+                  | ATH9K_POW_SM(ratesArray[rateHt20_1], 8)
+                  | ATH9K_POW_SM(ratesArray[rateHt20_0], 0));
+        REG_WRITE(ah, AR_PHY_POWER_TX_RATE6,
+                  ATH9K_POW_SM(ratesArray[rateHt20_7], 24)
+                  | ATH9K_POW_SM(ratesArray[rateHt20_6], 16)
+                  | ATH9K_POW_SM(ratesArray[rateHt20_5], 8)
+                  | ATH9K_POW_SM(ratesArray[rateHt20_4], 0));
+
+        /* HT40 power per rate */
+        if (IS_CHAN_HT40(chan)) {
+                REG_WRITE(ah, AR_PHY_POWER_TX_RATE7,
+                          ATH9K_POW_SM(ratesArray[rateHt40_3] +
+                                       ht40PowerIncForPdadc, 24)
+                          | ATH9K_POW_SM(ratesArray[rateHt40_2] +
+                                         ht40PowerIncForPdadc, 16)
+                          | ATH9K_POW_SM(ratesArray[rateHt40_1] +
+                                         ht40PowerIncForPdadc, 8)
+                          | ATH9K_POW_SM(ratesArray[rateHt40_0] +
+                                         ht40PowerIncForPdadc, 0));
+                REG_WRITE(ah, AR_PHY_POWER_TX_RATE8,
+                          ATH9K_POW_SM(ratesArray[rateHt40_7] +
+                                       ht40PowerIncForPdadc, 24)
+                          | ATH9K_POW_SM(ratesArray[rateHt40_6] +
+                                         ht40PowerIncForPdadc, 16)
+                          | ATH9K_POW_SM(ratesArray[rateHt40_5] +
+                                         ht40PowerIncForPdadc, 8)
+                          | ATH9K_POW_SM(ratesArray[rateHt40_4] +
+                                         ht40PowerIncForPdadc, 0));
+                REG_WRITE(ah, AR_PHY_POWER_TX_RATE9,
+                          ATH9K_POW_SM(ratesArray[rateExtOfdm], 24)
+                          | ATH9K_POW_SM(ratesArray[rateExtCck], 16)
+                          | ATH9K_POW_SM(ratesArray[rateDupOfdm], 8)
+                          | ATH9K_POW_SM(ratesArray[rateDupCck], 0));
+        }
+}
+
+static void ath9k_hw_4k_set_addac(struct ath_hw *ah,
+                                  struct ath9k_channel *chan)
+{
+        struct modal_eep_4k_header *pModal;
+        struct ar5416_eeprom_4k *eep = &ah->eeprom.map4k;
+        u8 biaslevel;
+
+        if (ah->hw_version.macVersion != AR_SREV_VERSION_9160)
+                return;
+
+        if (ah->eep_ops->get_eeprom_rev(ah) < AR5416_EEP_MINOR_VER_7)
+                return;
+
+        pModal = &eep->modalHeader;
+
+        if (pModal->xpaBiasLvl != 0xff) {
+                biaslevel = pModal->xpaBiasLvl;
+                INI_RA(&ah->iniAddac, 7, 1) =
+                  (INI_RA(&ah->iniAddac, 7, 1) & (~0x18)) | biaslevel << 3;
+        }
+}
+
+static void ath9k_hw_4k_set_gain(struct ath_hw *ah,
+                                 struct modal_eep_4k_header *pModal,
+                                 struct ar5416_eeprom_4k *eep,
+                                 u8 txRxAttenLocal)
+{
+        REG_WRITE(ah, AR_PHY_SWITCH_CHAIN_0,
+                  pModal->antCtrlChain[0]);
+
+        REG_WRITE(ah, AR_PHY_TIMING_CTRL4(0),
+                  (REG_READ(ah, AR_PHY_TIMING_CTRL4(0)) &
+                   ~(AR_PHY_TIMING_CTRL4_IQCORR_Q_Q_COFF |
+                     AR_PHY_TIMING_CTRL4_IQCORR_Q_I_COFF)) |
+                  SM(pModal->iqCalICh[0], AR_PHY_TIMING_CTRL4_IQCORR_Q_I_COFF) |
+                  SM(pModal->iqCalQCh[0], AR_PHY_TIMING_CTRL4_IQCORR_Q_Q_COFF));
+
+        if ((eep->baseEepHeader.version & AR5416_EEP_VER_MINOR_MASK) >=
+            AR5416_EEP_MINOR_VER_3) {
+                txRxAttenLocal = pModal->txRxAttenCh[0];
+
+                REG_RMW_FIELD(ah, AR_PHY_GAIN_2GHZ,
+                              AR_PHY_GAIN_2GHZ_XATTEN1_MARGIN, pModal->bswMargin[0]);
+                REG_RMW_FIELD(ah, AR_PHY_GAIN_2GHZ,
+                              AR_PHY_GAIN_2GHZ_XATTEN1_DB, pModal->bswAtten[0]);
+                REG_RMW_FIELD(ah, AR_PHY_GAIN_2GHZ,
+                              AR_PHY_GAIN_2GHZ_XATTEN2_MARGIN,
+                              pModal->xatten2Margin[0]);
+                REG_RMW_FIELD(ah, AR_PHY_GAIN_2GHZ,
+                              AR_PHY_GAIN_2GHZ_XATTEN2_DB, pModal->xatten2Db[0]);
+
+                /* Set the block 1 value to block 0 value */
+                REG_RMW_FIELD(ah, AR_PHY_GAIN_2GHZ + 0x1000,
+                              AR_PHY_GAIN_2GHZ_XATTEN1_MARGIN,
+                              pModal->bswMargin[0]);
+                REG_RMW_FIELD(ah, AR_PHY_GAIN_2GHZ + 0x1000,
+                              AR_PHY_GAIN_2GHZ_XATTEN1_DB, pModal->bswAtten[0]);
+                REG_RMW_FIELD(ah, AR_PHY_GAIN_2GHZ + 0x1000,
+                              AR_PHY_GAIN_2GHZ_XATTEN2_MARGIN,
+                              pModal->xatten2Margin[0]);
+                REG_RMW_FIELD(ah, AR_PHY_GAIN_2GHZ + 0x1000,
+                              AR_PHY_GAIN_2GHZ_XATTEN2_DB,
+                              pModal->xatten2Db[0]);
+        }
+
+        REG_RMW_FIELD(ah, AR_PHY_RXGAIN,
+                      AR9280_PHY_RXGAIN_TXRX_ATTEN, txRxAttenLocal);
+        REG_RMW_FIELD(ah, AR_PHY_RXGAIN,
+                      AR9280_PHY_RXGAIN_TXRX_MARGIN, pModal->rxTxMarginCh[0]);
+
+        REG_RMW_FIELD(ah, AR_PHY_RXGAIN + 0x1000,
+                      AR9280_PHY_RXGAIN_TXRX_ATTEN, txRxAttenLocal);
+        REG_RMW_FIELD(ah, AR_PHY_RXGAIN + 0x1000,
+                      AR9280_PHY_RXGAIN_TXRX_MARGIN, pModal->rxTxMarginCh[0]);
+
+        if (AR_SREV_9285_11(ah))
+                REG_WRITE(ah, AR9285_AN_TOP4, (AR9285_AN_TOP4_DEFAULT | 0x14));
+}
+
+/*
+ * Read EEPROM header info and program the device for correct operation
+ * given the channel value.
+ */
+static void ath9k_hw_4k_set_board_values(struct ath_hw *ah,
+                                         struct ath9k_channel *chan)
+{
+        struct modal_eep_4k_header *pModal;
+        struct ar5416_eeprom_4k *eep = &ah->eeprom.map4k;
+        u8 txRxAttenLocal;
+        u8 ob[5], db1[5], db2[5];
+        u8 ant_div_control1, ant_div_control2;
+        u32 regVal;
+
+        pModal = &eep->modalHeader;
+        txRxAttenLocal = 23;
+
+        REG_WRITE(ah, AR_PHY_SWITCH_COM,
+                  ah->eep_ops->get_eeprom_antenna_cfg(ah, chan));
+
+        /* Single chain for 4K EEPROM*/
+        ath9k_hw_4k_set_gain(ah, pModal, eep, txRxAttenLocal);
+
+        /* Initialize Ant Diversity settings from EEPROM */
+        if (pModal->version >= 3) {
+                ant_div_control1 = pModal->antdiv_ctl1;
+                ant_div_control2 = pModal->antdiv_ctl2;
+
+                regVal = REG_READ(ah, AR_PHY_MULTICHAIN_GAIN_CTL);
+                regVal &= (~(AR_PHY_9285_ANT_DIV_CTL_ALL));
+
+                regVal |= SM(ant_div_control1,
+                             AR_PHY_9285_ANT_DIV_CTL);
+                regVal |= SM(ant_div_control2,
+                             AR_PHY_9285_ANT_DIV_ALT_LNACONF);
+                regVal |= SM((ant_div_control2 >> 2),
+                             AR_PHY_9285_ANT_DIV_MAIN_LNACONF);
+                regVal |= SM((ant_div_control1 >> 1),
+                             AR_PHY_9285_ANT_DIV_ALT_GAINTB);
+                regVal |= SM((ant_div_control1 >> 2),
+                             AR_PHY_9285_ANT_DIV_MAIN_GAINTB);
+
+
+                REG_WRITE(ah, AR_PHY_MULTICHAIN_GAIN_CTL, regVal);
+                regVal = REG_READ(ah, AR_PHY_MULTICHAIN_GAIN_CTL);
+                regVal = REG_READ(ah, AR_PHY_CCK_DETECT);
+                regVal &= (~AR_PHY_CCK_DETECT_BB_ENABLE_ANT_FAST_DIV);
+                regVal |= SM((ant_div_control1 >> 3),
+                             AR_PHY_CCK_DETECT_BB_ENABLE_ANT_FAST_DIV);
+
+                REG_WRITE(ah, AR_PHY_CCK_DETECT, regVal);
+                regVal = REG_READ(ah, AR_PHY_CCK_DETECT);
+        }
+
+        if (pModal->version >= 2) {
+                ob[0] = pModal->ob_0;
+                ob[1] = pModal->ob_1;
+                ob[2] = pModal->ob_2;
+                ob[3] = pModal->ob_3;
+                ob[4] = pModal->ob_4;
+
+                db1[0] = pModal->db1_0;
+                db1[1] = pModal->db1_1;
+                db1[2] = pModal->db1_2;
+                db1[3] = pModal->db1_3;
+                db1[4] = pModal->db1_4;
+
+                db2[0] = pModal->db2_0;
+                db2[1] = pModal->db2_1;
+                db2[2] = pModal->db2_2;
+                db2[3] = pModal->db2_3;
+                db2[4] = pModal->db2_4;
+        } else if (pModal->version == 1) {
+                ob[0] = pModal->ob_0;
+                ob[1] = ob[2] = ob[3] = ob[4] = pModal->ob_1;
+                db1[0] = pModal->db1_0;
+                db1[1] = db1[2] = db1[3] = db1[4] = pModal->db1_1;
+                db2[0] = pModal->db2_0;
+                db2[1] = db2[2] = db2[3] = db2[4] = pModal->db2_1;
+        } else {
+                int i;
+
+                for (i = 0; i < 5; i++) {
+                        ob[i] = pModal->ob_0;
+                        db1[i] = pModal->db1_0;
+                        db2[i] = pModal->db1_0;
+                }
+        }
+
+        if (AR_SREV_9271(ah)) {
+                ath9k_hw_analog_shift_rmw(ah,
+                                          AR9285_AN_RF2G3,
+                                          AR9271_AN_RF2G3_OB_cck,
+                                          AR9271_AN_RF2G3_OB_cck_S,
+                                          ob[0]);
+                ath9k_hw_analog_shift_rmw(ah,
+                                          AR9285_AN_RF2G3,
+                                          AR9271_AN_RF2G3_OB_psk,
+                                          AR9271_AN_RF2G3_OB_psk_S,
+                                          ob[1]);
+                ath9k_hw_analog_shift_rmw(ah,
+                                          AR9285_AN_RF2G3,
+                                          AR9271_AN_RF2G3_OB_qam,
+                                          AR9271_AN_RF2G3_OB_qam_S,
+                                          ob[2]);
+                ath9k_hw_analog_shift_rmw(ah,
+                                          AR9285_AN_RF2G3,
+                                          AR9271_AN_RF2G3_DB_1,
+                                          AR9271_AN_RF2G3_DB_1_S,
+                                          db1[0]);
+                ath9k_hw_analog_shift_rmw(ah,
+                                          AR9285_AN_RF2G4,
+                                          AR9271_AN_RF2G4_DB_2,
+                                          AR9271_AN_RF2G4_DB_2_S,
+                                          db2[0]);
+        } else {
+                ath9k_hw_analog_shift_rmw(ah,
+                                          AR9285_AN_RF2G3,
+                                          AR9285_AN_RF2G3_OB_0,
+                                          AR9285_AN_RF2G3_OB_0_S,
+                                          ob[0]);
+                ath9k_hw_analog_shift_rmw(ah,
+                                          AR9285_AN_RF2G3,
+                                          AR9285_AN_RF2G3_OB_1,
+                                          AR9285_AN_RF2G3_OB_1_S,
+                                          ob[1]);
+                ath9k_hw_analog_shift_rmw(ah,
+                                          AR9285_AN_RF2G3,
+                                          AR9285_AN_RF2G3_OB_2,
+                                          AR9285_AN_RF2G3_OB_2_S,
+                                          ob[2]);
+                ath9k_hw_analog_shift_rmw(ah,
+                                          AR9285_AN_RF2G3,
+                                          AR9285_AN_RF2G3_OB_3,
+                                          AR9285_AN_RF2G3_OB_3_S,
+                                          ob[3]);
+                ath9k_hw_analog_shift_rmw(ah,
+                                          AR9285_AN_RF2G3,
+                                          AR9285_AN_RF2G3_OB_4,
+                                          AR9285_AN_RF2G3_OB_4_S,
+                                          ob[4]);
+
+                ath9k_hw_analog_shift_rmw(ah,
+                                          AR9285_AN_RF2G3,
+                                          AR9285_AN_RF2G3_DB1_0,
+                                          AR9285_AN_RF2G3_DB1_0_S,
+                                          db1[0]);
+                ath9k_hw_analog_shift_rmw(ah,
+                                          AR9285_AN_RF2G3,
+                                          AR9285_AN_RF2G3_DB1_1,
+                                          AR9285_AN_RF2G3_DB1_1_S,
+                                          db1[1]);
+                ath9k_hw_analog_shift_rmw(ah,
+                                          AR9285_AN_RF2G3,
+                                          AR9285_AN_RF2G3_DB1_2,
+                                          AR9285_AN_RF2G3_DB1_2_S,
+                                          db1[2]);
+                ath9k_hw_analog_shift_rmw(ah,
+                                          AR9285_AN_RF2G4,
+                                          AR9285_AN_RF2G4_DB1_3,
+                                          AR9285_AN_RF2G4_DB1_3_S,
+                                          db1[3]);
+                ath9k_hw_analog_shift_rmw(ah,
+                                          AR9285_AN_RF2G4,
+                                          AR9285_AN_RF2G4_DB1_4,
+                                          AR9285_AN_RF2G4_DB1_4_S, db1[4]);
+
+                ath9k_hw_analog_shift_rmw(ah,
+                                          AR9285_AN_RF2G4,
+                                          AR9285_AN_RF2G4_DB2_0,
+                                          AR9285_AN_RF2G4_DB2_0_S,
+                                          db2[0]);
+                ath9k_hw_analog_shift_rmw(ah,
+                                          AR9285_AN_RF2G4,
+                                          AR9285_AN_RF2G4_DB2_1,
+                                          AR9285_AN_RF2G4_DB2_1_S,
+                                          db2[1]);
+                ath9k_hw_analog_shift_rmw(ah,
+                                          AR9285_AN_RF2G4,
+                                          AR9285_AN_RF2G4_DB2_2,
+                                          AR9285_AN_RF2G4_DB2_2_S,
+                                          db2[2]);
+                ath9k_hw_analog_shift_rmw(ah,
+                                          AR9285_AN_RF2G4,
+                                          AR9285_AN_RF2G4_DB2_3,
+                                          AR9285_AN_RF2G4_DB2_3_S,
+                                          db2[3]);
+                ath9k_hw_analog_shift_rmw(ah,
+                                          AR9285_AN_RF2G4,
+                                          AR9285_AN_RF2G4_DB2_4,
+                                          AR9285_AN_RF2G4_DB2_4_S,
+                                          db2[4]);
+        }
+
+
+        if (AR_SREV_9285_11(ah))
+                REG_WRITE(ah, AR9285_AN_TOP4, AR9285_AN_TOP4_DEFAULT);
+
+        REG_RMW_FIELD(ah, AR_PHY_SETTLING, AR_PHY_SETTLING_SWITCH,
+                      pModal->switchSettling);
+        REG_RMW_FIELD(ah, AR_PHY_DESIRED_SZ, AR_PHY_DESIRED_SZ_ADC,
+                      pModal->adcDesiredSize);
+
+        REG_WRITE(ah, AR_PHY_RF_CTL4,
+                  SM(pModal->txEndToXpaOff, AR_PHY_RF_CTL4_TX_END_XPAA_OFF) |
+                  SM(pModal->txEndToXpaOff, AR_PHY_RF_CTL4_TX_END_XPAB_OFF) |
+                  SM(pModal->txFrameToXpaOn, AR_PHY_RF_CTL4_FRAME_XPAA_ON)  |
+                  SM(pModal->txFrameToXpaOn, AR_PHY_RF_CTL4_FRAME_XPAB_ON));
+
+        REG_RMW_FIELD(ah, AR_PHY_RF_CTL3, AR_PHY_TX_END_TO_A2_RX_ON,
+                      pModal->txEndToRxOn);
+        REG_RMW_FIELD(ah, AR_PHY_CCA, AR9280_PHY_CCA_THRESH62,
+                      pModal->thresh62);
+        REG_RMW_FIELD(ah, AR_PHY_EXT_CCA0, AR_PHY_EXT_CCA0_THRESH62,
+                      pModal->thresh62);
+
+        if ((eep->baseEepHeader.version & AR5416_EEP_VER_MINOR_MASK) >=
+                                                AR5416_EEP_MINOR_VER_2) {
+                REG_RMW_FIELD(ah, AR_PHY_RF_CTL2, AR_PHY_TX_END_DATA_START,
+                              pModal->txFrameToDataStart);
+                REG_RMW_FIELD(ah, AR_PHY_RF_CTL2, AR_PHY_TX_END_PA_ON,
+                              pModal->txFrameToPaOn);
+        }
+
+        if ((eep->baseEepHeader.version & AR5416_EEP_VER_MINOR_MASK) >=
+                                                AR5416_EEP_MINOR_VER_3) {
+                if (IS_CHAN_HT40(chan))
+                        REG_RMW_FIELD(ah, AR_PHY_SETTLING,
+                                      AR_PHY_SETTLING_SWITCH,
+                                      pModal->swSettleHt40);
+        }
+}
+
+static u16 ath9k_hw_4k_get_eeprom_antenna_cfg(struct ath_hw *ah,
+                                              struct ath9k_channel *chan)
+{
+        struct ar5416_eeprom_4k *eep = &ah->eeprom.map4k;
+        struct modal_eep_4k_header *pModal = &eep->modalHeader;
+
+        return pModal->antCtrlCommon & 0xFFFF;
+}
+
+static u8 ath9k_hw_4k_get_num_ant_config(struct ath_hw *ah,
+                                         enum ieee80211_band freq_band)
+{
+        return 1;
+}
+
+static u16 ath9k_hw_4k_get_spur_channel(struct ath_hw *ah, u16 i, bool is2GHz)
+{
+#define EEP_MAP4K_SPURCHAN \
+        (ah->eeprom.map4k.modalHeader.spurChans[i].spurChan)
+
+        u16 spur_val = AR_NO_SPUR;
+
+        DPRINTF(ah->ah_sc, ATH_DBG_ANI,
+                "Getting spur idx %d is2Ghz. %d val %x\n",
+                i, is2GHz, ah->config.spurchans[i][is2GHz]);
+
+        switch (ah->config.spurmode) {
+        case SPUR_DISABLE:
+                break;
+        case SPUR_ENABLE_IOCTL:
+                spur_val = ah->config.spurchans[i][is2GHz];
+                DPRINTF(ah->ah_sc, ATH_DBG_ANI,
+                        "Getting spur val from new loc. %d\n", spur_val);
+                break;
+        case SPUR_ENABLE_EEPROM:
+                spur_val = EEP_MAP4K_SPURCHAN;
+                break;
+        }
+
+        return spur_val;
+
+#undef EEP_MAP4K_SPURCHAN
+}
+
+const struct eeprom_ops eep_4k_ops = {
+        .check_eeprom           = ath9k_hw_4k_check_eeprom,
+        .get_eeprom             = ath9k_hw_4k_get_eeprom,
+        .fill_eeprom            = ath9k_hw_4k_fill_eeprom,
+        .get_eeprom_ver         = ath9k_hw_4k_get_eeprom_ver,
+        .get_eeprom_rev         = ath9k_hw_4k_get_eeprom_rev,
+        .get_num_ant_config     = ath9k_hw_4k_get_num_ant_config,
+        .get_eeprom_antenna_cfg = ath9k_hw_4k_get_eeprom_antenna_cfg,
+        .set_board_values       = ath9k_hw_4k_set_board_values,
+        .set_addac              = ath9k_hw_4k_set_addac,
+        .set_txpower            = ath9k_hw_4k_set_txpower,
+        .get_spur_channel       = ath9k_hw_4k_get_spur_channel
+};
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_9287.c b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
new file mode 100644
index 000000000000..aeb7f484b6e1
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
@@ -0,0 +1,1183 @@
+/*
+ * Copyright (c) 2008-2009 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "ath9k.h"
+
+static int ath9k_hw_AR9287_get_eeprom_ver(struct ath_hw *ah)
+{
+        return (ah->eeprom.map9287.baseEepHeader.version >> 12) & 0xF;
+}
+
+static int ath9k_hw_AR9287_get_eeprom_rev(struct ath_hw *ah)
+{
+        return (ah->eeprom.map9287.baseEepHeader.version) & 0xFFF;
+}
+
+static bool ath9k_hw_AR9287_fill_eeprom(struct ath_hw *ah)
+{
+        struct ar9287_eeprom *eep = &ah->eeprom.map9287;
+        u16 *eep_data;
+        int addr, eep_start_loc = AR9287_EEP_START_LOC;
+        eep_data = (u16 *)eep;
+
+        if (!ath9k_hw_use_flash(ah)) {
+                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
+                        "Reading from EEPROM, not flash\n");
+        }
+
+        for (addr = 0; addr < sizeof(struct ar9287_eeprom) / sizeof(u16);
+                        addr++) {
+                if (!ath9k_hw_nvram_read(ah, addr + eep_start_loc, eep_data)) {
+                        DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
+                                "Unable to read eeprom region \n");
+                        return false;
+                }
+                eep_data++;
+        }
+        return true;
+}
+
+static int ath9k_hw_AR9287_check_eeprom(struct ath_hw *ah)
+{
+        u32 sum = 0, el, integer;
+        u16 temp, word, magic, magic2, *eepdata;
+        int i, addr;
+        bool need_swap = false;
+        struct ar9287_eeprom *eep = &ah->eeprom.map9287;
+
+        if (!ath9k_hw_use_flash(ah)) {
+                if (!ath9k_hw_nvram_read
+                    (ah, AR5416_EEPROM_MAGIC_OFFSET, &magic)) {
+                        DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
+                                "Reading Magic # failed\n");
+                        return false;
+                }
+
+                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
+                                "Read Magic = 0x%04X\n", magic);
+                if (magic != AR5416_EEPROM_MAGIC) {
+                        magic2 = swab16(magic);
+
+                        if (magic2 == AR5416_EEPROM_MAGIC) {
+                                need_swap = true;
+                                eepdata = (u16 *)(&ah->eeprom);
+
+                                for (addr = 0;
+                                     addr < sizeof(struct ar9287_eeprom) / sizeof(u16);
+                                     addr++) {
+                                        temp = swab16(*eepdata);
+                                        *eepdata = temp;
+                                        eepdata++;
+                                }
+                        } else {
+                                DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
+                                        "Invalid EEPROM Magic. "
+                                        "endianness mismatch.\n");
+                                return -EINVAL;
+                        }
+                }
+        }
+        DPRINTF(ah->ah_sc, ATH_DBG_EEPROM, "need_swap = %s.\n", need_swap ?
+                "True" : "False");
+
+        if (need_swap)
+                el = swab16(ah->eeprom.map9287.baseEepHeader.length);
+        else
+                el = ah->eeprom.map9287.baseEepHeader.length;
+
+        if (el > sizeof(struct ar9287_eeprom))
+                el = sizeof(struct ar9287_eeprom) / sizeof(u16);
+        else
+                el = el / sizeof(u16);
+
+        eepdata = (u16 *)(&ah->eeprom);
+        for (i = 0; i < el; i++)
+                sum ^= *eepdata++;
+
+        if (need_swap) {
+                word = swab16(eep->baseEepHeader.length);
+                eep->baseEepHeader.length = word;
+
+                word = swab16(eep->baseEepHeader.checksum);
+                eep->baseEepHeader.checksum = word;
+
+                word = swab16(eep->baseEepHeader.version);
+                eep->baseEepHeader.version = word;
+
+                word = swab16(eep->baseEepHeader.regDmn[0]);
+                eep->baseEepHeader.regDmn[0] = word;
+
+                word = swab16(eep->baseEepHeader.regDmn[1]);
+                eep->baseEepHeader.regDmn[1] = word;
+
+                word = swab16(eep->baseEepHeader.rfSilent);
+                eep->baseEepHeader.rfSilent = word;
+
+                word = swab16(eep->baseEepHeader.blueToothOptions);
+                eep->baseEepHeader.blueToothOptions = word;
+
+                word = swab16(eep->baseEepHeader.deviceCap);
+                eep->baseEepHeader.deviceCap = word;
+
+                integer = swab32(eep->modalHeader.antCtrlCommon);
+                eep->modalHeader.antCtrlCommon = integer;
+
+                for (i = 0; i < AR9287_MAX_CHAINS; i++) {
+                        integer = swab32(eep->modalHeader.antCtrlChain[i]);
+                        eep->modalHeader.antCtrlChain[i] = integer;
+                }
+
+                for (i = 0; i < AR9287_EEPROM_MODAL_SPURS; i++) {
+                        word = swab16(eep->modalHeader.spurChans[i].spurChan);
+                        eep->modalHeader.spurChans[i].spurChan = word;
+                }
+        }
+
+        if (sum != 0xffff || ah->eep_ops->get_eeprom_ver(ah) != AR9287_EEP_VER
+            || ah->eep_ops->get_eeprom_rev(ah) < AR5416_EEP_NO_BACK_VER) {
+                DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
+                        "Bad EEPROM checksum 0x%x or revision 0x%04x\n",
+                         sum, ah->eep_ops->get_eeprom_ver(ah));
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+static u32 ath9k_hw_AR9287_get_eeprom(struct ath_hw *ah,
+                                      enum eeprom_param param)
+{
+        struct ar9287_eeprom *eep = &ah->eeprom.map9287;
+        struct modal_eep_ar9287_header *pModal = &eep->modalHeader;
+        struct base_eep_ar9287_header *pBase = &eep->baseEepHeader;
+        u16 ver_minor;
+
+        ver_minor = pBase->version & AR9287_EEP_VER_MINOR_MASK;
+        switch (param) {
+        case EEP_NFTHRESH_2:
+                return pModal->noiseFloorThreshCh[0];
+        case AR_EEPROM_MAC(0):
+                return pBase->macAddr[0] << 8 | pBase->macAddr[1];
+        case AR_EEPROM_MAC(1):
+                return pBase->macAddr[2] << 8 | pBase->macAddr[3];
+        case AR_EEPROM_MAC(2):
+                return pBase->macAddr[4] << 8 | pBase->macAddr[5];
+        case EEP_REG_0:
+                return pBase->regDmn[0];
+        case EEP_REG_1:
+                return pBase->regDmn[1];
+        case EEP_OP_CAP:
+                return pBase->deviceCap;
+        case EEP_OP_MODE:
+                return pBase->opCapFlags;
+        case EEP_RF_SILENT:
+                return pBase->rfSilent;
+        case EEP_MINOR_REV:
+                return ver_minor;
+        case EEP_TX_MASK:
+                return pBase->txMask;
+        case EEP_RX_MASK:
+                return pBase->rxMask;
+        case EEP_DEV_TYPE:
+                return pBase->deviceType;
+        case EEP_OL_PWRCTRL:
+                return pBase->openLoopPwrCntl;
+        case EEP_TEMPSENSE_SLOPE:
+                if (ver_minor >= AR9287_EEP_MINOR_VER_2)
+                        return pBase->tempSensSlope;
+                else
+                        return 0;
+        case EEP_TEMPSENSE_SLOPE_PAL_ON:
+                if (ver_minor >= AR9287_EEP_MINOR_VER_3)
+                        return pBase->tempSensSlopePalOn;
+                else
+                        return 0;
+        default:
+                return 0;
+        }
+}
+
+
+static void ath9k_hw_get_AR9287_gain_boundaries_pdadcs(struct ath_hw *ah,
+                                   struct ath9k_channel *chan,
+                                   struct cal_data_per_freq_ar9287 *pRawDataSet,
+                                   u8 *bChans,  u16 availPiers,
+                                   u16 tPdGainOverlap, int16_t *pMinCalPower,
+                                   u16 *pPdGainBoundaries, u8 *pPDADCValues,
+                                   u16 numXpdGains)
+{
+#define TMP_VAL_VPD_TABLE \
+        ((vpdTableI[i][sizeCurrVpdTable - 1] + (ss - maxIndex + 1) * vpdStep));
+
+        int       i, j, k;
+        int16_t   ss;
+        u16  idxL = 0, idxR = 0, numPiers;
+        u8   *pVpdL, *pVpdR, *pPwrL, *pPwrR;
+        u8   minPwrT4[AR9287_NUM_PD_GAINS];
+        u8   maxPwrT4[AR9287_NUM_PD_GAINS];
+        int16_t   vpdStep;
+        int16_t   tmpVal;
+        u16  sizeCurrVpdTable, maxIndex, tgtIndex;
+        bool    match;
+        int16_t  minDelta = 0;
+        struct chan_centers centers;
+        static u8 vpdTableL[AR5416_EEP4K_NUM_PD_GAINS]
+                [AR5416_MAX_PWR_RANGE_IN_HALF_DB];
+        static u8 vpdTableR[AR5416_EEP4K_NUM_PD_GAINS]
+                [AR5416_MAX_PWR_RANGE_IN_HALF_DB];
+        static u8 vpdTableI[AR5416_EEP4K_NUM_PD_GAINS]
+                [AR5416_MAX_PWR_RANGE_IN_HALF_DB];
+
+        ath9k_hw_get_channel_centers(ah, chan, &centers);
+
+        for (numPiers = 0; numPiers < availPiers; numPiers++) {
+                if (bChans[numPiers] == AR9287_BCHAN_UNUSED)
+                        break;
+        }
+
+        match = ath9k_hw_get_lower_upper_index(
+                                   (u8)FREQ2FBIN(centers.synth_center,
+                                    IS_CHAN_2GHZ(chan)), bChans, numPiers,
+                                    &idxL, &idxR);
+
+        if (match) {
+                for (i = 0; i < numXpdGains; i++) {
+                        minPwrT4[i] = pRawDataSet[idxL].pwrPdg[i][0];
+                        maxPwrT4[i] = pRawDataSet[idxL].pwrPdg[i][4];
+                        ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
+                                        pRawDataSet[idxL].pwrPdg[i],
+                                        pRawDataSet[idxL].vpdPdg[i],
+                                        AR9287_PD_GAIN_ICEPTS, vpdTableI[i]);
+                }
+        } else {
+                for (i = 0; i < numXpdGains; i++) {
+                        pVpdL = pRawDataSet[idxL].vpdPdg[i];
+                        pPwrL = pRawDataSet[idxL].pwrPdg[i];
+                        pVpdR = pRawDataSet[idxR].vpdPdg[i];
+                        pPwrR = pRawDataSet[idxR].pwrPdg[i];
+
+                        minPwrT4[i] = max(pPwrL[0], pPwrR[0]);
+
+                        maxPwrT4[i] =
+                                min(pPwrL[AR9287_PD_GAIN_ICEPTS - 1],
+                                    pPwrR[AR9287_PD_GAIN_ICEPTS - 1]);
+
+                        ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
+                                        pPwrL, pVpdL,
+                                        AR9287_PD_GAIN_ICEPTS,
+                                        vpdTableL[i]);
+                        ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
+                                        pPwrR, pVpdR,
+                                        AR9287_PD_GAIN_ICEPTS,
+                                        vpdTableR[i]);
+
+                        for (j = 0; j <= (maxPwrT4[i] - minPwrT4[i]) / 2; j++) {
+                                vpdTableI[i][j] =
+                                        (u8)(ath9k_hw_interpolate((u16)
+                                        FREQ2FBIN(centers. synth_center,
+                                        IS_CHAN_2GHZ(chan)),
+                                        bChans[idxL], bChans[idxR],
+                                        vpdTableL[i][j], vpdTableR[i][j]));
+                        }
+                }
+        }
+        *pMinCalPower = (int16_t)(minPwrT4[0] / 2);
+
+        k = 0;
+        for (i = 0; i < numXpdGains; i++) {
+                if (i == (numXpdGains - 1))
+                        pPdGainBoundaries[i] = (u16)(maxPwrT4[i] / 2);
+                else
+                        pPdGainBoundaries[i] = (u16)((maxPwrT4[i] +
+                                                      minPwrT4[i+1]) / 4);
+
+                pPdGainBoundaries[i] = min((u16)AR5416_MAX_RATE_POWER,
+                                            pPdGainBoundaries[i]);
+
+
+                if ((i == 0) && !AR_SREV_5416_20_OR_LATER(ah)) {
+                        minDelta = pPdGainBoundaries[0] - 23;
+                        pPdGainBoundaries[0] = 23;
+                } else
+                        minDelta = 0;
+
+                if (i == 0) {
+                        if (AR_SREV_9280_10_OR_LATER(ah))
+                                ss = (int16_t)(0 - (minPwrT4[i] / 2));
+                        else
+                                ss = 0;
+                } else
+                        ss = (int16_t)((pPdGainBoundaries[i-1] -
+                                       (minPwrT4[i] / 2)) -
+                                       tPdGainOverlap + 1 + minDelta);
+
+                vpdStep = (int16_t)(vpdTableI[i][1] - vpdTableI[i][0]);
+                vpdStep = (int16_t)((vpdStep < 1) ? 1 : vpdStep);
+                while ((ss < 0) && (k < (AR9287_NUM_PDADC_VALUES - 1))) {
+                        tmpVal = (int16_t)(vpdTableI[i][0] + ss * vpdStep);
+                        pPDADCValues[k++] = (u8)((tmpVal < 0) ? 0 : tmpVal);
+                        ss++;
+                }
+
+                sizeCurrVpdTable = (u8)((maxPwrT4[i] - minPwrT4[i]) / 2 + 1);
+                tgtIndex = (u8)(pPdGainBoundaries[i] +
+                                tPdGainOverlap - (minPwrT4[i] / 2));
+                maxIndex = (tgtIndex < sizeCurrVpdTable) ?
+                            tgtIndex : sizeCurrVpdTable;
+
+                while ((ss < maxIndex) && (k < (AR9287_NUM_PDADC_VALUES - 1)))
+                        pPDADCValues[k++] = vpdTableI[i][ss++];
+
+                vpdStep = (int16_t)(vpdTableI[i][sizeCurrVpdTable - 1] -
+                                    vpdTableI[i][sizeCurrVpdTable - 2]);
+                vpdStep = (int16_t)((vpdStep < 1) ? 1 : vpdStep);
+                if (tgtIndex > maxIndex) {
+                        while ((ss <= tgtIndex) &&
+                                (k < (AR9287_NUM_PDADC_VALUES - 1))) {
+                                tmpVal = (int16_t) TMP_VAL_VPD_TABLE;
+                                pPDADCValues[k++] = (u8)((tmpVal > 255) ?
+                                                          255 : tmpVal);
+                                ss++;
+                        }
+                }
+        }
+
+        while (i < AR9287_PD_GAINS_IN_MASK) {
+                pPdGainBoundaries[i] = pPdGainBoundaries[i-1];
+                i++;
+        }
+
+        while (k < AR9287_NUM_PDADC_VALUES) {
+                pPDADCValues[k] = pPDADCValues[k-1];
+                k++;
+        }
+
+#undef TMP_VAL_VPD_TABLE
+}
+
+static void ar9287_eeprom_get_tx_gain_index(struct ath_hw *ah,
+                            struct ath9k_channel *chan,
+                            struct cal_data_op_loop_ar9287 *pRawDatasetOpLoop,
+                            u8 *pCalChans,  u16 availPiers,
+                            int8_t *pPwr)
+{
+        u8 pcdac, i = 0;
+        u16  idxL = 0, idxR = 0, numPiers;
+        bool match;
+        struct chan_centers centers;
+
+        ath9k_hw_get_channel_centers(ah, chan, &centers);
+
+        for (numPiers = 0; numPiers < availPiers; numPiers++) {
+                if (pCalChans[numPiers] == AR9287_BCHAN_UNUSED)
+                        break;
+        }
+
+        match = ath9k_hw_get_lower_upper_index(
+                        (u8)FREQ2FBIN(centers.synth_center, IS_CHAN_2GHZ(chan)),
+                        pCalChans, numPiers,
+                        &idxL, &idxR);
+
+        if (match) {
+                pcdac = pRawDatasetOpLoop[idxL].pcdac[0][0];
+                *pPwr = pRawDatasetOpLoop[idxL].pwrPdg[0][0];
+        } else {
+                pcdac = pRawDatasetOpLoop[idxR].pcdac[0][0];
+                *pPwr = (pRawDatasetOpLoop[idxL].pwrPdg[0][0] +
+                                pRawDatasetOpLoop[idxR].pwrPdg[0][0])/2;
+        }
+
+        while ((pcdac > ah->originalGain[i]) &&
+                        (i < (AR9280_TX_GAIN_TABLE_SIZE - 1)))
+                i++;
+}
+
+static void ar9287_eeprom_olpc_set_pdadcs(struct ath_hw *ah,
+                                          int32_t txPower, u16 chain)
+{
+        u32 tmpVal;
+        u32 a;
+
+        tmpVal = REG_READ(ah, 0xa270);
+        tmpVal = tmpVal & 0xFCFFFFFF;
+        tmpVal = tmpVal | (0x3 << 24);
+        REG_WRITE(ah, 0xa270, tmpVal);
+
+        tmpVal = REG_READ(ah, 0xb270);
+        tmpVal = tmpVal & 0xFCFFFFFF;
+        tmpVal = tmpVal | (0x3 << 24);
+        REG_WRITE(ah, 0xb270, tmpVal);
+
+        if (chain == 0) {
+                tmpVal = REG_READ(ah, 0xa398);
+                tmpVal = tmpVal & 0xff00ffff;
+                a = (txPower)&0xff;
+                tmpVal = tmpVal | (a << 16);
+                REG_WRITE(ah, 0xa398, tmpVal);
+        }
+
+        if (chain == 1) {
+                tmpVal = REG_READ(ah, 0xb398);
+                tmpVal = tmpVal & 0xff00ffff;
+                a = (txPower)&0xff;
+                tmpVal = tmpVal | (a << 16);
+                REG_WRITE(ah, 0xb398, tmpVal);
+        }
+}
+
+static void ath9k_hw_set_AR9287_power_cal_table(struct ath_hw *ah,
+                                                struct ath9k_channel *chan,
+                                                int16_t *pTxPowerIndexOffset)
+{
+        struct cal_data_per_freq_ar9287 *pRawDataset;
+        struct cal_data_op_loop_ar9287 *pRawDatasetOpenLoop;
+        u8  *pCalBChans = NULL;
+        u16 pdGainOverlap_t2;
+        u8  pdadcValues[AR9287_NUM_PDADC_VALUES];
+        u16 gainBoundaries[AR9287_PD_GAINS_IN_MASK];
+        u16 numPiers = 0, i, j;
+        int16_t  tMinCalPower;
+        u16 numXpdGain, xpdMask;
+        u16 xpdGainValues[AR9287_NUM_PD_GAINS] = {0, 0, 0, 0};
+        u32 reg32, regOffset, regChainOffset;
+        int16_t   modalIdx, diff = 0;
+        struct ar9287_eeprom *pEepData = &ah->eeprom.map9287;
+        modalIdx = IS_CHAN_2GHZ(chan) ? 1 : 0;
+        xpdMask = pEepData->modalHeader.xpdGain;
+        if ((pEepData->baseEepHeader.version & AR9287_EEP_VER_MINOR_MASK) >=
+                        AR9287_EEP_MINOR_VER_2)
+                pdGainOverlap_t2 = pEepData->modalHeader.pdGainOverlap;
+        else
+                pdGainOverlap_t2 = (u16)(MS(REG_READ(ah, AR_PHY_TPCRG5),
+                                            AR_PHY_TPCRG5_PD_GAIN_OVERLAP));
+
+        if (IS_CHAN_2GHZ(chan)) {
+                pCalBChans = pEepData->calFreqPier2G;
+                numPiers = AR9287_NUM_2G_CAL_PIERS;
+                if (ath9k_hw_AR9287_get_eeprom(ah, EEP_OL_PWRCTRL)) {
+                        pRawDatasetOpenLoop =
+                                (struct cal_data_op_loop_ar9287 *)
+                                pEepData->calPierData2G[0];
+                        ah->initPDADC = pRawDatasetOpenLoop->vpdPdg[0][0];
+                }
+        }
+
+        numXpdGain = 0;
+        for (i = 1; i <= AR9287_PD_GAINS_IN_MASK; i++) {
+                if ((xpdMask >> (AR9287_PD_GAINS_IN_MASK - i)) & 1) {
+                        if (numXpdGain >= AR9287_NUM_PD_GAINS)
+                                break;
+                        xpdGainValues[numXpdGain] =
+                                (u16)(AR9287_PD_GAINS_IN_MASK-i);
+                        numXpdGain++;
+                }
+        }
+
+        REG_RMW_FIELD(ah, AR_PHY_TPCRG1, AR_PHY_TPCRG1_NUM_PD_GAIN,
+                      (numXpdGain - 1) & 0x3);
+        REG_RMW_FIELD(ah, AR_PHY_TPCRG1, AR_PHY_TPCRG1_PD_GAIN_1,
+                      xpdGainValues[0]);
+        REG_RMW_FIELD(ah, AR_PHY_TPCRG1, AR_PHY_TPCRG1_PD_GAIN_2,
+                      xpdGainValues[1]);
+        REG_RMW_FIELD(ah, AR_PHY_TPCRG1, AR_PHY_TPCRG1_PD_GAIN_3,
+                      xpdGainValues[2]);
+
+        for (i = 0; i < AR9287_MAX_CHAINS; i++) {
+                regChainOffset = i * 0x1000;
+                if (pEepData->baseEepHeader.txMask & (1 << i)) {
+                        pRawDatasetOpenLoop = (struct cal_data_op_loop_ar9287 *)
+                                               pEepData->calPierData2G[i];
+                        if (ath9k_hw_AR9287_get_eeprom(ah, EEP_OL_PWRCTRL)) {
+                                int8_t txPower;
+                                ar9287_eeprom_get_tx_gain_index(ah, chan,
+                                                          pRawDatasetOpenLoop,
+                                                          pCalBChans, numPiers,
+                                                          &txPower);
+                                ar9287_eeprom_olpc_set_pdadcs(ah, txPower, i);
+                        } else {
+                                pRawDataset =
+                                        (struct cal_data_per_freq_ar9287 *)
+                                        pEepData->calPierData2G[i];
+                                ath9k_hw_get_AR9287_gain_boundaries_pdadcs(
+                                                  ah, chan, pRawDataset,
+                                                  pCalBChans, numPiers,
+                                                  pdGainOverlap_t2,
+                                                  &tMinCalPower, gainBoundaries,
+                                                  pdadcValues, numXpdGain);
+                        }
+
+                        if (i == 0) {
+                                if (!ath9k_hw_AR9287_get_eeprom(
+                                            ah, EEP_OL_PWRCTRL)) {
+                                        REG_WRITE(ah, AR_PHY_TPCRG5 +
+                                          regChainOffset,
+                                          SM(pdGainOverlap_t2,
+                                             AR_PHY_TPCRG5_PD_GAIN_OVERLAP) |
+                                          SM(gainBoundaries[0],
+                                             AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_1)
+                                          | SM(gainBoundaries[1],
+                                               AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_2)
+                                          | SM(gainBoundaries[2],
+                                               AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_3)
+                                          | SM(gainBoundaries[3],
+                                               AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_4));
+                                }
+                        }
+
+                        if ((int32_t)AR9287_PWR_TABLE_OFFSET_DB !=
+                                     pEepData->baseEepHeader.pwrTableOffset) {
+                                diff = (u16)
+                                       (pEepData->baseEepHeader.pwrTableOffset
+                                        - (int32_t)AR9287_PWR_TABLE_OFFSET_DB);
+                                diff *= 2;
+
+                                for (j = 0;
+                                     j < ((u16)AR9287_NUM_PDADC_VALUES-diff);
+                                     j++)
+                                        pdadcValues[j] = pdadcValues[j+diff];
+
+                                for (j = (u16)(AR9287_NUM_PDADC_VALUES-diff);
+                                     j < AR9287_NUM_PDADC_VALUES; j++)
+                                        pdadcValues[j] =
+                                          pdadcValues[
+                                          AR9287_NUM_PDADC_VALUES-diff];
+                        }
+
+                        if (!ath9k_hw_AR9287_get_eeprom(ah, EEP_OL_PWRCTRL)) {
+                                regOffset = AR_PHY_BASE + (672 << 2) +
+                                                           regChainOffset;
+                                for (j = 0; j < 32; j++) {
+                                        reg32 = ((pdadcValues[4*j + 0]
+                                                  & 0xFF) << 0)  |
+                                                ((pdadcValues[4*j + 1]
+                                                  & 0xFF) << 8)  |
+                                                ((pdadcValues[4*j + 2]
+                                                  & 0xFF) << 16) |
+                                                ((pdadcValues[4*j + 3]
+                                                  & 0xFF) << 24) ;
+                                        REG_WRITE(ah, regOffset, reg32);
+
+                                        DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
+                                                "PDADC (%d,%4x): %4.4x %8.8x\n",
+                                                i, regChainOffset, regOffset,
+                                                reg32);
+
+                                        DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
+                                                "PDADC: Chain %d | "
+                                                "PDADC %3d Value %3d | "
+                                                "PDADC %3d Value %3d | "
+                                                "PDADC %3d Value %3d | "
+                                                "PDADC %3d Value %3d |\n",
+                                                i, 4 * j, pdadcValues[4 * j],
+                                                4 * j + 1,
+                                                pdadcValues[4 * j + 1],
+                                                4 * j + 2,
+                                                pdadcValues[4 * j + 2],
+                                                4 * j + 3,
+                                                pdadcValues[4 * j + 3]);
+
+                                        regOffset += 4;
+                                }
+                        }
+                }
+        }
+
+        *pTxPowerIndexOffset = 0;
+}
+
+static void ath9k_hw_set_AR9287_power_per_rate_table(struct ath_hw *ah,
+                struct ath9k_channel *chan, int16_t *ratesArray, u16 cfgCtl,
+                u16 AntennaReduction, u16 twiceMaxRegulatoryPower,
+                u16 powerLimit)
+{
+#define REDUCE_SCALED_POWER_BY_TWO_CHAIN     6
+#define REDUCE_SCALED_POWER_BY_THREE_CHAIN   10
+
+        u16 twiceMaxEdgePower = AR5416_MAX_RATE_POWER;
+        static const u16 tpScaleReductionTable[5] =
+                { 0, 3, 6, 9, AR5416_MAX_RATE_POWER };
+        int i;
+        int16_t  twiceLargestAntenna;
+        struct cal_ctl_data_ar9287 *rep;
+        struct cal_target_power_leg targetPowerOfdm = {0, {0, 0, 0, 0} },
+                                    targetPowerCck = {0, {0, 0, 0, 0} };
+        struct cal_target_power_leg targetPowerOfdmExt = {0, {0, 0, 0, 0} },
+                                    targetPowerCckExt = {0, {0, 0, 0, 0} };
+        struct cal_target_power_ht  targetPowerHt20,
+                                    targetPowerHt40 = {0, {0, 0, 0, 0} };
+        u16 scaledPower = 0, minCtlPower, maxRegAllowedPower;
+        u16 ctlModesFor11g[] =
+                {CTL_11B, CTL_11G, CTL_2GHT20,
+                 CTL_11B_EXT, CTL_11G_EXT, CTL_2GHT40};
+        u16 numCtlModes = 0, *pCtlMode = NULL, ctlMode, freq;
+        struct chan_centers centers;
+        int tx_chainmask;
+        u16 twiceMinEdgePower;
+        struct ar9287_eeprom *pEepData = &ah->eeprom.map9287;
+        tx_chainmask = ah->txchainmask;
+
+        ath9k_hw_get_channel_centers(ah, chan, &centers);
+
+        twiceLargestAntenna = max(pEepData->modalHeader.antennaGainCh[0],
+                                  pEepData->modalHeader.antennaGainCh[1]);
+
+        twiceLargestAntenna =  (int16_t)min((AntennaReduction) -
+                                            twiceLargestAntenna, 0);
+
+        maxRegAllowedPower = twiceMaxRegulatoryPower + twiceLargestAntenna;
+        if (ah->regulatory.tp_scale != ATH9K_TP_SCALE_MAX)
+                maxRegAllowedPower -=
+                        (tpScaleReductionTable[(ah->regulatory.tp_scale)] * 2);
+
+        scaledPower = min(powerLimit, maxRegAllowedPower);
+
+        switch (ar5416_get_ntxchains(tx_chainmask)) {
+        case 1:
+                break;
+        case 2:
+                scaledPower -= REDUCE_SCALED_POWER_BY_TWO_CHAIN;
+                break;
+        case 3:
+                scaledPower -= REDUCE_SCALED_POWER_BY_THREE_CHAIN;
+                break;
+        }
+        scaledPower = max((u16)0, scaledPower);
+
+        if (IS_CHAN_2GHZ(chan)) {
+                numCtlModes =
+                        ARRAY_SIZE(ctlModesFor11g) - SUB_NUM_CTL_MODES_AT_2G_40;
+                pCtlMode = ctlModesFor11g;
+
+                ath9k_hw_get_legacy_target_powers(ah, chan,
+                                                  pEepData->calTargetPowerCck,
+                                                  AR9287_NUM_2G_CCK_TARGET_POWERS,
+                                                  &targetPowerCck, 4, false);
+                ath9k_hw_get_legacy_target_powers(ah, chan,
+                                                  pEepData->calTargetPower2G,
+                                                  AR9287_NUM_2G_20_TARGET_POWERS,
+                                                  &targetPowerOfdm, 4, false);
+                ath9k_hw_get_target_powers(ah, chan,
+                                           pEepData->calTargetPower2GHT20,
+                                           AR9287_NUM_2G_20_TARGET_POWERS,
+                                           &targetPowerHt20, 8, false);
+
+                if (IS_CHAN_HT40(chan)) {
+                        numCtlModes = ARRAY_SIZE(ctlModesFor11g);
+                        ath9k_hw_get_target_powers(ah, chan,
+                                                   pEepData->calTargetPower2GHT40,
+                                                   AR9287_NUM_2G_40_TARGET_POWERS,
+                                                   &targetPowerHt40, 8, true);
+                        ath9k_hw_get_legacy_target_powers(ah, chan,
+                                                  pEepData->calTargetPowerCck,
+                                                  AR9287_NUM_2G_CCK_TARGET_POWERS,
+                                                  &targetPowerCckExt, 4, true);
+                        ath9k_hw_get_legacy_target_powers(ah, chan,
+                                                  pEepData->calTargetPower2G,
+                                                  AR9287_NUM_2G_20_TARGET_POWERS,
+                                                  &targetPowerOfdmExt, 4, true);
+                }
+        }
+
+        for (ctlMode = 0; ctlMode < numCtlModes; ctlMode++) {
+                bool isHt40CtlMode = (pCtlMode[ctlMode] == CTL_5GHT40) ||
+                                     (pCtlMode[ctlMode] == CTL_2GHT40);
+                if (isHt40CtlMode)
+                        freq = centers.synth_center;
+                else if (pCtlMode[ctlMode] & EXT_ADDITIVE)
+                        freq = centers.ext_center;
+                else
+                        freq = centers.ctl_center;
+
+                if (ah->eep_ops->get_eeprom_ver(ah) == 14 &&
+                    ah->eep_ops->get_eeprom_rev(ah) <= 2)
+                        twiceMaxEdgePower = AR5416_MAX_RATE_POWER;
+
+                for (i = 0; (i < AR9287_NUM_CTLS) && pEepData->ctlIndex[i]; i++) {
+                        if ((((cfgCtl & ~CTL_MODE_M) |
+                              (pCtlMode[ctlMode] & CTL_MODE_M)) ==
+                             pEepData->ctlIndex[i]) ||
+                            (((cfgCtl & ~CTL_MODE_M) |
+                              (pCtlMode[ctlMode] & CTL_MODE_M)) ==
+                             ((pEepData->ctlIndex[i] &
+                               CTL_MODE_M) | SD_NO_CTL))) {
+
+                                rep = &(pEepData->ctlData[i]);
+                                twiceMinEdgePower = ath9k_hw_get_max_edge_power(
+                                    freq,
+                                    rep->ctlEdges[ar5416_get_ntxchains(
+                                    tx_chainmask) - 1],
+                                    IS_CHAN_2GHZ(chan), AR5416_NUM_BAND_EDGES);
+
+                                if ((cfgCtl & ~CTL_MODE_M) == SD_NO_CTL)
+                                        twiceMaxEdgePower = min(
+                                                            twiceMaxEdgePower,
+                                                            twiceMinEdgePower);
+                                else {
+                                        twiceMaxEdgePower = twiceMinEdgePower;
+                                        break;
+                                }
+                        }
+                }
+
+                minCtlPower = (u8)min(twiceMaxEdgePower, scaledPower);
+
+                switch (pCtlMode[ctlMode]) {
+                case CTL_11B:
+                        for (i = 0;
+                             i < ARRAY_SIZE(targetPowerCck.tPow2x);
+                             i++) {
+                                targetPowerCck.tPow2x[i] = (u8)min(
+                                        (u16)targetPowerCck.tPow2x[i],
+                                        minCtlPower);
+                        }
+                        break;
+                case CTL_11A:
+                case CTL_11G:
+                        for (i = 0;
+                             i < ARRAY_SIZE(targetPowerOfdm.tPow2x);
+                             i++) {
+                                targetPowerOfdm.tPow2x[i] = (u8)min(
+                                        (u16)targetPowerOfdm.tPow2x[i],
+                                        minCtlPower);
+                        }
+                        break;
+                case CTL_5GHT20:
+                case CTL_2GHT20:
+                        for (i = 0;
+                             i < ARRAY_SIZE(targetPowerHt20.tPow2x);
+                             i++) {
+                                targetPowerHt20.tPow2x[i] = (u8)min(
+                                        (u16)targetPowerHt20.tPow2x[i],
+                                        minCtlPower);
+                        }
+                        break;
+                case CTL_11B_EXT:
+                        targetPowerCckExt.tPow2x[0] = (u8)min(
+                                    (u16)targetPowerCckExt.tPow2x[0],
+                                    minCtlPower);
+                        break;
+                case CTL_11A_EXT:
+                case CTL_11G_EXT:
+                        targetPowerOfdmExt.tPow2x[0] = (u8)min(
+                                    (u16)targetPowerOfdmExt.tPow2x[0],
+                                    minCtlPower);
+                        break;
+                case CTL_5GHT40:
+                case CTL_2GHT40:
+                        for (i = 0;
+                             i < ARRAY_SIZE(targetPowerHt40.tPow2x);
+                             i++) {
+                                targetPowerHt40.tPow2x[i] = (u8)min(
+                                        (u16)targetPowerHt40.tPow2x[i],
+                                        minCtlPower);
+                        }
+                        break;
+                default:
+                        break;
+                }
+        }
+
+        ratesArray[rate6mb] =
+        ratesArray[rate9mb] =
+        ratesArray[rate12mb] =
+        ratesArray[rate18mb] =
+        ratesArray[rate24mb] =
+        targetPowerOfdm.tPow2x[0];
+
+        ratesArray[rate36mb] = targetPowerOfdm.tPow2x[1];
+        ratesArray[rate48mb] = targetPowerOfdm.tPow2x[2];
+        ratesArray[rate54mb] = targetPowerOfdm.tPow2x[3];
+        ratesArray[rateXr] = targetPowerOfdm.tPow2x[0];
+
+        for (i = 0; i < ARRAY_SIZE(targetPowerHt20.tPow2x); i++)
+                ratesArray[rateHt20_0 + i] = targetPowerHt20.tPow2x[i];
+
+        if (IS_CHAN_2GHZ(chan)) {
+                ratesArray[rate1l] = targetPowerCck.tPow2x[0];
+                ratesArray[rate2s] = ratesArray[rate2l] =
+                        targetPowerCck.tPow2x[1];
+                ratesArray[rate5_5s] = ratesArray[rate5_5l] =
+                        targetPowerCck.tPow2x[2];
+                ratesArray[rate11s] = ratesArray[rate11l] =
+                        targetPowerCck.tPow2x[3];
+        }
+        if (IS_CHAN_HT40(chan)) {
+                for (i = 0; i < ARRAY_SIZE(targetPowerHt40.tPow2x); i++)
+                        ratesArray[rateHt40_0 + i] = targetPowerHt40.tPow2x[i];
+
+                ratesArray[rateDupOfdm] = targetPowerHt40.tPow2x[0];
+                ratesArray[rateDupCck]  = targetPowerHt40.tPow2x[0];
+                ratesArray[rateExtOfdm] = targetPowerOfdmExt.tPow2x[0];
+                if (IS_CHAN_2GHZ(chan))
+                        ratesArray[rateExtCck] = targetPowerCckExt.tPow2x[0];
+        }
+
+#undef REDUCE_SCALED_POWER_BY_TWO_CHAIN
+#undef REDUCE_SCALED_POWER_BY_THREE_CHAIN
+}
+
+static void ath9k_hw_AR9287_set_txpower(struct ath_hw *ah,
+                                        struct ath9k_channel *chan, u16 cfgCtl,
+                                        u8 twiceAntennaReduction,
+                                        u8 twiceMaxRegulatoryPower,
+                                        u8 powerLimit)
+{
+#define INCREASE_MAXPOW_BY_TWO_CHAIN     6
+#define INCREASE_MAXPOW_BY_THREE_CHAIN   10
+
+        struct ar9287_eeprom *pEepData = &ah->eeprom.map9287;
+        struct modal_eep_ar9287_header *pModal = &pEepData->modalHeader;
+        int16_t ratesArray[Ar5416RateSize];
+        int16_t  txPowerIndexOffset = 0;
+        u8 ht40PowerIncForPdadc = 2;
+        int i;
+
+        memset(ratesArray, 0, sizeof(ratesArray));
+
+        if ((pEepData->baseEepHeader.version & AR9287_EEP_VER_MINOR_MASK) >=
+            AR9287_EEP_MINOR_VER_2)
+                ht40PowerIncForPdadc = pModal->ht40PowerIncForPdadc;
+
+        ath9k_hw_set_AR9287_power_per_rate_table(ah, chan,
+                                                 &ratesArray[0], cfgCtl,
+                                                 twiceAntennaReduction,
+                                                 twiceMaxRegulatoryPower,
+                                                 powerLimit);
+
+        ath9k_hw_set_AR9287_power_cal_table(ah, chan, &txPowerIndexOffset);
+
+        for (i = 0; i < ARRAY_SIZE(ratesArray); i++) {
+                ratesArray[i] = (int16_t)(txPowerIndexOffset + ratesArray[i]);
+                if (ratesArray[i] > AR9287_MAX_RATE_POWER)
+                        ratesArray[i] = AR9287_MAX_RATE_POWER;
+        }
+
+        if (AR_SREV_9280_10_OR_LATER(ah)) {
+                for (i = 0; i < Ar5416RateSize; i++)
+                        ratesArray[i] -= AR9287_PWR_TABLE_OFFSET_DB * 2;
+        }
+
+        REG_WRITE(ah, AR_PHY_POWER_TX_RATE1,
+                  ATH9K_POW_SM(ratesArray[rate18mb], 24)
+                  | ATH9K_POW_SM(ratesArray[rate12mb], 16)
+                  | ATH9K_POW_SM(ratesArray[rate9mb], 8)
+                  | ATH9K_POW_SM(ratesArray[rate6mb], 0));
+
+        REG_WRITE(ah, AR_PHY_POWER_TX_RATE2,
+                  ATH9K_POW_SM(ratesArray[rate54mb], 24)
+                  | ATH9K_POW_SM(ratesArray[rate48mb], 16)
+                  | ATH9K_POW_SM(ratesArray[rate36mb], 8)
+                  | ATH9K_POW_SM(ratesArray[rate24mb], 0));
+
+        if (IS_CHAN_2GHZ(chan)) {
+                REG_WRITE(ah, AR_PHY_POWER_TX_RATE3,
+                          ATH9K_POW_SM(ratesArray[rate2s], 24)
+                          | ATH9K_POW_SM(ratesArray[rate2l], 16)
+                          | ATH9K_POW_SM(ratesArray[rateXr], 8)
+                          | ATH9K_POW_SM(ratesArray[rate1l], 0));
+                REG_WRITE(ah, AR_PHY_POWER_TX_RATE4,
+                          ATH9K_POW_SM(ratesArray[rate11s], 24)
+                          | ATH9K_POW_SM(ratesArray[rate11l], 16)
+                          | ATH9K_POW_SM(ratesArray[rate5_5s], 8)
+                          | ATH9K_POW_SM(ratesArray[rate5_5l], 0));
+        }
+
+        REG_WRITE(ah, AR_PHY_POWER_TX_RATE5,
+                  ATH9K_POW_SM(ratesArray[rateHt20_3], 24)
+                  | ATH9K_POW_SM(ratesArray[rateHt20_2], 16)
+                  | ATH9K_POW_SM(ratesArray[rateHt20_1], 8)
+                  | ATH9K_POW_SM(ratesArray[rateHt20_0], 0));
+
+        REG_WRITE(ah, AR_PHY_POWER_TX_RATE6,
+                  ATH9K_POW_SM(ratesArray[rateHt20_7], 24)
+                  | ATH9K_POW_SM(ratesArray[rateHt20_6], 16)
+                  | ATH9K_POW_SM(ratesArray[rateHt20_5], 8)
+                  | ATH9K_POW_SM(ratesArray[rateHt20_4], 0));
+
+        if (IS_CHAN_HT40(chan)) {
+                if (ath9k_hw_AR9287_get_eeprom(ah, EEP_OL_PWRCTRL)) {
+                        REG_WRITE(ah, AR_PHY_POWER_TX_RATE7,
+                                  ATH9K_POW_SM(ratesArray[rateHt40_3], 24)
+                                  | ATH9K_POW_SM(ratesArray[rateHt40_2], 16)
+                                  | ATH9K_POW_SM(ratesArray[rateHt40_1], 8)
+                                  | ATH9K_POW_SM(ratesArray[rateHt40_0], 0));
+
+                        REG_WRITE(ah, AR_PHY_POWER_TX_RATE8,
+                                  ATH9K_POW_SM(ratesArray[rateHt40_7], 24)
+                                  | ATH9K_POW_SM(ratesArray[rateHt40_6], 16)
+                                  | ATH9K_POW_SM(ratesArray[rateHt40_5], 8)
+                                  | ATH9K_POW_SM(ratesArray[rateHt40_4], 0));
+                } else {
+                        REG_WRITE(ah, AR_PHY_POWER_TX_RATE7,
+                                  ATH9K_POW_SM(ratesArray[rateHt40_3] +
+                                               ht40PowerIncForPdadc, 24)
+                                  | ATH9K_POW_SM(ratesArray[rateHt40_2] +
+                                                 ht40PowerIncForPdadc, 16)
+                                  | ATH9K_POW_SM(ratesArray[rateHt40_1] +
+                                                 ht40PowerIncForPdadc, 8)
+                                  | ATH9K_POW_SM(ratesArray[rateHt40_0] +
+                                                 ht40PowerIncForPdadc, 0));
+
+                        REG_WRITE(ah, AR_PHY_POWER_TX_RATE8,
+                                  ATH9K_POW_SM(ratesArray[rateHt40_7] +
+                                               ht40PowerIncForPdadc, 24)
+                                  | ATH9K_POW_SM(ratesArray[rateHt40_6] +
+                                                 ht40PowerIncForPdadc, 16)
+                                  | ATH9K_POW_SM(ratesArray[rateHt40_5] +
+                                                 ht40PowerIncForPdadc, 8)
+                                  | ATH9K_POW_SM(ratesArray[rateHt40_4] +
+                                                 ht40PowerIncForPdadc, 0));
+                }
+
+                REG_WRITE(ah, AR_PHY_POWER_TX_RATE9,
+                          ATH9K_POW_SM(ratesArray[rateExtOfdm], 24)
+                          | ATH9K_POW_SM(ratesArray[rateExtCck], 16)
+                          | ATH9K_POW_SM(ratesArray[rateDupOfdm], 8)
+                          | ATH9K_POW_SM(ratesArray[rateDupCck], 0));
+        }
+
+        if (IS_CHAN_2GHZ(chan))
+                i = rate1l;
+        else
+                i = rate6mb;
+
+        if (AR_SREV_9280_10_OR_LATER(ah))
+                ah->regulatory.max_power_level =
+                        ratesArray[i] + AR9287_PWR_TABLE_OFFSET_DB * 2;
+        else
+                ah->regulatory.max_power_level = ratesArray[i];
+
+        switch (ar5416_get_ntxchains(ah->txchainmask)) {
+        case 1:
+                break;
+        case 2:
+                ah->regulatory.max_power_level +=
+                        INCREASE_MAXPOW_BY_TWO_CHAIN;
+                break;
+        case 3:
+                ah->regulatory.max_power_level +=
+                        INCREASE_MAXPOW_BY_THREE_CHAIN;
+                break;
+        default:
+                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
+                        "Invalid chainmask configuration\n");
+                break;
+        }
+}
+
+static void ath9k_hw_AR9287_set_addac(struct ath_hw *ah,
+                                      struct ath9k_channel *chan)
+{
+}
+
+static void ath9k_hw_AR9287_set_board_values(struct ath_hw *ah,
+                                             struct ath9k_channel *chan)
+{
+        struct ar9287_eeprom *eep = &ah->eeprom.map9287;
+        struct modal_eep_ar9287_header *pModal = &eep->modalHeader;
+        u16 antWrites[AR9287_ANT_16S];
+        u32 regChainOffset;
+        u8 txRxAttenLocal;
+        int i, j, offset_num;
+
+        pModal = &eep->modalHeader;
+
+        antWrites[0] = (u16)((pModal->antCtrlCommon >> 28) & 0xF);
+        antWrites[1] = (u16)((pModal->antCtrlCommon >> 24) & 0xF);
+        antWrites[2] = (u16)((pModal->antCtrlCommon >> 20) & 0xF);
+        antWrites[3] = (u16)((pModal->antCtrlCommon >> 16) & 0xF);
+        antWrites[4] = (u16)((pModal->antCtrlCommon >> 12) & 0xF);
+        antWrites[5] = (u16)((pModal->antCtrlCommon >> 8) & 0xF);
+        antWrites[6] = (u16)((pModal->antCtrlCommon >> 4)  & 0xF);
+        antWrites[7] = (u16)(pModal->antCtrlCommon & 0xF);
+
+        offset_num = 8;
+
+        for (i = 0, j = offset_num; i < AR9287_MAX_CHAINS; i++) {
+                antWrites[j++] = (u16)((pModal->antCtrlChain[i] >> 28) & 0xf);
+                antWrites[j++] = (u16)((pModal->antCtrlChain[i] >> 10) & 0x3);
+                antWrites[j++] = (u16)((pModal->antCtrlChain[i] >> 8) & 0x3);
+                antWrites[j++] = 0;
+                antWrites[j++] = (u16)((pModal->antCtrlChain[i] >> 6) & 0x3);
+                antWrites[j++] = (u16)((pModal->antCtrlChain[i] >> 4) & 0x3);
+                antWrites[j++] = (u16)((pModal->antCtrlChain[i] >> 2) & 0x3);
+                antWrites[j++] = (u16)(pModal->antCtrlChain[i] & 0x3);
+        }
+
+        REG_WRITE(ah, AR_PHY_SWITCH_COM,
+                  ah->eep_ops->get_eeprom_antenna_cfg(ah, chan));
+
+        for (i = 0; i < AR9287_MAX_CHAINS; i++) {
+                regChainOffset = i * 0x1000;
+
+                REG_WRITE(ah, AR_PHY_SWITCH_CHAIN_0 + regChainOffset,
+                          pModal->antCtrlChain[i]);
+
+                REG_WRITE(ah, AR_PHY_TIMING_CTRL4(0) + regChainOffset,
+                          (REG_READ(ah, AR_PHY_TIMING_CTRL4(0) + regChainOffset)
+                           & ~(AR_PHY_TIMING_CTRL4_IQCORR_Q_Q_COFF |
+                               AR_PHY_TIMING_CTRL4_IQCORR_Q_I_COFF)) |
+                          SM(pModal->iqCalICh[i],
+                             AR_PHY_TIMING_CTRL4_IQCORR_Q_I_COFF) |
+                          SM(pModal->iqCalQCh[i],
+                             AR_PHY_TIMING_CTRL4_IQCORR_Q_Q_COFF));
+
+                txRxAttenLocal = pModal->txRxAttenCh[i];
+
+                REG_RMW_FIELD(ah, AR_PHY_GAIN_2GHZ + regChainOffset,
+                              AR_PHY_GAIN_2GHZ_XATTEN1_MARGIN,
+                              pModal->bswMargin[i]);
+                REG_RMW_FIELD(ah, AR_PHY_GAIN_2GHZ + regChainOffset,
+                              AR_PHY_GAIN_2GHZ_XATTEN1_DB,
+                              pModal->bswAtten[i]);
+                REG_RMW_FIELD(ah, AR_PHY_RXGAIN + regChainOffset,
+                              AR9280_PHY_RXGAIN_TXRX_ATTEN,
+                              txRxAttenLocal);
+                REG_RMW_FIELD(ah, AR_PHY_RXGAIN + regChainOffset,
+                              AR9280_PHY_RXGAIN_TXRX_MARGIN,
+                              pModal->rxTxMarginCh[i]);
+        }
+
+
+        if (IS_CHAN_HT40(chan))
+                REG_RMW_FIELD(ah, AR_PHY_SETTLING,
+                              AR_PHY_SETTLING_SWITCH, pModal->swSettleHt40);
+        else
+                REG_RMW_FIELD(ah, AR_PHY_SETTLING,
+                              AR_PHY_SETTLING_SWITCH, pModal->switchSettling);
+
+        REG_RMW_FIELD(ah, AR_PHY_DESIRED_SZ,
+                      AR_PHY_DESIRED_SZ_ADC, pModal->adcDesiredSize);
+
+        REG_WRITE(ah, AR_PHY_RF_CTL4,
+                  SM(pModal->txEndToXpaOff, AR_PHY_RF_CTL4_TX_END_XPAA_OFF)
+                  | SM(pModal->txEndToXpaOff, AR_PHY_RF_CTL4_TX_END_XPAB_OFF)
+                  | SM(pModal->txFrameToXpaOn, AR_PHY_RF_CTL4_FRAME_XPAA_ON)
+                  | SM(pModal->txFrameToXpaOn, AR_PHY_RF_CTL4_FRAME_XPAB_ON));
+
+        REG_RMW_FIELD(ah, AR_PHY_RF_CTL3,
+                      AR_PHY_TX_END_TO_A2_RX_ON, pModal->txEndToRxOn);
+
+        REG_RMW_FIELD(ah, AR_PHY_CCA,
+                      AR9280_PHY_CCA_THRESH62, pModal->thresh62);
+        REG_RMW_FIELD(ah, AR_PHY_EXT_CCA0,
+                      AR_PHY_EXT_CCA0_THRESH62, pModal->thresh62);
+
+        ath9k_hw_analog_shift_rmw(ah, AR9287_AN_RF2G3_CH0, AR9287_AN_RF2G3_DB1,
+                                  AR9287_AN_RF2G3_DB1_S, pModal->db1);
+        ath9k_hw_analog_shift_rmw(ah, AR9287_AN_RF2G3_CH0, AR9287_AN_RF2G3_DB2,
+                                  AR9287_AN_RF2G3_DB2_S, pModal->db2);
+        ath9k_hw_analog_shift_rmw(ah, AR9287_AN_RF2G3_CH0,
+                                  AR9287_AN_RF2G3_OB_CCK,
+                                  AR9287_AN_RF2G3_OB_CCK_S, pModal->ob_cck);
+        ath9k_hw_analog_shift_rmw(ah, AR9287_AN_RF2G3_CH0,
+                                  AR9287_AN_RF2G3_OB_PSK,
+                                  AR9287_AN_RF2G3_OB_PSK_S, pModal->ob_psk);
+        ath9k_hw_analog_shift_rmw(ah, AR9287_AN_RF2G3_CH0,
+                                  AR9287_AN_RF2G3_OB_QAM,
+                                  AR9287_AN_RF2G3_OB_QAM_S, pModal->ob_qam);
+        ath9k_hw_analog_shift_rmw(ah, AR9287_AN_RF2G3_CH0,
+                                  AR9287_AN_RF2G3_OB_PAL_OFF,
+                                  AR9287_AN_RF2G3_OB_PAL_OFF_S,
+                                  pModal->ob_pal_off);
+
+        ath9k_hw_analog_shift_rmw(ah, AR9287_AN_RF2G3_CH1,
+                                  AR9287_AN_RF2G3_DB1, AR9287_AN_RF2G3_DB1_S,
+                                  pModal->db1);
+        ath9k_hw_analog_shift_rmw(ah, AR9287_AN_RF2G3_CH1, AR9287_AN_RF2G3_DB2,
+                                  AR9287_AN_RF2G3_DB2_S, pModal->db2);
+        ath9k_hw_analog_shift_rmw(ah, AR9287_AN_RF2G3_CH1,
+                                  AR9287_AN_RF2G3_OB_CCK,
+                                  AR9287_AN_RF2G3_OB_CCK_S, pModal->ob_cck);
+        ath9k_hw_analog_shift_rmw(ah, AR9287_AN_RF2G3_CH1,
+                                  AR9287_AN_RF2G3_OB_PSK,
+                                  AR9287_AN_RF2G3_OB_PSK_S, pModal->ob_psk);
+        ath9k_hw_analog_shift_rmw(ah, AR9287_AN_RF2G3_CH1,
+                                  AR9287_AN_RF2G3_OB_QAM,
+                                  AR9287_AN_RF2G3_OB_QAM_S, pModal->ob_qam);
+        ath9k_hw_analog_shift_rmw(ah, AR9287_AN_RF2G3_CH1,
+                                  AR9287_AN_RF2G3_OB_PAL_OFF,
+                                  AR9287_AN_RF2G3_OB_PAL_OFF_S,
+                                  pModal->ob_pal_off);
+
+        REG_RMW_FIELD(ah, AR_PHY_RF_CTL2,
+                      AR_PHY_TX_END_DATA_START, pModal->txFrameToDataStart);
+        REG_RMW_FIELD(ah, AR_PHY_RF_CTL2,
+                      AR_PHY_TX_END_PA_ON, pModal->txFrameToPaOn);
+
+        ath9k_hw_analog_shift_rmw(ah, AR9287_AN_TOP2,
+                                  AR9287_AN_TOP2_XPABIAS_LVL,
+                                  AR9287_AN_TOP2_XPABIAS_LVL_S,
+                                  pModal->xpaBiasLvl);
+}
+
+static u8 ath9k_hw_AR9287_get_num_ant_config(struct ath_hw *ah,
+                                             enum ieee80211_band freq_band)
+{
+        return 1;
+}
+
+static u16 ath9k_hw_AR9287_get_eeprom_antenna_cfg(struct ath_hw *ah,
+                                                  struct ath9k_channel *chan)
+{
+        struct ar9287_eeprom *eep = &ah->eeprom.map9287;
+        struct modal_eep_ar9287_header *pModal = &eep->modalHeader;
+
+        return pModal->antCtrlCommon & 0xFFFF;
+}
+
+static u16 ath9k_hw_AR9287_get_spur_channel(struct ath_hw *ah,
+                                            u16 i, bool is2GHz)
+{
+#define EEP_MAP9287_SPURCHAN \
+        (ah->eeprom.map9287.modalHeader.spurChans[i].spurChan)
+        u16 spur_val = AR_NO_SPUR;
+
+        DPRINTF(ah->ah_sc, ATH_DBG_ANI,
+                "Getting spur idx %d is2Ghz. %d val %x\n",
+                i, is2GHz, ah->config.spurchans[i][is2GHz]);
+
+        switch (ah->config.spurmode) {
+        case SPUR_DISABLE:
+                break;
+        case SPUR_ENABLE_IOCTL:
+                spur_val = ah->config.spurchans[i][is2GHz];
+                DPRINTF(ah->ah_sc, ATH_DBG_ANI,
+                       "Getting spur val from new loc. %d\n", spur_val);
+                break;
+        case SPUR_ENABLE_EEPROM:
+                spur_val = EEP_MAP9287_SPURCHAN;
+                break;
+        }
+
+        return spur_val;
+
+#undef EEP_MAP9287_SPURCHAN
+}
+
+const struct eeprom_ops eep_AR9287_ops = {
+        .check_eeprom           = ath9k_hw_AR9287_check_eeprom,
+        .get_eeprom             = ath9k_hw_AR9287_get_eeprom,
+        .fill_eeprom            = ath9k_hw_AR9287_fill_eeprom,
+        .get_eeprom_ver         = ath9k_hw_AR9287_get_eeprom_ver,
+        .get_eeprom_rev         = ath9k_hw_AR9287_get_eeprom_rev,
+        .get_num_ant_config     = ath9k_hw_AR9287_get_num_ant_config,
+        .get_eeprom_antenna_cfg = ath9k_hw_AR9287_get_eeprom_antenna_cfg,
+        .set_board_values       = ath9k_hw_AR9287_set_board_values,
+        .set_addac              = ath9k_hw_AR9287_set_addac,
+        .set_txpower            = ath9k_hw_AR9287_set_txpower,
+        .get_spur_channel       = ath9k_hw_AR9287_get_spur_channel
+};
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_def.c b/drivers/net/wireless/ath/ath9k/eeprom_def.c
new file mode 100644
index 000000000000..5211ad94c8fb
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/eeprom_def.c
@@ -0,0 +1,1385 @@
+/*
+ * Copyright (c) 2008-2009 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "ath9k.h"
+
+static void ath9k_get_txgain_index(struct ath_hw *ah,
+                struct ath9k_channel *chan,
+                struct calDataPerFreqOpLoop *rawDatasetOpLoop,
+                u8 *calChans,  u16 availPiers, u8 *pwr, u8 *pcdacIdx)
+{
+        u8 pcdac, i = 0;
+        u16 idxL = 0, idxR = 0, numPiers;
+        bool match;
+        struct chan_centers centers;
+
+        ath9k_hw_get_channel_centers(ah, chan, &centers);
+
+        for (numPiers = 0; numPiers < availPiers; numPiers++)
+                if (calChans[numPiers] == AR5416_BCHAN_UNUSED)
+                        break;
+
+        match = ath9k_hw_get_lower_upper_index(
+                        (u8)FREQ2FBIN(centers.synth_center, IS_CHAN_2GHZ(chan)),
+                        calChans, numPiers, &idxL, &idxR);
+        if (match) {
+                pcdac = rawDatasetOpLoop[idxL].pcdac[0][0];
+                *pwr = rawDatasetOpLoop[idxL].pwrPdg[0][0];
+        } else {
+                pcdac = rawDatasetOpLoop[idxR].pcdac[0][0];
+                *pwr = (rawDatasetOpLoop[idxL].pwrPdg[0][0] +
+                                rawDatasetOpLoop[idxR].pwrPdg[0][0])/2;
+        }
+
+        while (pcdac > ah->originalGain[i] &&
+                        i < (AR9280_TX_GAIN_TABLE_SIZE - 1))
+                i++;
+
+        *pcdacIdx = i;
+        return;
+}
+
+static void ath9k_olc_get_pdadcs(struct ath_hw *ah,
+                                u32 initTxGain,
+                                int txPower,
+                                u8 *pPDADCValues)
+{
+        u32 i;
+        u32 offset;
+
+        REG_RMW_FIELD(ah, AR_PHY_TX_PWRCTRL6_0,
+                        AR_PHY_TX_PWRCTRL_ERR_EST_MODE, 3);
+        REG_RMW_FIELD(ah, AR_PHY_TX_PWRCTRL6_1,
+                        AR_PHY_TX_PWRCTRL_ERR_EST_MODE, 3);
+
+        REG_RMW_FIELD(ah, AR_PHY_TX_PWRCTRL7,
+                        AR_PHY_TX_PWRCTRL_INIT_TX_GAIN, initTxGain);
+
+        offset = txPower;
+        for (i = 0; i < AR5416_NUM_PDADC_VALUES; i++)
+                if (i < offset)
+                        pPDADCValues[i] = 0x0;
+                else
+                        pPDADCValues[i] = 0xFF;
+}
+
+static int ath9k_hw_def_get_eeprom_ver(struct ath_hw *ah)
+{
+        return ((ah->eeprom.def.baseEepHeader.version >> 12) & 0xF);
+}
+
+static int ath9k_hw_def_get_eeprom_rev(struct ath_hw *ah)
+{
+        return ((ah->eeprom.def.baseEepHeader.version) & 0xFFF);
+}
+
+static bool ath9k_hw_def_fill_eeprom(struct ath_hw *ah)
+{
+#define SIZE_EEPROM_DEF (sizeof(struct ar5416_eeprom_def) / sizeof(u16))
+        u16 *eep_data = (u16 *)&ah->eeprom.def;
+        int addr, ar5416_eep_start_loc = 0x100;
+
+        for (addr = 0; addr < SIZE_EEPROM_DEF; addr++) {
+                if (!ath9k_hw_nvram_read(ah, addr + ar5416_eep_start_loc,
+                                         eep_data)) {
+                        DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
+                                "Unable to read eeprom region\n");
+                        return false;
+                }
+                eep_data++;
+        }
+        return true;
+#undef SIZE_EEPROM_DEF
+}
+
+static int ath9k_hw_def_check_eeprom(struct ath_hw *ah)
+{
+        struct ar5416_eeprom_def *eep =
+                (struct ar5416_eeprom_def *) &ah->eeprom.def;
+        u16 *eepdata, temp, magic, magic2;
+        u32 sum = 0, el;
+        bool need_swap = false;
+        int i, addr, size;
+
+        if (!ath9k_hw_nvram_read(ah, AR5416_EEPROM_MAGIC_OFFSET, &magic)) {
+                DPRINTF(ah->ah_sc, ATH_DBG_FATAL, "Reading Magic # failed\n");
+                return false;
+        }
+
+        if (!ath9k_hw_use_flash(ah)) {
+                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
+                        "Read Magic = 0x%04X\n", magic);
+
+                if (magic != AR5416_EEPROM_MAGIC) {
+                        magic2 = swab16(magic);
+
+                        if (magic2 == AR5416_EEPROM_MAGIC) {
+                                size = sizeof(struct ar5416_eeprom_def);
+                                need_swap = true;
+                                eepdata = (u16 *) (&ah->eeprom);
+
+                                for (addr = 0; addr < size / sizeof(u16); addr++) {
+                                        temp = swab16(*eepdata);
+                                        *eepdata = temp;
+                                        eepdata++;
+                                }
+                        } else {
+                                DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
+                                        "Invalid EEPROM Magic. "
+                                        "Endianness mismatch.\n");
+                                return -EINVAL;
+                        }
+                }
+        }
+
+        DPRINTF(ah->ah_sc, ATH_DBG_EEPROM, "need_swap = %s.\n",
+                need_swap ? "True" : "False");
+
+        if (need_swap)
+                el = swab16(ah->eeprom.def.baseEepHeader.length);
+        else
+                el = ah->eeprom.def.baseEepHeader.length;
+
+        if (el > sizeof(struct ar5416_eeprom_def))
+                el = sizeof(struct ar5416_eeprom_def) / sizeof(u16);
+        else
+                el = el / sizeof(u16);
+
+        eepdata = (u16 *)(&ah->eeprom);
+
+        for (i = 0; i < el; i++)
+                sum ^= *eepdata++;
+
+        if (need_swap) {
+                u32 integer, j;
+                u16 word;
+
+                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
+                        "EEPROM Endianness is not native.. Changing.\n");
+
+                word = swab16(eep->baseEepHeader.length);
+                eep->baseEepHeader.length = word;
+
+                word = swab16(eep->baseEepHeader.checksum);
+                eep->baseEepHeader.checksum = word;
+
+                word = swab16(eep->baseEepHeader.version);
+                eep->baseEepHeader.version = word;
+
+                word = swab16(eep->baseEepHeader.regDmn[0]);
+                eep->baseEepHeader.regDmn[0] = word;
+
+                word = swab16(eep->baseEepHeader.regDmn[1]);
+                eep->baseEepHeader.regDmn[1] = word;
+
+                word = swab16(eep->baseEepHeader.rfSilent);
+                eep->baseEepHeader.rfSilent = word;
+
+                word = swab16(eep->baseEepHeader.blueToothOptions);
+                eep->baseEepHeader.blueToothOptions = word;
+
+                word = swab16(eep->baseEepHeader.deviceCap);
+                eep->baseEepHeader.deviceCap = word;
+
+                for (j = 0; j < ARRAY_SIZE(eep->modalHeader); j++) {
+                        struct modal_eep_header *pModal =
+                                &eep->modalHeader[j];
+                        integer = swab32(pModal->antCtrlCommon);
+                        pModal->antCtrlCommon = integer;
+
+                        for (i = 0; i < AR5416_MAX_CHAINS; i++) {
+                                integer = swab32(pModal->antCtrlChain[i]);
+                                pModal->antCtrlChain[i] = integer;
+                        }
+
+                        for (i = 0; i < AR5416_EEPROM_MODAL_SPURS; i++) {
+                                word = swab16(pModal->spurChans[i].spurChan);
+                                pModal->spurChans[i].spurChan = word;
+                        }
+                }
+        }
+
+        if (sum != 0xffff || ah->eep_ops->get_eeprom_ver(ah) != AR5416_EEP_VER ||
+            ah->eep_ops->get_eeprom_rev(ah) < AR5416_EEP_NO_BACK_VER) {
+                DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
+                        "Bad EEPROM checksum 0x%x or revision 0x%04x\n",
+                        sum, ah->eep_ops->get_eeprom_ver(ah));
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+static u32 ath9k_hw_def_get_eeprom(struct ath_hw *ah,
+                                   enum eeprom_param param)
+{
+        struct ar5416_eeprom_def *eep = &ah->eeprom.def;
+        struct modal_eep_header *pModal = eep->modalHeader;
+        struct base_eep_header *pBase = &eep->baseEepHeader;
+
+        switch (param) {
+        case EEP_NFTHRESH_5:
+                return pModal[0].noiseFloorThreshCh[0];
+        case EEP_NFTHRESH_2:
+                return pModal[1].noiseFloorThreshCh[0];
+        case AR_EEPROM_MAC(0):
+                return pBase->macAddr[0] << 8 | pBase->macAddr[1];
+        case AR_EEPROM_MAC(1):
+                return pBase->macAddr[2] << 8 | pBase->macAddr[3];
+        case AR_EEPROM_MAC(2):
+                return pBase->macAddr[4] << 8 | pBase->macAddr[5];
+        case EEP_REG_0:
+                return pBase->regDmn[0];
+        case EEP_REG_1:
+                return pBase->regDmn[1];
+        case EEP_OP_CAP:
+                return pBase->deviceCap;
+        case EEP_OP_MODE:
+                return pBase->opCapFlags;
+        case EEP_RF_SILENT:
+                return pBase->rfSilent;
+        case EEP_OB_5:
+                return pModal[0].ob;
+        case EEP_DB_5:
+                return pModal[0].db;
+        case EEP_OB_2:
+                return pModal[1].ob;
+        case EEP_DB_2:
+                return pModal[1].db;
+        case EEP_MINOR_REV:
+                return AR5416_VER_MASK;
+        case EEP_TX_MASK:
+                return pBase->txMask;
+        case EEP_RX_MASK:
+                return pBase->rxMask;
+        case EEP_RXGAIN_TYPE:
+                return pBase->rxGainType;
+        case EEP_TXGAIN_TYPE:
+                return pBase->txGainType;
+        case EEP_OL_PWRCTRL:
+                if (AR5416_VER_MASK >= AR5416_EEP_MINOR_VER_19)
+                        return pBase->openLoopPwrCntl ? true : false;
+                else
+                        return false;
+        case EEP_RC_CHAIN_MASK:
+                if (AR5416_VER_MASK >= AR5416_EEP_MINOR_VER_19)
+                        return pBase->rcChainMask;
+                else
+                        return 0;
+        case EEP_DAC_HPWR_5G:
+                if (AR5416_VER_MASK >= AR5416_EEP_MINOR_VER_20)
+                        return pBase->dacHiPwrMode_5G;
+                else
+                        return 0;
+        case EEP_FRAC_N_5G:
+                if (AR5416_VER_MASK >= AR5416_EEP_MINOR_VER_22)
+                        return pBase->frac_n_5g;
+                else
+                        return 0;
+        default:
+                return 0;
+        }
+}
+
+static void ath9k_hw_def_set_gain(struct ath_hw *ah,
+                                  struct modal_eep_header *pModal,
+                                  struct ar5416_eeprom_def *eep,
+                                  u8 txRxAttenLocal, int regChainOffset, int i)
+{
+        if (AR5416_VER_MASK >= AR5416_EEP_MINOR_VER_3) {
+                txRxAttenLocal = pModal->txRxAttenCh[i];
+
+                if (AR_SREV_9280_10_OR_LATER(ah)) {
+                        REG_RMW_FIELD(ah, AR_PHY_GAIN_2GHZ + regChainOffset,
+                              AR_PHY_GAIN_2GHZ_XATTEN1_MARGIN,
+                              pModal->bswMargin[i]);
+                        REG_RMW_FIELD(ah, AR_PHY_GAIN_2GHZ + regChainOffset,
+                              AR_PHY_GAIN_2GHZ_XATTEN1_DB,
+                              pModal->bswAtten[i]);
+                        REG_RMW_FIELD(ah, AR_PHY_GAIN_2GHZ + regChainOffset,
+                              AR_PHY_GAIN_2GHZ_XATTEN2_MARGIN,
+                              pModal->xatten2Margin[i]);
+                        REG_RMW_FIELD(ah, AR_PHY_GAIN_2GHZ + regChainOffset,
+                              AR_PHY_GAIN_2GHZ_XATTEN2_DB,
+                              pModal->xatten2Db[i]);
+                } else {
+                        REG_WRITE(ah, AR_PHY_GAIN_2GHZ + regChainOffset,
+                          (REG_READ(ah, AR_PHY_GAIN_2GHZ + regChainOffset) &
+                           ~AR_PHY_GAIN_2GHZ_BSW_MARGIN)
+                          | SM(pModal-> bswMargin[i],
+                               AR_PHY_GAIN_2GHZ_BSW_MARGIN));
+                        REG_WRITE(ah, AR_PHY_GAIN_2GHZ + regChainOffset,
+                          (REG_READ(ah, AR_PHY_GAIN_2GHZ + regChainOffset) &
+                           ~AR_PHY_GAIN_2GHZ_BSW_ATTEN)
+                          | SM(pModal->bswAtten[i],
+                               AR_PHY_GAIN_2GHZ_BSW_ATTEN));
+                }
+        }
+
+        if (AR_SREV_9280_10_OR_LATER(ah)) {
+                REG_RMW_FIELD(ah,
+                      AR_PHY_RXGAIN + regChainOffset,
+                      AR9280_PHY_RXGAIN_TXRX_ATTEN, txRxAttenLocal);
+                REG_RMW_FIELD(ah,
+                      AR_PHY_RXGAIN + regChainOffset,
+                      AR9280_PHY_RXGAIN_TXRX_MARGIN, pModal->rxTxMarginCh[i]);
+        } else {
+                REG_WRITE(ah,
+                          AR_PHY_RXGAIN + regChainOffset,
+                          (REG_READ(ah, AR_PHY_RXGAIN + regChainOffset) &
+                           ~AR_PHY_RXGAIN_TXRX_ATTEN)
+                          | SM(txRxAttenLocal, AR_PHY_RXGAIN_TXRX_ATTEN));
+                REG_WRITE(ah,
+                          AR_PHY_GAIN_2GHZ + regChainOffset,
+                          (REG_READ(ah, AR_PHY_GAIN_2GHZ + regChainOffset) &
+                           ~AR_PHY_GAIN_2GHZ_RXTX_MARGIN) |
+                          SM(pModal->rxTxMarginCh[i], AR_PHY_GAIN_2GHZ_RXTX_MARGIN));
+        }
+}
+
+static void ath9k_hw_def_set_board_values(struct ath_hw *ah,
+                                          struct ath9k_channel *chan)
+{
+        struct modal_eep_header *pModal;
+        struct ar5416_eeprom_def *eep = &ah->eeprom.def;
+        int i, regChainOffset;
+        u8 txRxAttenLocal;
+
+        pModal = &(eep->modalHeader[IS_CHAN_2GHZ(chan)]);
+        txRxAttenLocal = IS_CHAN_2GHZ(chan) ? 23 : 44;
+
+        REG_WRITE(ah, AR_PHY_SWITCH_COM,
+                  ah->eep_ops->get_eeprom_antenna_cfg(ah, chan));
+
+        for (i = 0; i < AR5416_MAX_CHAINS; i++) {
+                if (AR_SREV_9280(ah)) {
+                        if (i >= 2)
+                                break;
+                }
+
+                if (AR_SREV_5416_20_OR_LATER(ah) &&
+                    (ah->rxchainmask == 5 || ah->txchainmask == 5) && (i != 0))
+                        regChainOffset = (i == 1) ? 0x2000 : 0x1000;
+                else
+                        regChainOffset = i * 0x1000;
+
+                REG_WRITE(ah, AR_PHY_SWITCH_CHAIN_0 + regChainOffset,
+                          pModal->antCtrlChain[i]);
+
+                REG_WRITE(ah, AR_PHY_TIMING_CTRL4(0) + regChainOffset,
+                          (REG_READ(ah, AR_PHY_TIMING_CTRL4(0) + regChainOffset) &
+                           ~(AR_PHY_TIMING_CTRL4_IQCORR_Q_Q_COFF |
+                             AR_PHY_TIMING_CTRL4_IQCORR_Q_I_COFF)) |
+                          SM(pModal->iqCalICh[i],
+                             AR_PHY_TIMING_CTRL4_IQCORR_Q_I_COFF) |
+                          SM(pModal->iqCalQCh[i],
+                             AR_PHY_TIMING_CTRL4_IQCORR_Q_Q_COFF));
+
+                if ((i == 0) || AR_SREV_5416_20_OR_LATER(ah))
+                        ath9k_hw_def_set_gain(ah, pModal, eep, txRxAttenLocal,
+                                              regChainOffset, i);
+        }
+
+        if (AR_SREV_9280_10_OR_LATER(ah)) {
+                if (IS_CHAN_2GHZ(chan)) {
+                        ath9k_hw_analog_shift_rmw(ah, AR_AN_RF2G1_CH0,
+                                                  AR_AN_RF2G1_CH0_OB,
+                                                  AR_AN_RF2G1_CH0_OB_S,
+                                                  pModal->ob);
+                        ath9k_hw_analog_shift_rmw(ah, AR_AN_RF2G1_CH0,
+                                                  AR_AN_RF2G1_CH0_DB,
+                                                  AR_AN_RF2G1_CH0_DB_S,
+                                                  pModal->db);
+                        ath9k_hw_analog_shift_rmw(ah, AR_AN_RF2G1_CH1,
+                                                  AR_AN_RF2G1_CH1_OB,
+                                                  AR_AN_RF2G1_CH1_OB_S,
+                                                  pModal->ob_ch1);
+                        ath9k_hw_analog_shift_rmw(ah, AR_AN_RF2G1_CH1,
+                                                  AR_AN_RF2G1_CH1_DB,
+                                                  AR_AN_RF2G1_CH1_DB_S,
+                                                  pModal->db_ch1);
+                } else {
+                        ath9k_hw_analog_shift_rmw(ah, AR_AN_RF5G1_CH0,
+                                                  AR_AN_RF5G1_CH0_OB5,
+                                                  AR_AN_RF5G1_CH0_OB5_S,
+                                                  pModal->ob);
+                        ath9k_hw_analog_shift_rmw(ah, AR_AN_RF5G1_CH0,
+                                                  AR_AN_RF5G1_CH0_DB5,
+                                                  AR_AN_RF5G1_CH0_DB5_S,
+                                                  pModal->db);
+                        ath9k_hw_analog_shift_rmw(ah, AR_AN_RF5G1_CH1,
+                                                  AR_AN_RF5G1_CH1_OB5,
+                                                  AR_AN_RF5G1_CH1_OB5_S,
+                                                  pModal->ob_ch1);
+                        ath9k_hw_analog_shift_rmw(ah, AR_AN_RF5G1_CH1,
+                                                  AR_AN_RF5G1_CH1_DB5,
+                                                  AR_AN_RF5G1_CH1_DB5_S,
+                                                  pModal->db_ch1);
+                }
+                ath9k_hw_analog_shift_rmw(ah, AR_AN_TOP2,
+                                          AR_AN_TOP2_XPABIAS_LVL,
+                                          AR_AN_TOP2_XPABIAS_LVL_S,
+                                          pModal->xpaBiasLvl);
+                ath9k_hw_analog_shift_rmw(ah, AR_AN_TOP2,
+                                          AR_AN_TOP2_LOCALBIAS,
+                                          AR_AN_TOP2_LOCALBIAS_S,
+                                          pModal->local_bias);
+                REG_RMW_FIELD(ah, AR_PHY_XPA_CFG, AR_PHY_FORCE_XPA_CFG,
+                              pModal->force_xpaon);
+        }
+
+        REG_RMW_FIELD(ah, AR_PHY_SETTLING, AR_PHY_SETTLING_SWITCH,
+                      pModal->switchSettling);
+        REG_RMW_FIELD(ah, AR_PHY_DESIRED_SZ, AR_PHY_DESIRED_SZ_ADC,
+                      pModal->adcDesiredSize);
+
+        if (!AR_SREV_9280_10_OR_LATER(ah))
+                REG_RMW_FIELD(ah, AR_PHY_DESIRED_SZ,
+                              AR_PHY_DESIRED_SZ_PGA,
+                              pModal->pgaDesiredSize);
+
+        REG_WRITE(ah, AR_PHY_RF_CTL4,
+                  SM(pModal->txEndToXpaOff, AR_PHY_RF_CTL4_TX_END_XPAA_OFF)
+                  | SM(pModal->txEndToXpaOff,
+                       AR_PHY_RF_CTL4_TX_END_XPAB_OFF)
+                  | SM(pModal->txFrameToXpaOn,
+                       AR_PHY_RF_CTL4_FRAME_XPAA_ON)
+                  | SM(pModal->txFrameToXpaOn,
+                       AR_PHY_RF_CTL4_FRAME_XPAB_ON));
+
+        REG_RMW_FIELD(ah, AR_PHY_RF_CTL3, AR_PHY_TX_END_TO_A2_RX_ON,
+                      pModal->txEndToRxOn);
+
+        if (AR_SREV_9280_10_OR_LATER(ah)) {
+                REG_RMW_FIELD(ah, AR_PHY_CCA, AR9280_PHY_CCA_THRESH62,
+                              pModal->thresh62);
+                REG_RMW_FIELD(ah, AR_PHY_EXT_CCA0,
+                              AR_PHY_EXT_CCA0_THRESH62,
+                              pModal->thresh62);
+        } else {
+                REG_RMW_FIELD(ah, AR_PHY_CCA, AR_PHY_CCA_THRESH62,
+                              pModal->thresh62);
+                REG_RMW_FIELD(ah, AR_PHY_EXT_CCA,
+                              AR_PHY_EXT_CCA_THRESH62,
+                              pModal->thresh62);
+        }
+
+        if (AR5416_VER_MASK >= AR5416_EEP_MINOR_VER_2) {
+                REG_RMW_FIELD(ah, AR_PHY_RF_CTL2,
+                              AR_PHY_TX_END_DATA_START,
+                              pModal->txFrameToDataStart);
+                REG_RMW_FIELD(ah, AR_PHY_RF_CTL2, AR_PHY_TX_END_PA_ON,
+                              pModal->txFrameToPaOn);
+        }
+
+        if (AR5416_VER_MASK >= AR5416_EEP_MINOR_VER_3) {
+                if (IS_CHAN_HT40(chan))
+                        REG_RMW_FIELD(ah, AR_PHY_SETTLING,
+                                      AR_PHY_SETTLING_SWITCH,
+                                      pModal->swSettleHt40);
+        }
+
+        if (AR_SREV_9280_20_OR_LATER(ah) &&
+            AR5416_VER_MASK >= AR5416_EEP_MINOR_VER_19)
+                REG_RMW_FIELD(ah, AR_PHY_CCK_TX_CTRL,
+                              AR_PHY_CCK_TX_CTRL_TX_DAC_SCALE_CCK,
+                              pModal->miscBits);
+
+
+        if (AR_SREV_9280_20(ah) && AR5416_VER_MASK >= AR5416_EEP_MINOR_VER_20) {
+                if (IS_CHAN_2GHZ(chan))
+                        REG_RMW_FIELD(ah, AR_AN_TOP1, AR_AN_TOP1_DACIPMODE,
+                                        eep->baseEepHeader.dacLpMode);
+                else if (eep->baseEepHeader.dacHiPwrMode_5G)
+                        REG_RMW_FIELD(ah, AR_AN_TOP1, AR_AN_TOP1_DACIPMODE, 0);
+                else
+                        REG_RMW_FIELD(ah, AR_AN_TOP1, AR_AN_TOP1_DACIPMODE,
+                                      eep->baseEepHeader.dacLpMode);
+
+                REG_RMW_FIELD(ah, AR_PHY_FRAME_CTL, AR_PHY_FRAME_CTL_TX_CLIP,
+                              pModal->miscBits >> 2);
+
+                REG_RMW_FIELD(ah, AR_PHY_TX_PWRCTRL9,
+                              AR_PHY_TX_DESIRED_SCALE_CCK,
+                              eep->baseEepHeader.desiredScaleCCK);
+        }
+}
+
+static void ath9k_hw_def_set_addac(struct ath_hw *ah,
+                                   struct ath9k_channel *chan)
+{
+#define XPA_LVL_FREQ(cnt) (pModal->xpaBiasLvlFreq[cnt])
+        struct modal_eep_header *pModal;
+        struct ar5416_eeprom_def *eep = &ah->eeprom.def;
+        u8 biaslevel;
+
+        if (ah->hw_version.macVersion != AR_SREV_VERSION_9160)
+                return;
+
+        if (ah->eep_ops->get_eeprom_rev(ah) < AR5416_EEP_MINOR_VER_7)
+                return;
+
+        pModal = &(eep->modalHeader[IS_CHAN_2GHZ(chan)]);
+
+        if (pModal->xpaBiasLvl != 0xff) {
+                biaslevel = pModal->xpaBiasLvl;
+        } else {
+                u16 resetFreqBin, freqBin, freqCount = 0;
+                struct chan_centers centers;
+
+                ath9k_hw_get_channel_centers(ah, chan, &centers);
+
+                resetFreqBin = FREQ2FBIN(centers.synth_center,
+                                         IS_CHAN_2GHZ(chan));
+                freqBin = XPA_LVL_FREQ(0) & 0xff;
+                biaslevel = (u8) (XPA_LVL_FREQ(0) >> 14);
+
+                freqCount++;
+
+                while (freqCount < 3) {
+                        if (XPA_LVL_FREQ(freqCount) == 0x0)
+                                break;
+
+                        freqBin = XPA_LVL_FREQ(freqCount) & 0xff;
+                        if (resetFreqBin >= freqBin)
+                                biaslevel = (u8)(XPA_LVL_FREQ(freqCount) >> 14);
+                        else
+                                break;
+                        freqCount++;
+                }
+        }
+
+        if (IS_CHAN_2GHZ(chan)) {
+                INI_RA(&ah->iniAddac, 7, 1) = (INI_RA(&ah->iniAddac,
+                                        7, 1) & (~0x18)) | biaslevel << 3;
+        } else {
+                INI_RA(&ah->iniAddac, 6, 1) = (INI_RA(&ah->iniAddac,
+                                        6, 1) & (~0xc0)) | biaslevel << 6;
+        }
+#undef XPA_LVL_FREQ
+}
+
+static void ath9k_hw_get_def_gain_boundaries_pdadcs(struct ath_hw *ah,
+                                struct ath9k_channel *chan,
+                                struct cal_data_per_freq *pRawDataSet,
+                                u8 *bChans, u16 availPiers,
+                                u16 tPdGainOverlap, int16_t *pMinCalPower,
+                                u16 *pPdGainBoundaries, u8 *pPDADCValues,
+                                u16 numXpdGains)
+{
+        int i, j, k;
+        int16_t ss;
+        u16 idxL = 0, idxR = 0, numPiers;
+        static u8 vpdTableL[AR5416_NUM_PD_GAINS]
+                [AR5416_MAX_PWR_RANGE_IN_HALF_DB];
+        static u8 vpdTableR[AR5416_NUM_PD_GAINS]
+                [AR5416_MAX_PWR_RANGE_IN_HALF_DB];
+        static u8 vpdTableI[AR5416_NUM_PD_GAINS]
+                [AR5416_MAX_PWR_RANGE_IN_HALF_DB];
+
+        u8 *pVpdL, *pVpdR, *pPwrL, *pPwrR;
+        u8 minPwrT4[AR5416_NUM_PD_GAINS];
+        u8 maxPwrT4[AR5416_NUM_PD_GAINS];
+        int16_t vpdStep;
+        int16_t tmpVal;
+        u16 sizeCurrVpdTable, maxIndex, tgtIndex;
+        bool match;
+        int16_t minDelta = 0;
+        struct chan_centers centers;
+
+        ath9k_hw_get_channel_centers(ah, chan, &centers);
+
+        for (numPiers = 0; numPiers < availPiers; numPiers++) {
+                if (bChans[numPiers] == AR5416_BCHAN_UNUSED)
+                        break;
+        }
+
+        match = ath9k_hw_get_lower_upper_index((u8)FREQ2FBIN(centers.synth_center,
+                                                             IS_CHAN_2GHZ(chan)),
+                                               bChans, numPiers, &idxL, &idxR);
+
+        if (match) {
+                for (i = 0; i < numXpdGains; i++) {
+                        minPwrT4[i] = pRawDataSet[idxL].pwrPdg[i][0];
+                        maxPwrT4[i] = pRawDataSet[idxL].pwrPdg[i][4];
+                        ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
+                                        pRawDataSet[idxL].pwrPdg[i],
+                                        pRawDataSet[idxL].vpdPdg[i],
+                                        AR5416_PD_GAIN_ICEPTS,
+                                        vpdTableI[i]);
+                }
+        } else {
+                for (i = 0; i < numXpdGains; i++) {
+                        pVpdL = pRawDataSet[idxL].vpdPdg[i];
+                        pPwrL = pRawDataSet[idxL].pwrPdg[i];
+                        pVpdR = pRawDataSet[idxR].vpdPdg[i];
+                        pPwrR = pRawDataSet[idxR].pwrPdg[i];
+
+                        minPwrT4[i] = max(pPwrL[0], pPwrR[0]);
+
+                        maxPwrT4[i] =
+                                min(pPwrL[AR5416_PD_GAIN_ICEPTS - 1],
+                                    pPwrR[AR5416_PD_GAIN_ICEPTS - 1]);
+
+
+                        ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
+                                                pPwrL, pVpdL,
+                                                AR5416_PD_GAIN_ICEPTS,
+                                                vpdTableL[i]);
+                        ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
+                                                pPwrR, pVpdR,
+                                                AR5416_PD_GAIN_ICEPTS,
+                                                vpdTableR[i]);
+
+                        for (j = 0; j <= (maxPwrT4[i] - minPwrT4[i]) / 2; j++) {
+                                vpdTableI[i][j] =
+                                        (u8)(ath9k_hw_interpolate((u16)
+                                             FREQ2FBIN(centers.
+                                                       synth_center,
+                                                       IS_CHAN_2GHZ
+                                                       (chan)),
+                                             bChans[idxL], bChans[idxR],
+                                             vpdTableL[i][j], vpdTableR[i][j]));
+                        }
+                }
+        }
+
+        *pMinCalPower = (int16_t)(minPwrT4[0] / 2);
+
+        k = 0;
+
+        for (i = 0; i < numXpdGains; i++) {
+                if (i == (numXpdGains - 1))
+                        pPdGainBoundaries[i] =
+                                (u16)(maxPwrT4[i] / 2);
+                else
+                        pPdGainBoundaries[i] =
+                                (u16)((maxPwrT4[i] + minPwrT4[i + 1]) / 4);
+
+                pPdGainBoundaries[i] =
+                        min((u16)AR5416_MAX_RATE_POWER, pPdGainBoundaries[i]);
+
+                if ((i == 0) && !AR_SREV_5416_20_OR_LATER(ah)) {
+                        minDelta = pPdGainBoundaries[0] - 23;
+                        pPdGainBoundaries[0] = 23;
+                } else {
+                        minDelta = 0;
+                }
+
+                if (i == 0) {
+                        if (AR_SREV_9280_10_OR_LATER(ah))
+                                ss = (int16_t)(0 - (minPwrT4[i] / 2));
+                        else
+                                ss = 0;
+                } else {
+                        ss = (int16_t)((pPdGainBoundaries[i - 1] -
+                                        (minPwrT4[i] / 2)) -
+                                       tPdGainOverlap + 1 + minDelta);
+                }
+                vpdStep = (int16_t)(vpdTableI[i][1] - vpdTableI[i][0]);
+                vpdStep = (int16_t)((vpdStep < 1) ? 1 : vpdStep);
+
+                while ((ss < 0) && (k < (AR5416_NUM_PDADC_VALUES - 1))) {
+                        tmpVal = (int16_t)(vpdTableI[i][0] + ss * vpdStep);
+                        pPDADCValues[k++] = (u8)((tmpVal < 0) ? 0 : tmpVal);
+                        ss++;
+                }
+
+                sizeCurrVpdTable = (u8) ((maxPwrT4[i] - minPwrT4[i]) / 2 + 1);
+                tgtIndex = (u8)(pPdGainBoundaries[i] + tPdGainOverlap -
+                                (minPwrT4[i] / 2));
+                maxIndex = (tgtIndex < sizeCurrVpdTable) ?
+                        tgtIndex : sizeCurrVpdTable;
+
+                while ((ss < maxIndex) && (k < (AR5416_NUM_PDADC_VALUES - 1))) {
+                        pPDADCValues[k++] = vpdTableI[i][ss++];
+                }
+
+                vpdStep = (int16_t)(vpdTableI[i][sizeCurrVpdTable - 1] -
+                                    vpdTableI[i][sizeCurrVpdTable - 2]);
+                vpdStep = (int16_t)((vpdStep < 1) ? 1 : vpdStep);
+
+                if (tgtIndex > maxIndex) {
+                        while ((ss <= tgtIndex) &&
+                               (k < (AR5416_NUM_PDADC_VALUES - 1))) {
+                                tmpVal = (int16_t)((vpdTableI[i][sizeCurrVpdTable - 1] +
+                                                    (ss - maxIndex + 1) * vpdStep));
+                                pPDADCValues[k++] = (u8)((tmpVal > 255) ?
+                                                         255 : tmpVal);
+                                ss++;
+                        }
+                }
+        }
+
+        while (i < AR5416_PD_GAINS_IN_MASK) {
+                pPdGainBoundaries[i] = pPdGainBoundaries[i - 1];
+                i++;
+        }
+
+        while (k < AR5416_NUM_PDADC_VALUES) {
+                pPDADCValues[k] = pPDADCValues[k - 1];
+                k++;
+        }
+
+        return;
+}
+
+static void ath9k_hw_set_def_power_cal_table(struct ath_hw *ah,
+                                  struct ath9k_channel *chan,
+                                  int16_t *pTxPowerIndexOffset)
+{
+#define SM_PD_GAIN(x) SM(0x38, AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_##x)
+#define SM_PDGAIN_B(x, y) \
+                SM((gainBoundaries[x]), AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_##y)
+
+        struct ar5416_eeprom_def *pEepData = &ah->eeprom.def;
+        struct cal_data_per_freq *pRawDataset;
+        u8 *pCalBChans = NULL;
+        u16 pdGainOverlap_t2;
+        static u8 pdadcValues[AR5416_NUM_PDADC_VALUES];
+        u16 gainBoundaries[AR5416_PD_GAINS_IN_MASK];
+        u16 numPiers, i, j;
+        int16_t tMinCalPower;
+        u16 numXpdGain, xpdMask;
+        u16 xpdGainValues[AR5416_NUM_PD_GAINS] = { 0, 0, 0, 0 };
+        u32 reg32, regOffset, regChainOffset;
+        int16_t modalIdx;
+
+        modalIdx = IS_CHAN_2GHZ(chan) ? 1 : 0;
+        xpdMask = pEepData->modalHeader[modalIdx].xpdGain;
+
+        if ((pEepData->baseEepHeader.version & AR5416_EEP_VER_MINOR_MASK) >=
+            AR5416_EEP_MINOR_VER_2) {
+                pdGainOverlap_t2 =
+                        pEepData->modalHeader[modalIdx].pdGainOverlap;
+        } else {
+                pdGainOverlap_t2 = (u16)(MS(REG_READ(ah, AR_PHY_TPCRG5),
+                                            AR_PHY_TPCRG5_PD_GAIN_OVERLAP));
+        }
+
+        if (IS_CHAN_2GHZ(chan)) {
+                pCalBChans = pEepData->calFreqPier2G;
+                numPiers = AR5416_NUM_2G_CAL_PIERS;
+        } else {
+                pCalBChans = pEepData->calFreqPier5G;
+                numPiers = AR5416_NUM_5G_CAL_PIERS;
+        }
+
+        if (OLC_FOR_AR9280_20_LATER && IS_CHAN_2GHZ(chan)) {
+                pRawDataset = pEepData->calPierData2G[0];
+                ah->initPDADC = ((struct calDataPerFreqOpLoop *)
+                                 pRawDataset)->vpdPdg[0][0];
+        }
+
+        numXpdGain = 0;
+
+        for (i = 1; i <= AR5416_PD_GAINS_IN_MASK; i++) {
+                if ((xpdMask >> (AR5416_PD_GAINS_IN_MASK - i)) & 1) {
+                        if (numXpdGain >= AR5416_NUM_PD_GAINS)
+                                break;
+                        xpdGainValues[numXpdGain] =
+                                (u16)(AR5416_PD_GAINS_IN_MASK - i);
+                        numXpdGain++;
+                }
+        }
+
+        REG_RMW_FIELD(ah, AR_PHY_TPCRG1, AR_PHY_TPCRG1_NUM_PD_GAIN,
+                      (numXpdGain - 1) & 0x3);
+        REG_RMW_FIELD(ah, AR_PHY_TPCRG1, AR_PHY_TPCRG1_PD_GAIN_1,
+                      xpdGainValues[0]);
+        REG_RMW_FIELD(ah, AR_PHY_TPCRG1, AR_PHY_TPCRG1_PD_GAIN_2,
+                      xpdGainValues[1]);
+        REG_RMW_FIELD(ah, AR_PHY_TPCRG1, AR_PHY_TPCRG1_PD_GAIN_3,
+                      xpdGainValues[2]);
+
+        for (i = 0; i < AR5416_MAX_CHAINS; i++) {
+                if (AR_SREV_5416_20_OR_LATER(ah) &&
+                    (ah->rxchainmask == 5 || ah->txchainmask == 5) &&
+                    (i != 0)) {
+                        regChainOffset = (i == 1) ? 0x2000 : 0x1000;
+                } else
+                        regChainOffset = i * 0x1000;
+
+                if (pEepData->baseEepHeader.txMask & (1 << i)) {
+                        if (IS_CHAN_2GHZ(chan))
+                                pRawDataset = pEepData->calPierData2G[i];
+                        else
+                                pRawDataset = pEepData->calPierData5G[i];
+
+
+                        if (OLC_FOR_AR9280_20_LATER) {
+                                u8 pcdacIdx;
+                                u8 txPower;
+
+                                ath9k_get_txgain_index(ah, chan,
+                                (struct calDataPerFreqOpLoop *)pRawDataset,
+                                pCalBChans, numPiers, &txPower, &pcdacIdx);
+                                ath9k_olc_get_pdadcs(ah, pcdacIdx,
+                                                     txPower/2, pdadcValues);
+                        } else {
+                                ath9k_hw_get_def_gain_boundaries_pdadcs(ah,
+                                                        chan, pRawDataset,
+                                                        pCalBChans, numPiers,
+                                                        pdGainOverlap_t2,
+                                                        &tMinCalPower,
+                                                        gainBoundaries,
+                                                        pdadcValues,
+                                                        numXpdGain);
+                        }
+
+                        if ((i == 0) || AR_SREV_5416_20_OR_LATER(ah)) {
+                                if (OLC_FOR_AR9280_20_LATER) {
+                                        REG_WRITE(ah,
+                                                AR_PHY_TPCRG5 + regChainOffset,
+                                                SM(0x6,
+                                                AR_PHY_TPCRG5_PD_GAIN_OVERLAP) |
+                                                SM_PD_GAIN(1) | SM_PD_GAIN(2) |
+                                                SM_PD_GAIN(3) | SM_PD_GAIN(4));
+                                } else {
+                                        REG_WRITE(ah,
+                                                AR_PHY_TPCRG5 + regChainOffset,
+                                                SM(pdGainOverlap_t2,
+                                                AR_PHY_TPCRG5_PD_GAIN_OVERLAP)|
+                                                SM_PDGAIN_B(0, 1) |
+                                                SM_PDGAIN_B(1, 2) |
+                                                SM_PDGAIN_B(2, 3) |
+                                                SM_PDGAIN_B(3, 4));
+                                }
+                        }
+
+                        regOffset = AR_PHY_BASE + (672 << 2) + regChainOffset;
+                        for (j = 0; j < 32; j++) {
+                                reg32 = ((pdadcValues[4 * j + 0] & 0xFF) << 0) |
+                                        ((pdadcValues[4 * j + 1] & 0xFF) << 8) |
+                                        ((pdadcValues[4 * j + 2] & 0xFF) << 16)|
+                                        ((pdadcValues[4 * j + 3] & 0xFF) << 24);
+                                REG_WRITE(ah, regOffset, reg32);
+
+                                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
+                                        "PDADC (%d,%4x): %4.4x %8.8x\n",
+                                        i, regChainOffset, regOffset,
+                                        reg32);
+                                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
+                                        "PDADC: Chain %d | PDADC %3d "
+                                        "Value %3d | PDADC %3d Value %3d | "
+                                        "PDADC %3d Value %3d | PDADC %3d "
+                                        "Value %3d |\n",
+                                        i, 4 * j, pdadcValues[4 * j],
+                                        4 * j + 1, pdadcValues[4 * j + 1],
+                                        4 * j + 2, pdadcValues[4 * j + 2],
+                                        4 * j + 3,
+                                        pdadcValues[4 * j + 3]);
+
+                                regOffset += 4;
+                        }
+                }
+        }
+
+        *pTxPowerIndexOffset = 0;
+#undef SM_PD_GAIN
+#undef SM_PDGAIN_B
+}
+
+static void ath9k_hw_set_def_power_per_rate_table(struct ath_hw *ah,
+                                                  struct ath9k_channel *chan,
+                                                  int16_t *ratesArray,
+                                                  u16 cfgCtl,
+                                                  u16 AntennaReduction,
+                                                  u16 twiceMaxRegulatoryPower,
+                                                  u16 powerLimit)
+{
+#define REDUCE_SCALED_POWER_BY_TWO_CHAIN     6  /* 10*log10(2)*2 */
+#define REDUCE_SCALED_POWER_BY_THREE_CHAIN   10 /* 10*log10(3)*2 */
+
+        struct ar5416_eeprom_def *pEepData = &ah->eeprom.def;
+        u16 twiceMaxEdgePower = AR5416_MAX_RATE_POWER;
+        static const u16 tpScaleReductionTable[5] =
+                { 0, 3, 6, 9, AR5416_MAX_RATE_POWER };
+
+        int i;
+        int16_t twiceLargestAntenna;
+        struct cal_ctl_data *rep;
+        struct cal_target_power_leg targetPowerOfdm, targetPowerCck = {
+                0, { 0, 0, 0, 0}
+        };
+        struct cal_target_power_leg targetPowerOfdmExt = {
+                0, { 0, 0, 0, 0} }, targetPowerCckExt = {
+                0, { 0, 0, 0, 0 }
+        };
+        struct cal_target_power_ht targetPowerHt20, targetPowerHt40 = {
+                0, {0, 0, 0, 0}
+        };
+        u16 scaledPower = 0, minCtlPower, maxRegAllowedPower;
+        u16 ctlModesFor11a[] =
+                { CTL_11A, CTL_5GHT20, CTL_11A_EXT, CTL_5GHT40 };
+        u16 ctlModesFor11g[] =
+                { CTL_11B, CTL_11G, CTL_2GHT20, CTL_11B_EXT, CTL_11G_EXT,
+                  CTL_2GHT40
+                };
+        u16 numCtlModes, *pCtlMode, ctlMode, freq;
+        struct chan_centers centers;
+        int tx_chainmask;
+        u16 twiceMinEdgePower;
+
+        tx_chainmask = ah->txchainmask;
+
+        ath9k_hw_get_channel_centers(ah, chan, &centers);
+
+        twiceLargestAntenna = max(
+                pEepData->modalHeader
+                        [IS_CHAN_2GHZ(chan)].antennaGainCh[0],
+                pEepData->modalHeader
+                        [IS_CHAN_2GHZ(chan)].antennaGainCh[1]);
+
+        twiceLargestAntenna = max((u8)twiceLargestAntenna,
+                                  pEepData->modalHeader
+                                  [IS_CHAN_2GHZ(chan)].antennaGainCh[2]);
+
+        twiceLargestAntenna = (int16_t)min(AntennaReduction -
+                                           twiceLargestAntenna, 0);
+
+        maxRegAllowedPower = twiceMaxRegulatoryPower + twiceLargestAntenna;
+
+        if (ah->regulatory.tp_scale != ATH9K_TP_SCALE_MAX) {
+                maxRegAllowedPower -=
+                        (tpScaleReductionTable[(ah->regulatory.tp_scale)] * 2);
+        }
+
+        scaledPower = min(powerLimit, maxRegAllowedPower);
+
+        switch (ar5416_get_ntxchains(tx_chainmask)) {
+        case 1:
+                break;
+        case 2:
+                scaledPower -= REDUCE_SCALED_POWER_BY_TWO_CHAIN;
+                break;
+        case 3:
+                scaledPower -= REDUCE_SCALED_POWER_BY_THREE_CHAIN;
+                break;
+        }
+
+        scaledPower = max((u16)0, scaledPower);
+
+        if (IS_CHAN_2GHZ(chan)) {
+                numCtlModes = ARRAY_SIZE(ctlModesFor11g) -
+                        SUB_NUM_CTL_MODES_AT_2G_40;
+                pCtlMode = ctlModesFor11g;
+
+                ath9k_hw_get_legacy_target_powers(ah, chan,
+                        pEepData->calTargetPowerCck,
+                        AR5416_NUM_2G_CCK_TARGET_POWERS,
+                        &targetPowerCck, 4, false);
+                ath9k_hw_get_legacy_target_powers(ah, chan,
+                        pEepData->calTargetPower2G,
+                        AR5416_NUM_2G_20_TARGET_POWERS,
+                        &targetPowerOfdm, 4, false);
+                ath9k_hw_get_target_powers(ah, chan,
+                        pEepData->calTargetPower2GHT20,
+                        AR5416_NUM_2G_20_TARGET_POWERS,
+                        &targetPowerHt20, 8, false);
+
+                if (IS_CHAN_HT40(chan)) {
+                        numCtlModes = ARRAY_SIZE(ctlModesFor11g);
+                        ath9k_hw_get_target_powers(ah, chan,
+                                pEepData->calTargetPower2GHT40,
+                                AR5416_NUM_2G_40_TARGET_POWERS,
+                                &targetPowerHt40, 8, true);
+                        ath9k_hw_get_legacy_target_powers(ah, chan,
+                                pEepData->calTargetPowerCck,
+                                AR5416_NUM_2G_CCK_TARGET_POWERS,
+                                &targetPowerCckExt, 4, true);
+                        ath9k_hw_get_legacy_target_powers(ah, chan,
+                                pEepData->calTargetPower2G,
+                                AR5416_NUM_2G_20_TARGET_POWERS,
+                                &targetPowerOfdmExt, 4, true);
+                }
+        } else {
+                numCtlModes = ARRAY_SIZE(ctlModesFor11a) -
+                        SUB_NUM_CTL_MODES_AT_5G_40;
+                pCtlMode = ctlModesFor11a;
+
+                ath9k_hw_get_legacy_target_powers(ah, chan,
+                        pEepData->calTargetPower5G,
+                        AR5416_NUM_5G_20_TARGET_POWERS,
+                        &targetPowerOfdm, 4, false);
+                ath9k_hw_get_target_powers(ah, chan,
+                        pEepData->calTargetPower5GHT20,
+                        AR5416_NUM_5G_20_TARGET_POWERS,
+                        &targetPowerHt20, 8, false);
+
+                if (IS_CHAN_HT40(chan)) {
+                        numCtlModes = ARRAY_SIZE(ctlModesFor11a);
+                        ath9k_hw_get_target_powers(ah, chan,
+                                pEepData->calTargetPower5GHT40,
+                                AR5416_NUM_5G_40_TARGET_POWERS,
+                                &targetPowerHt40, 8, true);
+                        ath9k_hw_get_legacy_target_powers(ah, chan,
+                                pEepData->calTargetPower5G,
+                                AR5416_NUM_5G_20_TARGET_POWERS,
+                                &targetPowerOfdmExt, 4, true);
+                }
+        }
+
+        for (ctlMode = 0; ctlMode < numCtlModes; ctlMode++) {
+                bool isHt40CtlMode = (pCtlMode[ctlMode] == CTL_5GHT40) ||
+                        (pCtlMode[ctlMode] == CTL_2GHT40);
+                if (isHt40CtlMode)
+                        freq = centers.synth_center;
+                else if (pCtlMode[ctlMode] & EXT_ADDITIVE)
+                        freq = centers.ext_center;
+                else
+                        freq = centers.ctl_center;
+
+                if (ah->eep_ops->get_eeprom_ver(ah) == 14 &&
+                    ah->eep_ops->get_eeprom_rev(ah) <= 2)
+                        twiceMaxEdgePower = AR5416_MAX_RATE_POWER;
+
+                for (i = 0; (i < AR5416_NUM_CTLS) && pEepData->ctlIndex[i]; i++) {
+                        if ((((cfgCtl & ~CTL_MODE_M) |
+                              (pCtlMode[ctlMode] & CTL_MODE_M)) ==
+                             pEepData->ctlIndex[i]) ||
+                            (((cfgCtl & ~CTL_MODE_M) |
+                              (pCtlMode[ctlMode] & CTL_MODE_M)) ==
+                             ((pEepData->ctlIndex[i] & CTL_MODE_M) | SD_NO_CTL))) {
+                                rep = &(pEepData->ctlData[i]);
+
+                                twiceMinEdgePower = ath9k_hw_get_max_edge_power(freq,
+                                rep->ctlEdges[ar5416_get_ntxchains(tx_chainmask) - 1],
+                                IS_CHAN_2GHZ(chan), AR5416_NUM_BAND_EDGES);
+
+                                if ((cfgCtl & ~CTL_MODE_M) == SD_NO_CTL) {
+                                        twiceMaxEdgePower = min(twiceMaxEdgePower,
+                                                                twiceMinEdgePower);
+                                } else {
+                                        twiceMaxEdgePower = twiceMinEdgePower;
+                                        break;
+                                }
+                        }
+                }
+
+                minCtlPower = min(twiceMaxEdgePower, scaledPower);
+
+                switch (pCtlMode[ctlMode]) {
+                case CTL_11B:
+                        for (i = 0; i < ARRAY_SIZE(targetPowerCck.tPow2x); i++) {
+                                targetPowerCck.tPow2x[i] =
+                                        min((u16)targetPowerCck.tPow2x[i],
+                                            minCtlPower);
+                        }
+                        break;
+                case CTL_11A:
+                case CTL_11G:
+                        for (i = 0; i < ARRAY_SIZE(targetPowerOfdm.tPow2x); i++) {
+                                targetPowerOfdm.tPow2x[i] =
+                                        min((u16)targetPowerOfdm.tPow2x[i],
+                                            minCtlPower);
+                        }
+                        break;
+                case CTL_5GHT20:
+                case CTL_2GHT20:
+                        for (i = 0; i < ARRAY_SIZE(targetPowerHt20.tPow2x); i++) {
+                                targetPowerHt20.tPow2x[i] =
+                                        min((u16)targetPowerHt20.tPow2x[i],
+                                            minCtlPower);
+                        }
+                        break;
+                case CTL_11B_EXT:
+                        targetPowerCckExt.tPow2x[0] = min((u16)
+                                        targetPowerCckExt.tPow2x[0],
+                                        minCtlPower);
+                        break;
+                case CTL_11A_EXT:
+                case CTL_11G_EXT:
+                        targetPowerOfdmExt.tPow2x[0] = min((u16)
+                                        targetPowerOfdmExt.tPow2x[0],
+                                        minCtlPower);
+                        break;
+                case CTL_5GHT40:
+                case CTL_2GHT40:
+                        for (i = 0; i < ARRAY_SIZE(targetPowerHt40.tPow2x); i++) {
+                                targetPowerHt40.tPow2x[i] =
+                                        min((u16)targetPowerHt40.tPow2x[i],
+                                            minCtlPower);
+                        }
+                        break;
+                default:
+                        break;
+                }
+        }
+
+        ratesArray[rate6mb] = ratesArray[rate9mb] = ratesArray[rate12mb] =
+                ratesArray[rate18mb] = ratesArray[rate24mb] =
+                targetPowerOfdm.tPow2x[0];
+        ratesArray[rate36mb] = targetPowerOfdm.tPow2x[1];
+        ratesArray[rate48mb] = targetPowerOfdm.tPow2x[2];
+        ratesArray[rate54mb] = targetPowerOfdm.tPow2x[3];
+        ratesArray[rateXr] = targetPowerOfdm.tPow2x[0];
+
+        for (i = 0; i < ARRAY_SIZE(targetPowerHt20.tPow2x); i++)
+                ratesArray[rateHt20_0 + i] = targetPowerHt20.tPow2x[i];
+
+        if (IS_CHAN_2GHZ(chan)) {
+                ratesArray[rate1l] = targetPowerCck.tPow2x[0];
+                ratesArray[rate2s] = ratesArray[rate2l] =
+                        targetPowerCck.tPow2x[1];
+                ratesArray[rate5_5s] = ratesArray[rate5_5l] =
+                        targetPowerCck.tPow2x[2];
+                ratesArray[rate11s] = ratesArray[rate11l] =
+                        targetPowerCck.tPow2x[3];
+        }
+        if (IS_CHAN_HT40(chan)) {
+                for (i = 0; i < ARRAY_SIZE(targetPowerHt40.tPow2x); i++) {
+                        ratesArray[rateHt40_0 + i] =
+                                targetPowerHt40.tPow2x[i];
+                }
+                ratesArray[rateDupOfdm] = targetPowerHt40.tPow2x[0];
+                ratesArray[rateDupCck] = targetPowerHt40.tPow2x[0];
+                ratesArray[rateExtOfdm] = targetPowerOfdmExt.tPow2x[0];
+                if (IS_CHAN_2GHZ(chan)) {
+                        ratesArray[rateExtCck] =
+                                targetPowerCckExt.tPow2x[0];
+                }
+        }
+}
+
+static void ath9k_hw_def_set_txpower(struct ath_hw *ah,
+                                    struct ath9k_channel *chan,
+                                    u16 cfgCtl,
+                                    u8 twiceAntennaReduction,
+                                    u8 twiceMaxRegulatoryPower,
+                                    u8 powerLimit)
+{
+#define RT_AR_DELTA(x) (ratesArray[x] - cck_ofdm_delta)
+        struct ar5416_eeprom_def *pEepData = &ah->eeprom.def;
+        struct modal_eep_header *pModal =
+                &(pEepData->modalHeader[IS_CHAN_2GHZ(chan)]);
+        int16_t ratesArray[Ar5416RateSize];
+        int16_t txPowerIndexOffset = 0;
+        u8 ht40PowerIncForPdadc = 2;
+        int i, cck_ofdm_delta = 0;
+
+        memset(ratesArray, 0, sizeof(ratesArray));
+
+        if ((pEepData->baseEepHeader.version & AR5416_EEP_VER_MINOR_MASK) >=
+            AR5416_EEP_MINOR_VER_2) {
+                ht40PowerIncForPdadc = pModal->ht40PowerIncForPdadc;
+        }
+
+        ath9k_hw_set_def_power_per_rate_table(ah, chan,
+                                               &ratesArray[0], cfgCtl,
+                                               twiceAntennaReduction,
+                                               twiceMaxRegulatoryPower,
+                                               powerLimit);
+
+        ath9k_hw_set_def_power_cal_table(ah, chan, &txPowerIndexOffset);
+
+        for (i = 0; i < ARRAY_SIZE(ratesArray); i++) {
+                ratesArray[i] = (int16_t)(txPowerIndexOffset + ratesArray[i]);
+                if (ratesArray[i] > AR5416_MAX_RATE_POWER)
+                        ratesArray[i] = AR5416_MAX_RATE_POWER;
+        }
+
+        if (AR_SREV_9280_10_OR_LATER(ah)) {
+                for (i = 0; i < Ar5416RateSize; i++)
+                        ratesArray[i] -= AR5416_PWR_TABLE_OFFSET * 2;
+        }
+
+        REG_WRITE(ah, AR_PHY_POWER_TX_RATE1,
+                  ATH9K_POW_SM(ratesArray[rate18mb], 24)
+                  | ATH9K_POW_SM(ratesArray[rate12mb], 16)
+                  | ATH9K_POW_SM(ratesArray[rate9mb], 8)
+                  | ATH9K_POW_SM(ratesArray[rate6mb], 0));
+        REG_WRITE(ah, AR_PHY_POWER_TX_RATE2,
+                  ATH9K_POW_SM(ratesArray[rate54mb], 24)
+                  | ATH9K_POW_SM(ratesArray[rate48mb], 16)
+                  | ATH9K_POW_SM(ratesArray[rate36mb], 8)
+                  | ATH9K_POW_SM(ratesArray[rate24mb], 0));
+
+        if (IS_CHAN_2GHZ(chan)) {
+                if (OLC_FOR_AR9280_20_LATER) {
+                        cck_ofdm_delta = 2;
+                        REG_WRITE(ah, AR_PHY_POWER_TX_RATE3,
+                                ATH9K_POW_SM(RT_AR_DELTA(rate2s), 24)
+                                | ATH9K_POW_SM(RT_AR_DELTA(rate2l), 16)
+                                | ATH9K_POW_SM(ratesArray[rateXr], 8)
+                                | ATH9K_POW_SM(RT_AR_DELTA(rate1l), 0));
+                        REG_WRITE(ah, AR_PHY_POWER_TX_RATE4,
+                                ATH9K_POW_SM(RT_AR_DELTA(rate11s), 24)
+                                | ATH9K_POW_SM(RT_AR_DELTA(rate11l), 16)
+                                | ATH9K_POW_SM(RT_AR_DELTA(rate5_5s), 8)
+                                | ATH9K_POW_SM(RT_AR_DELTA(rate5_5l), 0));
+                } else {
+                        REG_WRITE(ah, AR_PHY_POWER_TX_RATE3,
+                                ATH9K_POW_SM(ratesArray[rate2s], 24)
+                                | ATH9K_POW_SM(ratesArray[rate2l], 16)
+                                | ATH9K_POW_SM(ratesArray[rateXr], 8)
+                                | ATH9K_POW_SM(ratesArray[rate1l], 0));
+                        REG_WRITE(ah, AR_PHY_POWER_TX_RATE4,
+                                ATH9K_POW_SM(ratesArray[rate11s], 24)
+                                | ATH9K_POW_SM(ratesArray[rate11l], 16)
+                                | ATH9K_POW_SM(ratesArray[rate5_5s], 8)
+                                | ATH9K_POW_SM(ratesArray[rate5_5l], 0));
+                }
+        }
+
+        REG_WRITE(ah, AR_PHY_POWER_TX_RATE5,
+                  ATH9K_POW_SM(ratesArray[rateHt20_3], 24)
+                  | ATH9K_POW_SM(ratesArray[rateHt20_2], 16)
+                  | ATH9K_POW_SM(ratesArray[rateHt20_1], 8)
+                  | ATH9K_POW_SM(ratesArray[rateHt20_0], 0));
+        REG_WRITE(ah, AR_PHY_POWER_TX_RATE6,
+                  ATH9K_POW_SM(ratesArray[rateHt20_7], 24)
+                  | ATH9K_POW_SM(ratesArray[rateHt20_6], 16)
+                  | ATH9K_POW_SM(ratesArray[rateHt20_5], 8)
+                  | ATH9K_POW_SM(ratesArray[rateHt20_4], 0));
+
+        if (IS_CHAN_HT40(chan)) {
+                REG_WRITE(ah, AR_PHY_POWER_TX_RATE7,
+                          ATH9K_POW_SM(ratesArray[rateHt40_3] +
+                                       ht40PowerIncForPdadc, 24)
+                          | ATH9K_POW_SM(ratesArray[rateHt40_2] +
+                                         ht40PowerIncForPdadc, 16)
+                          | ATH9K_POW_SM(ratesArray[rateHt40_1] +
+                                         ht40PowerIncForPdadc, 8)
+                          | ATH9K_POW_SM(ratesArray[rateHt40_0] +
+                                         ht40PowerIncForPdadc, 0));
+                REG_WRITE(ah, AR_PHY_POWER_TX_RATE8,
+                          ATH9K_POW_SM(ratesArray[rateHt40_7] +
+                                       ht40PowerIncForPdadc, 24)
+                          | ATH9K_POW_SM(ratesArray[rateHt40_6] +
+                                         ht40PowerIncForPdadc, 16)
+                          | ATH9K_POW_SM(ratesArray[rateHt40_5] +
+                                         ht40PowerIncForPdadc, 8)
+                          | ATH9K_POW_SM(ratesArray[rateHt40_4] +
+                                         ht40PowerIncForPdadc, 0));
+                if (OLC_FOR_AR9280_20_LATER) {
+                        REG_WRITE(ah, AR_PHY_POWER_TX_RATE9,
+                                ATH9K_POW_SM(ratesArray[rateExtOfdm], 24)
+                                | ATH9K_POW_SM(RT_AR_DELTA(rateExtCck), 16)
+                                | ATH9K_POW_SM(ratesArray[rateDupOfdm], 8)
+                                | ATH9K_POW_SM(RT_AR_DELTA(rateDupCck), 0));
+                } else {
+                        REG_WRITE(ah, AR_PHY_POWER_TX_RATE9,
+                                ATH9K_POW_SM(ratesArray[rateExtOfdm], 24)
+                                | ATH9K_POW_SM(ratesArray[rateExtCck], 16)
+                                | ATH9K_POW_SM(ratesArray[rateDupOfdm], 8)
+                                | ATH9K_POW_SM(ratesArray[rateDupCck], 0));
+                }
+        }
+
+        REG_WRITE(ah, AR_PHY_POWER_TX_SUB,
+                  ATH9K_POW_SM(pModal->pwrDecreaseFor3Chain, 6)
+                  | ATH9K_POW_SM(pModal->pwrDecreaseFor2Chain, 0));
+
+        i = rate6mb;
+
+        if (IS_CHAN_HT40(chan))
+                i = rateHt40_0;
+        else if (IS_CHAN_HT20(chan))
+                i = rateHt20_0;
+
+        if (AR_SREV_9280_10_OR_LATER(ah))
+                ah->regulatory.max_power_level =
+                        ratesArray[i] + AR5416_PWR_TABLE_OFFSET * 2;
+        else
+                ah->regulatory.max_power_level = ratesArray[i];
+
+        switch(ar5416_get_ntxchains(ah->txchainmask)) {
+        case 1:
+                break;
+        case 2:
+                ah->regulatory.max_power_level += INCREASE_MAXPOW_BY_TWO_CHAIN;
+                break;
+        case 3:
+                ah->regulatory.max_power_level += INCREASE_MAXPOW_BY_THREE_CHAIN;
+                break;
+        default:
+                DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
+                        "Invalid chainmask configuration\n");
+                break;
+        }
+}
+
+static u8 ath9k_hw_def_get_num_ant_config(struct ath_hw *ah,
+                                          enum ieee80211_band freq_band)
+{
+        struct ar5416_eeprom_def *eep = &ah->eeprom.def;
+        struct modal_eep_header *pModal =
+                &(eep->modalHeader[ATH9K_HAL_FREQ_BAND_2GHZ == freq_band]);
+        struct base_eep_header *pBase = &eep->baseEepHeader;
+        u8 num_ant_config;
+
+        num_ant_config = 1;
+
+        if (pBase->version >= 0x0E0D)
+                if (pModal->useAnt1)
+                        num_ant_config += 1;
+
+        return num_ant_config;
+}
+
+static u16 ath9k_hw_def_get_eeprom_antenna_cfg(struct ath_hw *ah,
+                                               struct ath9k_channel *chan)
+{
+        struct ar5416_eeprom_def *eep = &ah->eeprom.def;
+        struct modal_eep_header *pModal =
+                &(eep->modalHeader[IS_CHAN_2GHZ(chan)]);
+
+        return pModal->antCtrlCommon & 0xFFFF;
+}
+
+static u16 ath9k_hw_def_get_spur_channel(struct ath_hw *ah, u16 i, bool is2GHz)
+{
+#define EEP_DEF_SPURCHAN \
+        (ah->eeprom.def.modalHeader[is2GHz].spurChans[i].spurChan)
+
+        u16 spur_val = AR_NO_SPUR;
+
+        DPRINTF(ah->ah_sc, ATH_DBG_ANI,
+                "Getting spur idx %d is2Ghz. %d val %x\n",
+                i, is2GHz, ah->config.spurchans[i][is2GHz]);
+
+        switch (ah->config.spurmode) {
+        case SPUR_DISABLE:
+                break;
+        case SPUR_ENABLE_IOCTL:
+                spur_val = ah->config.spurchans[i][is2GHz];
+                DPRINTF(ah->ah_sc, ATH_DBG_ANI,
+                        "Getting spur val from new loc. %d\n", spur_val);
+                break;
+        case SPUR_ENABLE_EEPROM:
+                spur_val = EEP_DEF_SPURCHAN;
+                break;
+        }
+
+        return spur_val;
+
+#undef EEP_DEF_SPURCHAN
+}
+
+const struct eeprom_ops eep_def_ops = {
+        .check_eeprom           = ath9k_hw_def_check_eeprom,
+        .get_eeprom             = ath9k_hw_def_get_eeprom,
+        .fill_eeprom            = ath9k_hw_def_fill_eeprom,
+        .get_eeprom_ver         = ath9k_hw_def_get_eeprom_ver,
+        .get_eeprom_rev         = ath9k_hw_def_get_eeprom_rev,
+        .get_num_ant_config     = ath9k_hw_def_get_num_ant_config,
+        .get_eeprom_antenna_cfg = ath9k_hw_def_get_eeprom_antenna_cfg,
+        .set_board_values       = ath9k_hw_def_set_board_values,
+        .set_addac              = ath9k_hw_def_set_addac,
+        .set_txpower            = ath9k_hw_def_set_txpower,
+        .get_spur_channel       = ath9k_hw_def_get_spur_channel
+};
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 71a3bcc450a2..9f1b34d9861a 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -407,7 +407,7 @@ static void ath9k_hw_init_config(struct ath_hw *ah)
         ah->config.cck_trig_high = 200;
         ah->config.cck_trig_low = 100;
         ah->config.enable_ani = 1;
-        ah->config.diversity_control = 0;
+        ah->config.diversity_control = ATH9K_ANT_VARIABLE;
         ah->config.antenna_switch_swap = 0;
 
         for (i = 0; i < AR_EEPROM_MODAL_SPURS; i++) {
@@ -452,9 +452,6 @@ static void ath9k_hw_init_defaults(struct ath_hw *ah)
         ah->regulatory.power_limit = MAX_RATE_POWER;
         ah->regulatory.tp_scale = ATH9K_TP_SCALE_MAX;
         ah->atim_window = 0;
-        ah->diversity_control = ah->config.diversity_control;
-        ah->antenna_switch_swap =
-                ah->config.antenna_switch_swap;
         ah->sta_id1_defaults = AR_STA_ID1_CRPT_MIC_ENABLE;
         ah->beacon_interval = 100;
         ah->enable_32kHz_clock = DONT_USE_32KHZ;
@@ -3891,7 +3888,7 @@ bool ath9k_hw_setantennaswitch(struct ath_hw *ah,
                         break;
                 }
         } else {
-                ah->diversity_control = settings;
+                ah->config.diversity_control = settings;
         }
 
         return true;
@@ -4019,14 +4016,12 @@ void ath9k_hw_reset_tsf(struct ath_hw *ah)
         ath9k_ps_restore(ah->ah_sc);
 }
 
-bool ath9k_hw_set_tsfadjust(struct ath_hw *ah, u32 setting)
+void ath9k_hw_set_tsfadjust(struct ath_hw *ah, u32 setting)
 {
         if (setting)
                 ah->misc_mode |= AR_PCU_TX_ADD_TSF;
         else
                 ah->misc_mode &= ~AR_PCU_TX_ADD_TSF;
-
-        return true;
 }
 
 bool ath9k_hw_setslottime(struct ath_hw *ah, u32 us)
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index d4aaf4f8db29..0336981a70ec 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -127,6 +127,12 @@ enum wireless_mode {
         ATH9K_MODE_MAX,
 };
 
+enum ath9k_ant_setting {
+        ATH9K_ANT_VARIABLE = 0,
+        ATH9K_ANT_FIXED_A,
+        ATH9K_ANT_FIXED_B
+};
+
 enum ath9k_hw_caps {
         ATH9K_HW_CAP_MIC_AESCCM                 = BIT(0),
         ATH9K_HW_CAP_MIC_CKIP                   = BIT(1),
@@ -191,7 +197,7 @@ struct ath9k_ops_config {
         u32 cck_trig_high;
         u32 cck_trig_low;
         u32 enable_ani;
-        u16 diversity_control;
+        enum ath9k_ant_setting diversity_control;
         u16 antenna_switch_swap;
         int serialize_regmode;
         bool intr_mitigation;
@@ -330,12 +336,6 @@ enum ath9k_power_mode {
         ATH9K_PM_UNDEFINED
 };
 
-enum ath9k_ant_setting {
-        ATH9K_ANT_VARIABLE = 0,
-        ATH9K_ANT_FIXED_A,
-        ATH9K_ANT_FIXED_B
-};
-
 enum ath9k_tp_scale {
         ATH9K_TP_SCALE_MAX = 0,
         ATH9K_TP_SCALE_50,
@@ -437,8 +437,6 @@ struct ath_hw {
         u32 txurn_interrupt_mask;
         bool chip_fullsleep;
         u32 atim_window;
-        u16 antenna_switch_swap;
-        enum ath9k_ant_setting diversity_control;
 
         /* Calibration */
         enum ath9k_cal_types supp_cals;
@@ -507,7 +505,6 @@ struct ath_hw {
 
         /* ANI */
         u32 proc_phyerr;
-        bool has_hw_phycounters;
         u32 aniperiod;
         struct ar5416AniState *curani;
         struct ar5416AniState ani[255];
@@ -601,7 +598,7 @@ void ath9k_hw_write_associd(struct ath_softc *sc);
 u64 ath9k_hw_gettsf64(struct ath_hw *ah);
 void ath9k_hw_settsf64(struct ath_hw *ah, u64 tsf64);
 void ath9k_hw_reset_tsf(struct ath_hw *ah);
-bool ath9k_hw_set_tsfadjust(struct ath_hw *ah, u32 setting);
+void ath9k_hw_set_tsfadjust(struct ath_hw *ah, u32 setting);
 bool ath9k_hw_setslottime(struct ath_hw *ah, u32 us);
 void ath9k_hw_set11nmac2040(struct ath_hw *ah, enum ath9k_ht_macmode mode);
 void ath9k_hw_beaconinit(struct ath_hw *ah, u32 next_beacon, u32 beacon_period);
diff --git a/drivers/net/wireless/ath/ath9k/mac.c b/drivers/net/wireless/ath/ath9k/mac.c
index 6f923e318727..800bfab94635 100644
--- a/drivers/net/wireless/ath/ath9k/mac.c
+++ b/drivers/net/wireless/ath/ath9k/mac.c
@@ -40,20 +40,15 @@ u32 ath9k_hw_gettxbuf(struct ath_hw *ah, u32 q)
         return REG_READ(ah, AR_QTXDP(q));
 }
 
-bool ath9k_hw_puttxbuf(struct ath_hw *ah, u32 q, u32 txdp)
+void ath9k_hw_puttxbuf(struct ath_hw *ah, u32 q, u32 txdp)
 {
         REG_WRITE(ah, AR_QTXDP(q), txdp);
-
-        return true;
 }
 
-bool ath9k_hw_txstart(struct ath_hw *ah, u32 q)
+void ath9k_hw_txstart(struct ath_hw *ah, u32 q)
 {
         DPRINTF(ah->ah_sc, ATH_DBG_QUEUE, "Enable TXE on queue: %u\n", q);
-
         REG_WRITE(ah, AR_Q_TXE, 1 << q);
-
-        return true;
 }
 
 u32 ath9k_hw_numtxpending(struct ath_hw *ah, u32 q)
@@ -178,7 +173,7 @@ bool ath9k_hw_stoptxdma(struct ath_hw *ah, u32 q)
 #undef ATH9K_TIME_QUANTUM
 }
 
-bool ath9k_hw_filltxdesc(struct ath_hw *ah, struct ath_desc *ds,
+void ath9k_hw_filltxdesc(struct ath_hw *ah, struct ath_desc *ds,
                          u32 segLen, bool firstSeg,
                          bool lastSeg, const struct ath_desc *ds0)
 {
@@ -202,8 +197,6 @@ bool ath9k_hw_filltxdesc(struct ath_hw *ah, struct ath_desc *ds,
         ads->ds_txstatus4 = ads->ds_txstatus5 = 0;
         ads->ds_txstatus6 = ads->ds_txstatus7 = 0;
         ads->ds_txstatus8 = ads->ds_txstatus9 = 0;
-
-        return true;
 }
 
 void ath9k_hw_cleartxdesc(struct ath_hw *ah, struct ath_desc *ds)
@@ -888,7 +881,7 @@ int ath9k_hw_rxprocdesc(struct ath_hw *ah, struct ath_desc *ds,
         return 0;
 }
 
-bool ath9k_hw_setuprxdesc(struct ath_hw *ah, struct ath_desc *ds,
+void ath9k_hw_setuprxdesc(struct ath_hw *ah, struct ath_desc *ds,
                           u32 size, u32 flags)
 {
         struct ar5416_desc *ads = AR5416DESC(ds);
@@ -901,8 +894,6 @@ bool ath9k_hw_setuprxdesc(struct ath_hw *ah, struct ath_desc *ds,
         ads->ds_rxstatus8 &= ~AR_RxDone;
         if (!(pCap->hw_caps & ATH9K_HW_CAP_AUTOSLEEP))
                 memset(&(ads->u), 0, sizeof(ads->u));
-
-        return true;
 }
 
 bool ath9k_hw_setrxabort(struct ath_hw *ah, bool set)
diff --git a/drivers/net/wireless/ath/ath9k/mac.h b/drivers/net/wireless/ath/ath9k/mac.h
index 1176bce8b76c..7b3982295a43 100644
--- a/drivers/net/wireless/ath/ath9k/mac.h
+++ b/drivers/net/wireless/ath/ath9k/mac.h
@@ -628,12 +628,12 @@ struct ath9k_channel;
 struct ath_rate_table;
 
 u32 ath9k_hw_gettxbuf(struct ath_hw *ah, u32 q);
-bool ath9k_hw_puttxbuf(struct ath_hw *ah, u32 q, u32 txdp);
-bool ath9k_hw_txstart(struct ath_hw *ah, u32 q);
+void ath9k_hw_puttxbuf(struct ath_hw *ah, u32 q, u32 txdp);
+void ath9k_hw_txstart(struct ath_hw *ah, u32 q);
 u32 ath9k_hw_numtxpending(struct ath_hw *ah, u32 q);
 bool ath9k_hw_updatetxtriglevel(struct ath_hw *ah, bool bIncTrigLevel);
 bool ath9k_hw_stoptxdma(struct ath_hw *ah, u32 q);
-bool ath9k_hw_filltxdesc(struct ath_hw *ah, struct ath_desc *ds,
+void ath9k_hw_filltxdesc(struct ath_hw *ah, struct ath_desc *ds,
                          u32 segLen, bool firstSeg,
                          bool lastSeg, const struct ath_desc *ds0);
 void ath9k_hw_cleartxdesc(struct ath_hw *ah, struct ath_desc *ds);
@@ -668,7 +668,7 @@ bool ath9k_hw_releasetxqueue(struct ath_hw *ah, u32 q);
 bool ath9k_hw_resettxqueue(struct ath_hw *ah, u32 q);
 int ath9k_hw_rxprocdesc(struct ath_hw *ah, struct ath_desc *ds,
                         u32 pa, struct ath_desc *nds, u64 tsf);
-bool ath9k_hw_setuprxdesc(struct ath_hw *ah, struct ath_desc *ds,
+void ath9k_hw_setuprxdesc(struct ath_hw *ah, struct ath_desc *ds,
                           u32 size, u32 flags);
 bool ath9k_hw_setrxabort(struct ath_hw *ah, bool set);
 void ath9k_hw_putrxbuf(struct ath_hw *ah, u32 rxdp);
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index a9e43f7a23f6..fa4c6e74f977 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -1327,7 +1327,7 @@ static int ath_init_softc(u16 devid, struct ath_softc *sc)
          */
         ath_read_cachesize(sc, &csz);
         /* XXX assert csz is non-zero */
-        sc->cachelsz = csz << 2;        /* convert to bytes */
+        sc->common.cachelsz = csz << 2; /* convert to bytes */
 
         ah = kzalloc(sizeof(struct ath_hw), GFP_KERNEL);
         if (!ah) {
@@ -2140,6 +2140,7 @@ static void ath9k_stop(struct ieee80211_hw *hw)
         /* disable HAL and put h/w to sleep */
         ath9k_hw_disable(sc->sc_ah);
         ath9k_hw_configpcipowersave(sc->sc_ah, 1);
+        ath9k_hw_setpower(sc->sc_ah, ATH9K_PM_FULL_SLEEP);
 
         sc->sc_flags |= SC_OP_INVALID;
 
@@ -2214,8 +2215,7 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
         if ((conf->type == NL80211_IFTYPE_STATION) ||
             (conf->type == NL80211_IFTYPE_ADHOC) ||
             (conf->type == NL80211_IFTYPE_MESH_POINT)) {
-                if (ath9k_hw_phycounters(sc->sc_ah))
-                        sc->imask |= ATH9K_INT_MIB;
+                sc->imask |= ATH9K_INT_MIB;
                 sc->imask |= ATH9K_INT_TSFOOR;
         }
 
@@ -2380,6 +2380,7 @@ skip_chan_change:
         (FIF_PROMISC_IN_BSS |                   \
         FIF_ALLMULTI |                          \
         FIF_CONTROL |                           \
+        FIF_PSPOLL |                            \
         FIF_OTHER_BSS |                         \
         FIF_BCN_PRBRESP_PROMISC |               \
         FIF_FCSFAIL)
diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c
index 3546504a83c4..616bdff2b6a1 100644
--- a/drivers/net/wireless/ath/ath9k/pci.c
+++ b/drivers/net/wireless/ath/ath9k/pci.c
@@ -253,10 +253,12 @@ static int ath_pci_resume(struct pci_dev *pdev)
         u32 val;
         int err;
 
+        pci_restore_state(pdev);
+
         err = pci_enable_device(pdev);
         if (err)
                 return err;
-        pci_restore_state(pdev);
+
         /*
          * Suspend/Resume resets the PCI configuration space, so we have to
          * re-disable the RETRY_TIMEOUT register (0x41) to keep
diff --git a/drivers/net/wireless/ath/ath9k/phy.c b/drivers/net/wireless/ath/ath9k/phy.c
index 59bb3ce1e646..63bf9a307c6a 100644
--- a/drivers/net/wireless/ath/ath9k/phy.c
+++ b/drivers/net/wireless/ath/ath9k/phy.c
@@ -353,18 +353,16 @@ ath9k_hw_decrease_chain_power(struct ath_hw *ah, struct ath9k_channel *chan)
         u32 bank6SelMask;
         u32 *bank6Temp = ah->bank6Temp;
 
-        switch (ah->diversity_control) {
+        switch (ah->config.diversity_control) {
         case ATH9K_ANT_FIXED_A:
                 bank6SelMask =
-                    (ah->
-                     antenna_switch_swap & ANTSWAP_AB) ? REDUCE_CHAIN_0 :
-                    REDUCE_CHAIN_1;
+                    (ah->config.antenna_switch_swap & ANTSWAP_AB) ?
+                        REDUCE_CHAIN_0 : REDUCE_CHAIN_1;
                 break;
         case ATH9K_ANT_FIXED_B:
                 bank6SelMask =
-                    (ah->
-                     antenna_switch_swap & ANTSWAP_AB) ? REDUCE_CHAIN_1 :
-                    REDUCE_CHAIN_0;
+                    (ah->config.antenna_switch_swap & ANTSWAP_AB) ?
+                        REDUCE_CHAIN_1 : REDUCE_CHAIN_0;
                 break;
         case ATH9K_ANT_VARIABLE:
                 return;
diff --git a/drivers/net/wireless/ath/ath9k/phy.h b/drivers/net/wireless/ath/ath9k/phy.h
index 27bd93c6e74d..e83cd4ab87f0 100644
--- a/drivers/net/wireless/ath/ath9k/phy.h
+++ b/drivers/net/wireless/ath/ath9k/phy.h
@@ -312,7 +312,25 @@ bool ath9k_hw_init_rf(struct ath_hw *ah,
 #define AR_PHY_NEW_ADC_DC_GAIN_CORR(_i) (0x99b4 + ((_i) << 12))
 #define AR_PHY_NEW_ADC_GAIN_CORR_ENABLE 0x40000000
 #define AR_PHY_NEW_ADC_DC_OFFSET_CORR_ENABLE 0x80000000
-#define AR_PHY_MULTICHAIN_GAIN_CTL  0x99ac
+
+#define AR_PHY_MULTICHAIN_GAIN_CTL          0x99ac
+#define AR_PHY_9285_ANT_DIV_CTL_ALL         0x7f000000
+#define AR_PHY_9285_ANT_DIV_CTL             0x01000000
+#define AR_PHY_9285_ANT_DIV_CTL_S           24
+#define AR_PHY_9285_ANT_DIV_ALT_LNACONF     0x06000000
+#define AR_PHY_9285_ANT_DIV_ALT_LNACONF_S   25
+#define AR_PHY_9285_ANT_DIV_MAIN_LNACONF    0x18000000
+#define AR_PHY_9285_ANT_DIV_MAIN_LNACONF_S  27
+#define AR_PHY_9285_ANT_DIV_ALT_GAINTB      0x20000000
+#define AR_PHY_9285_ANT_DIV_ALT_GAINTB_S    29
+#define AR_PHY_9285_ANT_DIV_MAIN_GAINTB     0x40000000
+#define AR_PHY_9285_ANT_DIV_MAIN_GAINTB_S   30
+#define AR_PHY_9285_ANT_DIV_LNA1            2
+#define AR_PHY_9285_ANT_DIV_LNA2            1
+#define AR_PHY_9285_ANT_DIV_LNA1_PLUS_LNA2  3
+#define AR_PHY_9285_ANT_DIV_LNA1_MINUS_LNA2 0
+#define AR_PHY_9285_ANT_DIV_GAINTB_0        0
+#define AR_PHY_9285_ANT_DIV_GAINTB_1        1
 
 #define AR_PHY_EXT_CCA0             0x99b8
 #define AR_PHY_EXT_CCA0_THRESH62    0x000000FF
@@ -401,6 +419,7 @@ bool ath9k_hw_init_rf(struct ath_hw *ah,
 #define AR_PHY_CCK_DETECT_ANT_SWITCH_TIME           0x00001FC0
 #define AR_PHY_CCK_DETECT_ANT_SWITCH_TIME_S         6
 #define AR_PHY_CCK_DETECT_BB_ENABLE_ANT_FAST_DIV    0x2000
+#define AR_PHY_CCK_DETECT_BB_ENABLE_ANT_FAST_DIV_S  13
 
 #define AR_PHY_GAIN_2GHZ                0xA20C
 #define AR_PHY_GAIN_2GHZ_RXTX_MARGIN    0x00FC0000
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index 61edfab20ffc..61dbdd227444 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -100,38 +100,6 @@ static u64 ath_extend_tsf(struct ath_softc *sc, u32 rstamp)
         return (tsf & ~0x7fff) | rstamp;
 }
 
-static struct sk_buff *ath_rxbuf_alloc(struct ath_softc *sc, u32 len, gfp_t gfp_mask)
-{
-        struct sk_buff *skb;
-        u32 off;
-
-        /*
-         * Cache-line-align.  This is important (for the
-         * 5210 at least) as not doing so causes bogus data
-         * in rx'd frames.
-         */
-
-        /* Note: the kernel can allocate a value greater than
-         * what we ask it to give us. We really only need 4 KB as that
-         * is this hardware supports and in fact we need at least 3849
-         * as that is the MAX AMSDU size this hardware supports.
-         * Unfortunately this means we may get 8 KB here from the
-         * kernel... and that is actually what is observed on some
-         * systems :( */
-        skb = __dev_alloc_skb(len + sc->cachelsz - 1, gfp_mask);
-        if (skb != NULL) {
-                off = ((unsigned long) skb->data) % sc->cachelsz;
-                if (off != 0)
-                        skb_reserve(skb, sc->cachelsz - off);
-        } else {
-                DPRINTF(sc, ATH_DBG_FATAL,
-                        "skbuff alloc of size %u failed\n", len);
-                return NULL;
-        }
-
-        return skb;
-}
-
 /*
  * For Decrypt or Demic errors, we only mark packet status here and always push
  * up the frame up to let mac80211 handle the actual error case, be it no
@@ -252,6 +220,10 @@ static int ath_rx_prepare(struct sk_buff *skb, struct ath_desc *ds,
         else if (ds->ds_rxstat.rs_rssi > 127)
                 ds->ds_rxstat.rs_rssi = 127;
 
+        /* Update Beacon RSSI, this is used by ANI. */
+        if (ieee80211_is_beacon(fc))
+                sc->nodestats.ns_avgbrssi = ds->ds_rxstat.rs_rssi;
+
         rx_status->mactime = ath_extend_tsf(sc, ds->ds_rxstat.rs_tstamp);
         rx_status->band = hw->conf.channel->band;
         rx_status->freq = hw->conf.channel->center_freq;
@@ -332,10 +304,10 @@ int ath_rx_init(struct ath_softc *sc, int nbufs)
         spin_lock_init(&sc->rx.rxbuflock);
 
         sc->rx.bufsize = roundup(IEEE80211_MAX_MPDU_LEN,
-                                 min(sc->cachelsz, (u16)64));
+                                 min(sc->common.cachelsz, (u16)64));
 
         DPRINTF(sc, ATH_DBG_CONFIG, "cachelsz %u rxbufsize %u\n",
-                sc->cachelsz, sc->rx.bufsize);
+                sc->common.cachelsz, sc->rx.bufsize);
 
         /* Initialize rx descriptors */
 
@@ -348,7 +320,7 @@ int ath_rx_init(struct ath_softc *sc, int nbufs)
         }
 
         list_for_each_entry(bf, &sc->rx.rxbuf, list) {
-                skb = ath_rxbuf_alloc(sc, sc->rx.bufsize, GFP_KERNEL);
+                skb = ath_rxbuf_alloc(&sc->common, sc->rx.bufsize, GFP_KERNEL);
                 if (skb == NULL) {
                         error = -ENOMEM;
                         goto err;
@@ -448,8 +420,7 @@ u32 ath_calcrxfilter(struct ath_softc *sc)
         else
                 rfilt |= ATH9K_RX_FILTER_BEACON;
 
-        /* If in HOSTAP mode, want to enable reception of PSPOLL frames */
-        if (sc->sc_ah->opmode == NL80211_IFTYPE_AP)
+        if (sc->rx.rxfilter & FIF_PSPOLL)
                 rfilt |= ATH9K_RX_FILTER_PSPOLL;
 
         if (sc->sec_wiphy) {
@@ -774,7 +745,7 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush)
 
                 /* Ensure we always have an skb to requeue once we are done
                  * processing the current buffer's skb */
-                requeue_skb = ath_rxbuf_alloc(sc, sc->rx.bufsize, GFP_ATOMIC);
+                requeue_skb = ath_rxbuf_alloc(&sc->common, sc->rx.bufsize, GFP_ATOMIC);
 
                 /* If there is no memory we ignore the current RX'd frame,
                  * tell hardware it can give us a new frame using the old
@@ -789,7 +760,6 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush)
                                  DMA_FROM_DEVICE);
 
                 skb_put(skb, ds->ds_rxstat.rs_datalen);
-                skb->protocol = cpu_to_be16(ETH_P_CONTROL);
 
                 /* see if any padding is done by the hw and remove it */
                 hdr = (struct ieee80211_hdr *)skb->data;
diff --git a/drivers/net/wireless/ath/main.c b/drivers/net/wireless/ath/main.c
index 9949b11cb151..487193f1de1a 100644
--- a/drivers/net/wireless/ath/main.c
+++ b/drivers/net/wireless/ath/main.c
@@ -17,6 +17,42 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 
+#include "ath.h"
+
 MODULE_AUTHOR("Atheros Communications");
 MODULE_DESCRIPTION("Shared library for Atheros wireless LAN cards.");
 MODULE_LICENSE("Dual BSD/GPL");
+
+struct sk_buff *ath_rxbuf_alloc(struct ath_common *common,
+                                u32 len,
+                                gfp_t gfp_mask)
+{
+        struct sk_buff *skb;
+        u32 off;
+
+        /*
+         * Cache-line-align.  This is important (for the
+         * 5210 at least) as not doing so causes bogus data
+         * in rx'd frames.
+         */
+
+        /* Note: the kernel can allocate a value greater than
+         * what we ask it to give us. We really only need 4 KB as that
+         * is this hardware supports and in fact we need at least 3849
+         * as that is the MAX AMSDU size this hardware supports.
+         * Unfortunately this means we may get 8 KB here from the
+         * kernel... and that is actually what is observed on some
+         * systems :( */
+        skb = __dev_alloc_skb(len + common->cachelsz - 1, gfp_mask);
+        if (skb != NULL) {
+                off = ((unsigned long) skb->data) % common->cachelsz;
+                if (off != 0)
+                        skb_reserve(skb, common->cachelsz - off);
+        } else {
+                printk(KERN_ERR "skbuff alloc of size %u failed\n", len);
+                return NULL;
+        }
+
+        return skb;
+}
+EXPORT_SYMBOL(ath_rxbuf_alloc);
diff --git a/drivers/net/wireless/b43/b43.h b/drivers/net/wireless/b43/b43.h
index b6811cff18ba..a1b3b731935b 100644
--- a/drivers/net/wireless/b43/b43.h
+++ b/drivers/net/wireless/b43/b43.h
@@ -493,6 +493,10 @@ enum {
 
 /* Max size of a security key */
 #define B43_SEC_KEYSIZE                 16
+/* Max number of group keys */
+#define B43_NR_GROUP_KEYS               4
+/* Max number of pairwise keys */
+#define B43_NR_PAIRWISE_KEYS            50
 /* Security algorithms. */
 enum {
         B43_SEC_ALGO_NONE = 0,  /* unencrypted, as of TX header. */
@@ -639,7 +643,7 @@ struct b43_wl {
         u8 mac_addr[ETH_ALEN];
         /* Current BSSID */
         u8 bssid[ETH_ALEN];
-        /* Interface type. (IEEE80211_IF_TYPE_XXX) */
+        /* Interface type. (NL80211_IFTYPE_XXX) */
         int if_type;
         /* Is the card operating in AP, STA or IBSS mode? */
         bool operating;
@@ -819,8 +823,7 @@ struct b43_wldev {
 
         /* encryption/decryption */
         u16 ktp;                /* Key table pointer */
-        u8 max_nr_keys;
-        struct b43_key key[58];
+        struct b43_key key[B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS];
 
         /* Firmware data */
         struct b43_firmware fw;
@@ -845,7 +848,7 @@ static inline struct b43_wldev *dev_to_b43_wldev(struct device *dev)
         return ssb_get_drvdata(ssb_dev);
 }
 
-/* Is the device operating in a specified mode (IEEE80211_IF_TYPE_XXX). */
+/* Is the device operating in a specified mode (NL80211_IFTYPE_XXX). */
 static inline int b43_is_mode(struct b43_wl *wl, int type)
 {
         return (wl->operating && wl->if_type == type);
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 925f346ea361..950beefbeaeb 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -796,18 +796,19 @@ static void key_write(struct b43_wldev *dev,
 static void keymac_write(struct b43_wldev *dev, u8 index, const u8 *addr)
 {
         u32 addrtmp[2] = { 0, 0, };
-        u8 per_sta_keys_start = 8;
+        u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 
         if (b43_new_kidx_api(dev))
-                per_sta_keys_start = 4;
+                pairwise_keys_start = B43_NR_GROUP_KEYS;
 
-        B43_WARN_ON(index < per_sta_keys_start);
-        /* We have two default TX keys and possibly two default RX keys.
+        B43_WARN_ON(index < pairwise_keys_start);
+        /* We have four default TX keys and possibly four default RX keys.
          * Physical mac 0 is mapped to physical key 4 or 8, depending
          * on the firmware version.
          * So we must adjust the index here.
          */
-        index -= per_sta_keys_start;
+        index -= pairwise_keys_start;
+        B43_WARN_ON(index >= B43_NR_PAIRWISE_KEYS);
 
         if (addr) {
                 addrtmp[0] = addr[0];
@@ -818,27 +819,11 @@ static void keymac_write(struct b43_wldev *dev, u8 index, const u8 *addr)
                 addrtmp[1] |= ((u32) (addr[5]) << 8);
         }
 
-        if (dev->dev->id.revision >= 5) {
-                /* Receive match transmitter address mechanism */
-                b43_shm_write32(dev, B43_SHM_RCMTA,
-                                (index * 2) + 0, addrtmp[0]);
-                b43_shm_write16(dev, B43_SHM_RCMTA,
-                                (index * 2) + 1, addrtmp[1]);
-        } else {
-                /* RXE (Receive Engine) and
-                 * PSM (Programmable State Machine) mechanism
-                 */
-                if (index < 8) {
-                        /* TODO write to RCM 16, 19, 22 and 25 */
-                } else {
-                        b43_shm_write32(dev, B43_SHM_SHARED,
-                                        B43_SHM_SH_PSM + (index * 6) + 0,
-                                        addrtmp[0]);
-                        b43_shm_write16(dev, B43_SHM_SHARED,
-                                        B43_SHM_SH_PSM + (index * 6) + 4,
-                                        addrtmp[1]);
-                }
-        }
+        /* Receive match transmitter address (RCMTA) mechanism */
+        b43_shm_write32(dev, B43_SHM_RCMTA,
+                        (index * 2) + 0, addrtmp[0]);
+        b43_shm_write16(dev, B43_SHM_RCMTA,
+                        (index * 2) + 1, addrtmp[1]);
 }
 
 static void do_key_write(struct b43_wldev *dev,
@@ -846,20 +831,20 @@ static void do_key_write(struct b43_wldev *dev,
                          const u8 *key, size_t key_len, const u8 *mac_addr)
 {
         u8 buf[B43_SEC_KEYSIZE] = { 0, };
-        u8 per_sta_keys_start = 8;
+        u8 pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
 
         if (b43_new_kidx_api(dev))
-                per_sta_keys_start = 4;
+                pairwise_keys_start = B43_NR_GROUP_KEYS;
 
-        B43_WARN_ON(index >= dev->max_nr_keys);
+        B43_WARN_ON(index >= ARRAY_SIZE(dev->key));
         B43_WARN_ON(key_len > B43_SEC_KEYSIZE);
 
-        if (index >= per_sta_keys_start)
+        if (index >= pairwise_keys_start)
                 keymac_write(dev, index, NULL); /* First zero out mac. */
         if (key)
                 memcpy(buf, key, key_len);
         key_write(dev, index, algorithm, buf);
-        if (index >= per_sta_keys_start)
+        if (index >= pairwise_keys_start)
                 keymac_write(dev, index, mac_addr);
 
         dev->key[index].algorithm = algorithm;
@@ -872,21 +857,24 @@ static int b43_key_write(struct b43_wldev *dev,
                          struct ieee80211_key_conf *keyconf)
 {
         int i;
-        int sta_keys_start;
+        int pairwise_keys_start;
 
         if (key_len > B43_SEC_KEYSIZE)
                 return -EINVAL;
-        for (i = 0; i < dev->max_nr_keys; i++) {
+        for (i = 0; i < ARRAY_SIZE(dev->key); i++) {
                 /* Check that we don't already have this key. */
                 B43_WARN_ON(dev->key[i].keyconf == keyconf);
         }
         if (index < 0) {
                 /* Pairwise key. Get an empty slot for the key. */
                 if (b43_new_kidx_api(dev))
-                        sta_keys_start = 4;
+                        pairwise_keys_start = B43_NR_GROUP_KEYS;
                 else
-                        sta_keys_start = 8;
-                for (i = sta_keys_start; i < dev->max_nr_keys; i++) {
+                        pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
+                for (i = pairwise_keys_start;
+                     i < pairwise_keys_start + B43_NR_PAIRWISE_KEYS;
+                     i++) {
+                        B43_WARN_ON(i >= ARRAY_SIZE(dev->key));
                         if (!dev->key[i].keyconf) {
                                 /* found empty */
                                 index = i;
@@ -914,7 +902,7 @@ static int b43_key_write(struct b43_wldev *dev,
 
 static int b43_key_clear(struct b43_wldev *dev, int index)
 {
-        if (B43_WARN_ON((index < 0) || (index >= dev->max_nr_keys)))
+        if (B43_WARN_ON((index < 0) || (index >= ARRAY_SIZE(dev->key))))
                 return -EINVAL;
         do_key_write(dev, index, B43_SEC_ALGO_NONE,
                      NULL, B43_SEC_KEYSIZE, NULL);
@@ -929,15 +917,19 @@ static int b43_key_clear(struct b43_wldev *dev, int index)
 
 static void b43_clear_keys(struct b43_wldev *dev)
 {
-        int i;
+        int i, count;
 
-        for (i = 0; i < dev->max_nr_keys; i++)
+        if (b43_new_kidx_api(dev))
+                count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
+        else
+                count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
+        for (i = 0; i < count; i++)
                 b43_key_clear(dev, i);
 }
 
 static void b43_dump_keymemory(struct b43_wldev *dev)
 {
-        unsigned int i, index, offset;
+        unsigned int i, index, count, offset, pairwise_keys_start;
         u8 mac[ETH_ALEN];
         u16 algo;
         u32 rcmta0;
@@ -951,7 +943,14 @@ static void b43_dump_keymemory(struct b43_wldev *dev)
         hf = b43_hf_read(dev);
         b43dbg(dev->wl, "Hardware key memory dump:  USEDEFKEYS=%u\n",
                !!(hf & B43_HF_USEDEFKEYS));
-        for (index = 0; index < dev->max_nr_keys; index++) {
+        if (b43_new_kidx_api(dev)) {
+                pairwise_keys_start = B43_NR_GROUP_KEYS;
+                count = B43_NR_GROUP_KEYS + B43_NR_PAIRWISE_KEYS;
+        } else {
+                pairwise_keys_start = B43_NR_GROUP_KEYS * 2;
+                count = B43_NR_GROUP_KEYS * 2 + B43_NR_PAIRWISE_KEYS;
+        }
+        for (index = 0; index < count; index++) {
                 key = &(dev->key[index]);
                 printk(KERN_DEBUG "Key slot %02u: %s",
                        index, (key->keyconf == NULL) ? " " : "*");
@@ -965,11 +964,11 @@ static void b43_dump_keymemory(struct b43_wldev *dev)
                                       B43_SHM_SH_KEYIDXBLOCK + (index * 2));
                 printk("   Algo: %04X/%02X", algo, key->algorithm);
 
-                if (index >= 4) {
+                if (index >= pairwise_keys_start) {
                         rcmta0 = b43_shm_read32(dev, B43_SHM_RCMTA,
-                                                ((index - 4) * 2) + 0);
+                                                ((index - pairwise_keys_start) * 2) + 0);
                         rcmta1 = b43_shm_read16(dev, B43_SHM_RCMTA,
-                                                ((index - 4) * 2) + 1);
+                                                ((index - pairwise_keys_start) * 2) + 1);
                         *((__le32 *)(&mac[0])) = cpu_to_le32(rcmta0);
                         *((__le16 *)(&mac[4])) = cpu_to_le16(rcmta1);
                         printk("   MAC: %pM", mac);
@@ -1429,116 +1428,6 @@ static void b43_write_beacon_template(struct b43_wldev *dev,
         b43dbg(dev->wl, "Updated beacon template at 0x%x\n", ram_offset);
 }
 
-static void b43_write_probe_resp_plcp(struct b43_wldev *dev,
-                                      u16 shm_offset, u16 size,
-                                      struct ieee80211_rate *rate)
-{
-        struct b43_plcp_hdr4 plcp;
-        u32 tmp;
-        __le16 dur;
-
-        plcp.data = 0;
-        b43_generate_plcp_hdr(&plcp, size + FCS_LEN, rate->hw_value);
-        dur = ieee80211_generic_frame_duration(dev->wl->hw,
-                                               dev->wl->vif, size,
-                                               rate);
-        /* Write PLCP in two parts and timing for packet transfer */
-        tmp = le32_to_cpu(plcp.data);
-        b43_shm_write16(dev, B43_SHM_SHARED, shm_offset, tmp & 0xFFFF);
-        b43_shm_write16(dev, B43_SHM_SHARED, shm_offset + 2, tmp >> 16);
-        b43_shm_write16(dev, B43_SHM_SHARED, shm_offset + 6, le16_to_cpu(dur));
-}
-
-/* Instead of using custom probe response template, this function
- * just patches custom beacon template by:
- * 1) Changing packet type
- * 2) Patching duration field
- * 3) Stripping TIM
- */
-static const u8 *b43_generate_probe_resp(struct b43_wldev *dev,
-                                         u16 *dest_size,
-                                         struct ieee80211_rate *rate)
-{
-        const u8 *src_data;
-        u8 *dest_data;
-        u16 src_size, elem_size, src_pos, dest_pos;
-        __le16 dur;
-        struct ieee80211_hdr *hdr;
-        size_t ie_start;
-
-        src_size = dev->wl->current_beacon->len;
-        src_data = (const u8 *)dev->wl->current_beacon->data;
-
-        /* Get the start offset of the variable IEs in the packet. */
-        ie_start = offsetof(struct ieee80211_mgmt, u.probe_resp.variable);
-        B43_WARN_ON(ie_start != offsetof(struct ieee80211_mgmt, u.beacon.variable));
-
-        if (B43_WARN_ON(src_size < ie_start))
-                return NULL;
-
-        dest_data = kmalloc(src_size, GFP_ATOMIC);
-        if (unlikely(!dest_data))
-                return NULL;
-
-        /* Copy the static data and all Information Elements, except the TIM. */
-        memcpy(dest_data, src_data, ie_start);
-        src_pos = ie_start;
-        dest_pos = ie_start;
-        for ( ; src_pos < src_size - 2; src_pos += elem_size) {
-                elem_size = src_data[src_pos + 1] + 2;
-                if (src_data[src_pos] == 5) {
-                        /* This is the TIM. */
-                        continue;
-                }
-                memcpy(dest_data + dest_pos, src_data + src_pos,
-                       elem_size);
-                dest_pos += elem_size;
-        }
-        *dest_size = dest_pos;
-        hdr = (struct ieee80211_hdr *)dest_data;
-
-        /* Set the frame control. */
-        hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
-                                         IEEE80211_STYPE_PROBE_RESP);
-        dur = ieee80211_generic_frame_duration(dev->wl->hw,
-                                               dev->wl->vif, *dest_size,
-                                               rate);
-        hdr->duration_id = dur;
-
-        return dest_data;
-}
-
-static void b43_write_probe_resp_template(struct b43_wldev *dev,
-                                          u16 ram_offset,
-                                          u16 shm_size_offset,
-                                          struct ieee80211_rate *rate)
-{
-        const u8 *probe_resp_data;
-        u16 size;
-
-        size = dev->wl->current_beacon->len;
-        probe_resp_data = b43_generate_probe_resp(dev, &size, rate);
-        if (unlikely(!probe_resp_data))
-                return;
-
-        /* Looks like PLCP headers plus packet timings are stored for
-         * all possible basic rates
-         */
-        /* FIXME this is the wrong offset : it goes in tkip rx phase1 shm */
-#if 0
-        b43_write_probe_resp_plcp(dev, 0x31A, size, &b43_b_ratetable[0]);
-        b43_write_probe_resp_plcp(dev, 0x32C, size, &b43_b_ratetable[1]);
-        b43_write_probe_resp_plcp(dev, 0x33E, size, &b43_b_ratetable[2]);
-        b43_write_probe_resp_plcp(dev, 0x350, size, &b43_b_ratetable[3]);
-#endif
-
-        size = min((size_t) size, 0x200 - sizeof(struct b43_plcp_hdr6));
-        b43_write_template_common(dev, probe_resp_data,
-                                  size, ram_offset, shm_size_offset,
-                                  rate->hw_value);
-        kfree(probe_resp_data);
-}
-
 static void b43_upload_beacon0(struct b43_wldev *dev)
 {
         struct b43_wl *wl = dev->wl;
@@ -1546,10 +1435,6 @@ static void b43_upload_beacon0(struct b43_wldev *dev)
         if (wl->beacon0_uploaded)
                 return;
         b43_write_beacon_template(dev, 0x68, 0x18);
-        /* FIXME: Probe resp upload doesn't really belong here,
-         *        but we don't use that feature anyway. */
-        b43_write_probe_resp_template(dev, 0x268, 0x4A,
-                                      &__b43_ratetable[3]);
         wl->beacon0_uploaded = 1;
 }
 
@@ -2990,17 +2875,14 @@ error:
 
 static void b43_security_init(struct b43_wldev *dev)
 {
-        dev->max_nr_keys = (dev->dev->id.revision >= 5) ? 58 : 20;
-        B43_WARN_ON(dev->max_nr_keys > ARRAY_SIZE(dev->key));
         dev->ktp = b43_shm_read16(dev, B43_SHM_SHARED, B43_SHM_SH_KTP);
         /* KTP is a word address, but we address SHM bytewise.
          * So multiply by two.
          */
         dev->ktp *= 2;
-        if (dev->dev->id.revision >= 5) {
-                /* Number of RCMTA address slots */
-                b43_write16(dev, B43_MMIO_RCMTA_COUNT, dev->max_nr_keys - 8);
-        }
+        /* Number of RCMTA address slots */
+        b43_write16(dev, B43_MMIO_RCMTA_COUNT, B43_NR_PAIRWISE_KEYS);
+        /* Clear the key memory. */
         b43_clear_keys(dev);
 }
 
diff --git a/drivers/net/wireless/b43/phy_lp.c b/drivers/net/wireless/b43/phy_lp.c
index aa1486a1354b..cfb8337d3859 100644
--- a/drivers/net/wireless/b43/phy_lp.c
+++ b/drivers/net/wireless/b43/phy_lp.c
@@ -59,9 +59,126 @@ static void b43_lpphy_op_free(struct b43_wldev *dev)
         dev->phy.lp = NULL;
 }
 
+static void lpphy_read_band_sprom(struct b43_wldev *dev)
+{
+        struct b43_phy_lp *lpphy = dev->phy.lp;
+        struct ssb_bus *bus = dev->dev->bus;
+        u16 cckpo, maxpwr;
+        u32 ofdmpo;
+        int i;
+
+        if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ) {
+                lpphy->tx_isolation_med_band = bus->sprom.tri2g;
+                lpphy->bx_arch = bus->sprom.bxa2g;
+                lpphy->rx_pwr_offset = bus->sprom.rxpo2g;
+                lpphy->rssi_vf = bus->sprom.rssismf2g;
+                lpphy->rssi_vc = bus->sprom.rssismc2g;
+                lpphy->rssi_gs = bus->sprom.rssisav2g;
+                lpphy->txpa[0] = bus->sprom.pa0b0;
+                lpphy->txpa[1] = bus->sprom.pa0b1;
+                lpphy->txpa[2] = bus->sprom.pa0b2;
+                maxpwr = bus->sprom.maxpwr_bg;
+                lpphy->max_tx_pwr_med_band = maxpwr;
+                cckpo = bus->sprom.cck2gpo;
+                ofdmpo = bus->sprom.ofdm2gpo;
+                if (cckpo) {
+                        for (i = 0; i < 4; i++) {
+                                lpphy->tx_max_rate[i] =
+                                        maxpwr - (ofdmpo & 0xF) * 2;
+                                ofdmpo >>= 4;
+                        }
+                        ofdmpo = bus->sprom.ofdm2gpo;
+                        for (i = 4; i < 15; i++) {
+                                lpphy->tx_max_rate[i] =
+                                        maxpwr - (ofdmpo & 0xF) * 2;
+                                ofdmpo >>= 4;
+                        }
+                } else {
+                        ofdmpo &= 0xFF;
+                        for (i = 0; i < 4; i++)
+                                lpphy->tx_max_rate[i] = maxpwr;
+                        for (i = 4; i < 15; i++)
+                                lpphy->tx_max_rate[i] = maxpwr - ofdmpo;
+                }
+        } else { /* 5GHz */
+                lpphy->tx_isolation_low_band = bus->sprom.tri5gl;
+                lpphy->tx_isolation_med_band = bus->sprom.tri5g;
+                lpphy->tx_isolation_hi_band = bus->sprom.tri5gh;
+                lpphy->bx_arch = bus->sprom.bxa5g;
+                lpphy->rx_pwr_offset = bus->sprom.rxpo5g;
+                lpphy->rssi_vf = bus->sprom.rssismf5g;
+                lpphy->rssi_vc = bus->sprom.rssismc5g;
+                lpphy->rssi_gs = bus->sprom.rssisav5g;
+                lpphy->txpa[0] = bus->sprom.pa1b0;
+                lpphy->txpa[1] = bus->sprom.pa1b1;
+                lpphy->txpa[2] = bus->sprom.pa1b2;
+                lpphy->txpal[0] = bus->sprom.pa1lob0;
+                lpphy->txpal[1] = bus->sprom.pa1lob1;
+                lpphy->txpal[2] = bus->sprom.pa1lob2;
+                lpphy->txpah[0] = bus->sprom.pa1hib0;
+                lpphy->txpah[1] = bus->sprom.pa1hib1;
+                lpphy->txpah[2] = bus->sprom.pa1hib2;
+                maxpwr = bus->sprom.maxpwr_al;
+                ofdmpo = bus->sprom.ofdm5glpo;
+                lpphy->max_tx_pwr_low_band = maxpwr;
+                for (i = 4; i < 12; i++) {
+                        lpphy->tx_max_ratel[i] = maxpwr - (ofdmpo & 0xF) * 2;
+                        ofdmpo >>= 4;
+                }
+                maxpwr = bus->sprom.maxpwr_a;
+                ofdmpo = bus->sprom.ofdm5gpo;
+                lpphy->max_tx_pwr_med_band = maxpwr;
+                for (i = 4; i < 12; i++) {
+                        lpphy->tx_max_rate[i] = maxpwr - (ofdmpo & 0xF) * 2;
+                        ofdmpo >>= 4;
+                }
+                maxpwr = bus->sprom.maxpwr_ah;
+                ofdmpo = bus->sprom.ofdm5ghpo;
+                lpphy->max_tx_pwr_hi_band = maxpwr;
+                for (i = 4; i < 12; i++) {
+                        lpphy->tx_max_rateh[i] = maxpwr - (ofdmpo & 0xF) * 2;
+                        ofdmpo >>= 4;
+                }
+        }
+}
+
+static void lpphy_adjust_gain_table(struct b43_wldev *dev)
+{
+        struct b43_phy_lp *lpphy = dev->phy.lp;
+        u32 freq = dev->wl->hw->conf.channel->center_freq;
+        u16 temp[3];
+        u16 isolation;
+
+        B43_WARN_ON(dev->phy.rev >= 2);
+
+        if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ)
+                isolation = lpphy->tx_isolation_med_band;
+        else if (freq <= 5320)
+                isolation = lpphy->tx_isolation_low_band;
+        else if (freq <= 5700)
+                isolation = lpphy->tx_isolation_med_band;
+        else
+                isolation = lpphy->tx_isolation_hi_band;
+
+        temp[0] = ((isolation - 26) / 12) << 12;
+        temp[1] = temp[0] + 0x1000;
+        temp[2] = temp[0] + 0x2000;
+
+        b43_lptab_write_bulk(dev, B43_LPTAB16(12, 0), 3, temp);
+        b43_lptab_write_bulk(dev, B43_LPTAB16(13, 0), 3, temp);
+}
+
 static void lpphy_table_init(struct b43_wldev *dev)
 {
-        //TODO
+        if (dev->phy.rev < 2)
+                lpphy_rev0_1_table_init(dev);
+        else
+                lpphy_rev2plus_table_init(dev);
+
+        lpphy_init_tx_gain_table(dev);
+
+        if (dev->phy.rev < 2)
+                lpphy_adjust_gain_table(dev);
 }
 
 static void lpphy_baseband_rev0_1_init(struct b43_wldev *dev)
@@ -130,7 +247,7 @@ static void lpphy_baseband_rev0_1_init(struct b43_wldev *dev)
                 b43_phy_set(dev, B43_LPPHY_CRSGAIN_CTL, 0x0006);
                 b43_phy_write(dev, B43_LPPHY_GPIO_SELECT, 0x0005);
                 b43_phy_write(dev, B43_LPPHY_GPIO_OUTEN, 0xFFFF);
-                b43_hf_write(dev, b43_hf_read(dev) | 0x0800ULL << 32);
+                b43_hf_write(dev, b43_hf_read(dev) | B43_HF_PR45960W);
         }
         if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ) {
                 b43_phy_set(dev, B43_LPPHY_LP_PHY_CTL, 0x8000);
@@ -161,6 +278,56 @@ static void lpphy_baseband_rev0_1_init(struct b43_wldev *dev)
         }
 }
 
+static void lpphy_save_dig_flt_state(struct b43_wldev *dev)
+{
+        static const u16 addr[] = {
+                B43_PHY_OFDM(0xC1),
+                B43_PHY_OFDM(0xC2),
+                B43_PHY_OFDM(0xC3),
+                B43_PHY_OFDM(0xC4),
+                B43_PHY_OFDM(0xC5),
+                B43_PHY_OFDM(0xC6),
+                B43_PHY_OFDM(0xC7),
+                B43_PHY_OFDM(0xC8),
+                B43_PHY_OFDM(0xCF),
+        };
+
+        static const u16 coefs[] = {
+                0xDE5E, 0xE832, 0xE331, 0x4D26,
+                0x0026, 0x1420, 0x0020, 0xFE08,
+                0x0008,
+        };
+
+        struct b43_phy_lp *lpphy = dev->phy.lp;
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(addr); i++) {
+                lpphy->dig_flt_state[i] = b43_phy_read(dev, addr[i]);
+                b43_phy_write(dev, addr[i], coefs[i]);
+        }
+}
+
+static void lpphy_restore_dig_flt_state(struct b43_wldev *dev)
+{
+        static const u16 addr[] = {
+                B43_PHY_OFDM(0xC1),
+                B43_PHY_OFDM(0xC2),
+                B43_PHY_OFDM(0xC3),
+                B43_PHY_OFDM(0xC4),
+                B43_PHY_OFDM(0xC5),
+                B43_PHY_OFDM(0xC6),
+                B43_PHY_OFDM(0xC7),
+                B43_PHY_OFDM(0xC8),
+                B43_PHY_OFDM(0xCF),
+        };
+
+        struct b43_phy_lp *lpphy = dev->phy.lp;
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(addr); i++)
+                b43_phy_write(dev, addr[i], lpphy->dig_flt_state[i]);
+}
+
 static void lpphy_baseband_rev2plus_init(struct b43_wldev *dev)
 {
         struct ssb_bus *bus = dev->dev->bus;
@@ -175,7 +342,7 @@ static void lpphy_baseband_rev2plus_init(struct b43_wldev *dev)
         b43_phy_write(dev, B43_PHY_OFDM(0xF9), 0);
         b43_phy_write(dev, B43_LPPHY_TR_LOOKUP_1, 0);
         b43_phy_set(dev, B43_LPPHY_ADC_COMPENSATION_CTL, 0x10);
-        b43_phy_maskset(dev, B43_LPPHY_OFDMSYNCTHRESH0, 0xFF00, 0x78);
+        b43_phy_maskset(dev, B43_LPPHY_OFDMSYNCTHRESH0, 0xFF00, 0xB4);
         b43_phy_maskset(dev, B43_LPPHY_DCOFFSETTRANSIENT, 0xF8FF, 0x200);
         b43_phy_maskset(dev, B43_LPPHY_DCOFFSETTRANSIENT, 0xFF00, 0x7F);
         b43_phy_maskset(dev, B43_LPPHY_GAINDIRECTMISMATCH, 0xFF0F, 0x40);
@@ -183,7 +350,12 @@ static void lpphy_baseband_rev2plus_init(struct b43_wldev *dev)
         b43_phy_mask(dev, B43_LPPHY_CRSGAIN_CTL, ~0x4000);
         b43_phy_mask(dev, B43_LPPHY_CRSGAIN_CTL, ~0x2000);
         b43_phy_set(dev, B43_PHY_OFDM(0x10A), 0x1);
-        b43_phy_maskset(dev, B43_PHY_OFDM(0x10A), 0xFF01, 0x10);
+        if (bus->boardinfo.rev >= 0x18) {
+                b43_lptab_write(dev, B43_LPTAB32(17, 65), 0xEC);
+                b43_phy_maskset(dev, B43_PHY_OFDM(0x10A), 0xFF01, 0x14);
+        } else {
+                b43_phy_maskset(dev, B43_PHY_OFDM(0x10A), 0xFF01, 0x10);
+        }
         b43_phy_maskset(dev, B43_PHY_OFDM(0xDF), 0xFF00, 0xF4);
         b43_phy_maskset(dev, B43_PHY_OFDM(0xDF), 0x00FF, 0xF100);
         b43_phy_write(dev, B43_LPPHY_CLIPTHRESH, 0x48);
@@ -213,8 +385,10 @@ static void lpphy_baseband_rev2plus_init(struct b43_wldev *dev)
         b43_phy_maskset(dev, B43_LPPHY_CLIPCTRTHRESH, 0xFFE0, 0x12);
         b43_phy_maskset(dev, B43_LPPHY_GAINMISMATCH, 0x0FFF, 0x9000);
 
-        b43_lptab_write(dev, B43_LPTAB16(0x08, 0x14), 0);
-        b43_lptab_write(dev, B43_LPTAB16(0x08, 0x12), 0x40);
+        if ((bus->chip_id == 0x4325) && (bus->chip_rev == 1)) {
+                b43_lptab_write(dev, B43_LPTAB16(0x08, 0x14), 0);
+                b43_lptab_write(dev, B43_LPTAB16(0x08, 0x12), 0x40);
+        }
 
         if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ) {
                 b43_phy_set(dev, B43_LPPHY_CRSGAIN_CTL, 0x40);
@@ -234,6 +408,14 @@ static void lpphy_baseband_rev2plus_init(struct b43_wldev *dev)
         b43_phy_write(dev, B43_LPPHY_AFE_RSSI_CTL_1,
                       0x2000 | ((u16)lpphy->rssi_gs << 10) |
                       ((u16)lpphy->rssi_vc << 4) | lpphy->rssi_vf);
+
+        if ((bus->chip_id == 0x4325) && (bus->chip_rev == 0)) {
+                b43_phy_set(dev, B43_LPPHY_AFE_ADC_CTL_0, 0x1C);
+                b43_phy_maskset(dev, B43_LPPHY_AFE_CTL, 0x00FF, 0x8800);
+                b43_phy_maskset(dev, B43_LPPHY_AFE_ADC_CTL_1, 0xFC3C, 0x0400);
+        }
+
+        lpphy_save_dig_flt_state(dev);
 }
 
 static void lpphy_baseband_init(struct b43_wldev *dev)
@@ -333,12 +515,73 @@ static void lpphy_2062_init(struct b43_wldev *dev)
 /* Initialize the 2063 radio. */
 static void lpphy_2063_init(struct b43_wldev *dev)
 {
-        //TODO
+        b2063_upload_init_table(dev);
+        b43_radio_write(dev, B2063_LOGEN_SP5, 0);
+        b43_radio_set(dev, B2063_COMM8, 0x38);
+        b43_radio_write(dev, B2063_REG_SP1, 0x56);
+        b43_radio_mask(dev, B2063_RX_BB_CTL2, ~0x2);
+        b43_radio_write(dev, B2063_PA_SP7, 0);
+        b43_radio_write(dev, B2063_TX_RF_SP6, 0x20);
+        b43_radio_write(dev, B2063_TX_RF_SP9, 0x40);
+        b43_radio_write(dev, B2063_PA_SP3, 0xa0);
+        b43_radio_write(dev, B2063_PA_SP4, 0xa0);
+        b43_radio_write(dev, B2063_PA_SP2, 0x18);
 }
 
+struct lpphy_stx_table_entry {
+        u16 phy_offset;
+        u16 phy_shift;
+        u16 rf_addr;
+        u16 rf_shift;
+        u16 mask;
+};
+
+static const struct lpphy_stx_table_entry lpphy_stx_table[] = {
+        { .phy_offset = 2, .phy_shift = 6, .rf_addr = 0x3d, .rf_shift = 3, .mask = 0x01, },
+        { .phy_offset = 1, .phy_shift = 12, .rf_addr = 0x4c, .rf_shift = 1, .mask = 0x01, },
+        { .phy_offset = 1, .phy_shift = 8, .rf_addr = 0x50, .rf_shift = 0, .mask = 0x7f, },
+        { .phy_offset = 0, .phy_shift = 8, .rf_addr = 0x44, .rf_shift = 0, .mask = 0xff, },
+        { .phy_offset = 1, .phy_shift = 0, .rf_addr = 0x4a, .rf_shift = 0, .mask = 0xff, },
+        { .phy_offset = 0, .phy_shift = 4, .rf_addr = 0x4d, .rf_shift = 0, .mask = 0xff, },
+        { .phy_offset = 1, .phy_shift = 4, .rf_addr = 0x4e, .rf_shift = 0, .mask = 0xff, },
+        { .phy_offset = 0, .phy_shift = 12, .rf_addr = 0x4f, .rf_shift = 0, .mask = 0x0f, },
+        { .phy_offset = 1, .phy_shift = 0, .rf_addr = 0x4f, .rf_shift = 4, .mask = 0x0f, },
+        { .phy_offset = 3, .phy_shift = 0, .rf_addr = 0x49, .rf_shift = 0, .mask = 0x0f, },
+        { .phy_offset = 4, .phy_shift = 3, .rf_addr = 0x46, .rf_shift = 4, .mask = 0x07, },
+        { .phy_offset = 3, .phy_shift = 15, .rf_addr = 0x46, .rf_shift = 0, .mask = 0x01, },
+        { .phy_offset = 4, .phy_shift = 0, .rf_addr = 0x46, .rf_shift = 1, .mask = 0x07, },
+        { .phy_offset = 3, .phy_shift = 8, .rf_addr = 0x48, .rf_shift = 4, .mask = 0x07, },
+        { .phy_offset = 3, .phy_shift = 11, .rf_addr = 0x48, .rf_shift = 0, .mask = 0x0f, },
+        { .phy_offset = 3, .phy_shift = 4, .rf_addr = 0x49, .rf_shift = 4, .mask = 0x0f, },
+        { .phy_offset = 2, .phy_shift = 15, .rf_addr = 0x45, .rf_shift = 0, .mask = 0x01, },
+        { .phy_offset = 5, .phy_shift = 13, .rf_addr = 0x52, .rf_shift = 4, .mask = 0x07, },
+        { .phy_offset = 6, .phy_shift = 0, .rf_addr = 0x52, .rf_shift = 7, .mask = 0x01, },
+        { .phy_offset = 5, .phy_shift = 3, .rf_addr = 0x41, .rf_shift = 5, .mask = 0x07, },
+        { .phy_offset = 5, .phy_shift = 6, .rf_addr = 0x41, .rf_shift = 0, .mask = 0x0f, },
+        { .phy_offset = 5, .phy_shift = 10, .rf_addr = 0x42, .rf_shift = 5, .mask = 0x07, },
+        { .phy_offset = 4, .phy_shift = 15, .rf_addr = 0x42, .rf_shift = 0, .mask = 0x01, },
+        { .phy_offset = 5, .phy_shift = 0, .rf_addr = 0x42, .rf_shift = 1, .mask = 0x07, },
+        { .phy_offset = 4, .phy_shift = 11, .rf_addr = 0x43, .rf_shift = 4, .mask = 0x0f, },
+        { .phy_offset = 4, .phy_shift = 7, .rf_addr = 0x43, .rf_shift = 0, .mask = 0x0f, },
+        { .phy_offset = 4, .phy_shift = 6, .rf_addr = 0x45, .rf_shift = 1, .mask = 0x01, },
+        { .phy_offset = 2, .phy_shift = 7, .rf_addr = 0x40, .rf_shift = 4, .mask = 0x0f, },
+        { .phy_offset = 2, .phy_shift = 11, .rf_addr = 0x40, .rf_shift = 0, .mask = 0x0f, },
+};
+
 static void lpphy_sync_stx(struct b43_wldev *dev)
 {
-        //TODO
+        const struct lpphy_stx_table_entry *e;
+        unsigned int i;
+        u16 tmp;
+
+        for (i = 0; i < ARRAY_SIZE(lpphy_stx_table); i++) {
+                e = &lpphy_stx_table[i];
+                tmp = b43_radio_read(dev, e->rf_addr);
+                tmp >>= e->rf_shift;
+                tmp <<= e->phy_shift;
+                b43_phy_maskset(dev, B43_PHY_OFDM(0xF2 + e->phy_offset),
+                                ~(e->mask << e->phy_shift), tmp);
+        }
 }
 
 static void lpphy_radio_init(struct b43_wldev *dev)
@@ -356,8 +599,343 @@ static void lpphy_radio_init(struct b43_wldev *dev)
                 lpphy_sync_stx(dev);
                 b43_phy_write(dev, B43_PHY_OFDM(0xF0), 0x5F80);
                 b43_phy_write(dev, B43_PHY_OFDM(0xF1), 0);
-                //TODO Do something on the backplane
+                if (dev->dev->bus->chip_id == 0x4325) {
+                        // TODO SSB PMU recalibration
+                }
+        }
+}
+
+struct lpphy_iq_est { u32 iq_prod, i_pwr, q_pwr; };
+
+static void lpphy_set_rc_cap(struct b43_wldev *dev)
+{
+        u8 rc_cap = dev->phy.lp->rc_cap;
+
+        b43_radio_write(dev, B2062_N_RXBB_CALIB2, max_t(u8, rc_cap-4, 0x80));
+        b43_radio_write(dev, B2062_N_TX_CTL_A, ((rc_cap & 0x1F) >> 1) | 0x80);
+        b43_radio_write(dev, B2062_S_RXG_CNT16, ((rc_cap & 0x1F) >> 2) | 0x80);
+}
+
+static u8 lpphy_get_bb_mult(struct b43_wldev *dev)
+{
+        return (b43_lptab_read(dev, B43_LPTAB16(0, 87)) & 0xFF00) >> 8;
+}
+
+static void lpphy_set_bb_mult(struct b43_wldev *dev, u8 bb_mult)
+{
+        b43_lptab_write(dev, B43_LPTAB16(0, 87), (u16)bb_mult << 8);
+}
+
+static void lpphy_disable_crs(struct b43_wldev *dev)
+{
+        b43_phy_maskset(dev, B43_LPPHY_CRSGAIN_CTL, 0xFF1F, 0x80);
+        b43_phy_maskset(dev, B43_LPPHY_RF_OVERRIDE_VAL_0, 0xFFFC, 0x1);
+        b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_0, 0x3);
+        b43_phy_mask(dev, B43_LPPHY_RF_OVERRIDE_VAL_0, 0xFFFB);
+        b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_0, 0x4);
+        b43_phy_mask(dev, B43_LPPHY_RF_OVERRIDE_0, 0xFFF7);
+        b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_0, 0x8);
+        b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_VAL_0, 0x10);
+        b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_0, 0x10);
+        b43_phy_mask(dev, B43_LPPHY_RF_OVERRIDE_VAL_0, 0xFFDF);
+        b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_0, 0x20);
+        b43_phy_mask(dev, B43_LPPHY_RF_OVERRIDE_VAL_0, 0xFFBF);
+        b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_0, 0x40);
+        b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_2_VAL, 0x7);
+        b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_2_VAL, 0x38);
+        b43_phy_mask(dev, B43_LPPHY_RF_OVERRIDE_2_VAL, 0xFF3F);
+        b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_2_VAL, 0x100);
+        b43_phy_mask(dev, B43_LPPHY_RF_OVERRIDE_2_VAL, 0xFDFF);
+        b43_phy_write(dev, B43_LPPHY_PS_CTL_OVERRIDE_VAL0, 0);
+        b43_phy_write(dev, B43_LPPHY_PS_CTL_OVERRIDE_VAL1, 1);
+        b43_phy_write(dev, B43_LPPHY_PS_CTL_OVERRIDE_VAL2, 0x20);
+        b43_phy_mask(dev, B43_LPPHY_RF_OVERRIDE_2_VAL, 0xFBFF);
+        b43_phy_mask(dev, B43_LPPHY_RF_OVERRIDE_2_VAL, 0xF7FF);
+        b43_phy_write(dev, B43_LPPHY_TX_GAIN_CTL_OVERRIDE_VAL, 0);
+        b43_phy_write(dev, B43_LPPHY_RX_GAIN_CTL_OVERRIDE_VAL, 0x45AF);
+        b43_phy_write(dev, B43_LPPHY_RF_OVERRIDE_2, 0x3FF);
+}
+
+static void lpphy_restore_crs(struct b43_wldev *dev)
+{
+        if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ)
+                b43_phy_maskset(dev, B43_LPPHY_CRSGAIN_CTL, 0xFF1F, 0x60);
+        else
+                b43_phy_maskset(dev, B43_LPPHY_CRSGAIN_CTL, 0xFF1F, 0x20);
+        b43_phy_mask(dev, B43_LPPHY_RF_OVERRIDE_0, 0xFF80);
+        b43_phy_mask(dev, B43_LPPHY_RF_OVERRIDE_2, 0xFC00);
+}
+
+struct lpphy_tx_gains { u16 gm, pga, pad, dac; };
+
+static struct lpphy_tx_gains lpphy_get_tx_gains(struct b43_wldev *dev)
+{
+        struct lpphy_tx_gains gains;
+        u16 tmp;
+
+        gains.dac = (b43_phy_read(dev, B43_LPPHY_AFE_DAC_CTL) & 0x380) >> 7;
+        if (dev->phy.rev < 2) {
+                tmp = b43_phy_read(dev,
+                                   B43_LPPHY_TX_GAIN_CTL_OVERRIDE_VAL) & 0x7FF;
+                gains.gm = tmp & 0x0007;
+                gains.pga = (tmp & 0x0078) >> 3;
+                gains.pad = (tmp & 0x780) >> 7;
+        } else {
+                tmp = b43_phy_read(dev, B43_LPPHY_TX_GAIN_CTL_OVERRIDE_VAL);
+                gains.pad = b43_phy_read(dev, B43_PHY_OFDM(0xFB)) & 0xFF;
+                gains.gm = tmp & 0xFF;
+                gains.pga = (tmp >> 8) & 0xFF;
+        }
+
+        return gains;
+}
+
+static void lpphy_set_dac_gain(struct b43_wldev *dev, u16 dac)
+{
+        u16 ctl = b43_phy_read(dev, B43_LPPHY_AFE_DAC_CTL) & 0xC7F;
+        ctl |= dac << 7;
+        b43_phy_maskset(dev, B43_LPPHY_AFE_DAC_CTL, 0xF000, ctl);
+}
+
+static void lpphy_set_tx_gains(struct b43_wldev *dev,
+                               struct lpphy_tx_gains gains)
+{
+        u16 rf_gain, pa_gain;
+
+        if (dev->phy.rev < 2) {
+                rf_gain = (gains.pad << 7) | (gains.pga << 3) | gains.gm;
+                b43_phy_maskset(dev, B43_LPPHY_TX_GAIN_CTL_OVERRIDE_VAL,
+                                0xF800, rf_gain);
+        } else {
+                pa_gain = b43_phy_read(dev, B43_PHY_OFDM(0xFB)) & 0x7F00;
+                b43_phy_write(dev, B43_LPPHY_TX_GAIN_CTL_OVERRIDE_VAL,
+                              (gains.pga << 8) | gains.gm);
+                b43_phy_maskset(dev, B43_LPPHY_TX_GAIN_CTL_OVERRIDE_VAL,
+                                0x8000, gains.pad | pa_gain);
+                b43_phy_write(dev, B43_PHY_OFDM(0xFC),
+                              (gains.pga << 8) | gains.gm);
+                b43_phy_maskset(dev, B43_PHY_OFDM(0xFD),
+                                0x8000, gains.pad | pa_gain);
+        }
+        lpphy_set_dac_gain(dev, gains.dac);
+        if (dev->phy.rev < 2) {
+                b43_phy_maskset(dev, B43_LPPHY_RF_OVERRIDE_2, 0xFEFF, 1 << 8);
+        } else {
+                b43_phy_maskset(dev, B43_LPPHY_RF_OVERRIDE_2, 0xFF7F, 1 << 7);
+                b43_phy_maskset(dev, B43_LPPHY_RF_OVERRIDE_2, 0xBFFF, 1 << 14);
+        }
+        b43_phy_maskset(dev, B43_LPPHY_RF_OVERRIDE_2, 0xFFBF, 1 << 4);
+}
+
+static void lpphy_rev0_1_set_rx_gain(struct b43_wldev *dev, u32 gain)
+{
+        u16 trsw = gain & 0x1;
+        u16 lna = (gain & 0xFFFC) | ((gain & 0xC) >> 2);
+        u16 ext_lna = (gain & 2) >> 1;
+
+        b43_phy_maskset(dev, B43_LPPHY_RF_OVERRIDE_VAL_0, 0xFFFE, trsw);
+        b43_phy_maskset(dev, B43_LPPHY_RF_OVERRIDE_2_VAL,
+                        0xFBFF, ext_lna << 10);
+        b43_phy_maskset(dev, B43_LPPHY_RF_OVERRIDE_2_VAL,
+                        0xF7FF, ext_lna << 11);
+        b43_phy_write(dev, B43_LPPHY_RX_GAIN_CTL_OVERRIDE_VAL, lna);
+}
+
+static void lpphy_rev2plus_set_rx_gain(struct b43_wldev *dev, u32 gain)
+{
+        u16 low_gain = gain & 0xFFFF;
+        u16 high_gain = (gain >> 16) & 0xF;
+        u16 ext_lna = (gain >> 21) & 0x1;
+        u16 trsw = ~(gain >> 20) & 0x1;
+        u16 tmp;
+
+        b43_phy_maskset(dev, B43_LPPHY_RF_OVERRIDE_VAL_0, 0xFFFE, trsw);
+        b43_phy_maskset(dev, B43_LPPHY_RF_OVERRIDE_2_VAL,
+                        0xFDFF, ext_lna << 9);
+        b43_phy_maskset(dev, B43_LPPHY_RF_OVERRIDE_2_VAL,
+                        0xFBFF, ext_lna << 10);
+        b43_phy_write(dev, B43_LPPHY_RX_GAIN_CTL_OVERRIDE_VAL, low_gain);
+        b43_phy_maskset(dev, B43_LPPHY_AFE_DDFS, 0xFFF0, high_gain);
+        if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ) {
+                tmp = (gain >> 2) & 0x3;
+                b43_phy_maskset(dev, B43_LPPHY_RF_OVERRIDE_2_VAL,
+                                0xE7FF, tmp<<11);
+                b43_phy_maskset(dev, B43_PHY_OFDM(0xE6), 0xFFE7, tmp << 3);
+        }
+}
+
+static void lpphy_enable_rx_gain_override(struct b43_wldev *dev)
+{
+        b43_phy_mask(dev, B43_LPPHY_RF_OVERRIDE_0, 0xFFFE);
+        b43_phy_mask(dev, B43_LPPHY_RF_OVERRIDE_0, 0xFFEF);
+        b43_phy_mask(dev, B43_LPPHY_RF_OVERRIDE_0, 0xFFBF);
+        if (dev->phy.rev >= 2) {
+                b43_phy_mask(dev, B43_LPPHY_RF_OVERRIDE_2, 0xFEFF);
+                if (b43_current_band(dev->wl) != IEEE80211_BAND_2GHZ)
+                        return;
+                b43_phy_mask(dev, B43_LPPHY_RF_OVERRIDE_2, 0xFBFF);
+                b43_phy_mask(dev, B43_LPPHY_RF_OVERRIDE_2, 0xFFF7);
+        } else {
+                b43_phy_mask(dev, B43_LPPHY_RF_OVERRIDE_2, 0xFDFF);
+        }
+}
+
+static void lpphy_disable_rx_gain_override(struct b43_wldev *dev)
+{
+        b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_0, 0x1);
+        b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_0, 0x10);
+        b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_0, 0x40);
+        if (dev->phy.rev >= 2) {
+                b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_2, 0x100);
+                if (b43_current_band(dev->wl) != IEEE80211_BAND_2GHZ)
+                        return;
+                b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_2, 0x400);
+                b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_2, 0x8);
+        } else {
+                b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_2, 0x200);
+        }
+}
+
+static void lpphy_set_rx_gain(struct b43_wldev *dev, u32 gain)
+{
+        if (dev->phy.rev < 2)
+                lpphy_rev0_1_set_rx_gain(dev, gain);
+        else
+                lpphy_rev2plus_set_rx_gain(dev, gain);
+        lpphy_enable_rx_gain_override(dev);
+}
+
+static void lpphy_set_rx_gain_by_index(struct b43_wldev *dev, u16 idx)
+{
+        u32 gain = b43_lptab_read(dev, B43_LPTAB16(12, idx));
+        lpphy_set_rx_gain(dev, gain);
+}
+
+static void lpphy_stop_ddfs(struct b43_wldev *dev)
+{
+        b43_phy_mask(dev, B43_LPPHY_AFE_DDFS, 0xFFFD);
+        b43_phy_mask(dev, B43_LPPHY_LP_PHY_CTL, 0xFFDF);
+}
+
+static void lpphy_run_ddfs(struct b43_wldev *dev, int i_on, int q_on,
+                           int incr1, int incr2, int scale_idx)
+{
+        lpphy_stop_ddfs(dev);
+        b43_phy_mask(dev, B43_LPPHY_AFE_DDFS_POINTER_INIT, 0xFF80);
+        b43_phy_mask(dev, B43_LPPHY_AFE_DDFS_POINTER_INIT, 0x80FF);
+        b43_phy_maskset(dev, B43_LPPHY_AFE_DDFS_INCR_INIT, 0xFF80, incr1);
+        b43_phy_maskset(dev, B43_LPPHY_AFE_DDFS_INCR_INIT, 0x80FF, incr2 << 8);
+        b43_phy_maskset(dev, B43_LPPHY_AFE_DDFS, 0xFFF7, i_on << 3);
+        b43_phy_maskset(dev, B43_LPPHY_AFE_DDFS, 0xFFEF, q_on << 4);
+        b43_phy_maskset(dev, B43_LPPHY_AFE_DDFS, 0xFF9F, scale_idx << 5);
+        b43_phy_mask(dev, B43_LPPHY_AFE_DDFS, 0xFFFB);
+        b43_phy_set(dev, B43_LPPHY_AFE_DDFS, 0x2);
+        b43_phy_set(dev, B43_LPPHY_AFE_DDFS, 0x20);
+}
+
+static bool lpphy_rx_iq_est(struct b43_wldev *dev, u16 samples, u8 time,
+                           struct lpphy_iq_est *iq_est)
+{
+        int i;
+
+        b43_phy_mask(dev, B43_LPPHY_CRSGAIN_CTL, 0xFFF7);
+        b43_phy_write(dev, B43_LPPHY_IQ_NUM_SMPLS_ADDR, samples);
+        b43_phy_maskset(dev, B43_LPPHY_IQ_ENABLE_WAIT_TIME_ADDR, 0xFF00, time);
+        b43_phy_mask(dev, B43_LPPHY_IQ_ENABLE_WAIT_TIME_ADDR, 0xFEFF);
+        b43_phy_set(dev, B43_LPPHY_IQ_ENABLE_WAIT_TIME_ADDR, 0xFDFF);
+
+        for (i = 0; i < 500; i++) {
+                if (!(b43_phy_read(dev,
+                                B43_LPPHY_IQ_ENABLE_WAIT_TIME_ADDR) & 0x200))
+                        break;
+                msleep(1);
+        }
+
+        if ((b43_phy_read(dev, B43_LPPHY_IQ_ENABLE_WAIT_TIME_ADDR) & 0x200)) {
+                b43_phy_set(dev, B43_LPPHY_CRSGAIN_CTL, 0x8);
+                return false;
+        }
+
+        iq_est->iq_prod = b43_phy_read(dev, B43_LPPHY_IQ_ACC_HI_ADDR);
+        iq_est->iq_prod <<= 16;
+        iq_est->iq_prod |= b43_phy_read(dev, B43_LPPHY_IQ_ACC_LO_ADDR);
+
+        iq_est->i_pwr = b43_phy_read(dev, B43_LPPHY_IQ_I_PWR_ACC_HI_ADDR);
+        iq_est->i_pwr <<= 16;
+        iq_est->i_pwr |= b43_phy_read(dev, B43_LPPHY_IQ_I_PWR_ACC_LO_ADDR);
+
+        iq_est->q_pwr = b43_phy_read(dev, B43_LPPHY_IQ_Q_PWR_ACC_HI_ADDR);
+        iq_est->q_pwr <<= 16;
+        iq_est->q_pwr |= b43_phy_read(dev, B43_LPPHY_IQ_Q_PWR_ACC_LO_ADDR);
+
+        b43_phy_set(dev, B43_LPPHY_CRSGAIN_CTL, 0x8);
+        return true;
+}
+
+static int lpphy_loopback(struct b43_wldev *dev)
+{
+        struct lpphy_iq_est iq_est;
+        int i, index = -1;
+        u32 tmp;
+
+        memset(&iq_est, 0, sizeof(iq_est));
+
+        b43_phy_maskset(dev, B43_LPPHY_RF_OVERRIDE_VAL_0, 0xFFFC, 0x3);
+        b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_0, 0x3);
+        b43_phy_mask(dev, B43_LPPHY_AFE_CTL_OVRVAL, 0xFFFE);
+        b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_0, 0x800);
+        b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_VAL_0, 0x800);
+        b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_0, 0x8);
+        b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_VAL_0, 0x8);
+        b43_radio_write(dev, B2062_N_TX_CTL_A, 0x80);
+        b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_0, 0x80);
+        b43_phy_set(dev, B43_LPPHY_RF_OVERRIDE_VAL_0, 0x80);
+        for (i = 0; i < 32; i++) {
+                lpphy_set_rx_gain_by_index(dev, i);
+                lpphy_run_ddfs(dev, 1, 1, 5, 5, 0);
+                if (!(lpphy_rx_iq_est(dev, 1000, 32, &iq_est)))
+                        continue;
+                tmp = (iq_est.i_pwr + iq_est.q_pwr) / 1000;
+                if ((tmp > 4000) && (tmp < 10000)) {
+                        index = i;
+                        break;
+                }
         }
+        lpphy_stop_ddfs(dev);
+        return index;
+}
+
+static u32 lpphy_qdiv_roundup(u32 dividend, u32 divisor, u8 precision)
+{
+        u32 quotient, remainder, rbit, roundup, tmp;
+
+        if (divisor == 0) {
+                quotient = 0;
+                remainder = 0;
+        } else {
+                quotient = dividend / divisor;
+                remainder = dividend % divisor;
+        }
+
+        rbit = divisor & 0x1;
+        roundup = (divisor >> 1) + rbit;
+        precision--;
+
+        while (precision != 0xFF) {
+                tmp = remainder - roundup;
+                quotient <<= 1;
+                remainder <<= 1;
+                if (remainder >= roundup) {
+                        remainder = (tmp << 1) + rbit;
+                        quotient--;
+                }
+                precision--;
+        }
+
+        if (remainder >= roundup)
+                quotient++;
+
+        return quotient;
 }
 
 /* Read the TX power control mode from hardware. */
@@ -444,6 +1022,170 @@ static void lpphy_set_tx_power_control(struct b43_wldev *dev,
         lpphy_write_tx_pctl_mode_to_hardware(dev);
 }
 
+static void lpphy_rev0_1_rc_calib(struct b43_wldev *dev)
+{
+        struct b43_phy_lp *lpphy = dev->phy.lp;
+        struct lpphy_iq_est iq_est;
+        struct lpphy_tx_gains tx_gains;
+        static const u32 ideal_pwr_table[22] = {
+                0x10000, 0x10557, 0x10e2d, 0x113e0, 0x10f22, 0x0ff64,
+                0x0eda2, 0x0e5d4, 0x0efd1, 0x0fbe8, 0x0b7b8, 0x04b35,
+                0x01a5e, 0x00a0b, 0x00444, 0x001fd, 0x000ff, 0x00088,
+                0x0004c, 0x0002c, 0x0001a, 0xc0006,
+        };
+        bool old_txg_ovr;
+        u8 old_bbmult;
+        u16 old_rf_ovr, old_rf_ovrval, old_afe_ovr, old_afe_ovrval,
+            old_rf2_ovr, old_rf2_ovrval, old_phy_ctl, old_txpctl;
+        u32 normal_pwr, ideal_pwr, mean_sq_pwr, tmp = 0, mean_sq_pwr_min = 0;
+        int loopback, i, j, inner_sum;
+
+        memset(&iq_est, 0, sizeof(iq_est));
+
+        b43_switch_channel(dev, 7);
+        old_txg_ovr = (b43_phy_read(dev, B43_LPPHY_AFE_CTL_OVR) >> 6) & 1;
+        old_bbmult = lpphy_get_bb_mult(dev);
+        if (old_txg_ovr)
+                tx_gains = lpphy_get_tx_gains(dev);
+        old_rf_ovr = b43_phy_read(dev, B43_LPPHY_RF_OVERRIDE_0);
+        old_rf_ovrval = b43_phy_read(dev, B43_LPPHY_RF_OVERRIDE_VAL_0);
+        old_afe_ovr = b43_phy_read(dev, B43_LPPHY_AFE_CTL_OVR);
+        old_afe_ovrval = b43_phy_read(dev, B43_LPPHY_AFE_CTL_OVRVAL);
+        old_rf2_ovr = b43_phy_read(dev, B43_LPPHY_RF_OVERRIDE_2);
+        old_rf2_ovrval = b43_phy_read(dev, B43_LPPHY_RF_OVERRIDE_2_VAL);
+        old_phy_ctl = b43_phy_read(dev, B43_LPPHY_LP_PHY_CTL);
+        old_txpctl = b43_phy_read(dev, B43_LPPHY_TX_PWR_CTL_CMD) &
+                                        B43_LPPHY_TX_PWR_CTL_CMD_MODE;
+
+        lpphy_set_tx_power_control(dev, B43_LPPHY_TX_PWR_CTL_CMD_MODE_OFF);
+        lpphy_disable_crs(dev);
+        loopback = lpphy_loopback(dev);
+        if (loopback == -1)
+                goto finish;
+        lpphy_set_rx_gain_by_index(dev, loopback);
+        b43_phy_maskset(dev, B43_LPPHY_LP_PHY_CTL, 0xFFBF, 0x40);
+        b43_phy_maskset(dev, B43_LPPHY_RF_OVERRIDE_2_VAL, 0xFFF8, 0x1);
+        b43_phy_maskset(dev, B43_LPPHY_RF_OVERRIDE_2_VAL, 0xFFC7, 0x8);
+        b43_phy_maskset(dev, B43_LPPHY_RF_OVERRIDE_2_VAL, 0xFF3F, 0xC0);
+        for (i = 128; i <= 159; i++) {
+                b43_radio_write(dev, B2062_N_RXBB_CALIB2, i);
+                inner_sum = 0;
+                for (j = 5; j <= 25; j++) {
+                        lpphy_run_ddfs(dev, 1, 1, j, j, 0);
+                        if (!(lpphy_rx_iq_est(dev, 1000, 32, &iq_est)))
+                                goto finish;
+                        mean_sq_pwr = iq_est.i_pwr + iq_est.q_pwr;
+                        if (j == 5)
+                                tmp = mean_sq_pwr;
+                        ideal_pwr = ((ideal_pwr_table[j-5] >> 3) + 1) >> 1;
+                        normal_pwr = lpphy_qdiv_roundup(mean_sq_pwr, tmp, 12);
+                        mean_sq_pwr = ideal_pwr - normal_pwr;
+                        mean_sq_pwr *= mean_sq_pwr;
+                        inner_sum += mean_sq_pwr;
+                        if ((i = 128) || (inner_sum < mean_sq_pwr_min)) {
+                                lpphy->rc_cap = i;
+                                mean_sq_pwr_min = inner_sum;
+                        }
+                }
+        }
+        lpphy_stop_ddfs(dev);
+
+finish:
+        lpphy_restore_crs(dev);
+        b43_phy_write(dev, B43_LPPHY_RF_OVERRIDE_VAL_0, old_rf_ovrval);
+        b43_phy_write(dev, B43_LPPHY_RF_OVERRIDE_0, old_rf_ovr);
+        b43_phy_write(dev, B43_LPPHY_AFE_CTL_OVRVAL, old_afe_ovrval);
+        b43_phy_write(dev, B43_LPPHY_AFE_CTL_OVR, old_afe_ovr);
+        b43_phy_write(dev, B43_LPPHY_RF_OVERRIDE_2_VAL, old_rf2_ovrval);
+        b43_phy_write(dev, B43_LPPHY_RF_OVERRIDE_2, old_rf2_ovr);
+        b43_phy_write(dev, B43_LPPHY_LP_PHY_CTL, old_phy_ctl);
+
+        lpphy_set_bb_mult(dev, old_bbmult);
+        if (old_txg_ovr) {
+                /*
+                 * SPEC FIXME: The specs say "get_tx_gains" here, which is
+                 * illogical. According to lwfinger, vendor driver v4.150.10.5
+                 * has a Set here, while v4.174.64.19 has a Get - regression in
+                 * the vendor driver? This should be tested this once the code
+                 * is testable.
+                 */
+                lpphy_set_tx_gains(dev, tx_gains);
+        }
+        lpphy_set_tx_power_control(dev, old_txpctl);
+        if (lpphy->rc_cap)
+                lpphy_set_rc_cap(dev);
+}
+
+static void lpphy_rev2plus_rc_calib(struct b43_wldev *dev)
+{
+        struct ssb_bus *bus = dev->dev->bus;
+        u32 crystal_freq = bus->chipco.pmu.crystalfreq * 1000;
+        u8 tmp = b43_radio_read(dev, B2063_RX_BB_SP8) & 0xFF;
+        int i;
+
+        b43_radio_write(dev, B2063_RX_BB_SP8, 0x0);
+        b43_radio_write(dev, B2063_RC_CALIB_CTL1, 0x7E);
+        b43_radio_mask(dev, B2063_PLL_SP1, 0xF7);
+        b43_radio_write(dev, B2063_RC_CALIB_CTL1, 0x7C);
+        b43_radio_write(dev, B2063_RC_CALIB_CTL2, 0x15);
+        b43_radio_write(dev, B2063_RC_CALIB_CTL3, 0x70);
+        b43_radio_write(dev, B2063_RC_CALIB_CTL4, 0x52);
+        b43_radio_write(dev, B2063_RC_CALIB_CTL5, 0x1);
+        b43_radio_write(dev, B2063_RC_CALIB_CTL1, 0x7D);
+
+        for (i = 0; i < 10000; i++) {
+                if (b43_radio_read(dev, B2063_RC_CALIB_CTL6) & 0x2)
+                        break;
+                msleep(1);
+        }
+
+        if (!(b43_radio_read(dev, B2063_RC_CALIB_CTL6) & 0x2))
+                b43_radio_write(dev, B2063_RX_BB_SP8, tmp);
+
+        tmp = b43_radio_read(dev, B2063_TX_BB_SP3) & 0xFF;
+
+        b43_radio_write(dev, B2063_TX_BB_SP3, 0x0);
+        b43_radio_write(dev, B2063_RC_CALIB_CTL1, 0x7E);
+        b43_radio_write(dev, B2063_RC_CALIB_CTL1, 0x7C);
+        b43_radio_write(dev, B2063_RC_CALIB_CTL2, 0x55);
+        b43_radio_write(dev, B2063_RC_CALIB_CTL3, 0x76);
+
+        if (crystal_freq == 24000000) {
+                b43_radio_write(dev, B2063_RC_CALIB_CTL4, 0xFC);
+                b43_radio_write(dev, B2063_RC_CALIB_CTL5, 0x0);
+        } else {
+                b43_radio_write(dev, B2063_RC_CALIB_CTL4, 0x13);
+                b43_radio_write(dev, B2063_RC_CALIB_CTL5, 0x1);
+        }
+
+        b43_radio_write(dev, B2063_PA_SP7, 0x7D);
+
+        for (i = 0; i < 10000; i++) {
+                if (b43_radio_read(dev, B2063_RC_CALIB_CTL6) & 0x2)
+                        break;
+                msleep(1);
+        }
+
+        if (!(b43_radio_read(dev, B2063_RC_CALIB_CTL6) & 0x2))
+                b43_radio_write(dev, B2063_TX_BB_SP3, tmp);
+
+        b43_radio_write(dev, B2063_RC_CALIB_CTL1, 0x7E);
+}
+
+static void lpphy_calibrate_rc(struct b43_wldev *dev)
+{
+        struct b43_phy_lp *lpphy = dev->phy.lp;
+
+        if (dev->phy.rev >= 2) {
+                lpphy_rev2plus_rc_calib(dev);
+        } else if (!lpphy->rc_cap) {
+                if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ)
+                        lpphy_rev0_1_rc_calib(dev);
+        } else {
+                lpphy_set_rc_cap(dev);
+        }
+}
+
 static void lpphy_set_tx_power_by_index(struct b43_wldev *dev, u8 index)
 {
         struct b43_phy_lp *lpphy = dev->phy.lp;
@@ -532,13 +1274,14 @@ static void lpphy_tx_pctl_init(struct b43_wldev *dev)
 
 static int b43_lpphy_op_init(struct b43_wldev *dev)
 {
-        /* TODO: band SPROM */
+        lpphy_read_band_sprom(dev); //FIXME should this be in prepare_structs?
         lpphy_baseband_init(dev);
         lpphy_radio_init(dev);
-        //TODO calibrate RC
+        lpphy_calibrate_rc(dev);
         //TODO set channel
         lpphy_tx_pctl_init(dev);
-        //TODO full calib
+        lpphy_calibration(dev);
+        //TODO ACI init
 
         return 0;
 }
@@ -616,7 +1359,6 @@ static enum b43_txpwr_result b43_lpphy_op_recalc_txpower(struct b43_wldev *dev,
         return B43_TXPWR_RES_DONE;
 }
 
-
 const struct b43_phy_operations b43_phyops_lp = {
         .allocate               = b43_lpphy_op_allocate,
         .free                   = b43_lpphy_op_free,
diff --git a/drivers/net/wireless/b43/phy_lp.h b/drivers/net/wireless/b43/phy_lp.h
index 829b2bba3ee1..0461d5b3144f 100644
--- a/drivers/net/wireless/b43/phy_lp.h
+++ b/drivers/net/wireless/b43/phy_lp.h
@@ -831,6 +831,22 @@ struct b43_phy_lp {
         /* Transmit isolation high band */
         u8 tx_isolation_hi_band; /* FIXME initial value? */
 
+        /* Max transmit power medium band */
+        u16 max_tx_pwr_med_band;
+        /* Max transmit power low band */
+        u16 max_tx_pwr_low_band;
+        /* Max transmit power high band */
+        u16 max_tx_pwr_hi_band;
+
+        /* FIXME What are these used for? */
+        /* FIXME Is 15 the correct array size? */
+        u16 tx_max_rate[15];
+        u16 tx_max_ratel[15];
+        u16 tx_max_rateh[15];
+
+        /* Transmit power arrays */
+        s16 txpa[3], txpal[3], txpah[3];
+
         /* Receive power offset */
         u8 rx_pwr_offset; /* FIXME initial value? */
 
@@ -865,6 +881,9 @@ struct b43_phy_lp {
         /* Transmit iqlocal best coeffs */
         bool tx_iqloc_best_coeffs_valid;
         u8 tx_iqloc_best_coeffs[11];
+
+        /* Used for "Save/Restore Dig Filt State" */
+        u16 dig_flt_state[9];
 };
 
 
diff --git a/drivers/net/wireless/b43/tables_lpphy.c b/drivers/net/wireless/b43/tables_lpphy.c
index 4ea734dce218..2721310acb2a 100644
--- a/drivers/net/wireless/b43/tables_lpphy.c
+++ b/drivers/net/wireless/b43/tables_lpphy.c
@@ -28,22 +28,22 @@
 #include "phy_lp.h"
 
 
-/* Entry of the 2062 radio init table */
-struct b2062_init_tab_entry {
+/* Entry of the 2062/2063 radio init table */
+struct b206x_init_tab_entry {
         u16 offset;
         u16 value_a;
         u16 value_g;
         u8 flags;
 };
-#define B2062_FLAG_A    0x01 /* Flag: Init in A mode */
-#define B2062_FLAG_G    0x02 /* Flag: Init in G mode */
+#define B206X_FLAG_A    0x01 /* Flag: Init in A mode */
+#define B206X_FLAG_G    0x02 /* Flag: Init in G mode */
 
-static const struct b2062_init_tab_entry b2062_init_tab[] = {
+static const struct b206x_init_tab_entry b2062_init_tab[] = {
         /* { .offset = B2062_N_COMM1, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
         /* { .offset = 0x0001, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
         /* { .offset = B2062_N_COMM2, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
         /* { .offset = B2062_N_COMM3, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
-        { .offset = B2062_N_COMM4, .value_a = 0x0001, .value_g = 0x0000, .flags = B2062_FLAG_A | B2062_FLAG_G, },
+        { .offset = B2062_N_COMM4, .value_a = 0x0001, .value_g = 0x0000, .flags = B206X_FLAG_A | B206X_FLAG_G, },
         /* { .offset = B2062_N_COMM5, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
         /* { .offset = B2062_N_COMM6, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
         /* { .offset = B2062_N_COMM7, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
@@ -56,42 +56,42 @@ static const struct b2062_init_tab_entry b2062_init_tab[] = {
         /* { .offset = B2062_N_COMM14, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
         /* { .offset = B2062_N_COMM15, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
         /* { .offset = B2062_N_PDN_CTL0, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
-        { .offset = B2062_N_PDN_CTL1, .value_a = 0x0000, .value_g = 0x00CA, .flags = B2062_FLAG_G, },
+        { .offset = B2062_N_PDN_CTL1, .value_a = 0x0000, .value_g = 0x00CA, .flags = B206X_FLAG_G, },
         /* { .offset = B2062_N_PDN_CTL2, .value_a = 0x0018, .value_g = 0x0018, .flags = 0, }, */
-        { .offset = B2062_N_PDN_CTL3, .value_a = 0x0000, .value_g = 0x0000, .flags = B2062_FLAG_A | B2062_FLAG_G, },
-        { .offset = B2062_N_PDN_CTL4, .value_a = 0x0015, .value_g = 0x002A, .flags = B2062_FLAG_A | B2062_FLAG_G, },
+        { .offset = B2062_N_PDN_CTL3, .value_a = 0x0000, .value_g = 0x0000, .flags = B206X_FLAG_A | B206X_FLAG_G, },
+        { .offset = B2062_N_PDN_CTL4, .value_a = 0x0015, .value_g = 0x002A, .flags = B206X_FLAG_A | B206X_FLAG_G, },
         /* { .offset = B2062_N_GEN_CTL0, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
         /* { .offset = B2062_N_IQ_CALIB, .value_a = 0x0001, .value_g = 0x0001, .flags = 0, }, */
-        { .offset = B2062_N_LGENC, .value_a = 0x00DB, .value_g = 0x00FF, .flags = B2062_FLAG_A, },
+        { .offset = B2062_N_LGENC, .value_a = 0x00DB, .value_g = 0x00FF, .flags = B206X_FLAG_A, },
         /* { .offset = B2062_N_LGENA_LPF, .value_a = 0x0001, .value_g = 0x0001, .flags = 0, }, */
         /* { .offset = B2062_N_LGENA_BIAS0, .value_a = 0x0041, .value_g = 0x0041, .flags = 0, }, */
         /* { .offset = B2062_N_LGNEA_BIAS1, .value_a = 0x0002, .value_g = 0x0002, .flags = 0, }, */
         /* { .offset = B2062_N_LGENA_CTL0, .value_a = 0x0032, .value_g = 0x0032, .flags = 0, }, */
         /* { .offset = B2062_N_LGENA_CTL1, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
         /* { .offset = B2062_N_LGENA_CTL2, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
-        { .offset = B2062_N_LGENA_TUNE0, .value_a = 0x00DD, .value_g = 0x0000, .flags = B2062_FLAG_A | B2062_FLAG_G, },
+        { .offset = B2062_N_LGENA_TUNE0, .value_a = 0x00DD, .value_g = 0x0000, .flags = B206X_FLAG_A | B206X_FLAG_G, },
         /* { .offset = B2062_N_LGENA_TUNE1, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
-        { .offset = B2062_N_LGENA_TUNE2, .value_a = 0x00DD, .value_g = 0x0000, .flags = B2062_FLAG_A | B2062_FLAG_G, },
-        { .offset = B2062_N_LGENA_TUNE3, .value_a = 0x0077, .value_g = 0x00B5, .flags = B2062_FLAG_A | B2062_FLAG_G, },
-        { .offset = B2062_N_LGENA_CTL3, .value_a = 0x0000, .value_g = 0x00FF, .flags = B2062_FLAG_A | B2062_FLAG_G, },
+        { .offset = B2062_N_LGENA_TUNE2, .value_a = 0x00DD, .value_g = 0x0000, .flags = B206X_FLAG_A | B206X_FLAG_G, },
+        { .offset = B2062_N_LGENA_TUNE3, .value_a = 0x0077, .value_g = 0x00B5, .flags = B206X_FLAG_A | B206X_FLAG_G, },
+        { .offset = B2062_N_LGENA_CTL3, .value_a = 0x0000, .value_g = 0x00FF, .flags = B206X_FLAG_A | B206X_FLAG_G, },
         /* { .offset = B2062_N_LGENA_CTL4, .value_a = 0x001F, .value_g = 0x001F, .flags = 0, }, */
         /* { .offset = B2062_N_LGENA_CTL5, .value_a = 0x0032, .value_g = 0x0032, .flags = 0, }, */
         /* { .offset = B2062_N_LGENA_CTL6, .value_a = 0x0032, .value_g = 0x0032, .flags = 0, }, */
-        { .offset = B2062_N_LGENA_CTL7, .value_a = 0x0033, .value_g = 0x0033, .flags = B2062_FLAG_A | B2062_FLAG_G, },
+        { .offset = B2062_N_LGENA_CTL7, .value_a = 0x0033, .value_g = 0x0033, .flags = B206X_FLAG_A | B206X_FLAG_G, },
         /* { .offset = B2062_N_RXA_CTL0, .value_a = 0x0009, .value_g = 0x0009, .flags = 0, }, */
-        { .offset = B2062_N_RXA_CTL1, .value_a = 0x0000, .value_g = 0x0000, .flags = B2062_FLAG_G, },
+        { .offset = B2062_N_RXA_CTL1, .value_a = 0x0000, .value_g = 0x0000, .flags = B206X_FLAG_G, },
         /* { .offset = B2062_N_RXA_CTL2, .value_a = 0x0018, .value_g = 0x0018, .flags = 0, }, */
         /* { .offset = B2062_N_RXA_CTL3, .value_a = 0x0027, .value_g = 0x0027, .flags = 0, }, */
         /* { .offset = B2062_N_RXA_CTL4, .value_a = 0x0028, .value_g = 0x0028, .flags = 0, }, */
         /* { .offset = B2062_N_RXA_CTL5, .value_a = 0x0007, .value_g = 0x0007, .flags = 0, }, */
         /* { .offset = B2062_N_RXA_CTL6, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
         /* { .offset = B2062_N_RXA_CTL7, .value_a = 0x0008, .value_g = 0x0008, .flags = 0, }, */
-        { .offset = B2062_N_RXBB_CTL0, .value_a = 0x0082, .value_g = 0x0080, .flags = B2062_FLAG_A | B2062_FLAG_G, },
+        { .offset = B2062_N_RXBB_CTL0, .value_a = 0x0082, .value_g = 0x0080, .flags = B206X_FLAG_A | B206X_FLAG_G, },
         /* { .offset = B2062_N_RXBB_CTL1, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
         /* { .offset = B2062_N_RXBB_CTL2, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
         /* { .offset = B2062_N_RXBB_GAIN0, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
-        { .offset = B2062_N_RXBB_GAIN1, .value_a = 0x0004, .value_g = 0x0004, .flags = B2062_FLAG_A | B2062_FLAG_G, },
-        { .offset = B2062_N_RXBB_GAIN2, .value_a = 0x0000, .value_g = 0x0000, .flags = B2062_FLAG_A | B2062_FLAG_G, },
+        { .offset = B2062_N_RXBB_GAIN1, .value_a = 0x0004, .value_g = 0x0004, .flags = B206X_FLAG_A | B206X_FLAG_G, },
+        { .offset = B2062_N_RXBB_GAIN2, .value_a = 0x0000, .value_g = 0x0000, .flags = B206X_FLAG_A | B206X_FLAG_G, },
         /* { .offset = B2062_N_RXBB_GAIN3, .value_a = 0x0011, .value_g = 0x0011, .flags = 0, }, */
         /* { .offset = B2062_N_RXBB_RSSI0, .value_a = 0x0043, .value_g = 0x0043, .flags = 0, }, */
         /* { .offset = B2062_N_RXBB_RSSI1, .value_a = 0x0033, .value_g = 0x0033, .flags = 0, }, */
@@ -112,8 +112,8 @@ static const struct b2062_init_tab_entry b2062_init_tab[] = {
         /* { .offset = B2062_N_TX_CTL1, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
         /* { .offset = B2062_N_TX_CTL2, .value_a = 0x0084, .value_g = 0x0084, .flags = 0, }, */
         /* { .offset = B2062_N_TX_CTL3, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
-        { .offset = B2062_N_TX_CTL4, .value_a = 0x0003, .value_g = 0x0003, .flags = B2062_FLAG_A | B2062_FLAG_G, },
-        { .offset = B2062_N_TX_CTL5, .value_a = 0x0002, .value_g = 0x0002, .flags = B2062_FLAG_A | B2062_FLAG_G, },
+        { .offset = B2062_N_TX_CTL4, .value_a = 0x0003, .value_g = 0x0003, .flags = B206X_FLAG_A | B206X_FLAG_G, },
+        { .offset = B2062_N_TX_CTL5, .value_a = 0x0002, .value_g = 0x0002, .flags = B206X_FLAG_A | B206X_FLAG_G, },
         /* { .offset = B2062_N_TX_CTL6, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
         /* { .offset = B2062_N_TX_CTL7, .value_a = 0x0058, .value_g = 0x0058, .flags = 0, }, */
         /* { .offset = B2062_N_TX_CTL8, .value_a = 0x0082, .value_g = 0x0082, .flags = 0, }, */
@@ -121,7 +121,7 @@ static const struct b2062_init_tab_entry b2062_init_tab[] = {
         /* { .offset = B2062_N_TX_CTL_A, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
         /* { .offset = B2062_N_TX_GC2G, .value_a = 0x00FF, .value_g = 0x00FF, .flags = 0, }, */
         /* { .offset = B2062_N_TX_GC5G, .value_a = 0x00FF, .value_g = 0x00FF, .flags = 0, }, */
-        { .offset = B2062_N_TX_TUNE, .value_a = 0x0088, .value_g = 0x001B, .flags = B2062_FLAG_A | B2062_FLAG_G, },
+        { .offset = B2062_N_TX_TUNE, .value_a = 0x0088, .value_g = 0x001B, .flags = B206X_FLAG_A | B206X_FLAG_G, },
         /* { .offset = B2062_N_TX_PAD, .value_a = 0x0088, .value_g = 0x0088, .flags = 0, }, */
         /* { .offset = B2062_N_TX_PGA, .value_a = 0x0088, .value_g = 0x0088, .flags = 0, }, */
         /* { .offset = B2062_N_TX_PADAUX, .value_a = 0x0033, .value_g = 0x0033, .flags = 0, }, */
@@ -150,7 +150,7 @@ static const struct b2062_init_tab_entry b2062_init_tab[] = {
         /* { .offset = B2062_S_RADIO_ID_CODE, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
         /* { .offset = B2062_S_COMM2, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
         /* { .offset = B2062_S_COMM3, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
-        { .offset = B2062_S_COMM4, .value_a = 0x0001, .value_g = 0x0000, .flags = B2062_FLAG_A | B2062_FLAG_G, },
+        { .offset = B2062_S_COMM4, .value_a = 0x0001, .value_g = 0x0000, .flags = B206X_FLAG_A | B206X_FLAG_G, },
         /* { .offset = B2062_S_COMM5, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
         /* { .offset = B2062_S_COMM6, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
         /* { .offset = B2062_S_COMM7, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
@@ -162,24 +162,24 @@ static const struct b2062_init_tab_entry b2062_init_tab[] = {
         /* { .offset = B2062_S_COMM13, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
         /* { .offset = B2062_S_COMM14, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
         /* { .offset = B2062_S_COMM15, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
-        { .offset = B2062_S_PDS_CTL0, .value_a = 0x00FF, .value_g = 0x00FF, .flags = B2062_FLAG_A | B2062_FLAG_G, },
+        { .offset = B2062_S_PDS_CTL0, .value_a = 0x00FF, .value_g = 0x00FF, .flags = B206X_FLAG_A | B206X_FLAG_G, },
         /* { .offset = B2062_S_PDS_CTL1, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
         /* { .offset = B2062_S_PDS_CTL2, .value_a = 0x008E, .value_g = 0x008E, .flags = 0, }, */
         /* { .offset = B2062_S_PDS_CTL3, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
         /* { .offset = B2062_S_BG_CTL0, .value_a = 0x0006, .value_g = 0x0006, .flags = 0, }, */
         /* { .offset = B2062_S_BG_CTL1, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
         /* { .offset = B2062_S_BG_CTL2, .value_a = 0x0011, .value_g = 0x0011, .flags = 0, }, */
-        { .offset = B2062_S_LGENG_CTL0, .value_a = 0x00F8, .value_g = 0x00D8, .flags = B2062_FLAG_A | B2062_FLAG_G, },
-        { .offset = B2062_S_LGENG_CTL1, .value_a = 0x003C, .value_g = 0x0024, .flags = B2062_FLAG_A | B2062_FLAG_G, },
+        { .offset = B2062_S_LGENG_CTL0, .value_a = 0x00F8, .value_g = 0x00D8, .flags = B206X_FLAG_A | B206X_FLAG_G, },
+        { .offset = B2062_S_LGENG_CTL1, .value_a = 0x003C, .value_g = 0x0024, .flags = B206X_FLAG_A | B206X_FLAG_G, },
         /* { .offset = B2062_S_LGENG_CTL2, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
         /* { .offset = B2062_S_LGENG_CTL3, .value_a = 0x0041, .value_g = 0x0041, .flags = 0, }, */
         /* { .offset = B2062_S_LGENG_CTL4, .value_a = 0x0002, .value_g = 0x0002, .flags = 0, }, */
         /* { .offset = B2062_S_LGENG_CTL5, .value_a = 0x0033, .value_g = 0x0033, .flags = 0, }, */
         /* { .offset = B2062_S_LGENG_CTL6, .value_a = 0x0022, .value_g = 0x0022, .flags = 0, }, */
         /* { .offset = B2062_S_LGENG_CTL7, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
-        { .offset = B2062_S_LGENG_CTL8, .value_a = 0x0088, .value_g = 0x0080, .flags = B2062_FLAG_A | B2062_FLAG_G, },
+        { .offset = B2062_S_LGENG_CTL8, .value_a = 0x0088, .value_g = 0x0080, .flags = B206X_FLAG_A | B206X_FLAG_G, },
         /* { .offset = B2062_S_LGENG_CTL9, .value_a = 0x0088, .value_g = 0x0088, .flags = 0, }, */
-        { .offset = B2062_S_LGENG_CTL10, .value_a = 0x0088, .value_g = 0x0080, .flags = B2062_FLAG_A | B2062_FLAG_G, },
+        { .offset = B2062_S_LGENG_CTL10, .value_a = 0x0088, .value_g = 0x0080, .flags = B206X_FLAG_A | B206X_FLAG_G, },
         /* { .offset = B2062_S_LGENG_CTL11, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
         /* { .offset = B2062_S_REFPLL_CTL0, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
         /* { .offset = B2062_S_REFPLL_CTL1, .value_a = 0x0007, .value_g = 0x0007, .flags = 0, }, */
@@ -198,41 +198,41 @@ static const struct b2062_init_tab_entry b2062_init_tab[] = {
         /* { .offset = B2062_S_REFPLL_CTL14, .value_a = 0x0075, .value_g = 0x0075, .flags = 0, }, */
         /* { .offset = B2062_S_REFPLL_CTL15, .value_a = 0x00B4, .value_g = 0x00B4, .flags = 0, }, */
         /* { .offset = B2062_S_REFPLL_CTL16, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
-        { .offset = B2062_S_RFPLL_CTL0, .value_a = 0x0098, .value_g = 0x0098, .flags = B2062_FLAG_A | B2062_FLAG_G, },
-        { .offset = B2062_S_RFPLL_CTL1, .value_a = 0x0010, .value_g = 0x0010, .flags = B2062_FLAG_A | B2062_FLAG_G, },
+        { .offset = B2062_S_RFPLL_CTL0, .value_a = 0x0098, .value_g = 0x0098, .flags = B206X_FLAG_A | B206X_FLAG_G, },
+        { .offset = B2062_S_RFPLL_CTL1, .value_a = 0x0010, .value_g = 0x0010, .flags = B206X_FLAG_A | B206X_FLAG_G, },
         /* { .offset = B2062_S_RFPLL_CTL2, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
         /* { .offset = B2062_S_RFPLL_CTL3, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
         /* { .offset = B2062_S_RFPLL_CTL4, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
-        { .offset = B2062_S_RFPLL_CTL5, .value_a = 0x0043, .value_g = 0x0043, .flags = B2062_FLAG_A | B2062_FLAG_G, },
-        { .offset = B2062_S_RFPLL_CTL6, .value_a = 0x0047, .value_g = 0x0047, .flags = B2062_FLAG_A | B2062_FLAG_G, },
-        { .offset = B2062_S_RFPLL_CTL7, .value_a = 0x000C, .value_g = 0x000C, .flags = B2062_FLAG_A | B2062_FLAG_G, },
-        { .offset = B2062_S_RFPLL_CTL8, .value_a = 0x0011, .value_g = 0x0011, .flags = B2062_FLAG_A | B2062_FLAG_G, },
-        { .offset = B2062_S_RFPLL_CTL9, .value_a = 0x0011, .value_g = 0x0011, .flags = B2062_FLAG_A | B2062_FLAG_G, },
-        { .offset = B2062_S_RFPLL_CTL10, .value_a = 0x000E, .value_g = 0x000E, .flags = B2062_FLAG_A | B2062_FLAG_G, },
-        { .offset = B2062_S_RFPLL_CTL11, .value_a = 0x0008, .value_g = 0x0008, .flags = B2062_FLAG_A | B2062_FLAG_G, },
-        { .offset = B2062_S_RFPLL_CTL12, .value_a = 0x0033, .value_g = 0x0033, .flags = B2062_FLAG_A | B2062_FLAG_G, },
-        { .offset = B2062_S_RFPLL_CTL13, .value_a = 0x000A, .value_g = 0x000A, .flags = B2062_FLAG_A | B2062_FLAG_G, },
-        { .offset = B2062_S_RFPLL_CTL14, .value_a = 0x0006, .value_g = 0x0006, .flags = B2062_FLAG_A | B2062_FLAG_G, },
+        { .offset = B2062_S_RFPLL_CTL5, .value_a = 0x0043, .value_g = 0x0043, .flags = B206X_FLAG_A | B206X_FLAG_G, },
+        { .offset = B2062_S_RFPLL_CTL6, .value_a = 0x0047, .value_g = 0x0047, .flags = B206X_FLAG_A | B206X_FLAG_G, },
+        { .offset = B2062_S_RFPLL_CTL7, .value_a = 0x000C, .value_g = 0x000C, .flags = B206X_FLAG_A | B206X_FLAG_G, },
+        { .offset = B2062_S_RFPLL_CTL8, .value_a = 0x0011, .value_g = 0x0011, .flags = B206X_FLAG_A | B206X_FLAG_G, },
+        { .offset = B2062_S_RFPLL_CTL9, .value_a = 0x0011, .value_g = 0x0011, .flags = B206X_FLAG_A | B206X_FLAG_G, },
+        { .offset = B2062_S_RFPLL_CTL10, .value_a = 0x000E, .value_g = 0x000E, .flags = B206X_FLAG_A | B206X_FLAG_G, },
+        { .offset = B2062_S_RFPLL_CTL11, .value_a = 0x0008, .value_g = 0x0008, .flags = B206X_FLAG_A | B206X_FLAG_G, },
+        { .offset = B2062_S_RFPLL_CTL12, .value_a = 0x0033, .value_g = 0x0033, .flags = B206X_FLAG_A | B206X_FLAG_G, },
+        { .offset = B2062_S_RFPLL_CTL13, .value_a = 0x000A, .value_g = 0x000A, .flags = B206X_FLAG_A | B206X_FLAG_G, },
+        { .offset = B2062_S_RFPLL_CTL14, .value_a = 0x0006, .value_g = 0x0006, .flags = B206X_FLAG_A | B206X_FLAG_G, },
         /* { .offset = B2062_S_RFPLL_CTL15, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
         /* { .offset = B2062_S_RFPLL_CTL16, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
         /* { .offset = B2062_S_RFPLL_CTL17, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
-        { .offset = B2062_S_RFPLL_CTL18, .value_a = 0x003E, .value_g = 0x003E, .flags = B2062_FLAG_A | B2062_FLAG_G, },
-        { .offset = B2062_S_RFPLL_CTL19, .value_a = 0x0013, .value_g = 0x0013, .flags = B2062_FLAG_A | B2062_FLAG_G, },
+        { .offset = B2062_S_RFPLL_CTL18, .value_a = 0x003E, .value_g = 0x003E, .flags = B206X_FLAG_A | B206X_FLAG_G, },
+        { .offset = B2062_S_RFPLL_CTL19, .value_a = 0x0013, .value_g = 0x0013, .flags = B206X_FLAG_A | B206X_FLAG_G, },
         /* { .offset = B2062_S_RFPLL_CTL20, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
-        { .offset = B2062_S_RFPLL_CTL21, .value_a = 0x0062, .value_g = 0x0062, .flags = B2062_FLAG_A | B2062_FLAG_G, },
-        { .offset = B2062_S_RFPLL_CTL22, .value_a = 0x0007, .value_g = 0x0007, .flags = B2062_FLAG_A | B2062_FLAG_G, },
-        { .offset = B2062_S_RFPLL_CTL23, .value_a = 0x0016, .value_g = 0x0016, .flags = B2062_FLAG_A | B2062_FLAG_G, },
-        { .offset = B2062_S_RFPLL_CTL24, .value_a = 0x005C, .value_g = 0x005C, .flags = B2062_FLAG_A | B2062_FLAG_G, },
-        { .offset = B2062_S_RFPLL_CTL25, .value_a = 0x0095, .value_g = 0x0095, .flags = B2062_FLAG_A | B2062_FLAG_G, },
+        { .offset = B2062_S_RFPLL_CTL21, .value_a = 0x0062, .value_g = 0x0062, .flags = B206X_FLAG_A | B206X_FLAG_G, },
+        { .offset = B2062_S_RFPLL_CTL22, .value_a = 0x0007, .value_g = 0x0007, .flags = B206X_FLAG_A | B206X_FLAG_G, },
+        { .offset = B2062_S_RFPLL_CTL23, .value_a = 0x0016, .value_g = 0x0016, .flags = B206X_FLAG_A | B206X_FLAG_G, },
+        { .offset = B2062_S_RFPLL_CTL24, .value_a = 0x005C, .value_g = 0x005C, .flags = B206X_FLAG_A | B206X_FLAG_G, },
+        { .offset = B2062_S_RFPLL_CTL25, .value_a = 0x0095, .value_g = 0x0095, .flags = B206X_FLAG_A | B206X_FLAG_G, },
         /* { .offset = B2062_S_RFPLL_CTL26, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
         /* { .offset = B2062_S_RFPLL_CTL27, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
         /* { .offset = B2062_S_RFPLL_CTL28, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
         /* { .offset = B2062_S_RFPLL_CTL29, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
-        { .offset = B2062_S_RFPLL_CTL30, .value_a = 0x00A0, .value_g = 0x00A0, .flags = B2062_FLAG_A | B2062_FLAG_G, },
-        { .offset = B2062_S_RFPLL_CTL31, .value_a = 0x0004, .value_g = 0x0004, .flags = B2062_FLAG_A | B2062_FLAG_G, },
+        { .offset = B2062_S_RFPLL_CTL30, .value_a = 0x00A0, .value_g = 0x00A0, .flags = B206X_FLAG_A | B206X_FLAG_G, },
+        { .offset = B2062_S_RFPLL_CTL31, .value_a = 0x0004, .value_g = 0x0004, .flags = B206X_FLAG_A | B206X_FLAG_G, },
         /* { .offset = B2062_S_RFPLL_CTL32, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
-        { .offset = B2062_S_RFPLL_CTL33, .value_a = 0x00CC, .value_g = 0x00CC, .flags = B2062_FLAG_A | B2062_FLAG_G, },
-        { .offset = B2062_S_RFPLL_CTL34, .value_a = 0x0007, .value_g = 0x0007, .flags = B2062_FLAG_A | B2062_FLAG_G, },
+        { .offset = B2062_S_RFPLL_CTL33, .value_a = 0x00CC, .value_g = 0x00CC, .flags = B206X_FLAG_A | B206X_FLAG_G, },
+        { .offset = B2062_S_RFPLL_CTL34, .value_a = 0x0007, .value_g = 0x0007, .flags = B206X_FLAG_A | B206X_FLAG_G, },
         /* { .offset = B2062_S_RXG_CNT0, .value_a = 0x0010, .value_g = 0x0010, .flags = 0, }, */
         /* { .offset = B2062_S_RXG_CNT1, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
         /* { .offset = B2062_S_RXG_CNT2, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
@@ -241,7 +241,7 @@ static const struct b2062_init_tab_entry b2062_init_tab[] = {
         /* { .offset = B2062_S_RXG_CNT5, .value_a = 0x0055, .value_g = 0x0055, .flags = 0, }, */
         /* { .offset = B2062_S_RXG_CNT6, .value_a = 0x0055, .value_g = 0x0055, .flags = 0, }, */
         /* { .offset = B2062_S_RXG_CNT7, .value_a = 0x0005, .value_g = 0x0005, .flags = 0, }, */
-        { .offset = B2062_S_RXG_CNT8, .value_a = 0x000F, .value_g = 0x000F, .flags = B2062_FLAG_A, },
+        { .offset = B2062_S_RXG_CNT8, .value_a = 0x000F, .value_g = 0x000F, .flags = B206X_FLAG_A, },
         /* { .offset = B2062_S_RXG_CNT9, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
         /* { .offset = B2062_S_RXG_CNT10, .value_a = 0x0055, .value_g = 0x0055, .flags = 0, }, */
         /* { .offset = B2062_S_RXG_CNT11, .value_a = 0x0066, .value_g = 0x0066, .flags = 0, }, */
@@ -253,19 +253,337 @@ static const struct b2062_init_tab_entry b2062_init_tab[] = {
         /* { .offset = B2062_S_RXG_CNT17, .value_a = 0x0055, .value_g = 0x0055, .flags = 0, }, */
 };
 
+static const struct b206x_init_tab_entry b2063_init_tab[] = {
+        { .offset = B2063_COMM1, .value_a = 0x0000, .value_g = 0x0000, .flags = B206X_FLAG_G, },
+        /* { .offset = B2063_COMM2, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_COMM3, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_COMM4, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_COMM5, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_COMM6, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_COMM7, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_COMM8, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_COMM9, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        { .offset = B2063_COMM10, .value_a = 0x0001, .value_g = 0x0000, .flags = B206X_FLAG_A, },
+        /* { .offset = B2063_COMM11, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_COMM12, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_COMM13, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_COMM14, .value_a = 0x0006, .value_g = 0x0006, .flags = 0, }, */
+        /* { .offset = B2063_COMM15, .value_a = 0x000f, .value_g = 0x000f, .flags = 0, }, */
+        { .offset = B2063_COMM16, .value_a = 0x0000, .value_g = 0x0000, .flags = B206X_FLAG_G, },
+        { .offset = B2063_COMM17, .value_a = 0x0000, .value_g = 0x0000, .flags = B206X_FLAG_G, },
+        { .offset = B2063_COMM18, .value_a = 0x0000, .value_g = 0x0000, .flags = B206X_FLAG_G, },
+        { .offset = B2063_COMM19, .value_a = 0x0000, .value_g = 0x0000, .flags = B206X_FLAG_G, },
+        { .offset = B2063_COMM20, .value_a = 0x0000, .value_g = 0x0000, .flags = B206X_FLAG_G, },
+        { .offset = B2063_COMM21, .value_a = 0x0000, .value_g = 0x0000, .flags = B206X_FLAG_G, },
+        { .offset = B2063_COMM22, .value_a = 0x0000, .value_g = 0x0000, .flags = B206X_FLAG_G, },
+        { .offset = B2063_COMM23, .value_a = 0x0000, .value_g = 0x0000, .flags = B206X_FLAG_G, },
+        { .offset = B2063_COMM24, .value_a = 0x0000, .value_g = 0x0000, .flags = B206X_FLAG_G, },
+        /* { .offset = B2063_PWR_SWITCH_CTL, .value_a = 0x007f, .value_g = 0x007f, .flags = 0, }, */
+        /* { .offset = B2063_PLL_SP1, .value_a = 0x003f, .value_g = 0x003f, .flags = 0, }, */
+        /* { .offset = B2063_PLL_SP2, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        { .offset = B2063_LOGEN_SP1, .value_a = 0x00e8, .value_g = 0x00d4, .flags = B206X_FLAG_A | B206X_FLAG_G, },
+        { .offset = B2063_LOGEN_SP2, .value_a = 0x00a7, .value_g = 0x0053, .flags = B206X_FLAG_A | B206X_FLAG_G, },
+        /* { .offset = B2063_LOGEN_SP3, .value_a = 0x00ff, .value_g = 0x00ff, .flags = 0, }, */
+        { .offset = B2063_LOGEN_SP4, .value_a = 0x00f0, .value_g = 0x000f, .flags = B206X_FLAG_A | B206X_FLAG_G, },
+        /* { .offset = B2063_LOGEN_SP5, .value_a = 0x0001, .value_g = 0x0001, .flags = 0, }, */
+        { .offset = B2063_G_RX_SP1, .value_a = 0x001f, .value_g = 0x005e, .flags = B206X_FLAG_G, },
+        { .offset = B2063_G_RX_SP2, .value_a = 0x007f, .value_g = 0x007e, .flags = B206X_FLAG_G, },
+        { .offset = B2063_G_RX_SP3, .value_a = 0x0030, .value_g = 0x00f0, .flags = B206X_FLAG_G, },
+        /* { .offset = B2063_G_RX_SP4, .value_a = 0x0035, .value_g = 0x0035, .flags = 0, }, */
+        /* { .offset = B2063_G_RX_SP5, .value_a = 0x003f, .value_g = 0x003f, .flags = 0, }, */
+        /* { .offset = B2063_G_RX_SP6, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        { .offset = B2063_G_RX_SP7, .value_a = 0x007f, .value_g = 0x007f, .flags = B206X_FLAG_A | B206X_FLAG_G, },
+        /* { .offset = B2063_G_RX_SP8, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_G_RX_SP9, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        { .offset = B2063_G_RX_SP10, .value_a = 0x000c, .value_g = 0x000c, .flags = B206X_FLAG_A | B206X_FLAG_G, },
+        /* { .offset = B2063_G_RX_SP11, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        { .offset = B2063_A_RX_SP1, .value_a = 0x003c, .value_g = 0x003f, .flags = B206X_FLAG_A, },
+        { .offset = B2063_A_RX_SP2, .value_a = 0x00fc, .value_g = 0x00fe, .flags = B206X_FLAG_A, },
+        /* { .offset = B2063_A_RX_SP3, .value_a = 0x00ff, .value_g = 0x00ff, .flags = 0, }, */
+        /* { .offset = B2063_A_RX_SP4, .value_a = 0x00ff, .value_g = 0x00ff, .flags = 0, }, */
+        /* { .offset = B2063_A_RX_SP5, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_A_RX_SP6, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        { .offset = B2063_A_RX_SP7, .value_a = 0x0008, .value_g = 0x0008, .flags = B206X_FLAG_A | B206X_FLAG_G, },
+        /* { .offset = B2063_RX_BB_SP1, .value_a = 0x000f, .value_g = 0x000f, .flags = 0, }, */
+        /* { .offset = B2063_RX_BB_SP2, .value_a = 0x0022, .value_g = 0x0022, .flags = 0, }, */
+        /* { .offset = B2063_RX_BB_SP3, .value_a = 0x00a8, .value_g = 0x00a8, .flags = 0, }, */
+        { .offset = B2063_RX_BB_SP4, .value_a = 0x0060, .value_g = 0x0060, .flags = B206X_FLAG_A | B206X_FLAG_G, },
+        /* { .offset = B2063_RX_BB_SP5, .value_a = 0x0011, .value_g = 0x0011, .flags = 0, }, */
+        /* { .offset = B2063_RX_BB_SP6, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_RX_BB_SP7, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        { .offset = B2063_RX_BB_SP8, .value_a = 0x0030, .value_g = 0x0030, .flags = B206X_FLAG_A | B206X_FLAG_G, },
+        /* { .offset = B2063_TX_RF_SP1, .value_a = 0x0001, .value_g = 0x0001, .flags = 0, }, */
+        /* { .offset = B2063_TX_RF_SP2, .value_a = 0x0003, .value_g = 0x0003, .flags = 0, }, */
+        { .offset = B2063_TX_RF_SP3, .value_a = 0x000c, .value_g = 0x000b, .flags = B206X_FLAG_A | B206X_FLAG_G, },
+        { .offset = B2063_TX_RF_SP4, .value_a = 0x0010, .value_g = 0x000f, .flags = B206X_FLAG_A | B206X_FLAG_G, },
+        /* { .offset = B2063_TX_RF_SP5, .value_a = 0x000f, .value_g = 0x000f, .flags = 0, }, */
+        /* { .offset = B2063_TX_RF_SP6, .value_a = 0x0080, .value_g = 0x0080, .flags = 0, }, */
+        /* { .offset = B2063_TX_RF_SP7, .value_a = 0x0068, .value_g = 0x0068, .flags = 0, }, */
+        /* { .offset = B2063_TX_RF_SP8, .value_a = 0x0068, .value_g = 0x0068, .flags = 0, }, */
+        /* { .offset = B2063_TX_RF_SP9, .value_a = 0x0080, .value_g = 0x0080, .flags = 0, }, */
+        /* { .offset = B2063_TX_RF_SP10, .value_a = 0x00ff, .value_g = 0x00ff, .flags = 0, }, */
+        /* { .offset = B2063_TX_RF_SP11, .value_a = 0x0003, .value_g = 0x0003, .flags = 0, }, */
+        /* { .offset = B2063_TX_RF_SP12, .value_a = 0x0038, .value_g = 0x0038, .flags = 0, }, */
+        /* { .offset = B2063_TX_RF_SP13, .value_a = 0x00ff, .value_g = 0x00ff, .flags = 0, }, */
+        /* { .offset = B2063_TX_RF_SP14, .value_a = 0x0038, .value_g = 0x0038, .flags = 0, }, */
+        /* { .offset = B2063_TX_RF_SP15, .value_a = 0x00c0, .value_g = 0x00c0, .flags = 0, }, */
+        /* { .offset = B2063_TX_RF_SP16, .value_a = 0x00ff, .value_g = 0x00ff, .flags = 0, }, */
+        /* { .offset = B2063_TX_RF_SP17, .value_a = 0x00ff, .value_g = 0x00ff, .flags = 0, }, */
+        { .offset = B2063_PA_SP1, .value_a = 0x003d, .value_g = 0x00fd, .flags = B206X_FLAG_A | B206X_FLAG_G, },
+        /* { .offset = B2063_PA_SP2, .value_a = 0x000c, .value_g = 0x000c, .flags = 0, }, */
+        /* { .offset = B2063_PA_SP3, .value_a = 0x0096, .value_g = 0x0096, .flags = 0, }, */
+        /* { .offset = B2063_PA_SP4, .value_a = 0x005a, .value_g = 0x005a, .flags = 0, }, */
+        /* { .offset = B2063_PA_SP5, .value_a = 0x007f, .value_g = 0x007f, .flags = 0, }, */
+        /* { .offset = B2063_PA_SP6, .value_a = 0x007f, .value_g = 0x007f, .flags = 0, }, */
+        /* { .offset = B2063_PA_SP7, .value_a = 0x0033, .value_g = 0x0033, .flags = 0, }, */
+        { .offset = B2063_TX_BB_SP1, .value_a = 0x0002, .value_g = 0x0002, .flags = B206X_FLAG_A | B206X_FLAG_G, },
+        /* { .offset = B2063_TX_BB_SP2, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_TX_BB_SP3, .value_a = 0x0030, .value_g = 0x0030, .flags = 0, }, */
+        /* { .offset = B2063_REG_SP1, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        { .offset = B2063_BANDGAP_CTL1, .value_a = 0x0056, .value_g = 0x0056, .flags = B206X_FLAG_A | B206X_FLAG_G, },
+        /* { .offset = B2063_BANDGAP_CTL2, .value_a = 0x0006, .value_g = 0x0006, .flags = 0, }, */
+        /* { .offset = B2063_LPO_CTL1, .value_a = 0x000e, .value_g = 0x000e, .flags = 0, }, */
+        /* { .offset = B2063_RC_CALIB_CTL1, .value_a = 0x007e, .value_g = 0x007e, .flags = 0, }, */
+        /* { .offset = B2063_RC_CALIB_CTL2, .value_a = 0x0015, .value_g = 0x0015, .flags = 0, }, */
+        /* { .offset = B2063_RC_CALIB_CTL3, .value_a = 0x000f, .value_g = 0x000f, .flags = 0, }, */
+        /* { .offset = B2063_RC_CALIB_CTL4, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_RC_CALIB_CTL5, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_RC_CALIB_CTL6, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_RC_CALIB_CTL7, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_RC_CALIB_CTL8, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_RC_CALIB_CTL9, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_RC_CALIB_CTL10, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_PLL_JTAG_CALNRST, .value_a = 0x0004, .value_g = 0x0004, .flags = 0, }, */
+        /* { .offset = B2063_PLL_JTAG_IN_PLL1, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_PLL_JTAG_IN_PLL2, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_PLL_JTAG_PLL_CP1, .value_a = 0x00cf, .value_g = 0x00cf, .flags = 0, }, */
+        /* { .offset = B2063_PLL_JTAG_PLL_CP2, .value_a = 0x0059, .value_g = 0x0059, .flags = 0, }, */
+        /* { .offset = B2063_PLL_JTAG_PLL_CP3, .value_a = 0x0007, .value_g = 0x0007, .flags = 0, }, */
+        /* { .offset = B2063_PLL_JTAG_PLL_CP4, .value_a = 0x0042, .value_g = 0x0042, .flags = 0, }, */
+        /* { .offset = B2063_PLL_JTAG_PLL_CTL1, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_PLL_JTAG_PLL_LF1, .value_a = 0x00db, .value_g = 0x00db, .flags = 0, }, */
+        /* { .offset = B2063_PLL_JTAG_PLL_LF2, .value_a = 0x0094, .value_g = 0x0094, .flags = 0, }, */
+        /* { .offset = B2063_PLL_JTAG_PLL_LF3, .value_a = 0x0028, .value_g = 0x0028, .flags = 0, }, */
+        /* { .offset = B2063_PLL_JTAG_PLL_LF4, .value_a = 0x0063, .value_g = 0x0063, .flags = 0, }, */
+        /* { .offset = B2063_PLL_JTAG_PLL_SG1, .value_a = 0x0007, .value_g = 0x0007, .flags = 0, }, */
+        /* { .offset = B2063_PLL_JTAG_PLL_SG2, .value_a = 0x00d3, .value_g = 0x00d3, .flags = 0, }, */
+        /* { .offset = B2063_PLL_JTAG_PLL_SG3, .value_a = 0x00b1, .value_g = 0x00b1, .flags = 0, }, */
+        /* { .offset = B2063_PLL_JTAG_PLL_SG4, .value_a = 0x003b, .value_g = 0x003b, .flags = 0, }, */
+        /* { .offset = B2063_PLL_JTAG_PLL_SG5, .value_a = 0x0006, .value_g = 0x0006, .flags = 0, }, */
+        /* { .offset = B2063_PLL_JTAG_PLL_VCO1, .value_a = 0x0058, .value_g = 0x0058, .flags = 0, }, */
+        { .offset = B2063_PLL_JTAG_PLL_VCO2, .value_a = 0x00f7, .value_g = 0x00f7, .flags = B206X_FLAG_A | B206X_FLAG_G, },
+        /* { .offset = B2063_PLL_JTAG_PLL_VCO_CALIB1, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_PLL_JTAG_PLL_VCO_CALIB2, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_PLL_JTAG_PLL_VCO_CALIB3, .value_a = 0x0002, .value_g = 0x0002, .flags = 0, }, */
+        /* { .offset = B2063_PLL_JTAG_PLL_VCO_CALIB4, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_PLL_JTAG_PLL_VCO_CALIB5, .value_a = 0x0009, .value_g = 0x0009, .flags = 0, }, */
+        /* { .offset = B2063_PLL_JTAG_PLL_VCO_CALIB6, .value_a = 0x0005, .value_g = 0x0005, .flags = 0, }, */
+        /* { .offset = B2063_PLL_JTAG_PLL_VCO_CALIB7, .value_a = 0x0016, .value_g = 0x0016, .flags = 0, }, */
+        /* { .offset = B2063_PLL_JTAG_PLL_VCO_CALIB8, .value_a = 0x006b, .value_g = 0x006b, .flags = 0, }, */
+        /* { .offset = B2063_PLL_JTAG_PLL_VCO_CALIB9, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_PLL_JTAG_PLL_VCO_CALIB10, .value_a = 0x00b3, .value_g = 0x00b3, .flags = 0, }, */
+        /* { .offset = B2063_PLL_JTAG_PLL_XTAL_12, .value_a = 0x0004, .value_g = 0x0004, .flags = 0, }, */
+        /* { .offset = B2063_PLL_JTAG_PLL_XTAL3, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_LOGEN_ACL1, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_LOGEN_ACL2, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_LOGEN_ACL3, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_LOGEN_ACL4, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_LOGEN_ACL5, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_LO_CALIB_INPUTS, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_LO_CALIB_CTL1, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_LO_CALIB_CTL2, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_LO_CALIB_CTL3, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_LO_CALIB_WAITCNT, .value_a = 0x0002, .value_g = 0x0002, .flags = 0, }, */
+        /* { .offset = B2063_LO_CALIB_OVR1, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_LO_CALIB_OVR2, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_LO_CALIB_OVAL1, .value_a = 0x0066, .value_g = 0x0066, .flags = 0, }, */
+        /* { .offset = B2063_LO_CALIB_OVAL2, .value_a = 0x0066, .value_g = 0x0066, .flags = 0, }, */
+        /* { .offset = B2063_LO_CALIB_OVAL3, .value_a = 0x0066, .value_g = 0x0066, .flags = 0, }, */
+        /* { .offset = B2063_LO_CALIB_OVAL4, .value_a = 0x0066, .value_g = 0x0066, .flags = 0, }, */
+        /* { .offset = B2063_LO_CALIB_OVAL5, .value_a = 0x0066, .value_g = 0x0066, .flags = 0, }, */
+        /* { .offset = B2063_LO_CALIB_OVAL6, .value_a = 0x0066, .value_g = 0x0066, .flags = 0, }, */
+        /* { .offset = B2063_LO_CALIB_OVAL7, .value_a = 0x0066, .value_g = 0x0066, .flags = 0, }, */
+        /* { .offset = B2063_LO_CALIB_CALVLD1, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_LO_CALIB_CALVLD2, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_LO_CALIB_CVAL1, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_LO_CALIB_CVAL2, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_LO_CALIB_CVAL3, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_LO_CALIB_CVAL4, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_LO_CALIB_CVAL5, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_LO_CALIB_CVAL6, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_LO_CALIB_CVAL7, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_LOGEN_CALIB_EN, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_LOGEN_PEAKDET1, .value_a = 0x00ff, .value_g = 0x00ff, .flags = 0, }, */
+        /* { .offset = B2063_LOGEN_RCCR1, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_LOGEN_VCOBUF1, .value_a = 0x0060, .value_g = 0x0060, .flags = 0, }, */
+        /* { .offset = B2063_LOGEN_MIXER1, .value_a = 0x0066, .value_g = 0x0066, .flags = 0, }, */
+        /* { .offset = B2063_LOGEN_MIXER2, .value_a = 0x000c, .value_g = 0x000c, .flags = 0, }, */
+        /* { .offset = B2063_LOGEN_BUF1, .value_a = 0x0066, .value_g = 0x0066, .flags = 0, }, */
+        /* { .offset = B2063_LOGEN_BUF2, .value_a = 0x000c, .value_g = 0x000c, .flags = 0, }, */
+        /* { .offset = B2063_LOGEN_DIV1, .value_a = 0x0001, .value_g = 0x0001, .flags = 0, }, */
+        /* { .offset = B2063_LOGEN_DIV2, .value_a = 0x0066, .value_g = 0x0066, .flags = 0, }, */
+        /* { .offset = B2063_LOGEN_DIV3, .value_a = 0x0066, .value_g = 0x0066, .flags = 0, }, */
+        /* { .offset = B2063_LOGEN_CBUFRX1, .value_a = 0x0066, .value_g = 0x0066, .flags = 0, }, */
+        /* { .offset = B2063_LOGEN_CBUFRX2, .value_a = 0x0066, .value_g = 0x0066, .flags = 0, }, */
+        /* { .offset = B2063_LOGEN_CBUFTX1, .value_a = 0x0066, .value_g = 0x0066, .flags = 0, }, */
+        /* { .offset = B2063_LOGEN_CBUFTX2, .value_a = 0x0066, .value_g = 0x0066, .flags = 0, }, */
+        /* { .offset = B2063_LOGEN_IDAC1, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_LOGEN_SPARE1, .value_a = 0x0001, .value_g = 0x0001, .flags = 0, }, */
+        /* { .offset = B2063_LOGEN_SPARE2, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_LOGEN_SPARE3, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_G_RX_1ST1, .value_a = 0x0033, .value_g = 0x0033, .flags = 0, }, */
+        /* { .offset = B2063_G_RX_1ST2, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_G_RX_1ST3, .value_a = 0x0005, .value_g = 0x0005, .flags = 0, }, */
+        /* { .offset = B2063_G_RX_2ND1, .value_a = 0x0030, .value_g = 0x0030, .flags = 0, }, */
+        /* { .offset = B2063_G_RX_2ND2, .value_a = 0x0055, .value_g = 0x0055, .flags = 0, }, */
+        /* { .offset = B2063_G_RX_2ND3, .value_a = 0x0033, .value_g = 0x0033, .flags = 0, }, */
+        /* { .offset = B2063_G_RX_2ND4, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_G_RX_2ND5, .value_a = 0x0033, .value_g = 0x0033, .flags = 0, }, */
+        /* { .offset = B2063_G_RX_2ND6, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_G_RX_2ND7, .value_a = 0x0035, .value_g = 0x0035, .flags = 0, }, */
+        /* { .offset = B2063_G_RX_2ND8, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_G_RX_PS1, .value_a = 0x0033, .value_g = 0x0033, .flags = 0, }, */
+        /* { .offset = B2063_G_RX_PS2, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_G_RX_PS3, .value_a = 0x0033, .value_g = 0x0033, .flags = 0, }, */
+        /* { .offset = B2063_G_RX_PS4, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_G_RX_PS5, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_G_RX_MIX1, .value_a = 0x0044, .value_g = 0x0044, .flags = 0, }, */
+        /* { .offset = B2063_G_RX_MIX2, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        { .offset = B2063_G_RX_MIX3, .value_a = 0x0071, .value_g = 0x0071, .flags = B206X_FLAG_A | B206X_FLAG_G, },
+        { .offset = B2063_G_RX_MIX4, .value_a = 0x0071, .value_g = 0x0071, .flags = B206X_FLAG_A | B206X_FLAG_G, },
+        /* { .offset = B2063_G_RX_MIX5, .value_a = 0x0003, .value_g = 0x0003, .flags = 0, }, */
+        /* { .offset = B2063_G_RX_MIX6, .value_a = 0x0088, .value_g = 0x0088, .flags = 0, }, */
+        /* { .offset = B2063_G_RX_MIX7, .value_a = 0x0044, .value_g = 0x0044, .flags = 0, }, */
+        /* { .offset = B2063_G_RX_MIX8, .value_a = 0x0001, .value_g = 0x0001, .flags = 0, }, */
+        /* { .offset = B2063_G_RX_PDET1, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_G_RX_SPARES1, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_G_RX_SPARES2, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_G_RX_SPARES3, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_A_RX_1ST1, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        { .offset = B2063_A_RX_1ST2, .value_a = 0x00f0, .value_g = 0x0030, .flags = B206X_FLAG_A, },
+        /* { .offset = B2063_A_RX_1ST3, .value_a = 0x0005, .value_g = 0x0005, .flags = 0, }, */
+        /* { .offset = B2063_A_RX_1ST4, .value_a = 0x0033, .value_g = 0x0033, .flags = 0, }, */
+        /* { .offset = B2063_A_RX_1ST5, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_A_RX_2ND1, .value_a = 0x0005, .value_g = 0x0005, .flags = 0, }, */
+        /* { .offset = B2063_A_RX_2ND2, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_A_RX_2ND3, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_A_RX_2ND4, .value_a = 0x0005, .value_g = 0x0005, .flags = 0, }, */
+        /* { .offset = B2063_A_RX_2ND5, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_A_RX_2ND6, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_A_RX_2ND7, .value_a = 0x0005, .value_g = 0x0005, .flags = 0, }, */
+        /* { .offset = B2063_A_RX_PS1, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_A_RX_PS2, .value_a = 0x0033, .value_g = 0x0033, .flags = 0, }, */
+        /* { .offset = B2063_A_RX_PS3, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_A_RX_PS4, .value_a = 0x0033, .value_g = 0x0033, .flags = 0, }, */
+        /* { .offset = B2063_A_RX_PS5, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        { .offset = B2063_A_RX_PS6, .value_a = 0x0077, .value_g = 0x0077, .flags = B206X_FLAG_A | B206X_FLAG_G, },
+        /* { .offset = B2063_A_RX_MIX1, .value_a = 0x0088, .value_g = 0x0088, .flags = 0, }, */
+        /* { .offset = B2063_A_RX_MIX2, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_A_RX_MIX3, .value_a = 0x0044, .value_g = 0x0044, .flags = 0, }, */
+        { .offset = B2063_A_RX_MIX4, .value_a = 0x0003, .value_g = 0x0003, .flags = B206X_FLAG_A | B206X_FLAG_G, },
+        { .offset = B2063_A_RX_MIX5, .value_a = 0x000f, .value_g = 0x000f, .flags = B206X_FLAG_A | B206X_FLAG_G, },
+        { .offset = B2063_A_RX_MIX6, .value_a = 0x000f, .value_g = 0x000f, .flags = B206X_FLAG_A | B206X_FLAG_G, },
+        /* { .offset = B2063_A_RX_MIX7, .value_a = 0x0044, .value_g = 0x0044, .flags = 0, }, */
+        /* { .offset = B2063_A_RX_MIX8, .value_a = 0x0001, .value_g = 0x0001, .flags = 0, }, */
+        /* { .offset = B2063_A_RX_PWRDET1, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_A_RX_SPARE1, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_A_RX_SPARE2, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_A_RX_SPARE3, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        { .offset = B2063_RX_TIA_CTL1, .value_a = 0x0077, .value_g = 0x0077, .flags = B206X_FLAG_A | B206X_FLAG_G, },
+        /* { .offset = B2063_RX_TIA_CTL2, .value_a = 0x0058, .value_g = 0x0058, .flags = 0, }, */
+        { .offset = B2063_RX_TIA_CTL3, .value_a = 0x0077, .value_g = 0x0077, .flags = B206X_FLAG_A | B206X_FLAG_G, },
+        /* { .offset = B2063_RX_TIA_CTL4, .value_a = 0x0058, .value_g = 0x0058, .flags = 0, }, */
+        /* { .offset = B2063_RX_TIA_CTL5, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_RX_TIA_CTL6, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_RX_BB_CTL1, .value_a = 0x0074, .value_g = 0x0074, .flags = 0, }, */
+        { .offset = B2063_RX_BB_CTL2, .value_a = 0x0004, .value_g = 0x0004, .flags = B206X_FLAG_A | B206X_FLAG_G, },
+        /* { .offset = B2063_RX_BB_CTL3, .value_a = 0x00a2, .value_g = 0x00a2, .flags = 0, }, */
+        /* { .offset = B2063_RX_BB_CTL4, .value_a = 0x00aa, .value_g = 0x00aa, .flags = 0, }, */
+        /* { .offset = B2063_RX_BB_CTL5, .value_a = 0x0024, .value_g = 0x0024, .flags = 0, }, */
+        /* { .offset = B2063_RX_BB_CTL6, .value_a = 0x00a9, .value_g = 0x00a9, .flags = 0, }, */
+        /* { .offset = B2063_RX_BB_CTL7, .value_a = 0x0028, .value_g = 0x0028, .flags = 0, }, */
+        /* { .offset = B2063_RX_BB_CTL8, .value_a = 0x0010, .value_g = 0x0010, .flags = 0, }, */
+        /* { .offset = B2063_RX_BB_CTL9, .value_a = 0x0055, .value_g = 0x0055, .flags = 0, }, */
+        /* { .offset = B2063_TX_RF_CTL1, .value_a = 0x0080, .value_g = 0x0080, .flags = 0, }, */
+        /* { .offset = B2063_TX_RF_IDAC_LO_RF_I, .value_a = 0x0088, .value_g = 0x0088, .flags = 0, }, */
+        /* { .offset = B2063_TX_RF_IDAC_LO_RF_Q, .value_a = 0x0088, .value_g = 0x0088, .flags = 0, }, */
+        /* { .offset = B2063_TX_RF_IDAC_LO_BB_I, .value_a = 0x0088, .value_g = 0x0088, .flags = 0, }, */
+        /* { .offset = B2063_TX_RF_IDAC_LO_BB_Q, .value_a = 0x0088, .value_g = 0x0088, .flags = 0, }, */
+        /* { .offset = B2063_TX_RF_CTL2, .value_a = 0x0080, .value_g = 0x0080, .flags = 0, }, */
+        /* { .offset = B2063_TX_RF_CTL3, .value_a = 0x0038, .value_g = 0x0038, .flags = 0, }, */
+        /* { .offset = B2063_TX_RF_CTL4, .value_a = 0x00b8, .value_g = 0x00b8, .flags = 0, }, */
+        /* { .offset = B2063_TX_RF_CTL5, .value_a = 0x0080, .value_g = 0x0080, .flags = 0, }, */
+        /* { .offset = B2063_TX_RF_CTL6, .value_a = 0x0038, .value_g = 0x0038, .flags = 0, }, */
+        /* { .offset = B2063_TX_RF_CTL7, .value_a = 0x0078, .value_g = 0x0078, .flags = 0, }, */
+        /* { .offset = B2063_TX_RF_CTL8, .value_a = 0x00c0, .value_g = 0x00c0, .flags = 0, }, */
+        /* { .offset = B2063_TX_RF_CTL9, .value_a = 0x0003, .value_g = 0x0003, .flags = 0, }, */
+        /* { .offset = B2063_TX_RF_CTL10, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_TX_RF_CTL14, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_TX_RF_CTL15, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        { .offset = B2063_PA_CTL1, .value_a = 0x0000, .value_g = 0x0004, .flags = B206X_FLAG_A, },
+        /* { .offset = B2063_PA_CTL2, .value_a = 0x000c, .value_g = 0x000c, .flags = 0, }, */
+        /* { .offset = B2063_PA_CTL3, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_PA_CTL4, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_PA_CTL5, .value_a = 0x0096, .value_g = 0x0096, .flags = 0, }, */
+        /* { .offset = B2063_PA_CTL6, .value_a = 0x0077, .value_g = 0x0077, .flags = 0, }, */
+        /* { .offset = B2063_PA_CTL7, .value_a = 0x005a, .value_g = 0x005a, .flags = 0, }, */
+        /* { .offset = B2063_PA_CTL8, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_PA_CTL9, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_PA_CTL10, .value_a = 0x0021, .value_g = 0x0021, .flags = 0, }, */
+        /* { .offset = B2063_PA_CTL11, .value_a = 0x0070, .value_g = 0x0070, .flags = 0, }, */
+        /* { .offset = B2063_PA_CTL12, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_PA_CTL13, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_TX_BB_CTL1, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_TX_BB_CTL2, .value_a = 0x00b3, .value_g = 0x00b3, .flags = 0, }, */
+        /* { .offset = B2063_TX_BB_CTL3, .value_a = 0x0055, .value_g = 0x0055, .flags = 0, }, */
+        /* { .offset = B2063_TX_BB_CTL4, .value_a = 0x000b, .value_g = 0x000b, .flags = 0, }, */
+        /* { .offset = B2063_GPIO_CTL1, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        { .offset = B2063_VREG_CTL1, .value_a = 0x0003, .value_g = 0x0003, .flags = B206X_FLAG_A | B206X_FLAG_G, },
+        /* { .offset = B2063_AMUX_CTL1, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_IQ_CALIB_GVAR, .value_a = 0x00b3, .value_g = 0x00b3, .flags = 0, }, */
+        /* { .offset = B2063_IQ_CALIB_CTL1, .value_a = 0x0055, .value_g = 0x0055, .flags = 0, }, */
+        /* { .offset = B2063_IQ_CALIB_CTL2, .value_a = 0x0030, .value_g = 0x0030, .flags = 0, }, */
+        /* { .offset = B2063_TEMPSENSE_CTL1, .value_a = 0x0046, .value_g = 0x0046, .flags = 0, }, */
+        /* { .offset = B2063_TEMPSENSE_CTL2, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_TX_RX_LOOPBACK1, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_TX_RX_LOOPBACK2, .value_a = 0x0000, .value_g = 0x0000, .flags = 0, }, */
+        /* { .offset = B2063_EXT_TSSI_CTL1, .value_a = 0x0021, .value_g = 0x0021, .flags = 0, }, */
+        /* { .offset = B2063_EXT_TSSI_CTL2, .value_a = 0x0023, .value_g = 0x0023, .flags = 0, }, */
+        /* { .offset = B2063_AFE_CTL , .value_a = 0x0002, .value_g = 0x0002, .flags = 0, }, */
+};
+
 void b2062_upload_init_table(struct b43_wldev *dev)
 {
-        const struct b2062_init_tab_entry *e;
+        const struct b206x_init_tab_entry *e;
         unsigned int i;
 
         for (i = 0; i < ARRAY_SIZE(b2062_init_tab); i++) {
                 e = &b2062_init_tab[i];
                 if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ) {
-                        if (!(e->flags & B2062_FLAG_G))
+                        if (!(e->flags & B206X_FLAG_G))
+                                continue;
+                        b43_radio_write(dev, e->offset, e->value_g);
+                } else {
+                        if (!(e->flags & B206X_FLAG_A))
+                                continue;
+                        b43_radio_write(dev, e->offset, e->value_a);
+                }
+        }
+}
+
+void b2063_upload_init_table(struct b43_wldev *dev)
+{
+        const struct b206x_init_tab_entry *e;
+        unsigned int i;
+
+        for (i = 0; i < ARRAY_SIZE(b2063_init_tab); i++) {
+                e = &b2063_init_tab[i];
+                if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ) {
+                        if (!(e->flags & B206X_FLAG_G))
                                 continue;
                         b43_radio_write(dev, e->offset, e->value_g);
                 } else {
-                        if (!(e->flags & B2062_FLAG_A))
+                        if (!(e->flags & B206X_FLAG_A))
                                 continue;
                         b43_radio_write(dev, e->offset, e->value_a);
                 }
@@ -392,3 +710,1726 @@ void b43_lptab_write_bulk(struct b43_wldev *dev, u32 offset,
                 offset++;
         }
 }
+
+static const u8 lpphy_min_sig_sq_table[] = {
+        0xde, 0xdc, 0xda, 0xd8, 0xd6, 0xd4, 0xd2, 0xcf, 0xcd,
+        0xca, 0xc7, 0xc4, 0xc1, 0xbe, 0xbe, 0xbe, 0xbe, 0xbe,
+        0xbe, 0xbe, 0xbe, 0xbe, 0xbe, 0xbe, 0xbe, 0xbe, 0x00,
+        0xbe, 0xbe, 0xbe, 0xbe, 0xbe, 0xbe, 0xbe, 0xbe, 0xbe,
+        0xbe, 0xbe, 0xbe, 0xbe, 0xc1, 0xc4, 0xc7, 0xca, 0xcd,
+        0xcf, 0xd2, 0xd4, 0xd6, 0xd8, 0xda, 0xdc, 0xde,
+};
+
+static const u16 lpphy_rev01_noise_scale_table[] = {
+        0xa4a4, 0xa4a4, 0xa4a4, 0xa4a4, 0xa4a4, 0xa4a4, 0xa4a4, 0xa4a4, 0xa4a4,
+        0xa4a4, 0xa4a4, 0xa4a4, 0xa4a4, 0xa400, 0xa4a4, 0xa4a4, 0xa4a4, 0xa4a4,
+        0xa4a4, 0xa4a4, 0xa4a4, 0xa4a4, 0xa4a4, 0xa4a4, 0xa4a4, 0xa4a4, 0x00a4,
+        0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x4c00, 0x2d36,
+        0x0000, 0x0000, 0x4c00, 0x2d36,
+};
+
+static const u16 lpphy_rev2plus_noise_scale_table[] = {
+        0x00a4, 0x00a4, 0x00a4, 0x00a4, 0x00a4, 0x00a4, 0x00a4, 0x00a4, 0x00a4,
+        0x00a4, 0x00a4, 0x00a4, 0x00a4, 0x00a4, 0x00a4, 0x00a4, 0x00a4, 0x00a4,
+        0x00a4, 0x00a4, 0x00a4, 0x00a4, 0x00a4, 0x00a4, 0x00a4, 0x00a4, 0x0000,
+        0x00a4, 0x00a4, 0x00a4, 0x00a4, 0x00a4, 0x00a4, 0x00a4, 0x00a4, 0x00a4,
+        0x00a4, 0x00a4, 0x00a4, 0x00a4, 0x00a4, 0x00a4, 0x00a4, 0x00a4, 0x00a4,
+        0x00a4, 0x00a4, 0x00a4, 0x00a4, 0x00a4, 0x00a4, 0x00a4,
+        0x00a4,
+};
+
+static const u16 lpphy_crs_gain_nft_table[] = {
+        0x0366, 0x036a, 0x036f, 0x0364, 0x0367, 0x036d, 0x0374, 0x037f, 0x036f,
+        0x037b, 0x038a, 0x0378, 0x0367, 0x036d, 0x0375, 0x0381, 0x0374, 0x0381,
+        0x0392, 0x03a9, 0x03c4, 0x03e1, 0x0001, 0x001f, 0x0040, 0x005e, 0x007f,
+        0x009e, 0x00bd, 0x00dd, 0x00fd, 0x011d, 0x013d,
+};
+
+static const u16 lpphy_rev01_filter_control_table[] = {
+        0xa0fc, 0x10fc, 0x10db, 0x20b7, 0xff93, 0x10bf, 0x109b, 0x2077, 0xff53,
+        0x0127,
+};
+
+static const u32 lpphy_rev2plus_filter_control_table[] = {
+        0x000141fc, 0x000021fc, 0x000021b7, 0x0000416f, 0x0001ff27, 0x0000217f,
+        0x00002137, 0x000040ef, 0x0001fea7, 0x0000024f,
+};
+
+static const u32 lpphy_rev01_ps_control_table[] = {
+        0x00010000, 0x000000a0, 0x00040000, 0x00000048, 0x08080101, 0x00000080,
+        0x08080101, 0x00000040, 0x08080101, 0x000000c0, 0x08a81501, 0x000000c0,
+        0x0fe8fd01, 0x000000c0, 0x08300105, 0x000000c0, 0x08080201, 0x000000c0,
+        0x08280205, 0x000000c0, 0xe80802fe, 0x000000c7, 0x28080206, 0x000000c0,
+        0x08080202, 0x000000c0, 0x0ba87602, 0x000000c0, 0x1068013d, 0x000000c0,
+        0x10280105, 0x000000c0, 0x08880102, 0x000000c0, 0x08280106, 0x000000c0,
+        0xe80801fd, 0x000000c7, 0xa8080115, 0x000000c0,
+};
+
+static const u32 lpphy_rev2plus_ps_control_table[] = {
+        0x00e38e08, 0x00e08e38, 0x00000000, 0x00000000, 0x00000000, 0x00002080,
+        0x00006180, 0x00003002, 0x00000040, 0x00002042, 0x00180047, 0x00080043,
+        0x00000041, 0x000020c1, 0x00046006, 0x00042002, 0x00040000, 0x00002003,
+        0x00180006, 0x00080002,
+};
+
+static const u8 lpphy_pll_fraction_table[] = {
+        0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x00, 0x00, 0x80,
+        0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80,
+};
+
+static const u16 lpphy_iq_local_table[] = {
+        0x0200, 0x0300, 0x0400, 0x0600, 0x0800, 0x0b00, 0x1000, 0x1001, 0x1002,
+        0x1003, 0x1004, 0x1005, 0x1006, 0x1007, 0x1707, 0x2007, 0x2d07, 0x4007,
+        0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+        0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0200, 0x0300, 0x0400, 0x0600,
+        0x0800, 0x0b00, 0x1000, 0x1001, 0x1002, 0x1003, 0x1004, 0x1005, 0x1006,
+        0x1007, 0x1707, 0x2007, 0x2d07, 0x4007, 0x0000, 0x0000, 0x0000, 0x0000,
+        0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+        0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+        0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+        0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x4000, 0x0000, 0x0000,
+        0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+        0x0000, 0x0000,
+};
+
+static const u16 lpphy_ofdm_cck_gain_table[] = {
+        0x5000, 0x6000, 0x7000, 0x0001, 0x1001, 0x2001, 0x3001, 0x4001, 0x5001,
+        0x6001, 0x7001, 0x7011, 0x7021, 0x2035, 0x2045, 0x2055, 0x2065, 0x2075,
+        0x006d, 0x007d, 0x014d, 0x015d, 0x115d, 0x035d, 0x135d, 0x055d, 0x155d,
+        0x0d5d, 0x1d5d, 0x2d5d, 0x555d, 0x655d, 0x755d,
+};
+
+static const u16 lpphy_gain_delta_table[] = {
+        0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+};
+
+static const u32 lpphy_tx_power_control_table[] = {
+        0x00000050, 0x0000004f, 0x0000004e, 0x0000004d, 0x0000004c, 0x0000004b,
+        0x0000004a, 0x00000049, 0x00000048, 0x00000047, 0x00000046, 0x00000045,
+        0x00000044, 0x00000043, 0x00000042, 0x00000041, 0x00000040, 0x0000003f,
+        0x0000003e, 0x0000003d, 0x0000003c, 0x0000003b, 0x0000003a, 0x00000039,
+        0x00000038, 0x00000037, 0x00000036, 0x00000035, 0x00000034, 0x00000033,
+        0x00000032, 0x00000031, 0x00000030, 0x0000002f, 0x0000002e, 0x0000002d,
+        0x0000002c, 0x0000002b, 0x0000002a, 0x00000029, 0x00000028, 0x00000027,
+        0x00000026, 0x00000025, 0x00000024, 0x00000023, 0x00000022, 0x00000021,
+        0x00000020, 0x0000001f, 0x0000001e, 0x0000001d, 0x0000001c, 0x0000001b,
+        0x0000001a, 0x00000019, 0x00000018, 0x00000017, 0x00000016, 0x00000015,
+        0x00000014, 0x00000013, 0x00000012, 0x00000011, 0x00000000, 0x00000000,
+        0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+        0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+        0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+        0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+        0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+        0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+        0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+        0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+        0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+        0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+        0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+        0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+        0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+        0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+        0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+        0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+        0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+        0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+        0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+        0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+        0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+        0x000075a0, 0x000075a0, 0x000075a1, 0x000075a1, 0x000075a2, 0x000075a2,
+        0x000075a3, 0x000075a3, 0x000074b0, 0x000074b0, 0x000074b1, 0x000074b1,
+        0x000074b2, 0x000074b2, 0x000074b3, 0x000074b3, 0x00006d20, 0x00006d20,
+        0x00006d21, 0x00006d21, 0x00006d22, 0x00006d22, 0x00006d23, 0x00006d23,
+        0x00004660, 0x00004660, 0x00004661, 0x00004661, 0x00004662, 0x00004662,
+        0x00004663, 0x00004663, 0x00003e60, 0x00003e60, 0x00003e61, 0x00003e61,
+        0x00003e62, 0x00003e62, 0x00003e63, 0x00003e63, 0x00003660, 0x00003660,
+        0x00003661, 0x00003661, 0x00003662, 0x00003662, 0x00003663, 0x00003663,
+        0x00002e60, 0x00002e60, 0x00002e61, 0x00002e61, 0x00002e62, 0x00002e62,
+        0x00002e63, 0x00002e63, 0x00002660, 0x00002660, 0x00002661, 0x00002661,
+        0x00002662, 0x00002662, 0x00002663, 0x00002663, 0x000025e0, 0x000025e0,
+        0x000025e1, 0x000025e1, 0x000025e2, 0x000025e2, 0x000025e3, 0x000025e3,
+        0x00001de0, 0x00001de0, 0x00001de1, 0x00001de1, 0x00001de2, 0x00001de2,
+        0x00001de3, 0x00001de3, 0x00001d60, 0x00001d60, 0x00001d61, 0x00001d61,
+        0x00001d62, 0x00001d62, 0x00001d63, 0x00001d63, 0x00001560, 0x00001560,
+        0x00001561, 0x00001561, 0x00001562, 0x00001562, 0x00001563, 0x00001563,
+        0x00000d60, 0x00000d60, 0x00000d61, 0x00000d61, 0x00000d62, 0x00000d62,
+        0x00000d63, 0x00000d63, 0x00000ce0, 0x00000ce0, 0x00000ce1, 0x00000ce1,
+        0x00000ce2, 0x00000ce2, 0x00000ce3, 0x00000ce3, 0x00000e10, 0x00000e10,
+        0x00000e11, 0x00000e11, 0x00000e12, 0x00000e12, 0x00000e13, 0x00000e13,
+        0x00000bf0, 0x00000bf0, 0x00000bf1, 0x00000bf1, 0x00000bf2, 0x00000bf2,
+        0x00000bf3, 0x00000bf3, 0x04200000, 0x04000000, 0x04200000, 0x04000000,
+        0x04200000, 0x04000000, 0x04200000, 0x04000000, 0x04200000, 0x04000000,
+        0x04200000, 0x04000000, 0x04200000, 0x04000000, 0x04200000, 0x04000000,
+        0x04200000, 0x04000000, 0x04200000, 0x04000000, 0x04200000, 0x04000000,
+        0x04200000, 0x04000000, 0x04200000, 0x04000000, 0x04200000, 0x04000000,
+        0x04200000, 0x04000000, 0x04200000, 0x04000000, 0x04200000, 0x04000000,
+        0x04200000, 0x04000000, 0x04200000, 0x04000000, 0x04200000, 0x04000000,
+        0x04200000, 0x04000000, 0x04200000, 0x04000000, 0x04200000, 0x04000000,
+        0x04200000, 0x04000000, 0x04200000, 0x04000000, 0x04200000, 0x04000000,
+        0x04200000, 0x04000000, 0x04200000, 0x04000000, 0x04200000, 0x04000000,
+        0x04200000, 0x04000000, 0x04200000, 0x04000000, 0x04200000, 0x04000000,
+        0x04200000, 0x04000000, 0x04200000, 0x04000000, 0x04200000, 0x04000000,
+        0x04200000, 0x04000000, 0x04200000, 0x04000000, 0x04200000, 0x04000000,
+        0x04200000, 0x04000000, 0x04200000, 0x04000000, 0x04200000, 0x04000000,
+        0x04200000, 0x04000000, 0x04200000, 0x04000000, 0x04200000, 0x04000000,
+        0x04200000, 0x04000000, 0x04200000, 0x04000000, 0x04200000, 0x04000000,
+        0x04200000, 0x04000000, 0x04200000, 0x04000000, 0x04200000, 0x04000000,
+        0x04200000, 0x04000000, 0x04200000, 0x04000000, 0x04200000, 0x04000000,
+        0x04200000, 0x04000000, 0x04200000, 0x04000000, 0x04200000, 0x04000000,
+        0x04200000, 0x04000000, 0x04200000, 0x04000000, 0x04200000, 0x04000000,
+        0x04200000, 0x04000000, 0x04200000, 0x04000000, 0x04200000, 0x04000000,
+        0x04200000, 0x04000000, 0x04200000, 0x04000000, 0x000000ff, 0x000002fc,
+        0x0000fa08, 0x00000305, 0x00000206, 0x00000304, 0x0000fb04, 0x0000fcff,
+        0x000005fb, 0x0000fd01, 0x00000401, 0x00000006, 0x0000ff03, 0x000007fc,
+        0x0000fc08, 0x00000203, 0x0000fffb, 0x00000600, 0x0000fa01, 0x0000fc03,
+        0x0000fe06, 0x0000fe00, 0x00000102, 0x000007fd, 0x000004fb, 0x000006ff,
+        0x000004fd, 0x0000fdfa, 0x000007fb, 0x0000fdfa, 0x0000fa06, 0x00000500,
+        0x0000f902, 0x000007fa, 0x0000fafa, 0x00000500, 0x000007fa, 0x00000700,
+        0x00000305, 0x000004ff, 0x00000801, 0x00000503, 0x000005f9, 0x00000404,
+        0x0000fb08, 0x000005fd, 0x00000501, 0x00000405, 0x0000fb03, 0x000007fc,
+        0x00000403, 0x00000303, 0x00000402, 0x0000faff, 0x0000fe05, 0x000005fd,
+        0x0000fe01, 0x000007fa, 0x00000202, 0x00000504, 0x00000102, 0x000008fe,
+        0x0000fa04, 0x0000fafc, 0x0000fe08, 0x000000f9, 0x000002fa, 0x000003fe,
+        0x00000304, 0x000004f9, 0x00000100, 0x0000fd06, 0x000008fc, 0x00000701,
+        0x00000504, 0x0000fdfe, 0x0000fdfc, 0x000003fe, 0x00000704, 0x000002fc,
+        0x000004f9, 0x0000fdfd, 0x0000fa07, 0x00000205, 0x000003fd, 0x000005fb,
+        0x000004f9, 0x00000804, 0x0000fc06, 0x0000fcf9, 0x00000100, 0x0000fe05,
+        0x00000408, 0x0000fb02, 0x00000304, 0x000006fe, 0x000004fa, 0x00000305,
+        0x000008fc, 0x00000102, 0x000001fd, 0x000004fc, 0x0000fe03, 0x00000701,
+        0x000001fb, 0x000001f9, 0x00000206, 0x000006fd, 0x00000508, 0x00000700,
+        0x00000304, 0x000005fe, 0x000005ff, 0x0000fa04, 0x00000303, 0x0000fefb,
+        0x000007f9, 0x0000fefc, 0x000004fd, 0x000005fc, 0x0000fffd, 0x0000fc08,
+        0x0000fbf9, 0x0000fd07, 0x000008fb, 0x0000fe02, 0x000006fb, 0x00000702,
+};
+
+static const u32 lpphy_gain_idx_table[] = {
+        0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+        0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+        0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+        0x10000001, 0x00000000, 0x20000082, 0x00000000, 0x40000104, 0x00000000,
+        0x60004207, 0x00000001, 0x7000838a, 0x00000001, 0xd021050d, 0x00000001,
+        0xe041c683, 0x00000001, 0x50828805, 0x00000000, 0x80e34288, 0x00000000,
+        0xb144040b, 0x00000000, 0xe1a6058e, 0x00000000, 0x12064711, 0x00000001,
+        0xb0a18612, 0x00000010, 0xe1024794, 0x00000010, 0x11630915, 0x00000011,
+        0x31c3ca1b, 0x00000011, 0xc1848a9c, 0x00000018, 0xf1e50da0, 0x00000018,
+        0x22468e21, 0x00000019, 0x4286d023, 0x00000019, 0xa347d0a4, 0x00000019,
+        0xb36811a6, 0x00000019, 0xf3e89227, 0x00000019, 0x0408d329, 0x0000001a,
+        0x244953aa, 0x0000001a, 0x346994ab, 0x0000001a, 0x54aa152c, 0x0000001a,
+        0x64ca55ad, 0x0000001a, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+        0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+        0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+        0x00000000, 0x00000000, 0x10000001, 0x00000000, 0x20000082, 0x00000000,
+        0x40000104, 0x00000000, 0x60004207, 0x00000001, 0x7000838a, 0x00000001,
+        0xd021050d, 0x00000001, 0xe041c683, 0x00000001, 0x50828805, 0x00000000,
+        0x80e34288, 0x00000000, 0xb144040b, 0x00000000, 0xe1a6058e, 0x00000000,
+        0x12064711, 0x00000001, 0xb0a18612, 0x00000010, 0xe1024794, 0x00000010,
+        0x11630915, 0x00000011, 0x31c3ca1b, 0x00000011, 0xc1848a9c, 0x00000018,
+        0xf1e50da0, 0x00000018, 0x22468e21, 0x00000019, 0x4286d023, 0x00000019,
+        0xa347d0a4, 0x00000019, 0xb36811a6, 0x00000019, 0xf3e89227, 0x00000019,
+        0x0408d329, 0x0000001a, 0x244953aa, 0x0000001a, 0x346994ab, 0x0000001a,
+        0x54aa152c, 0x0000001a, 0x64ca55ad, 0x0000001a,
+};
+
+static const u16 lpphy_aux_gain_idx_table[] = {
+        0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+        0x0001, 0x0002, 0x0004, 0x0016, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+        0x0000, 0x0000, 0x0000, 0x0000, 0x0001, 0x0002, 0x0004, 0x0016,
+};
+
+static const u32 lpphy_gain_value_table[] = {
+        0x00000008, 0x0000000e, 0x00000014, 0x0000001a, 0x000000fb, 0x00000004,
+        0x00000008, 0x0000000d, 0x00000001, 0x00000004, 0x00000007, 0x0000000a,
+        0x0000000d, 0x00000010, 0x00000012, 0x00000015, 0x00000000, 0x00000006,
+        0x0000000c, 0x00000000, 0x00000000, 0x00000000, 0x00000012, 0x00000000,
+        0x00000000, 0x00000000, 0x00000018, 0x00000000, 0x00000000, 0x00000000,
+        0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+        0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+        0x0000001e, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+        0x00000000, 0x00000003, 0x00000006, 0x00000009, 0x0000000c, 0x0000000f,
+        0x00000012, 0x00000015, 0x00000018, 0x0000001b, 0x0000001e, 0x00000000,
+        0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000009, 0x000000f1,
+        0x00000000, 0x00000000,
+};
+
+static const u16 lpphy_gain_table[] = {
+        0x0000, 0x0400, 0x0800, 0x0802, 0x0804, 0x0806, 0x0807, 0x0808, 0x080a,
+        0x080b, 0x080c, 0x080e, 0x080f, 0x0810, 0x0812, 0x0813, 0x0814, 0x0816,
+        0x0817, 0x081a, 0x081b, 0x081f, 0x0820, 0x0824, 0x0830, 0x0834, 0x0837,
+        0x083b, 0x083f, 0x0840, 0x0844, 0x0857, 0x085b, 0x085f, 0x08d7, 0x08db,
+        0x08df, 0x0957, 0x095b, 0x095f, 0x0b57, 0x0b5b, 0x0b5f, 0x0f5f, 0x135f,
+        0x175f, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+        0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+        0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+        0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+        0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+        0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+};
+
+static const u32 lpphy_a0_gain_idx_table[] = {
+        0x001111e0, 0x00652051, 0x00606055, 0x005b005a, 0x00555060, 0x00511065,
+        0x004c806b, 0x0047d072, 0x00444078, 0x00400080, 0x003ca087, 0x0039408f,
+        0x0035e098, 0x0032e0a1, 0x003030aa, 0x002d80b4, 0x002ae0bf, 0x002880ca,
+        0x002640d6, 0x002410e3, 0x002220f0, 0x002020ff, 0x001e510e, 0x001ca11e,
+        0x001b012f, 0x00199140, 0x00182153, 0x0016c168, 0x0015817d, 0x00145193,
+        0x001321ab, 0x001211c5, 0x001111e0, 0x001021fc, 0x000f321a, 0x000e523a,
+        0x000d925c, 0x000cd27f, 0x000c12a5, 0x000b62cd, 0x000ac2f8, 0x000a2325,
+        0x00099355, 0x00091387, 0x000883bd, 0x000813f5, 0x0007a432, 0x00073471,
+        0x0006c4b5, 0x000664fc, 0x00061547, 0x0005b598, 0x000565ec, 0x00051646,
+        0x0004d6a5, 0x0004870a, 0x00044775, 0x000407e6, 0x0003d85e, 0x000398dd,
+        0x00036963, 0x000339f2, 0x00030a89, 0x0002db28,
+};
+
+static const u16 lpphy_a0_aux_gain_idx_table[] = {
+        0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+        0x0000, 0x0000, 0x0002, 0x0014, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+        0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0002, 0x0014,
+};
+
+static const u32 lpphy_a0_gain_value_table[] = {
+        0x00000008, 0x0000000e, 0x00000014, 0x0000001a, 0x000000fb, 0x00000004,
+        0x00000008, 0x0000000d, 0x00000001, 0x00000004, 0x00000007, 0x0000000a,
+        0x0000000d, 0x00000010, 0x00000012, 0x00000015, 0x00000000, 0x00000006,
+        0x0000000c, 0x00000000, 0x00000000, 0x00000000, 0x00000012, 0x00000000,
+        0x00000000, 0x00000000, 0x00000018, 0x00000000, 0x00000000, 0x00000000,
+        0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+        0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+        0x0000001e, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+        0x00000000, 0x00000003, 0x00000006, 0x00000009, 0x0000000c, 0x0000000f,
+        0x00000012, 0x00000015, 0x00000018, 0x0000001b, 0x0000001e, 0x00000000,
+        0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x0000000f, 0x000000f7,
+        0x00000000, 0x00000000,
+};
+
+static const u16 lpphy_a0_gain_table[] = {
+        0x0000, 0x0002, 0x0004, 0x0006, 0x0007, 0x0008, 0x000a, 0x000b, 0x000c,
+        0x000e, 0x000f, 0x0010, 0x0012, 0x0013, 0x0014, 0x0016, 0x0017, 0x001a,
+        0x001b, 0x001f, 0x0020, 0x0024, 0x0030, 0x0034, 0x0037, 0x003b, 0x003f,
+        0x0040, 0x0044, 0x0057, 0x005b, 0x005f, 0x00d7, 0x00db, 0x00df, 0x0157,
+        0x015b, 0x015f, 0x0357, 0x035b, 0x035f, 0x075f, 0x0b5f, 0x0f5f, 0x0000,
+        0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+        0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+        0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+        0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+        0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+        0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+};
+
+static const u16 lpphy_sw_control_table[] = {
+        0x0128, 0x0128, 0x0009, 0x0009, 0x0028, 0x0028, 0x0028, 0x0028, 0x0128,
+        0x0128, 0x0009, 0x0009, 0x0028, 0x0028, 0x0028, 0x0028, 0x0009, 0x0009,
+        0x0009, 0x0009, 0x0009, 0x0009, 0x0009, 0x0009, 0x0018, 0x0018, 0x0018,
+        0x0018, 0x0018, 0x0018, 0x0018, 0x0018, 0x0128, 0x0128, 0x0009, 0x0009,
+        0x0028, 0x0028, 0x0028, 0x0028, 0x0128, 0x0128, 0x0009, 0x0009, 0x0028,
+        0x0028, 0x0028, 0x0028, 0x0009, 0x0009, 0x0009, 0x0009, 0x0009, 0x0009,
+        0x0009, 0x0009, 0x0018, 0x0018, 0x0018, 0x0018, 0x0018, 0x0018, 0x0018,
+        0x0018,
+};
+
+static const u8 lpphy_hf_table[] = {
+        0x4b, 0x36, 0x24, 0x18, 0x49, 0x34, 0x23, 0x17, 0x48,
+        0x33, 0x23, 0x17, 0x48, 0x33, 0x23, 0x17,
+};
+
+static const u32 lpphy_papd_eps_table[] = {
+        0x00000000, 0x00013ffc, 0x0001dff3, 0x0001bff0, 0x00023fe9, 0x00021fdf,
+        0x00028fdf, 0x00033fd2, 0x00039fcb, 0x00043fc7, 0x0004efc2, 0x00055fb5,
+        0x0005cfb0, 0x00063fa8, 0x00068fa3, 0x00071f98, 0x0007ef92, 0x00084f8b,
+        0x0008df82, 0x00097f77, 0x0009df69, 0x000a3f62, 0x000adf57, 0x000b6f4c,
+        0x000bff41, 0x000c9f39, 0x000cff30, 0x000dbf27, 0x000e4f1e, 0x000edf16,
+        0x000f7f13, 0x00102f11, 0x00110f10, 0x0011df11, 0x0012ef15, 0x00143f1c,
+        0x00158f27, 0x00172f35, 0x00193f47, 0x001baf5f, 0x001e6f7e, 0x0021cfa4,
+        0x0025bfd2, 0x002a2008, 0x002fb047, 0x00360090, 0x003d40e0, 0x0045c135,
+        0x004fb189, 0x005ae1d7, 0x0067221d, 0x0075025a, 0x007ff291, 0x007ff2bf,
+        0x007ff2e3, 0x007ff2ff, 0x007ff315, 0x007ff329, 0x007ff33f, 0x007ff356,
+        0x007ff36e, 0x007ff39c, 0x007ff441, 0x007ff506,
+};
+
+static const u32 lpphy_papd_mult_table[] = {
+        0x001111e0, 0x00652051, 0x00606055, 0x005b005a, 0x00555060, 0x00511065,
+        0x004c806b, 0x0047d072, 0x00444078, 0x00400080, 0x003ca087, 0x0039408f,
+        0x0035e098, 0x0032e0a1, 0x003030aa, 0x002d80b4, 0x002ae0bf, 0x002880ca,
+        0x002640d6, 0x002410e3, 0x002220f0, 0x002020ff, 0x001e510e, 0x001ca11e,
+        0x001b012f, 0x00199140, 0x00182153, 0x0016c168, 0x0015817d, 0x00145193,
+        0x001321ab, 0x001211c5, 0x001111e0, 0x001021fc, 0x000f321a, 0x000e523a,
+        0x000d925c, 0x000cd27f, 0x000c12a5, 0x000b62cd, 0x000ac2f8, 0x000a2325,
+        0x00099355, 0x00091387, 0x000883bd, 0x000813f5, 0x0007a432, 0x00073471,
+        0x0006c4b5, 0x000664fc, 0x00061547, 0x0005b598, 0x000565ec, 0x00051646,
+        0x0004d6a5, 0x0004870a, 0x00044775, 0x000407e6, 0x0003d85e, 0x000398dd,
+        0x00036963, 0x000339f2, 0x00030a89, 0x0002db28,
+};
+
+static struct lpphy_tx_gain_table_entry lpphy_rev0_nopa_tx_gain_table[] = {
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 152, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 147, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 143, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 139, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 135, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 131, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 128, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 124, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 121, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 117, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 114, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 111, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 107, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 104, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 101, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 99, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 96, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 93, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 90, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 88, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 85, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 83, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 81, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 78, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 76, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 74, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 72, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 70, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 68, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 66, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 62, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 60, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 59, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 57, },
+        { .gm = 7, .pga = 15, .pad = 13, .dac = 0, .bb_mult = 72, },
+        { .gm = 7, .pga = 15, .pad = 13, .dac = 0, .bb_mult = 70, },
+        { .gm = 7, .pga = 15, .pad = 13, .dac = 0, .bb_mult = 68, },
+        { .gm = 7, .pga = 15, .pad = 13, .dac = 0, .bb_mult = 66, },
+        { .gm = 7, .pga = 15, .pad = 13, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 15, .pad = 13, .dac = 0, .bb_mult = 62, },
+        { .gm = 7, .pga = 15, .pad = 13, .dac = 0, .bb_mult = 60, },
+        { .gm = 7, .pga = 15, .pad = 13, .dac = 0, .bb_mult = 59, },
+        { .gm = 7, .pga = 15, .pad = 13, .dac = 0, .bb_mult = 57, },
+        { .gm = 7, .pga = 15, .pad = 12, .dac = 0, .bb_mult = 71, },
+        { .gm = 7, .pga = 15, .pad = 12, .dac = 0, .bb_mult = 69, },
+        { .gm = 7, .pga = 15, .pad = 12, .dac = 0, .bb_mult = 67, },
+        { .gm = 7, .pga = 15, .pad = 12, .dac = 0, .bb_mult = 65, },
+        { .gm = 7, .pga = 15, .pad = 12, .dac = 0, .bb_mult = 63, },
+        { .gm = 7, .pga = 15, .pad = 12, .dac = 0, .bb_mult = 62, },
+        { .gm = 7, .pga = 15, .pad = 12, .dac = 0, .bb_mult = 60, },
+        { .gm = 7, .pga = 15, .pad = 12, .dac = 0, .bb_mult = 58, },
+        { .gm = 7, .pga = 15, .pad = 12, .dac = 0, .bb_mult = 57, },
+        { .gm = 7, .pga = 15, .pad = 11, .dac = 0, .bb_mult = 70, },
+        { .gm = 7, .pga = 15, .pad = 11, .dac = 0, .bb_mult = 68, },
+        { .gm = 7, .pga = 15, .pad = 11, .dac = 0, .bb_mult = 66, },
+        { .gm = 7, .pga = 15, .pad = 11, .dac = 0, .bb_mult = 65, },
+        { .gm = 7, .pga = 15, .pad = 11, .dac = 0, .bb_mult = 63, },
+        { .gm = 7, .pga = 15, .pad = 11, .dac = 0, .bb_mult = 61, },
+        { .gm = 7, .pga = 15, .pad = 11, .dac = 0, .bb_mult = 59, },
+        { .gm = 7, .pga = 15, .pad = 11, .dac = 0, .bb_mult = 58, },
+        { .gm = 7, .pga = 15, .pad = 10, .dac = 0, .bb_mult = 71, },
+        { .gm = 7, .pga = 15, .pad = 10, .dac = 0, .bb_mult = 69, },
+        { .gm = 7, .pga = 15, .pad = 10, .dac = 0, .bb_mult = 67, },
+        { .gm = 7, .pga = 15, .pad = 10, .dac = 0, .bb_mult = 65, },
+        { .gm = 7, .pga = 15, .pad = 10, .dac = 0, .bb_mult = 63, },
+        { .gm = 7, .pga = 15, .pad = 10, .dac = 0, .bb_mult = 61, },
+        { .gm = 7, .pga = 15, .pad = 10, .dac = 0, .bb_mult = 60, },
+        { .gm = 7, .pga = 15, .pad = 10, .dac = 0, .bb_mult = 58, },
+        { .gm = 7, .pga = 15, .pad = 10, .dac = 0, .bb_mult = 56, },
+        { .gm = 7, .pga = 15, .pad = 9, .dac = 0, .bb_mult = 70, },
+        { .gm = 7, .pga = 15, .pad = 9, .dac = 0, .bb_mult = 68, },
+        { .gm = 7, .pga = 15, .pad = 9, .dac = 0, .bb_mult = 66, },
+        { .gm = 7, .pga = 15, .pad = 9, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 15, .pad = 9, .dac = 0, .bb_mult = 62, },
+        { .gm = 7, .pga = 15, .pad = 9, .dac = 0, .bb_mult = 60, },
+        { .gm = 7, .pga = 15, .pad = 9, .dac = 0, .bb_mult = 59, },
+        { .gm = 7, .pga = 14, .pad = 9, .dac = 0, .bb_mult = 72, },
+        { .gm = 7, .pga = 14, .pad = 9, .dac = 0, .bb_mult = 70, },
+        { .gm = 7, .pga = 14, .pad = 9, .dac = 0, .bb_mult = 68, },
+        { .gm = 7, .pga = 14, .pad = 9, .dac = 0, .bb_mult = 66, },
+        { .gm = 7, .pga = 14, .pad = 9, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 14, .pad = 9, .dac = 0, .bb_mult = 62, },
+        { .gm = 7, .pga = 14, .pad = 9, .dac = 0, .bb_mult = 60, },
+        { .gm = 7, .pga = 14, .pad = 9, .dac = 0, .bb_mult = 59, },
+        { .gm = 7, .pga = 13, .pad = 9, .dac = 0, .bb_mult = 72, },
+        { .gm = 7, .pga = 13, .pad = 9, .dac = 0, .bb_mult = 70, },
+        { .gm = 7, .pga = 13, .pad = 9, .dac = 0, .bb_mult = 68, },
+        { .gm = 7, .pga = 13, .pad = 9, .dac = 0, .bb_mult = 66, },
+        { .gm = 7, .pga = 13, .pad = 9, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 13, .pad = 9, .dac = 0, .bb_mult = 63, },
+        { .gm = 7, .pga = 13, .pad = 9, .dac = 0, .bb_mult = 61, },
+        { .gm = 7, .pga = 13, .pad = 9, .dac = 0, .bb_mult = 59, },
+        { .gm = 7, .pga = 13, .pad = 9, .dac = 0, .bb_mult = 57, },
+        { .gm = 7, .pga = 13, .pad = 8, .dac = 0, .bb_mult = 72, },
+        { .gm = 7, .pga = 13, .pad = 8, .dac = 0, .bb_mult = 70, },
+        { .gm = 7, .pga = 13, .pad = 8, .dac = 0, .bb_mult = 68, },
+        { .gm = 7, .pga = 13, .pad = 8, .dac = 0, .bb_mult = 66, },
+        { .gm = 7, .pga = 13, .pad = 8, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 13, .pad = 8, .dac = 0, .bb_mult = 62, },
+        { .gm = 7, .pga = 13, .pad = 8, .dac = 0, .bb_mult = 60, },
+        { .gm = 7, .pga = 13, .pad = 8, .dac = 0, .bb_mult = 59, },
+        { .gm = 7, .pga = 12, .pad = 8, .dac = 0, .bb_mult = 72, },
+        { .gm = 7, .pga = 12, .pad = 8, .dac = 0, .bb_mult = 70, },
+        { .gm = 7, .pga = 12, .pad = 8, .dac = 0, .bb_mult = 68, },
+        { .gm = 7, .pga = 12, .pad = 8, .dac = 0, .bb_mult = 66, },
+        { .gm = 7, .pga = 12, .pad = 8, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 12, .pad = 8, .dac = 0, .bb_mult = 62, },
+        { .gm = 7, .pga = 12, .pad = 8, .dac = 0, .bb_mult = 61, },
+        { .gm = 7, .pga = 12, .pad = 8, .dac = 0, .bb_mult = 59, },
+        { .gm = 7, .pga = 12, .pad = 7, .dac = 0, .bb_mult = 73, },
+        { .gm = 7, .pga = 12, .pad = 7, .dac = 0, .bb_mult = 71, },
+        { .gm = 7, .pga = 12, .pad = 7, .dac = 0, .bb_mult = 69, },
+        { .gm = 7, .pga = 12, .pad = 7, .dac = 0, .bb_mult = 67, },
+        { .gm = 7, .pga = 12, .pad = 7, .dac = 0, .bb_mult = 65, },
+        { .gm = 7, .pga = 12, .pad = 7, .dac = 0, .bb_mult = 63, },
+        { .gm = 7, .pga = 12, .pad = 7, .dac = 0, .bb_mult = 61, },
+        { .gm = 7, .pga = 12, .pad = 7, .dac = 0, .bb_mult = 59, },
+        { .gm = 7, .pga = 11, .pad = 7, .dac = 0, .bb_mult = 72, },
+        { .gm = 7, .pga = 11, .pad = 7, .dac = 0, .bb_mult = 70, },
+        { .gm = 7, .pga = 11, .pad = 7, .dac = 0, .bb_mult = 68, },
+        { .gm = 7, .pga = 11, .pad = 7, .dac = 0, .bb_mult = 66, },
+        { .gm = 7, .pga = 11, .pad = 7, .dac = 0, .bb_mult = 65, },
+        { .gm = 7, .pga = 11, .pad = 7, .dac = 0, .bb_mult = 63, },
+        { .gm = 7, .pga = 11, .pad = 7, .dac = 0, .bb_mult = 61, },
+        { .gm = 7, .pga = 11, .pad = 7, .dac = 0, .bb_mult = 59, },
+        { .gm = 7, .pga = 11, .pad = 6, .dac = 0, .bb_mult = 73, },
+        { .gm = 7, .pga = 11, .pad = 6, .dac = 0, .bb_mult = 71, },
+};
+
+static struct lpphy_tx_gain_table_entry lpphy_rev0_2ghz_tx_gain_table[] = {
+        { .gm = 4, .pga = 15, .pad = 9, .dac = 0, .bb_mult = 64, },
+        { .gm = 4, .pga = 15, .pad = 9, .dac = 0, .bb_mult = 62, },
+        { .gm = 4, .pga = 15, .pad = 9, .dac = 0, .bb_mult = 60, },
+        { .gm = 4, .pga = 15, .pad = 9, .dac = 0, .bb_mult = 59, },
+        { .gm = 4, .pga = 14, .pad = 9, .dac = 0, .bb_mult = 72, },
+        { .gm = 4, .pga = 14, .pad = 9, .dac = 0, .bb_mult = 70, },
+        { .gm = 4, .pga = 14, .pad = 9, .dac = 0, .bb_mult = 68, },
+        { .gm = 4, .pga = 14, .pad = 9, .dac = 0, .bb_mult = 66, },
+        { .gm = 4, .pga = 14, .pad = 9, .dac = 0, .bb_mult = 64, },
+        { .gm = 4, .pga = 14, .pad = 9, .dac = 0, .bb_mult = 62, },
+        { .gm = 4, .pga = 14, .pad = 9, .dac = 0, .bb_mult = 60, },
+        { .gm = 4, .pga = 14, .pad = 9, .dac = 0, .bb_mult = 59, },
+        { .gm = 4, .pga = 13, .pad = 9, .dac = 0, .bb_mult = 72, },
+        { .gm = 4, .pga = 13, .pad = 9, .dac = 0, .bb_mult = 70, },
+        { .gm = 4, .pga = 13, .pad = 9, .dac = 0, .bb_mult = 68, },
+        { .gm = 4, .pga = 13, .pad = 9, .dac = 0, .bb_mult = 66, },
+        { .gm = 4, .pga = 13, .pad = 9, .dac = 0, .bb_mult = 64, },
+        { .gm = 4, .pga = 13, .pad = 9, .dac = 0, .bb_mult = 63, },
+        { .gm = 4, .pga = 13, .pad = 9, .dac = 0, .bb_mult = 61, },
+        { .gm = 4, .pga = 13, .pad = 9, .dac = 0, .bb_mult = 59, },
+        { .gm = 4, .pga = 13, .pad = 9, .dac = 0, .bb_mult = 57, },
+        { .gm = 4, .pga = 13, .pad = 8, .dac = 0, .bb_mult = 72, },
+        { .gm = 4, .pga = 13, .pad = 8, .dac = 0, .bb_mult = 70, },
+        { .gm = 4, .pga = 13, .pad = 8, .dac = 0, .bb_mult = 68, },
+        { .gm = 4, .pga = 13, .pad = 8, .dac = 0, .bb_mult = 66, },
+        { .gm = 4, .pga = 13, .pad = 8, .dac = 0, .bb_mult = 64, },
+        { .gm = 4, .pga = 13, .pad = 8, .dac = 0, .bb_mult = 62, },
+        { .gm = 4, .pga = 13, .pad = 8, .dac = 0, .bb_mult = 60, },
+        { .gm = 4, .pga = 13, .pad = 8, .dac = 0, .bb_mult = 59, },
+        { .gm = 4, .pga = 12, .pad = 8, .dac = 0, .bb_mult = 72, },
+        { .gm = 4, .pga = 12, .pad = 8, .dac = 0, .bb_mult = 70, },
+        { .gm = 4, .pga = 12, .pad = 8, .dac = 0, .bb_mult = 68, },
+        { .gm = 4, .pga = 12, .pad = 8, .dac = 0, .bb_mult = 66, },
+        { .gm = 4, .pga = 12, .pad = 8, .dac = 0, .bb_mult = 64, },
+        { .gm = 4, .pga = 12, .pad = 8, .dac = 0, .bb_mult = 62, },
+        { .gm = 4, .pga = 12, .pad = 8, .dac = 0, .bb_mult = 61, },
+        { .gm = 4, .pga = 12, .pad = 8, .dac = 0, .bb_mult = 59, },
+        { .gm = 4, .pga = 12, .pad = 7, .dac = 0, .bb_mult = 73, },
+        { .gm = 4, .pga = 12, .pad = 7, .dac = 0, .bb_mult = 71, },
+        { .gm = 4, .pga = 12, .pad = 7, .dac = 0, .bb_mult = 69, },
+        { .gm = 4, .pga = 12, .pad = 7, .dac = 0, .bb_mult = 67, },
+        { .gm = 4, .pga = 12, .pad = 7, .dac = 0, .bb_mult = 65, },
+        { .gm = 4, .pga = 12, .pad = 7, .dac = 0, .bb_mult = 63, },
+        { .gm = 4, .pga = 12, .pad = 7, .dac = 0, .bb_mult = 61, },
+        { .gm = 4, .pga = 12, .pad = 7, .dac = 0, .bb_mult = 59, },
+        { .gm = 4, .pga = 11, .pad = 7, .dac = 0, .bb_mult = 72, },
+        { .gm = 4, .pga = 11, .pad = 7, .dac = 0, .bb_mult = 70, },
+        { .gm = 4, .pga = 11, .pad = 7, .dac = 0, .bb_mult = 68, },
+        { .gm = 4, .pga = 11, .pad = 7, .dac = 0, .bb_mult = 66, },
+        { .gm = 4, .pga = 11, .pad = 7, .dac = 0, .bb_mult = 65, },
+        { .gm = 4, .pga = 11, .pad = 7, .dac = 0, .bb_mult = 63, },
+        { .gm = 4, .pga = 11, .pad = 7, .dac = 0, .bb_mult = 61, },
+        { .gm = 4, .pga = 11, .pad = 7, .dac = 0, .bb_mult = 59, },
+        { .gm = 4, .pga = 11, .pad = 6, .dac = 0, .bb_mult = 73, },
+        { .gm = 4, .pga = 11, .pad = 6, .dac = 0, .bb_mult = 71, },
+        { .gm = 4, .pga = 11, .pad = 6, .dac = 0, .bb_mult = 69, },
+        { .gm = 4, .pga = 11, .pad = 6, .dac = 0, .bb_mult = 67, },
+        { .gm = 4, .pga = 11, .pad = 6, .dac = 0, .bb_mult = 65, },
+        { .gm = 4, .pga = 11, .pad = 6, .dac = 0, .bb_mult = 63, },
+        { .gm = 4, .pga = 11, .pad = 6, .dac = 0, .bb_mult = 61, },
+        { .gm = 4, .pga = 11, .pad = 6, .dac = 0, .bb_mult = 60, },
+        { .gm = 4, .pga = 10, .pad = 6, .dac = 0, .bb_mult = 72, },
+        { .gm = 4, .pga = 10, .pad = 6, .dac = 0, .bb_mult = 70, },
+        { .gm = 4, .pga = 10, .pad = 6, .dac = 0, .bb_mult = 68, },
+        { .gm = 4, .pga = 10, .pad = 6, .dac = 0, .bb_mult = 66, },
+        { .gm = 4, .pga = 10, .pad = 6, .dac = 0, .bb_mult = 64, },
+        { .gm = 4, .pga = 10, .pad = 6, .dac = 0, .bb_mult = 62, },
+        { .gm = 4, .pga = 10, .pad = 6, .dac = 0, .bb_mult = 60, },
+        { .gm = 4, .pga = 10, .pad = 6, .dac = 0, .bb_mult = 59, },
+        { .gm = 4, .pga = 10, .pad = 5, .dac = 0, .bb_mult = 72, },
+        { .gm = 4, .pga = 10, .pad = 5, .dac = 0, .bb_mult = 70, },
+        { .gm = 4, .pga = 10, .pad = 5, .dac = 0, .bb_mult = 68, },
+        { .gm = 4, .pga = 10, .pad = 5, .dac = 0, .bb_mult = 66, },
+        { .gm = 4, .pga = 10, .pad = 5, .dac = 0, .bb_mult = 64, },
+        { .gm = 4, .pga = 10, .pad = 5, .dac = 0, .bb_mult = 62, },
+        { .gm = 4, .pga = 10, .pad = 5, .dac = 0, .bb_mult = 60, },
+        { .gm = 4, .pga = 10, .pad = 5, .dac = 0, .bb_mult = 59, },
+        { .gm = 4, .pga = 9, .pad = 5, .dac = 0, .bb_mult = 70, },
+        { .gm = 4, .pga = 9, .pad = 5, .dac = 0, .bb_mult = 68, },
+        { .gm = 4, .pga = 9, .pad = 5, .dac = 0, .bb_mult = 66, },
+        { .gm = 4, .pga = 9, .pad = 5, .dac = 0, .bb_mult = 64, },
+        { .gm = 4, .pga = 9, .pad = 5, .dac = 0, .bb_mult = 63, },
+        { .gm = 4, .pga = 9, .pad = 5, .dac = 0, .bb_mult = 61, },
+        { .gm = 4, .pga = 9, .pad = 5, .dac = 0, .bb_mult = 59, },
+        { .gm = 4, .pga = 9, .pad = 4, .dac = 0, .bb_mult = 71, },
+        { .gm = 4, .pga = 9, .pad = 4, .dac = 0, .bb_mult = 69, },
+        { .gm = 4, .pga = 9, .pad = 4, .dac = 0, .bb_mult = 67, },
+        { .gm = 4, .pga = 9, .pad = 4, .dac = 0, .bb_mult = 65, },
+        { .gm = 4, .pga = 9, .pad = 4, .dac = 0, .bb_mult = 63, },
+        { .gm = 4, .pga = 9, .pad = 4, .dac = 0, .bb_mult = 62, },
+        { .gm = 4, .pga = 9, .pad = 4, .dac = 0, .bb_mult = 60, },
+        { .gm = 4, .pga = 9, .pad = 4, .dac = 0, .bb_mult = 58, },
+        { .gm = 4, .pga = 8, .pad = 4, .dac = 0, .bb_mult = 70, },
+        { .gm = 4, .pga = 8, .pad = 4, .dac = 0, .bb_mult = 68, },
+        { .gm = 4, .pga = 8, .pad = 4, .dac = 0, .bb_mult = 66, },
+        { .gm = 4, .pga = 8, .pad = 4, .dac = 0, .bb_mult = 65, },
+        { .gm = 4, .pga = 8, .pad = 4, .dac = 0, .bb_mult = 63, },
+        { .gm = 4, .pga = 8, .pad = 4, .dac = 0, .bb_mult = 61, },
+        { .gm = 4, .pga = 8, .pad = 4, .dac = 0, .bb_mult = 59, },
+        { .gm = 4, .pga = 7, .pad = 4, .dac = 0, .bb_mult = 68, },
+        { .gm = 4, .pga = 7, .pad = 4, .dac = 0, .bb_mult = 66, },
+        { .gm = 4, .pga = 7, .pad = 4, .dac = 0, .bb_mult = 64, },
+        { .gm = 4, .pga = 7, .pad = 4, .dac = 0, .bb_mult = 62, },
+        { .gm = 4, .pga = 7, .pad = 4, .dac = 0, .bb_mult = 61, },
+        { .gm = 4, .pga = 7, .pad = 4, .dac = 0, .bb_mult = 59, },
+        { .gm = 4, .pga = 7, .pad = 3, .dac = 0, .bb_mult = 67, },
+        { .gm = 4, .pga = 7, .pad = 3, .dac = 0, .bb_mult = 65, },
+        { .gm = 4, .pga = 7, .pad = 3, .dac = 0, .bb_mult = 63, },
+        { .gm = 4, .pga = 7, .pad = 3, .dac = 0, .bb_mult = 62, },
+        { .gm = 4, .pga = 7, .pad = 3, .dac = 0, .bb_mult = 60, },
+        { .gm = 4, .pga = 6, .pad = 3, .dac = 0, .bb_mult = 65, },
+        { .gm = 4, .pga = 6, .pad = 3, .dac = 0, .bb_mult = 63, },
+        { .gm = 4, .pga = 6, .pad = 3, .dac = 0, .bb_mult = 61, },
+        { .gm = 4, .pga = 6, .pad = 3, .dac = 0, .bb_mult = 60, },
+        { .gm = 4, .pga = 6, .pad = 3, .dac = 0, .bb_mult = 58, },
+        { .gm = 4, .pga = 5, .pad = 3, .dac = 0, .bb_mult = 68, },
+        { .gm = 4, .pga = 5, .pad = 3, .dac = 0, .bb_mult = 66, },
+        { .gm = 4, .pga = 5, .pad = 3, .dac = 0, .bb_mult = 64, },
+        { .gm = 4, .pga = 5, .pad = 3, .dac = 0, .bb_mult = 62, },
+        { .gm = 4, .pga = 5, .pad = 3, .dac = 0, .bb_mult = 60, },
+        { .gm = 4, .pga = 5, .pad = 3, .dac = 0, .bb_mult = 59, },
+        { .gm = 4, .pga = 5, .pad = 3, .dac = 0, .bb_mult = 57, },
+        { .gm = 4, .pga = 4, .pad = 2, .dac = 0, .bb_mult = 83, },
+        { .gm = 4, .pga = 4, .pad = 2, .dac = 0, .bb_mult = 81, },
+        { .gm = 4, .pga = 4, .pad = 2, .dac = 0, .bb_mult = 78, },
+        { .gm = 4, .pga = 4, .pad = 2, .dac = 0, .bb_mult = 76, },
+        { .gm = 4, .pga = 4, .pad = 2, .dac = 0, .bb_mult = 74, },
+        { .gm = 4, .pga = 4, .pad = 2, .dac = 0, .bb_mult = 72, },
+};
+
+static struct lpphy_tx_gain_table_entry lpphy_rev0_5ghz_tx_gain_table[] = {
+        { .gm = 7, .pga = 15, .pad = 15, .dac = 0, .bb_mult = 99, },
+        { .gm = 7, .pga = 15, .pad = 15, .dac = 0, .bb_mult = 96, },
+        { .gm = 7, .pga = 15, .pad = 15, .dac = 0, .bb_mult = 93, },
+        { .gm = 7, .pga = 15, .pad = 15, .dac = 0, .bb_mult = 90, },
+        { .gm = 7, .pga = 15, .pad = 15, .dac = 0, .bb_mult = 88, },
+        { .gm = 7, .pga = 15, .pad = 15, .dac = 0, .bb_mult = 85, },
+        { .gm = 7, .pga = 15, .pad = 15, .dac = 0, .bb_mult = 83, },
+        { .gm = 7, .pga = 15, .pad = 15, .dac = 0, .bb_mult = 81, },
+        { .gm = 7, .pga = 15, .pad = 15, .dac = 0, .bb_mult = 78, },
+        { .gm = 7, .pga = 15, .pad = 15, .dac = 0, .bb_mult = 76, },
+        { .gm = 7, .pga = 15, .pad = 15, .dac = 0, .bb_mult = 74, },
+        { .gm = 7, .pga = 15, .pad = 15, .dac = 0, .bb_mult = 72, },
+        { .gm = 7, .pga = 15, .pad = 15, .dac = 0, .bb_mult = 70, },
+        { .gm = 7, .pga = 15, .pad = 15, .dac = 0, .bb_mult = 68, },
+        { .gm = 7, .pga = 15, .pad = 15, .dac = 0, .bb_mult = 66, },
+        { .gm = 7, .pga = 15, .pad = 15, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 15, .pad = 15, .dac = 0, .bb_mult = 62, },
+        { .gm = 7, .pga = 15, .pad = 15, .dac = 0, .bb_mult = 60, },
+        { .gm = 7, .pga = 15, .pad = 15, .dac = 0, .bb_mult = 59, },
+        { .gm = 7, .pga = 15, .pad = 15, .dac = 0, .bb_mult = 57, },
+        { .gm = 7, .pga = 15, .pad = 15, .dac = 0, .bb_mult = 55, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 72, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 70, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 68, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 66, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 62, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 60, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 58, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 56, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 55, },
+        { .gm = 7, .pga = 15, .pad = 13, .dac = 0, .bb_mult = 71, },
+        { .gm = 7, .pga = 15, .pad = 13, .dac = 0, .bb_mult = 69, },
+        { .gm = 7, .pga = 15, .pad = 13, .dac = 0, .bb_mult = 67, },
+        { .gm = 7, .pga = 15, .pad = 13, .dac = 0, .bb_mult = 65, },
+        { .gm = 7, .pga = 15, .pad = 13, .dac = 0, .bb_mult = 63, },
+        { .gm = 7, .pga = 15, .pad = 13, .dac = 0, .bb_mult = 62, },
+        { .gm = 7, .pga = 15, .pad = 13, .dac = 0, .bb_mult = 60, },
+        { .gm = 7, .pga = 15, .pad = 13, .dac = 0, .bb_mult = 58, },
+        { .gm = 7, .pga = 15, .pad = 13, .dac = 0, .bb_mult = 56, },
+        { .gm = 7, .pga = 15, .pad = 12, .dac = 0, .bb_mult = 72, },
+        { .gm = 7, .pga = 15, .pad = 12, .dac = 0, .bb_mult = 70, },
+        { .gm = 7, .pga = 15, .pad = 12, .dac = 0, .bb_mult = 68, },
+        { .gm = 7, .pga = 15, .pad = 12, .dac = 0, .bb_mult = 66, },
+        { .gm = 7, .pga = 15, .pad = 12, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 15, .pad = 12, .dac = 0, .bb_mult = 62, },
+        { .gm = 7, .pga = 15, .pad = 12, .dac = 0, .bb_mult = 60, },
+        { .gm = 7, .pga = 15, .pad = 12, .dac = 0, .bb_mult = 59, },
+        { .gm = 7, .pga = 15, .pad = 12, .dac = 0, .bb_mult = 57, },
+        { .gm = 7, .pga = 15, .pad = 11, .dac = 0, .bb_mult = 73, },
+        { .gm = 7, .pga = 15, .pad = 11, .dac = 0, .bb_mult = 71, },
+        { .gm = 7, .pga = 15, .pad = 11, .dac = 0, .bb_mult = 69, },
+        { .gm = 7, .pga = 15, .pad = 11, .dac = 0, .bb_mult = 67, },
+        { .gm = 7, .pga = 15, .pad = 11, .dac = 0, .bb_mult = 65, },
+        { .gm = 7, .pga = 15, .pad = 11, .dac = 0, .bb_mult = 63, },
+        { .gm = 7, .pga = 15, .pad = 11, .dac = 0, .bb_mult = 61, },
+        { .gm = 7, .pga = 15, .pad = 11, .dac = 0, .bb_mult = 60, },
+        { .gm = 7, .pga = 15, .pad = 11, .dac = 0, .bb_mult = 58, },
+        { .gm = 7, .pga = 15, .pad = 10, .dac = 0, .bb_mult = 71, },
+        { .gm = 7, .pga = 15, .pad = 10, .dac = 0, .bb_mult = 69, },
+        { .gm = 7, .pga = 15, .pad = 10, .dac = 0, .bb_mult = 67, },
+        { .gm = 7, .pga = 15, .pad = 10, .dac = 0, .bb_mult = 65, },
+        { .gm = 7, .pga = 15, .pad = 10, .dac = 0, .bb_mult = 63, },
+        { .gm = 7, .pga = 15, .pad = 10, .dac = 0, .bb_mult = 61, },
+        { .gm = 7, .pga = 15, .pad = 10, .dac = 0, .bb_mult = 60, },
+        { .gm = 7, .pga = 15, .pad = 10, .dac = 0, .bb_mult = 58, },
+        { .gm = 7, .pga = 15, .pad = 9, .dac = 0, .bb_mult = 70, },
+        { .gm = 7, .pga = 15, .pad = 9, .dac = 0, .bb_mult = 68, },
+        { .gm = 7, .pga = 15, .pad = 9, .dac = 0, .bb_mult = 66, },
+        { .gm = 7, .pga = 15, .pad = 9, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 15, .pad = 9, .dac = 0, .bb_mult = 62, },
+        { .gm = 7, .pga = 15, .pad = 9, .dac = 0, .bb_mult = 61, },
+        { .gm = 7, .pga = 15, .pad = 9, .dac = 0, .bb_mult = 59, },
+        { .gm = 7, .pga = 15, .pad = 9, .dac = 0, .bb_mult = 57, },
+        { .gm = 7, .pga = 15, .pad = 9, .dac = 0, .bb_mult = 56, },
+        { .gm = 7, .pga = 14, .pad = 9, .dac = 0, .bb_mult = 68, },
+        { .gm = 7, .pga = 14, .pad = 9, .dac = 0, .bb_mult = 66, },
+        { .gm = 7, .pga = 14, .pad = 9, .dac = 0, .bb_mult = 65, },
+        { .gm = 7, .pga = 14, .pad = 9, .dac = 0, .bb_mult = 63, },
+        { .gm = 7, .pga = 14, .pad = 9, .dac = 0, .bb_mult = 61, },
+        { .gm = 7, .pga = 14, .pad = 9, .dac = 0, .bb_mult = 59, },
+        { .gm = 7, .pga = 14, .pad = 9, .dac = 0, .bb_mult = 58, },
+        { .gm = 7, .pga = 13, .pad = 9, .dac = 0, .bb_mult = 70, },
+        { .gm = 7, .pga = 13, .pad = 9, .dac = 0, .bb_mult = 68, },
+        { .gm = 7, .pga = 13, .pad = 9, .dac = 0, .bb_mult = 66, },
+        { .gm = 7, .pga = 13, .pad = 9, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 13, .pad = 9, .dac = 0, .bb_mult = 63, },
+        { .gm = 7, .pga = 13, .pad = 9, .dac = 0, .bb_mult = 61, },
+        { .gm = 7, .pga = 13, .pad = 9, .dac = 0, .bb_mult = 59, },
+        { .gm = 7, .pga = 13, .pad = 9, .dac = 0, .bb_mult = 57, },
+        { .gm = 7, .pga = 13, .pad = 8, .dac = 0, .bb_mult = 70, },
+        { .gm = 7, .pga = 13, .pad = 8, .dac = 0, .bb_mult = 68, },
+        { .gm = 7, .pga = 13, .pad = 8, .dac = 0, .bb_mult = 66, },
+        { .gm = 7, .pga = 13, .pad = 8, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 13, .pad = 8, .dac = 0, .bb_mult = 62, },
+        { .gm = 7, .pga = 13, .pad = 8, .dac = 0, .bb_mult = 60, },
+        { .gm = 7, .pga = 13, .pad = 8, .dac = 0, .bb_mult = 59, },
+        { .gm = 7, .pga = 13, .pad = 8, .dac = 0, .bb_mult = 57, },
+        { .gm = 7, .pga = 12, .pad = 8, .dac = 0, .bb_mult = 70, },
+        { .gm = 7, .pga = 12, .pad = 8, .dac = 0, .bb_mult = 68, },
+        { .gm = 7, .pga = 12, .pad = 8, .dac = 0, .bb_mult = 66, },
+        { .gm = 7, .pga = 12, .pad = 8, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 12, .pad = 8, .dac = 0, .bb_mult = 62, },
+        { .gm = 7, .pga = 12, .pad = 8, .dac = 0, .bb_mult = 61, },
+        { .gm = 7, .pga = 12, .pad = 8, .dac = 0, .bb_mult = 59, },
+        { .gm = 7, .pga = 12, .pad = 8, .dac = 0, .bb_mult = 57, },
+        { .gm = 7, .pga = 12, .pad = 7, .dac = 0, .bb_mult = 70, },
+        { .gm = 7, .pga = 12, .pad = 7, .dac = 0, .bb_mult = 68, },
+        { .gm = 7, .pga = 12, .pad = 7, .dac = 0, .bb_mult = 66, },
+        { .gm = 7, .pga = 12, .pad = 7, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 12, .pad = 7, .dac = 0, .bb_mult = 62, },
+        { .gm = 7, .pga = 12, .pad = 7, .dac = 0, .bb_mult = 61, },
+        { .gm = 7, .pga = 12, .pad = 7, .dac = 0, .bb_mult = 59, },
+        { .gm = 7, .pga = 12, .pad = 7, .dac = 0, .bb_mult = 57, },
+        { .gm = 7, .pga = 11, .pad = 7, .dac = 0, .bb_mult = 70, },
+        { .gm = 7, .pga = 11, .pad = 7, .dac = 0, .bb_mult = 68, },
+        { .gm = 7, .pga = 11, .pad = 7, .dac = 0, .bb_mult = 66, },
+        { .gm = 7, .pga = 11, .pad = 7, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 11, .pad = 7, .dac = 0, .bb_mult = 62, },
+        { .gm = 7, .pga = 11, .pad = 7, .dac = 0, .bb_mult = 61, },
+        { .gm = 7, .pga = 11, .pad = 7, .dac = 0, .bb_mult = 59, },
+        { .gm = 7, .pga = 11, .pad = 7, .dac = 0, .bb_mult = 57, },
+        { .gm = 7, .pga = 11, .pad = 6, .dac = 0, .bb_mult = 69, },
+        { .gm = 7, .pga = 11, .pad = 6, .dac = 0, .bb_mult = 67, },
+        { .gm = 7, .pga = 11, .pad = 6, .dac = 0, .bb_mult = 65, },
+        { .gm = 7, .pga = 11, .pad = 6, .dac = 0, .bb_mult = 63, },
+        { .gm = 7, .pga = 11, .pad = 6, .dac = 0, .bb_mult = 62, },
+        { .gm = 7, .pga = 11, .pad = 6, .dac = 0, .bb_mult = 60, },
+};
+
+static struct lpphy_tx_gain_table_entry lpphy_rev1_nopa_tx_gain_table[] = {
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 152, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 147, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 143, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 139, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 135, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 131, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 128, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 124, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 121, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 117, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 114, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 111, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 107, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 104, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 101, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 99, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 96, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 93, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 90, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 88, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 85, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 83, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 81, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 78, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 76, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 74, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 72, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 70, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 68, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 66, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 62, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 60, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 59, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 57, },
+        { .gm = 7, .pga = 15, .pad = 13, .dac = 0, .bb_mult = 72, },
+        { .gm = 7, .pga = 15, .pad = 13, .dac = 0, .bb_mult = 70, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 68, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 66, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 62, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 60, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 59, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 57, },
+        { .gm = 7, .pga = 15, .pad = 13, .dac = 0, .bb_mult = 72, },
+        { .gm = 7, .pga = 15, .pad = 13, .dac = 0, .bb_mult = 70, },
+        { .gm = 7, .pga = 15, .pad = 13, .dac = 0, .bb_mult = 68, },
+        { .gm = 7, .pga = 15, .pad = 13, .dac = 0, .bb_mult = 66, },
+        { .gm = 7, .pga = 15, .pad = 13, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 15, .pad = 13, .dac = 0, .bb_mult = 62, },
+        { .gm = 7, .pga = 15, .pad = 13, .dac = 0, .bb_mult = 60, },
+        { .gm = 7, .pga = 15, .pad = 13, .dac = 0, .bb_mult = 59, },
+        { .gm = 7, .pga = 15, .pad = 13, .dac = 0, .bb_mult = 57, },
+        { .gm = 7, .pga = 15, .pad = 12, .dac = 0, .bb_mult = 71, },
+        { .gm = 7, .pga = 15, .pad = 12, .dac = 0, .bb_mult = 69, },
+        { .gm = 7, .pga = 15, .pad = 12, .dac = 0, .bb_mult = 67, },
+        { .gm = 7, .pga = 15, .pad = 12, .dac = 0, .bb_mult = 65, },
+        { .gm = 7, .pga = 15, .pad = 12, .dac = 0, .bb_mult = 63, },
+        { .gm = 7, .pga = 15, .pad = 12, .dac = 0, .bb_mult = 62, },
+        { .gm = 7, .pga = 15, .pad = 12, .dac = 0, .bb_mult = 60, },
+        { .gm = 7, .pga = 15, .pad = 12, .dac = 0, .bb_mult = 58, },
+        { .gm = 7, .pga = 15, .pad = 12, .dac = 0, .bb_mult = 57, },
+        { .gm = 7, .pga = 15, .pad = 11, .dac = 0, .bb_mult = 70, },
+        { .gm = 7, .pga = 15, .pad = 11, .dac = 0, .bb_mult = 68, },
+        { .gm = 7, .pga = 15, .pad = 11, .dac = 0, .bb_mult = 66, },
+        { .gm = 7, .pga = 15, .pad = 11, .dac = 0, .bb_mult = 65, },
+        { .gm = 7, .pga = 15, .pad = 11, .dac = 0, .bb_mult = 63, },
+        { .gm = 7, .pga = 15, .pad = 11, .dac = 0, .bb_mult = 61, },
+        { .gm = 7, .pga = 15, .pad = 11, .dac = 0, .bb_mult = 59, },
+        { .gm = 7, .pga = 15, .pad = 11, .dac = 0, .bb_mult = 58, },
+        { .gm = 7, .pga = 15, .pad = 10, .dac = 0, .bb_mult = 71, },
+        { .gm = 7, .pga = 15, .pad = 10, .dac = 0, .bb_mult = 69, },
+        { .gm = 7, .pga = 15, .pad = 10, .dac = 0, .bb_mult = 67, },
+        { .gm = 7, .pga = 15, .pad = 10, .dac = 0, .bb_mult = 65, },
+        { .gm = 7, .pga = 15, .pad = 10, .dac = 0, .bb_mult = 63, },
+        { .gm = 7, .pga = 15, .pad = 10, .dac = 0, .bb_mult = 61, },
+        { .gm = 7, .pga = 15, .pad = 10, .dac = 0, .bb_mult = 60, },
+        { .gm = 7, .pga = 15, .pad = 10, .dac = 0, .bb_mult = 58, },
+        { .gm = 7, .pga = 15, .pad = 10, .dac = 0, .bb_mult = 56, },
+        { .gm = 7, .pga = 15, .pad = 9, .dac = 0, .bb_mult = 70, },
+        { .gm = 7, .pga = 15, .pad = 9, .dac = 0, .bb_mult = 68, },
+        { .gm = 7, .pga = 15, .pad = 9, .dac = 0, .bb_mult = 66, },
+        { .gm = 7, .pga = 15, .pad = 9, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 15, .pad = 9, .dac = 0, .bb_mult = 62, },
+        { .gm = 7, .pga = 15, .pad = 9, .dac = 0, .bb_mult = 60, },
+        { .gm = 7, .pga = 15, .pad = 9, .dac = 0, .bb_mult = 59, },
+        { .gm = 7, .pga = 14, .pad = 9, .dac = 0, .bb_mult = 72, },
+        { .gm = 7, .pga = 14, .pad = 9, .dac = 0, .bb_mult = 70, },
+        { .gm = 7, .pga = 14, .pad = 9, .dac = 0, .bb_mult = 68, },
+        { .gm = 7, .pga = 14, .pad = 9, .dac = 0, .bb_mult = 66, },
+        { .gm = 7, .pga = 14, .pad = 9, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 14, .pad = 9, .dac = 0, .bb_mult = 62, },
+        { .gm = 7, .pga = 14, .pad = 9, .dac = 0, .bb_mult = 60, },
+        { .gm = 7, .pga = 14, .pad = 9, .dac = 0, .bb_mult = 59, },
+        { .gm = 7, .pga = 13, .pad = 9, .dac = 0, .bb_mult = 72, },
+        { .gm = 7, .pga = 13, .pad = 9, .dac = 0, .bb_mult = 70, },
+        { .gm = 7, .pga = 13, .pad = 9, .dac = 0, .bb_mult = 68, },
+        { .gm = 7, .pga = 13, .pad = 9, .dac = 0, .bb_mult = 66, },
+        { .gm = 7, .pga = 13, .pad = 9, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 13, .pad = 9, .dac = 0, .bb_mult = 63, },
+        { .gm = 7, .pga = 13, .pad = 9, .dac = 0, .bb_mult = 61, },
+        { .gm = 7, .pga = 13, .pad = 9, .dac = 0, .bb_mult = 59, },
+        { .gm = 7, .pga = 13, .pad = 9, .dac = 0, .bb_mult = 57, },
+        { .gm = 7, .pga = 13, .pad = 8, .dac = 0, .bb_mult = 72, },
+        { .gm = 7, .pga = 13, .pad = 8, .dac = 0, .bb_mult = 70, },
+        { .gm = 7, .pga = 13, .pad = 8, .dac = 0, .bb_mult = 68, },
+        { .gm = 7, .pga = 13, .pad = 8, .dac = 0, .bb_mult = 66, },
+        { .gm = 7, .pga = 13, .pad = 8, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 13, .pad = 8, .dac = 0, .bb_mult = 62, },
+        { .gm = 7, .pga = 13, .pad = 8, .dac = 0, .bb_mult = 60, },
+        { .gm = 7, .pga = 13, .pad = 8, .dac = 0, .bb_mult = 59, },
+        { .gm = 7, .pga = 12, .pad = 8, .dac = 0, .bb_mult = 72, },
+        { .gm = 7, .pga = 12, .pad = 8, .dac = 0, .bb_mult = 70, },
+        { .gm = 7, .pga = 12, .pad = 8, .dac = 0, .bb_mult = 68, },
+        { .gm = 7, .pga = 12, .pad = 8, .dac = 0, .bb_mult = 66, },
+        { .gm = 7, .pga = 12, .pad = 8, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 12, .pad = 8, .dac = 0, .bb_mult = 62, },
+        { .gm = 7, .pga = 12, .pad = 8, .dac = 0, .bb_mult = 61, },
+        { .gm = 7, .pga = 12, .pad = 8, .dac = 0, .bb_mult = 59, },
+        { .gm = 7, .pga = 12, .pad = 7, .dac = 0, .bb_mult = 73, },
+        { .gm = 7, .pga = 12, .pad = 7, .dac = 0, .bb_mult = 71, },
+        { .gm = 7, .pga = 12, .pad = 7, .dac = 0, .bb_mult = 69, },
+        { .gm = 7, .pga = 12, .pad = 7, .dac = 0, .bb_mult = 67, },
+        { .gm = 7, .pga = 12, .pad = 7, .dac = 0, .bb_mult = 65, },
+        { .gm = 7, .pga = 12, .pad = 7, .dac = 0, .bb_mult = 63, },
+        { .gm = 7, .pga = 12, .pad = 7, .dac = 0, .bb_mult = 61, },
+        { .gm = 7, .pga = 12, .pad = 7, .dac = 0, .bb_mult = 59, },
+        { .gm = 7, .pga = 11, .pad = 7, .dac = 0, .bb_mult = 72, },
+        { .gm = 7, .pga = 11, .pad = 7, .dac = 0, .bb_mult = 70, },
+        { .gm = 7, .pga = 11, .pad = 7, .dac = 0, .bb_mult = 68, },
+        { .gm = 7, .pga = 11, .pad = 7, .dac = 0, .bb_mult = 66, },
+        { .gm = 7, .pga = 11, .pad = 7, .dac = 0, .bb_mult = 65, },
+        { .gm = 7, .pga = 11, .pad = 7, .dac = 0, .bb_mult = 63, },
+        { .gm = 7, .pga = 11, .pad = 7, .dac = 0, .bb_mult = 61, },
+        { .gm = 7, .pga = 11, .pad = 7, .dac = 0, .bb_mult = 59, },
+        { .gm = 7, .pga = 11, .pad = 6, .dac = 0, .bb_mult = 73, },
+        { .gm = 7, .pga = 11, .pad = 6, .dac = 0, .bb_mult = 71, },
+};
+
+static struct lpphy_tx_gain_table_entry lpphy_rev1_2ghz_tx_gain_table[] = {
+        { .gm = 4, .pga = 15, .pad = 9, .dac = 0, .bb_mult = 85, },
+        { .gm = 4, .pga = 15, .pad = 9, .dac = 0, .bb_mult = 81, },
+        { .gm = 4, .pga = 15, .pad = 9, .dac = 0, .bb_mult = 78, },
+        { .gm = 4, .pga = 15, .pad = 9, .dac = 0, .bb_mult = 76, },
+        { .gm = 4, .pga = 15, .pad = 9, .dac = 0, .bb_mult = 74, },
+        { .gm = 4, .pga = 15, .pad = 9, .dac = 0, .bb_mult = 72, },
+        { .gm = 4, .pga = 15, .pad = 9, .dac = 0, .bb_mult = 70, },
+        { .gm = 4, .pga = 15, .pad = 9, .dac = 0, .bb_mult = 68, },
+        { .gm = 4, .pga = 15, .pad = 9, .dac = 0, .bb_mult = 66, },
+        { .gm = 4, .pga = 15, .pad = 9, .dac = 0, .bb_mult = 64, },
+        { .gm = 4, .pga = 15, .pad = 9, .dac = 0, .bb_mult = 62, },
+        { .gm = 4, .pga = 15, .pad = 9, .dac = 0, .bb_mult = 60, },
+        { .gm = 4, .pga = 15, .pad = 9, .dac = 0, .bb_mult = 59, },
+        { .gm = 4, .pga = 14, .pad = 9, .dac = 0, .bb_mult = 72, },
+        { .gm = 4, .pga = 14, .pad = 9, .dac = 0, .bb_mult = 70, },
+        { .gm = 4, .pga = 14, .pad = 9, .dac = 0, .bb_mult = 68, },
+        { .gm = 4, .pga = 14, .pad = 9, .dac = 0, .bb_mult = 66, },
+        { .gm = 4, .pga = 14, .pad = 9, .dac = 0, .bb_mult = 64, },
+        { .gm = 4, .pga = 14, .pad = 9, .dac = 0, .bb_mult = 62, },
+        { .gm = 4, .pga = 14, .pad = 9, .dac = 0, .bb_mult = 60, },
+        { .gm = 4, .pga = 14, .pad = 9, .dac = 0, .bb_mult = 59, },
+        { .gm = 4, .pga = 13, .pad = 9, .dac = 0, .bb_mult = 72, },
+        { .gm = 4, .pga = 13, .pad = 9, .dac = 0, .bb_mult = 70, },
+        { .gm = 4, .pga = 13, .pad = 9, .dac = 0, .bb_mult = 68, },
+        { .gm = 4, .pga = 13, .pad = 9, .dac = 0, .bb_mult = 66, },
+        { .gm = 4, .pga = 13, .pad = 9, .dac = 0, .bb_mult = 64, },
+        { .gm = 4, .pga = 13, .pad = 9, .dac = 0, .bb_mult = 63, },
+        { .gm = 4, .pga = 13, .pad = 9, .dac = 0, .bb_mult = 61, },
+        { .gm = 4, .pga = 13, .pad = 9, .dac = 0, .bb_mult = 59, },
+        { .gm = 4, .pga = 13, .pad = 9, .dac = 0, .bb_mult = 57, },
+        { .gm = 4, .pga = 13, .pad = 8, .dac = 0, .bb_mult = 72, },
+        { .gm = 4, .pga = 13, .pad = 8, .dac = 0, .bb_mult = 70, },
+        { .gm = 4, .pga = 13, .pad = 8, .dac = 0, .bb_mult = 68, },
+        { .gm = 4, .pga = 13, .pad = 8, .dac = 0, .bb_mult = 66, },
+        { .gm = 4, .pga = 13, .pad = 8, .dac = 0, .bb_mult = 64, },
+        { .gm = 4, .pga = 13, .pad = 8, .dac = 0, .bb_mult = 62, },
+        { .gm = 4, .pga = 13, .pad = 8, .dac = 0, .bb_mult = 60, },
+        { .gm = 4, .pga = 13, .pad = 8, .dac = 0, .bb_mult = 59, },
+        { .gm = 4, .pga = 12, .pad = 8, .dac = 0, .bb_mult = 72, },
+        { .gm = 4, .pga = 12, .pad = 8, .dac = 0, .bb_mult = 70, },
+        { .gm = 4, .pga = 12, .pad = 8, .dac = 0, .bb_mult = 68, },
+        { .gm = 4, .pga = 12, .pad = 8, .dac = 0, .bb_mult = 66, },
+        { .gm = 4, .pga = 12, .pad = 8, .dac = 0, .bb_mult = 64, },
+        { .gm = 4, .pga = 12, .pad = 8, .dac = 0, .bb_mult = 62, },
+        { .gm = 4, .pga = 12, .pad = 8, .dac = 0, .bb_mult = 61, },
+        { .gm = 4, .pga = 12, .pad = 8, .dac = 0, .bb_mult = 59, },
+        { .gm = 4, .pga = 12, .pad = 7, .dac = 0, .bb_mult = 73, },
+        { .gm = 4, .pga = 12, .pad = 7, .dac = 0, .bb_mult = 71, },
+        { .gm = 4, .pga = 12, .pad = 7, .dac = 0, .bb_mult = 69, },
+        { .gm = 4, .pga = 12, .pad = 7, .dac = 0, .bb_mult = 67, },
+        { .gm = 4, .pga = 12, .pad = 7, .dac = 0, .bb_mult = 65, },
+        { .gm = 4, .pga = 12, .pad = 7, .dac = 0, .bb_mult = 63, },
+        { .gm = 4, .pga = 12, .pad = 7, .dac = 0, .bb_mult = 61, },
+        { .gm = 4, .pga = 12, .pad = 7, .dac = 0, .bb_mult = 59, },
+        { .gm = 4, .pga = 11, .pad = 7, .dac = 0, .bb_mult = 72, },
+        { .gm = 4, .pga = 11, .pad = 7, .dac = 0, .bb_mult = 70, },
+        { .gm = 4, .pga = 11, .pad = 7, .dac = 0, .bb_mult = 68, },
+        { .gm = 4, .pga = 11, .pad = 7, .dac = 0, .bb_mult = 66, },
+        { .gm = 4, .pga = 11, .pad = 7, .dac = 0, .bb_mult = 65, },
+        { .gm = 4, .pga = 11, .pad = 7, .dac = 0, .bb_mult = 63, },
+        { .gm = 4, .pga = 11, .pad = 7, .dac = 0, .bb_mult = 61, },
+        { .gm = 4, .pga = 11, .pad = 7, .dac = 0, .bb_mult = 59, },
+        { .gm = 4, .pga = 11, .pad = 6, .dac = 0, .bb_mult = 73, },
+        { .gm = 4, .pga = 11, .pad = 6, .dac = 0, .bb_mult = 71, },
+        { .gm = 4, .pga = 11, .pad = 6, .dac = 0, .bb_mult = 69, },
+        { .gm = 4, .pga = 11, .pad = 6, .dac = 0, .bb_mult = 67, },
+        { .gm = 4, .pga = 11, .pad = 6, .dac = 0, .bb_mult = 65, },
+        { .gm = 4, .pga = 11, .pad = 6, .dac = 0, .bb_mult = 63, },
+        { .gm = 4, .pga = 11, .pad = 6, .dac = 0, .bb_mult = 61, },
+        { .gm = 4, .pga = 11, .pad = 6, .dac = 0, .bb_mult = 60, },
+        { .gm = 4, .pga = 10, .pad = 6, .dac = 0, .bb_mult = 72, },
+        { .gm = 4, .pga = 10, .pad = 6, .dac = 0, .bb_mult = 70, },
+        { .gm = 4, .pga = 10, .pad = 6, .dac = 0, .bb_mult = 68, },
+        { .gm = 4, .pga = 10, .pad = 6, .dac = 0, .bb_mult = 66, },
+        { .gm = 4, .pga = 10, .pad = 6, .dac = 0, .bb_mult = 64, },
+        { .gm = 4, .pga = 10, .pad = 6, .dac = 0, .bb_mult = 62, },
+        { .gm = 4, .pga = 10, .pad = 6, .dac = 0, .bb_mult = 60, },
+        { .gm = 4, .pga = 10, .pad = 6, .dac = 0, .bb_mult = 59, },
+        { .gm = 4, .pga = 10, .pad = 5, .dac = 0, .bb_mult = 72, },
+        { .gm = 4, .pga = 10, .pad = 5, .dac = 0, .bb_mult = 70, },
+        { .gm = 4, .pga = 10, .pad = 5, .dac = 0, .bb_mult = 68, },
+        { .gm = 4, .pga = 10, .pad = 5, .dac = 0, .bb_mult = 66, },
+        { .gm = 4, .pga = 10, .pad = 5, .dac = 0, .bb_mult = 64, },
+        { .gm = 4, .pga = 10, .pad = 5, .dac = 0, .bb_mult = 62, },
+        { .gm = 4, .pga = 10, .pad = 5, .dac = 0, .bb_mult = 60, },
+        { .gm = 4, .pga = 10, .pad = 5, .dac = 0, .bb_mult = 59, },
+        { .gm = 4, .pga = 9, .pad = 5, .dac = 0, .bb_mult = 70, },
+        { .gm = 4, .pga = 9, .pad = 5, .dac = 0, .bb_mult = 68, },
+        { .gm = 4, .pga = 9, .pad = 5, .dac = 0, .bb_mult = 66, },
+        { .gm = 4, .pga = 9, .pad = 5, .dac = 0, .bb_mult = 64, },
+        { .gm = 4, .pga = 9, .pad = 5, .dac = 0, .bb_mult = 63, },
+        { .gm = 4, .pga = 9, .pad = 5, .dac = 0, .bb_mult = 61, },
+        { .gm = 4, .pga = 9, .pad = 5, .dac = 0, .bb_mult = 59, },
+        { .gm = 4, .pga = 9, .pad = 4, .dac = 0, .bb_mult = 71, },
+        { .gm = 4, .pga = 9, .pad = 4, .dac = 0, .bb_mult = 69, },
+        { .gm = 4, .pga = 9, .pad = 4, .dac = 0, .bb_mult = 67, },
+        { .gm = 4, .pga = 9, .pad = 4, .dac = 0, .bb_mult = 65, },
+        { .gm = 4, .pga = 9, .pad = 4, .dac = 0, .bb_mult = 63, },
+        { .gm = 4, .pga = 9, .pad = 4, .dac = 0, .bb_mult = 62, },
+        { .gm = 4, .pga = 9, .pad = 4, .dac = 0, .bb_mult = 60, },
+        { .gm = 4, .pga = 9, .pad = 4, .dac = 0, .bb_mult = 58, },
+        { .gm = 4, .pga = 8, .pad = 4, .dac = 0, .bb_mult = 70, },
+        { .gm = 4, .pga = 8, .pad = 4, .dac = 0, .bb_mult = 68, },
+        { .gm = 4, .pga = 8, .pad = 4, .dac = 0, .bb_mult = 66, },
+        { .gm = 4, .pga = 8, .pad = 4, .dac = 0, .bb_mult = 65, },
+        { .gm = 4, .pga = 8, .pad = 4, .dac = 0, .bb_mult = 63, },
+        { .gm = 4, .pga = 8, .pad = 4, .dac = 0, .bb_mult = 61, },
+        { .gm = 4, .pga = 8, .pad = 4, .dac = 0, .bb_mult = 59, },
+        { .gm = 4, .pga = 7, .pad = 4, .dac = 0, .bb_mult = 68, },
+        { .gm = 4, .pga = 7, .pad = 4, .dac = 0, .bb_mult = 66, },
+        { .gm = 4, .pga = 7, .pad = 4, .dac = 0, .bb_mult = 64, },
+        { .gm = 4, .pga = 7, .pad = 4, .dac = 0, .bb_mult = 62, },
+        { .gm = 4, .pga = 7, .pad = 4, .dac = 0, .bb_mult = 61, },
+        { .gm = 4, .pga = 7, .pad = 4, .dac = 0, .bb_mult = 59, },
+        { .gm = 4, .pga = 7, .pad = 3, .dac = 0, .bb_mult = 67, },
+        { .gm = 4, .pga = 7, .pad = 3, .dac = 0, .bb_mult = 65, },
+        { .gm = 4, .pga = 7, .pad = 3, .dac = 0, .bb_mult = 63, },
+        { .gm = 4, .pga = 7, .pad = 3, .dac = 0, .bb_mult = 62, },
+        { .gm = 4, .pga = 7, .pad = 3, .dac = 0, .bb_mult = 60, },
+        { .gm = 4, .pga = 6, .pad = 3, .dac = 0, .bb_mult = 65, },
+        { .gm = 4, .pga = 6, .pad = 3, .dac = 0, .bb_mult = 63, },
+        { .gm = 4, .pga = 6, .pad = 3, .dac = 0, .bb_mult = 61, },
+        { .gm = 4, .pga = 6, .pad = 3, .dac = 0, .bb_mult = 60, },
+        { .gm = 4, .pga = 6, .pad = 3, .dac = 0, .bb_mult = 58, },
+        { .gm = 4, .pga = 5, .pad = 3, .dac = 0, .bb_mult = 68, },
+        { .gm = 4, .pga = 5, .pad = 3, .dac = 0, .bb_mult = 66, },
+        { .gm = 4, .pga = 5, .pad = 3, .dac = 0, .bb_mult = 64, },
+        { .gm = 4, .pga = 5, .pad = 3, .dac = 0, .bb_mult = 62, },
+};
+
+static struct lpphy_tx_gain_table_entry lpphy_rev1_5ghz_tx_gain_table[] = {
+        { .gm = 7, .pga = 15, .pad = 15, .dac = 0, .bb_mult = 99, },
+        { .gm = 7, .pga = 15, .pad = 15, .dac = 0, .bb_mult = 96, },
+        { .gm = 7, .pga = 15, .pad = 15, .dac = 0, .bb_mult = 93, },
+        { .gm = 7, .pga = 15, .pad = 15, .dac = 0, .bb_mult = 90, },
+        { .gm = 7, .pga = 15, .pad = 15, .dac = 0, .bb_mult = 88, },
+        { .gm = 7, .pga = 15, .pad = 15, .dac = 0, .bb_mult = 85, },
+        { .gm = 7, .pga = 15, .pad = 15, .dac = 0, .bb_mult = 83, },
+        { .gm = 7, .pga = 15, .pad = 15, .dac = 0, .bb_mult = 81, },
+        { .gm = 7, .pga = 15, .pad = 15, .dac = 0, .bb_mult = 78, },
+        { .gm = 7, .pga = 15, .pad = 15, .dac = 0, .bb_mult = 76, },
+        { .gm = 7, .pga = 15, .pad = 15, .dac = 0, .bb_mult = 74, },
+        { .gm = 7, .pga = 15, .pad = 15, .dac = 0, .bb_mult = 72, },
+        { .gm = 7, .pga = 15, .pad = 15, .dac = 0, .bb_mult = 70, },
+        { .gm = 7, .pga = 15, .pad = 15, .dac = 0, .bb_mult = 68, },
+        { .gm = 7, .pga = 15, .pad = 15, .dac = 0, .bb_mult = 66, },
+        { .gm = 7, .pga = 15, .pad = 15, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 15, .pad = 15, .dac = 0, .bb_mult = 62, },
+        { .gm = 7, .pga = 15, .pad = 15, .dac = 0, .bb_mult = 60, },
+        { .gm = 7, .pga = 15, .pad = 15, .dac = 0, .bb_mult = 59, },
+        { .gm = 7, .pga = 15, .pad = 15, .dac = 0, .bb_mult = 57, },
+        { .gm = 7, .pga = 15, .pad = 15, .dac = 0, .bb_mult = 55, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 72, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 70, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 68, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 66, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 62, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 60, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 58, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 56, },
+        { .gm = 7, .pga = 15, .pad = 14, .dac = 0, .bb_mult = 55, },
+        { .gm = 7, .pga = 15, .pad = 13, .dac = 0, .bb_mult = 71, },
+        { .gm = 7, .pga = 15, .pad = 13, .dac = 0, .bb_mult = 69, },
+        { .gm = 7, .pga = 15, .pad = 13, .dac = 0, .bb_mult = 67, },
+        { .gm = 7, .pga = 15, .pad = 13, .dac = 0, .bb_mult = 65, },
+        { .gm = 7, .pga = 15, .pad = 13, .dac = 0, .bb_mult = 63, },
+        { .gm = 7, .pga = 15, .pad = 13, .dac = 0, .bb_mult = 62, },
+        { .gm = 7, .pga = 15, .pad = 13, .dac = 0, .bb_mult = 60, },
+        { .gm = 7, .pga = 15, .pad = 13, .dac = 0, .bb_mult = 58, },
+        { .gm = 7, .pga = 15, .pad = 13, .dac = 0, .bb_mult = 56, },
+        { .gm = 7, .pga = 15, .pad = 12, .dac = 0, .bb_mult = 72, },
+        { .gm = 7, .pga = 15, .pad = 12, .dac = 0, .bb_mult = 70, },
+        { .gm = 7, .pga = 15, .pad = 12, .dac = 0, .bb_mult = 68, },
+        { .gm = 7, .pga = 15, .pad = 12, .dac = 0, .bb_mult = 66, },
+        { .gm = 7, .pga = 15, .pad = 12, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 15, .pad = 12, .dac = 0, .bb_mult = 62, },
+        { .gm = 7, .pga = 15, .pad = 12, .dac = 0, .bb_mult = 60, },
+        { .gm = 7, .pga = 15, .pad = 12, .dac = 0, .bb_mult = 59, },
+        { .gm = 7, .pga = 15, .pad = 12, .dac = 0, .bb_mult = 57, },
+        { .gm = 7, .pga = 15, .pad = 11, .dac = 0, .bb_mult = 73, },
+        { .gm = 7, .pga = 15, .pad = 11, .dac = 0, .bb_mult = 71, },
+        { .gm = 7, .pga = 15, .pad = 11, .dac = 0, .bb_mult = 69, },
+        { .gm = 7, .pga = 15, .pad = 11, .dac = 0, .bb_mult = 67, },
+        { .gm = 7, .pga = 15, .pad = 11, .dac = 0, .bb_mult = 65, },
+        { .gm = 7, .pga = 15, .pad = 11, .dac = 0, .bb_mult = 63, },
+        { .gm = 7, .pga = 15, .pad = 11, .dac = 0, .bb_mult = 61, },
+        { .gm = 7, .pga = 15, .pad = 11, .dac = 0, .bb_mult = 60, },
+        { .gm = 7, .pga = 15, .pad = 11, .dac = 0, .bb_mult = 58, },
+        { .gm = 7, .pga = 15, .pad = 10, .dac = 0, .bb_mult = 71, },
+        { .gm = 7, .pga = 15, .pad = 10, .dac = 0, .bb_mult = 69, },
+        { .gm = 7, .pga = 15, .pad = 10, .dac = 0, .bb_mult = 67, },
+        { .gm = 7, .pga = 15, .pad = 10, .dac = 0, .bb_mult = 65, },
+        { .gm = 7, .pga = 15, .pad = 10, .dac = 0, .bb_mult = 63, },
+        { .gm = 7, .pga = 15, .pad = 10, .dac = 0, .bb_mult = 61, },
+        { .gm = 7, .pga = 15, .pad = 10, .dac = 0, .bb_mult = 60, },
+        { .gm = 7, .pga = 15, .pad = 10, .dac = 0, .bb_mult = 58, },
+        { .gm = 7, .pga = 15, .pad = 9, .dac = 0, .bb_mult = 70, },
+        { .gm = 7, .pga = 15, .pad = 9, .dac = 0, .bb_mult = 68, },
+        { .gm = 7, .pga = 15, .pad = 9, .dac = 0, .bb_mult = 66, },
+        { .gm = 7, .pga = 15, .pad = 9, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 15, .pad = 9, .dac = 0, .bb_mult = 62, },
+        { .gm = 7, .pga = 15, .pad = 9, .dac = 0, .bb_mult = 61, },
+        { .gm = 7, .pga = 15, .pad = 9, .dac = 0, .bb_mult = 59, },
+        { .gm = 7, .pga = 15, .pad = 9, .dac = 0, .bb_mult = 57, },
+        { .gm = 7, .pga = 15, .pad = 9, .dac = 0, .bb_mult = 56, },
+        { .gm = 7, .pga = 14, .pad = 9, .dac = 0, .bb_mult = 68, },
+        { .gm = 7, .pga = 14, .pad = 9, .dac = 0, .bb_mult = 66, },
+        { .gm = 7, .pga = 14, .pad = 9, .dac = 0, .bb_mult = 65, },
+        { .gm = 7, .pga = 14, .pad = 9, .dac = 0, .bb_mult = 63, },
+        { .gm = 7, .pga = 14, .pad = 9, .dac = 0, .bb_mult = 61, },
+        { .gm = 7, .pga = 14, .pad = 9, .dac = 0, .bb_mult = 59, },
+        { .gm = 7, .pga = 14, .pad = 9, .dac = 0, .bb_mult = 58, },
+        { .gm = 7, .pga = 13, .pad = 9, .dac = 0, .bb_mult = 70, },
+        { .gm = 7, .pga = 13, .pad = 9, .dac = 0, .bb_mult = 68, },
+        { .gm = 7, .pga = 13, .pad = 9, .dac = 0, .bb_mult = 66, },
+        { .gm = 7, .pga = 13, .pad = 9, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 13, .pad = 9, .dac = 0, .bb_mult = 63, },
+        { .gm = 7, .pga = 13, .pad = 9, .dac = 0, .bb_mult = 61, },
+        { .gm = 7, .pga = 13, .pad = 9, .dac = 0, .bb_mult = 59, },
+        { .gm = 7, .pga = 13, .pad = 9, .dac = 0, .bb_mult = 57, },
+        { .gm = 7, .pga = 13, .pad = 8, .dac = 0, .bb_mult = 70, },
+        { .gm = 7, .pga = 13, .pad = 8, .dac = 0, .bb_mult = 68, },
+        { .gm = 7, .pga = 13, .pad = 8, .dac = 0, .bb_mult = 66, },
+        { .gm = 7, .pga = 13, .pad = 8, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 13, .pad = 8, .dac = 0, .bb_mult = 62, },
+        { .gm = 7, .pga = 13, .pad = 8, .dac = 0, .bb_mult = 60, },
+        { .gm = 7, .pga = 13, .pad = 8, .dac = 0, .bb_mult = 59, },
+        { .gm = 7, .pga = 13, .pad = 8, .dac = 0, .bb_mult = 57, },
+        { .gm = 7, .pga = 12, .pad = 8, .dac = 0, .bb_mult = 70, },
+        { .gm = 7, .pga = 12, .pad = 8, .dac = 0, .bb_mult = 68, },
+        { .gm = 7, .pga = 12, .pad = 8, .dac = 0, .bb_mult = 66, },
+        { .gm = 7, .pga = 12, .pad = 8, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 12, .pad = 8, .dac = 0, .bb_mult = 62, },
+        { .gm = 7, .pga = 12, .pad = 8, .dac = 0, .bb_mult = 61, },
+        { .gm = 7, .pga = 12, .pad = 8, .dac = 0, .bb_mult = 59, },
+        { .gm = 7, .pga = 12, .pad = 8, .dac = 0, .bb_mult = 57, },
+        { .gm = 7, .pga = 12, .pad = 7, .dac = 0, .bb_mult = 70, },
+        { .gm = 7, .pga = 12, .pad = 7, .dac = 0, .bb_mult = 68, },
+        { .gm = 7, .pga = 12, .pad = 7, .dac = 0, .bb_mult = 66, },
+        { .gm = 7, .pga = 12, .pad = 7, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 12, .pad = 7, .dac = 0, .bb_mult = 62, },
+        { .gm = 7, .pga = 12, .pad = 7, .dac = 0, .bb_mult = 61, },
+        { .gm = 7, .pga = 12, .pad = 7, .dac = 0, .bb_mult = 59, },
+        { .gm = 7, .pga = 12, .pad = 7, .dac = 0, .bb_mult = 57, },
+        { .gm = 7, .pga = 11, .pad = 7, .dac = 0, .bb_mult = 70, },
+        { .gm = 7, .pga = 11, .pad = 7, .dac = 0, .bb_mult = 68, },
+        { .gm = 7, .pga = 11, .pad = 7, .dac = 0, .bb_mult = 66, },
+        { .gm = 7, .pga = 11, .pad = 7, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 11, .pad = 7, .dac = 0, .bb_mult = 62, },
+        { .gm = 7, .pga = 11, .pad = 7, .dac = 0, .bb_mult = 61, },
+        { .gm = 7, .pga = 11, .pad = 7, .dac = 0, .bb_mult = 59, },
+        { .gm = 7, .pga = 11, .pad = 7, .dac = 0, .bb_mult = 57, },
+        { .gm = 7, .pga = 11, .pad = 6, .dac = 0, .bb_mult = 69, },
+        { .gm = 7, .pga = 11, .pad = 6, .dac = 0, .bb_mult = 67, },
+        { .gm = 7, .pga = 11, .pad = 6, .dac = 0, .bb_mult = 65, },
+        { .gm = 7, .pga = 11, .pad = 6, .dac = 0, .bb_mult = 63, },
+        { .gm = 7, .pga = 11, .pad = 6, .dac = 0, .bb_mult = 62, },
+        { .gm = 7, .pga = 11, .pad = 6, .dac = 0, .bb_mult = 60, },
+};
+
+static struct lpphy_tx_gain_table_entry lpphy_rev2_nopa_tx_gain_table[] = {
+        { .gm = 255, .pga = 255, .pad = 203, .dac = 0, .bb_mult = 152, },
+        { .gm = 255, .pga = 255, .pad = 203, .dac = 0, .bb_mult = 147, },
+        { .gm = 255, .pga = 255, .pad = 203, .dac = 0, .bb_mult = 143, },
+        { .gm = 255, .pga = 255, .pad = 203, .dac = 0, .bb_mult = 139, },
+        { .gm = 255, .pga = 255, .pad = 203, .dac = 0, .bb_mult = 135, },
+        { .gm = 255, .pga = 255, .pad = 203, .dac = 0, .bb_mult = 131, },
+        { .gm = 255, .pga = 255, .pad = 203, .dac = 0, .bb_mult = 128, },
+        { .gm = 255, .pga = 255, .pad = 203, .dac = 0, .bb_mult = 124, },
+        { .gm = 255, .pga = 255, .pad = 203, .dac = 0, .bb_mult = 121, },
+        { .gm = 255, .pga = 255, .pad = 203, .dac = 0, .bb_mult = 117, },
+        { .gm = 255, .pga = 255, .pad = 203, .dac = 0, .bb_mult = 114, },
+        { .gm = 255, .pga = 255, .pad = 203, .dac = 0, .bb_mult = 111, },
+        { .gm = 255, .pga = 255, .pad = 203, .dac = 0, .bb_mult = 107, },
+        { .gm = 255, .pga = 255, .pad = 203, .dac = 0, .bb_mult = 104, },
+        { .gm = 255, .pga = 255, .pad = 203, .dac = 0, .bb_mult = 101, },
+        { .gm = 255, .pga = 255, .pad = 203, .dac = 0, .bb_mult = 99, },
+        { .gm = 255, .pga = 255, .pad = 203, .dac = 0, .bb_mult = 96, },
+        { .gm = 255, .pga = 255, .pad = 203, .dac = 0, .bb_mult = 93, },
+        { .gm = 255, .pga = 255, .pad = 203, .dac = 0, .bb_mult = 90, },
+        { .gm = 255, .pga = 255, .pad = 203, .dac = 0, .bb_mult = 88, },
+        { .gm = 255, .pga = 255, .pad = 203, .dac = 0, .bb_mult = 85, },
+        { .gm = 255, .pga = 255, .pad = 203, .dac = 0, .bb_mult = 83, },
+        { .gm = 255, .pga = 255, .pad = 203, .dac = 0, .bb_mult = 81, },
+        { .gm = 255, .pga = 255, .pad = 203, .dac = 0, .bb_mult = 78, },
+        { .gm = 255, .pga = 255, .pad = 203, .dac = 0, .bb_mult = 76, },
+        { .gm = 255, .pga = 255, .pad = 203, .dac = 0, .bb_mult = 74, },
+        { .gm = 255, .pga = 255, .pad = 203, .dac = 0, .bb_mult = 72, },
+        { .gm = 255, .pga = 255, .pad = 203, .dac = 0, .bb_mult = 70, },
+        { .gm = 255, .pga = 255, .pad = 203, .dac = 0, .bb_mult = 68, },
+        { .gm = 255, .pga = 255, .pad = 203, .dac = 0, .bb_mult = 66, },
+        { .gm = 255, .pga = 255, .pad = 203, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 255, .pad = 197, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 255, .pad = 192, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 255, .pad = 186, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 255, .pad = 181, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 255, .pad = 176, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 255, .pad = 171, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 255, .pad = 166, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 255, .pad = 161, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 255, .pad = 157, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 255, .pad = 152, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 255, .pad = 148, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 255, .pad = 144, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 255, .pad = 140, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 255, .pad = 136, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 255, .pad = 132, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 255, .pad = 128, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 255, .pad = 124, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 255, .pad = 121, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 255, .pad = 117, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 255, .pad = 114, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 255, .pad = 111, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 255, .pad = 108, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 255, .pad = 105, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 255, .pad = 102, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 255, .pad = 99, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 255, .pad = 96, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 255, .pad = 93, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 255, .pad = 91, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 255, .pad = 88, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 255, .pad = 86, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 255, .pad = 83, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 255, .pad = 81, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 255, .pad = 79, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 255, .pad = 76, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 255, .pad = 74, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 255, .pad = 72, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 255, .pad = 70, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 255, .pad = 68, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 255, .pad = 66, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 255, .pad = 64, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 248, .pad = 64, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 248, .pad = 62, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 241, .pad = 62, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 241, .pad = 60, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 234, .pad = 60, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 234, .pad = 59, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 227, .pad = 59, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 227, .pad = 57, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 221, .pad = 57, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 221, .pad = 55, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 215, .pad = 55, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 215, .pad = 54, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 208, .pad = 54, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 208, .pad = 52, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 203, .pad = 52, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 203, .pad = 51, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 197, .pad = 51, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 197, .pad = 49, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 191, .pad = 49, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 191, .pad = 48, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 186, .pad = 48, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 186, .pad = 47, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 181, .pad = 47, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 181, .pad = 45, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 175, .pad = 45, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 175, .pad = 44, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 170, .pad = 44, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 170, .pad = 43, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 166, .pad = 43, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 166, .pad = 42, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 161, .pad = 42, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 161, .pad = 40, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 156, .pad = 40, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 156, .pad = 39, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 152, .pad = 39, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 152, .pad = 38, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 148, .pad = 38, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 148, .pad = 37, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 143, .pad = 37, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 143, .pad = 36, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 139, .pad = 36, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 139, .pad = 35, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 135, .pad = 35, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 135, .pad = 34, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 132, .pad = 34, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 132, .pad = 33, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 128, .pad = 33, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 128, .pad = 32, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 124, .pad = 32, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 124, .pad = 31, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 121, .pad = 31, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 121, .pad = 30, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 117, .pad = 30, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 117, .pad = 29, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 114, .pad = 29, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 114, .pad = 29, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 111, .pad = 29, .dac = 0, .bb_mult = 64, },
+};
+
+static struct lpphy_tx_gain_table_entry lpphy_rev2_2ghz_tx_gain_table[] = {
+        { .gm = 7, .pga = 99, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 96, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 93, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 90, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 88, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 85, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 83, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 81, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 78, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 76, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 74, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 72, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 70, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 68, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 66, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 64, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 64, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 62, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 62, .pad = 248, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 60, .pad = 248, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 60, .pad = 241, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 59, .pad = 241, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 59, .pad = 234, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 57, .pad = 234, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 57, .pad = 227, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 55, .pad = 227, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 55, .pad = 221, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 54, .pad = 221, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 54, .pad = 215, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 52, .pad = 215, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 52, .pad = 208, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 51, .pad = 208, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 51, .pad = 203, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 49, .pad = 203, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 49, .pad = 197, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 48, .pad = 197, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 48, .pad = 191, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 47, .pad = 191, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 47, .pad = 186, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 45, .pad = 186, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 45, .pad = 181, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 44, .pad = 181, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 44, .pad = 175, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 43, .pad = 175, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 43, .pad = 170, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 42, .pad = 170, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 42, .pad = 166, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 40, .pad = 166, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 40, .pad = 161, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 39, .pad = 161, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 39, .pad = 156, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 38, .pad = 156, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 38, .pad = 152, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 37, .pad = 152, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 37, .pad = 148, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 36, .pad = 148, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 36, .pad = 143, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 35, .pad = 143, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 35, .pad = 139, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 34, .pad = 139, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 34, .pad = 135, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 33, .pad = 135, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 33, .pad = 132, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 32, .pad = 132, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 32, .pad = 128, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 31, .pad = 128, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 31, .pad = 124, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 30, .pad = 124, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 30, .pad = 121, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 29, .pad = 121, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 29, .pad = 117, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 29, .pad = 117, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 29, .pad = 114, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 28, .pad = 114, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 28, .pad = 111, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 27, .pad = 111, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 27, .pad = 108, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 26, .pad = 108, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 26, .pad = 104, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 25, .pad = 104, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 25, .pad = 102, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 25, .pad = 102, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 25, .pad = 99, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 24, .pad = 99, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 24, .pad = 96, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 23, .pad = 96, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 23, .pad = 93, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 23, .pad = 93, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 23, .pad = 90, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 22, .pad = 90, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 22, .pad = 88, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 21, .pad = 88, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 21, .pad = 85, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 21, .pad = 85, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 21, .pad = 83, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 20, .pad = 83, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 20, .pad = 81, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 20, .pad = 81, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 20, .pad = 78, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 19, .pad = 78, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 19, .pad = 76, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 19, .pad = 76, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 19, .pad = 74, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 18, .pad = 74, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 18, .pad = 72, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 18, .pad = 72, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 18, .pad = 70, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 17, .pad = 70, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 17, .pad = 68, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 17, .pad = 68, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 17, .pad = 66, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 16, .pad = 66, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 16, .pad = 64, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 16, .pad = 64, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 16, .pad = 62, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 15, .pad = 62, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 15, .pad = 60, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 15, .pad = 60, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 15, .pad = 59, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 14, .pad = 59, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 14, .pad = 57, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 14, .pad = 57, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 14, .pad = 55, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 14, .pad = 55, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 14, .pad = 54, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 13, .pad = 54, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 13, .pad = 52, .dac = 0, .bb_mult = 64, },
+        { .gm = 7, .pga = 13, .pad = 52, .dac = 0, .bb_mult = 64, },
+};
+
+static struct lpphy_tx_gain_table_entry lpphy_rev2_5ghz_tx_gain_table[] = {
+        { .gm = 255, .pga = 255, .pad = 255, .dac = 0, .bb_mult = 152, },
+        { .gm = 255, .pga = 255, .pad = 255, .dac = 0, .bb_mult = 147, },
+        { .gm = 255, .pga = 255, .pad = 255, .dac = 0, .bb_mult = 143, },
+        { .gm = 255, .pga = 255, .pad = 255, .dac = 0, .bb_mult = 139, },
+        { .gm = 255, .pga = 255, .pad = 255, .dac = 0, .bb_mult = 135, },
+        { .gm = 255, .pga = 255, .pad = 255, .dac = 0, .bb_mult = 131, },
+        { .gm = 255, .pga = 255, .pad = 255, .dac = 0, .bb_mult = 128, },
+        { .gm = 255, .pga = 255, .pad = 255, .dac = 0, .bb_mult = 124, },
+        { .gm = 255, .pga = 255, .pad = 255, .dac = 0, .bb_mult = 121, },
+        { .gm = 255, .pga = 255, .pad = 255, .dac = 0, .bb_mult = 117, },
+        { .gm = 255, .pga = 255, .pad = 255, .dac = 0, .bb_mult = 114, },
+        { .gm = 255, .pga = 255, .pad = 255, .dac = 0, .bb_mult = 111, },
+        { .gm = 255, .pga = 255, .pad = 255, .dac = 0, .bb_mult = 107, },
+        { .gm = 255, .pga = 255, .pad = 255, .dac = 0, .bb_mult = 104, },
+        { .gm = 255, .pga = 255, .pad = 255, .dac = 0, .bb_mult = 101, },
+        { .gm = 255, .pga = 255, .pad = 255, .dac = 0, .bb_mult = 99, },
+        { .gm = 255, .pga = 255, .pad = 255, .dac = 0, .bb_mult = 96, },
+        { .gm = 255, .pga = 255, .pad = 255, .dac = 0, .bb_mult = 93, },
+        { .gm = 255, .pga = 255, .pad = 255, .dac = 0, .bb_mult = 90, },
+        { .gm = 255, .pga = 255, .pad = 255, .dac = 0, .bb_mult = 88, },
+        { .gm = 255, .pga = 255, .pad = 255, .dac = 0, .bb_mult = 85, },
+        { .gm = 255, .pga = 255, .pad = 255, .dac = 0, .bb_mult = 83, },
+        { .gm = 255, .pga = 255, .pad = 255, .dac = 0, .bb_mult = 81, },
+        { .gm = 255, .pga = 255, .pad = 255, .dac = 0, .bb_mult = 78, },
+        { .gm = 255, .pga = 255, .pad = 255, .dac = 0, .bb_mult = 76, },
+        { .gm = 255, .pga = 255, .pad = 255, .dac = 0, .bb_mult = 74, },
+        { .gm = 255, .pga = 255, .pad = 255, .dac = 0, .bb_mult = 72, },
+        { .gm = 255, .pga = 255, .pad = 255, .dac = 0, .bb_mult = 70, },
+        { .gm = 255, .pga = 255, .pad = 255, .dac = 0, .bb_mult = 68, },
+        { .gm = 255, .pga = 255, .pad = 255, .dac = 0, .bb_mult = 66, },
+        { .gm = 255, .pga = 255, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 248, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 241, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 234, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 227, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 221, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 215, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 208, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 203, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 197, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 191, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 186, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 181, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 175, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 170, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 166, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 161, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 156, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 152, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 148, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 143, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 139, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 135, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 132, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 128, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 124, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 121, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 117, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 114, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 111, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 108, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 104, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 102, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 99, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 96, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 93, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 90, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 88, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 85, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 83, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 81, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 78, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 76, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 74, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 72, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 70, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 68, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 66, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 64, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 64, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 62, .pad = 255, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 62, .pad = 248, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 60, .pad = 248, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 60, .pad = 241, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 59, .pad = 241, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 59, .pad = 234, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 57, .pad = 234, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 57, .pad = 227, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 55, .pad = 227, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 55, .pad = 221, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 54, .pad = 221, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 54, .pad = 215, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 52, .pad = 215, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 52, .pad = 208, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 51, .pad = 208, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 51, .pad = 203, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 49, .pad = 203, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 49, .pad = 197, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 48, .pad = 197, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 48, .pad = 191, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 47, .pad = 191, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 47, .pad = 186, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 45, .pad = 186, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 45, .pad = 181, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 44, .pad = 181, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 44, .pad = 175, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 43, .pad = 175, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 43, .pad = 170, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 42, .pad = 170, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 42, .pad = 166, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 40, .pad = 166, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 40, .pad = 161, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 39, .pad = 161, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 39, .pad = 156, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 38, .pad = 156, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 38, .pad = 152, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 37, .pad = 152, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 37, .pad = 148, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 36, .pad = 148, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 36, .pad = 143, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 35, .pad = 143, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 35, .pad = 139, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 34, .pad = 139, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 34, .pad = 135, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 33, .pad = 135, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 33, .pad = 132, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 32, .pad = 132, .dac = 0, .bb_mult = 64, },
+        { .gm = 255, .pga = 32, .pad = 128, .dac = 0, .bb_mult = 64, },
+};
+
+void lpphy_rev0_1_table_init(struct b43_wldev *dev)
+{
+        B43_WARN_ON(dev->phy.rev >= 2);
+
+        b43_lptab_write_bulk(dev, B43_LPTAB8(2, 0),
+                ARRAY_SIZE(lpphy_min_sig_sq_table), lpphy_min_sig_sq_table);
+        b43_lptab_write_bulk(dev, B43_LPTAB16(1, 0),
+                ARRAY_SIZE(lpphy_rev01_noise_scale_table), lpphy_rev01_noise_scale_table);
+        b43_lptab_write_bulk(dev, B43_LPTAB16(14, 0),
+                ARRAY_SIZE(lpphy_crs_gain_nft_table), lpphy_crs_gain_nft_table);
+        b43_lptab_write_bulk(dev, B43_LPTAB16(8, 0),
+                ARRAY_SIZE(lpphy_rev01_filter_control_table), lpphy_rev01_filter_control_table);
+        b43_lptab_write_bulk(dev, B43_LPTAB32(9, 0),
+                ARRAY_SIZE(lpphy_rev01_ps_control_table), lpphy_rev01_ps_control_table);
+        b43_lptab_write_bulk(dev, B43_LPTAB8(6, 0),
+                ARRAY_SIZE(lpphy_pll_fraction_table), lpphy_pll_fraction_table);
+        b43_lptab_write_bulk(dev, B43_LPTAB16(0, 0),
+                ARRAY_SIZE(lpphy_iq_local_table), lpphy_iq_local_table);
+        b43_lptab_write_bulk(dev, B43_LPTAB16(13, 0),
+                ARRAY_SIZE(lpphy_ofdm_cck_gain_table), lpphy_ofdm_cck_gain_table);
+        b43_lptab_write_bulk(dev, B43_LPTAB16(12, 0),
+                ARRAY_SIZE(lpphy_ofdm_cck_gain_table), lpphy_ofdm_cck_gain_table);
+        b43_lptab_write_bulk(dev, B43_LPTAB16(15, 0),
+                ARRAY_SIZE(lpphy_gain_delta_table), lpphy_gain_delta_table);
+        b43_lptab_write_bulk(dev, B43_LPTAB32(10, 0),
+                ARRAY_SIZE(lpphy_tx_power_control_table), lpphy_tx_power_control_table);
+}
+
+void lpphy_rev2plus_table_init(struct b43_wldev *dev)
+{
+        struct ssb_bus *bus = dev->dev->bus;
+        int i;
+
+        B43_WARN_ON(dev->phy.rev < 2);
+
+        /*
+         * FIXME This code follows the specs, but it looks wrong:
+         * In each pass, it writes 4 bytes to an offset in table ID 7,
+         * then increments the offset by 1 for the next pass. This results
+         * in the first 3 bytes of each pass except the first one getting
+         * written to a location that has already been zeroed in the previous
+         * pass.
+         * This is what the vendor driver does, but it still looks suspicious.
+         *
+         * This should probably suffice:
+         *
+         * for (i = 0; i < 704; i+=4)
+         *      b43_lptab_write(dev, B43_LPTAB32(7, i), 0)
+         *
+         * This should be tested once the code is functional.
+         */
+        for (i = 0; i < 704; i++)
+                b43_lptab_write(dev, B43_LPTAB32(7, i), 0);
+
+        b43_lptab_write_bulk(dev, B43_LPTAB8(2, 0),
+                ARRAY_SIZE(lpphy_min_sig_sq_table), lpphy_min_sig_sq_table);
+        b43_lptab_write_bulk(dev, B43_LPTAB16(1, 0),
+                ARRAY_SIZE(lpphy_rev2plus_noise_scale_table), lpphy_rev2plus_noise_scale_table);
+        b43_lptab_write_bulk(dev, B43_LPTAB32(11, 0),
+                ARRAY_SIZE(lpphy_rev2plus_filter_control_table), lpphy_rev2plus_filter_control_table);
+        b43_lptab_write_bulk(dev, B43_LPTAB32(12, 0),
+                ARRAY_SIZE(lpphy_rev2plus_ps_control_table), lpphy_rev2plus_ps_control_table);
+        b43_lptab_write_bulk(dev, B43_LPTAB32(13, 0),
+                ARRAY_SIZE(lpphy_gain_idx_table), lpphy_gain_idx_table);
+        b43_lptab_write_bulk(dev, B43_LPTAB16(14, 0),
+                ARRAY_SIZE(lpphy_aux_gain_idx_table), lpphy_aux_gain_idx_table);
+        b43_lptab_write_bulk(dev, B43_LPTAB16(15, 0),
+                ARRAY_SIZE(lpphy_sw_control_table), lpphy_sw_control_table);
+        b43_lptab_write_bulk(dev, B43_LPTAB8(16, 0),
+                ARRAY_SIZE(lpphy_hf_table), lpphy_hf_table);
+        b43_lptab_write_bulk(dev, B43_LPTAB32(17, 0),
+                ARRAY_SIZE(lpphy_gain_value_table), lpphy_gain_value_table);
+        b43_lptab_write_bulk(dev, B43_LPTAB16(18, 0),
+                ARRAY_SIZE(lpphy_gain_table), lpphy_gain_table);
+        b43_lptab_write_bulk(dev, B43_LPTAB8(6, 0),
+                ARRAY_SIZE(lpphy_pll_fraction_table), lpphy_pll_fraction_table);
+        b43_lptab_write_bulk(dev, B43_LPTAB16(0, 0),
+                ARRAY_SIZE(lpphy_iq_local_table), lpphy_iq_local_table);
+        b43_lptab_write_bulk(dev, B43_LPTAB32(9, 0),
+                ARRAY_SIZE(lpphy_papd_eps_table), lpphy_papd_eps_table);
+        b43_lptab_write_bulk(dev, B43_LPTAB32(10, 0),
+                ARRAY_SIZE(lpphy_papd_mult_table), lpphy_papd_mult_table);
+
+        if ((bus->chip_id == 0x4325) && (bus->chip_rev == 0)) {
+                b43_lptab_write_bulk(dev, B43_LPTAB32(13, 0),
+                        ARRAY_SIZE(lpphy_a0_gain_idx_table), lpphy_a0_gain_idx_table);
+                b43_lptab_write_bulk(dev, B43_LPTAB16(14, 0),
+                        ARRAY_SIZE(lpphy_a0_aux_gain_idx_table), lpphy_a0_aux_gain_idx_table);
+                b43_lptab_write_bulk(dev, B43_LPTAB32(17, 0),
+                        ARRAY_SIZE(lpphy_a0_gain_value_table), lpphy_a0_gain_value_table);
+                b43_lptab_write_bulk(dev, B43_LPTAB16(18, 0),
+                        ARRAY_SIZE(lpphy_a0_gain_table), lpphy_a0_gain_table);
+        }
+}
+
+static void lpphy_rev0_1_write_gain_table(struct b43_wldev *dev, int offset,
+                                struct lpphy_tx_gain_table_entry data)
+{
+        u32 tmp;
+
+        B43_WARN_ON(dev->phy.rev >= 2);
+
+        tmp  = data.pad << 11;
+        tmp |= data.pga << 7;
+        tmp |= data.gm  << 4;
+        tmp |= data.dac;
+        b43_lptab_write(dev, B43_LPTAB32(10, 0xC0 + offset), tmp);
+        tmp  = data.bb_mult << 20;
+        b43_lptab_write(dev, B43_LPTAB32(10, 0x140 + offset), tmp);
+}
+
+static void lpphy_rev2plus_write_gain_table(struct b43_wldev *dev, int offset,
+                                struct lpphy_tx_gain_table_entry data)
+{
+        u32 tmp;
+
+        B43_WARN_ON(dev->phy.rev < 2);
+
+        tmp  = data.pad << 16;
+        tmp |= data.pga << 8;
+        tmp |= data.gm;
+        tmp |= 0x7f000000;
+        b43_lptab_write(dev, B43_LPTAB32(7, 0xC0 + offset), tmp);
+        tmp  = data.bb_mult << 20;
+        tmp |= data.dac << 28;
+        b43_lptab_write(dev, B43_LPTAB32(7, 0x140 + offset), tmp);
+}
+
+void lpphy_write_gain_table(struct b43_wldev *dev, int offset,
+                            struct lpphy_tx_gain_table_entry data)
+{
+        if (dev->phy.rev >= 2)
+                lpphy_rev2plus_write_gain_table(dev, offset, data);
+        else
+                lpphy_rev0_1_write_gain_table(dev, offset, data);
+}
+
+void lpphy_write_gain_table_bulk(struct b43_wldev *dev, int offset, int count,
+                                 struct lpphy_tx_gain_table_entry *table)
+{
+        int i;
+
+        for (i = offset; i < count; i++)
+                lpphy_write_gain_table(dev, i, table[i]);
+}
+
+void lpphy_init_tx_gain_table(struct b43_wldev *dev)
+{
+        struct ssb_bus *bus = dev->dev->bus;
+
+        switch (dev->phy.rev) {
+        case 0:
+                if ((bus->sprom.boardflags_hi & B43_BFH_NOPA) ||
+                    (bus->sprom.boardflags_lo & B43_BFL_HGPA))
+                        lpphy_write_gain_table_bulk(dev, 0, 128,
+                                        lpphy_rev0_nopa_tx_gain_table);
+                else if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ)
+                        lpphy_write_gain_table_bulk(dev, 0, 128,
+                                        lpphy_rev0_2ghz_tx_gain_table);
+                else
+                        lpphy_write_gain_table_bulk(dev, 0, 128,
+                                        lpphy_rev0_5ghz_tx_gain_table);
+                break;
+        case 1:
+                if ((bus->sprom.boardflags_hi & B43_BFH_NOPA) ||
+                    (bus->sprom.boardflags_lo & B43_BFL_HGPA))
+                        lpphy_write_gain_table_bulk(dev, 0, 128,
+                                        lpphy_rev1_nopa_tx_gain_table);
+                else if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ)
+                        lpphy_write_gain_table_bulk(dev, 0, 128,
+                                        lpphy_rev1_2ghz_tx_gain_table);
+                else
+                        lpphy_write_gain_table_bulk(dev, 0, 128,
+                                        lpphy_rev1_5ghz_tx_gain_table);
+                break;
+        default:
+                if (bus->sprom.boardflags_hi & B43_BFH_NOPA)
+                        lpphy_write_gain_table_bulk(dev, 0, 128,
+                                        lpphy_rev2_nopa_tx_gain_table);
+                else if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ)
+                        lpphy_write_gain_table_bulk(dev, 0, 128,
+                                        lpphy_rev2_2ghz_tx_gain_table);
+                else
+                        lpphy_write_gain_table_bulk(dev, 0, 128,
+                                        lpphy_rev2_5ghz_tx_gain_table);
+        }
+}
diff --git a/drivers/net/wireless/b43/tables_lpphy.h b/drivers/net/wireless/b43/tables_lpphy.h
index 0b8d02895a5d..84f1d265f657 100644
--- a/drivers/net/wireless/b43/tables_lpphy.h
+++ b/drivers/net/wireless/b43/tables_lpphy.h
@@ -26,6 +26,19 @@ void b43_lptab_write_bulk(struct b43_wldev *dev, u32 offset,
                           unsigned int nr_elements, const void *data);
 
 void b2062_upload_init_table(struct b43_wldev *dev);
+void b2063_upload_init_table(struct b43_wldev *dev);
 
+struct lpphy_tx_gain_table_entry {
+        u8 gm,  pga,  pad,  dac,  bb_mult;
+};
+
+void lpphy_write_gain_table(struct b43_wldev *dev, int offset,
+                            struct lpphy_tx_gain_table_entry data);
+void lpphy_write_gain_table_bulk(struct b43_wldev *dev, int offset, int count,
+                                 struct lpphy_tx_gain_table_entry *table);
+
+void lpphy_rev0_1_table_init(struct b43_wldev *dev);
+void lpphy_rev2plus_table_init(struct b43_wldev *dev);
+void lpphy_init_tx_gain_table(struct b43_wldev *dev);
 
 #endif /* B43_TABLES_LPPHY_H_ */
diff --git a/drivers/net/wireless/b43/xmit.c b/drivers/net/wireless/b43/xmit.c
index 5b85e7d73592..5280ebc8c6e9 100644
--- a/drivers/net/wireless/b43/xmit.c
+++ b/drivers/net/wireless/b43/xmit.c
@@ -237,7 +237,7 @@ int b43_generate_txhdr(struct b43_wldev *dev,
                 int wlhdr_len;
                 size_t iv_len;
 
-                B43_WARN_ON(key_idx >= dev->max_nr_keys);
+                B43_WARN_ON(key_idx >= ARRAY_SIZE(dev->key));
                 key = &(dev->key[key_idx]);
 
                 if (unlikely(!key->keyconf)) {
@@ -578,7 +578,7 @@ void b43_rx(struct b43_wldev *dev, struct sk_buff *skb, const void *_rxhdr)
                  * key index, but the ucode passed it slightly different.
                  */
                 keyidx = b43_kidx_to_raw(dev, keyidx);
-                B43_WARN_ON(keyidx >= dev->max_nr_keys);
+                B43_WARN_ON(keyidx >= ARRAY_SIZE(dev->key));
 
                 if (dev->key[keyidx].algorithm != B43_SEC_ALGO_NONE) {
                         wlhdr_len = ieee80211_hdrlen(fctl);
diff --git a/drivers/net/wireless/iwlwifi/iwl-1000.c b/drivers/net/wireless/iwlwifi/iwl-1000.c
index cf3fbc6b98ef..191718a0c545 100644
--- a/drivers/net/wireless/iwlwifi/iwl-1000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-1000.c
@@ -117,8 +117,8 @@ static struct iwl_lib_ops iwl1000_lib = {
                         EEPROM_5000_REG_BAND_3_CHANNELS,
                         EEPROM_5000_REG_BAND_4_CHANNELS,
                         EEPROM_5000_REG_BAND_5_CHANNELS,
-                        EEPROM_5000_REG_BAND_24_FAT_CHANNELS,
-                        EEPROM_5000_REG_BAND_52_FAT_CHANNELS
+                        EEPROM_5000_REG_BAND_24_HT40_CHANNELS,
+                        EEPROM_5000_REG_BAND_52_HT40_CHANNELS
                 },
                 .verify_signature  = iwlcore_eeprom_verify_signature,
                 .acquire_semaphore = iwlcore_eeprom_acquire_semaphore,
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945-hw.h b/drivers/net/wireless/iwlwifi/iwl-3945-hw.h
index b569c6f38e5c..16772780c5b0 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945-hw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-3945-hw.h
@@ -176,7 +176,7 @@ struct iwl3945_eeprom {
  * in EEPROM containing EEPROM_CHANNEL_* usage flags (LSB) and max regulatory
  * txpower (MSB).
  *
- * Entries immediately below are for 20 MHz channel width.  FAT (40 MHz)
+ * Entries immediately below are for 20 MHz channel width.  HT40 (40 MHz)
  * channels (only for 4965, not supported by 3945) appear later in the EEPROM.
  *
  * 2.4 GHz channels 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.c b/drivers/net/wireless/iwlwifi/iwl-3945.c
index e1b0ef3c56a3..ba5ef832d770 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.c
@@ -502,14 +502,14 @@ static void _iwl3945_dbg_report_frame(struct iwl_priv *priv,
                 }
         }
         if (print_dump)
-                iwl_print_hex_dump(IWL_DL_RX, data, length);
+                iwl_print_hex_dump(priv, IWL_DL_RX, data, length);
 }
 
 static void iwl3945_dbg_report_frame(struct iwl_priv *priv,
                       struct iwl_rx_packet *pkt,
                       struct ieee80211_hdr *header, int group100)
 {
-        if (iwl_debug_level & IWL_DL_RX)
+        if (iwl_get_debug_level(priv) & IWL_DL_RX)
                 _iwl3945_dbg_report_frame(priv, pkt, header, group100);
 }
 
@@ -544,9 +544,7 @@ static void iwl3945_pass_packet_to_mac80211(struct iwl_priv *priv,
                                    struct ieee80211_rx_status *stats)
 {
         struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
-#ifdef CONFIG_IWLWIFI_LEDS
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)IWL_RX_DATA(pkt);
-#endif
         struct iwl3945_rx_frame_hdr *rx_hdr = IWL_RX_HDR(pkt);
         struct iwl3945_rx_frame_end *rx_end = IWL_RX_END(pkt);
         short len = le16_to_cpu(rx_hdr->len);
@@ -577,6 +575,8 @@ static void iwl3945_pass_packet_to_mac80211(struct iwl_priv *priv,
         if (ieee80211_is_data(hdr->frame_control))
                 priv->rxtxpackets += len;
 #endif
+        iwl_update_stats(priv, false, hdr->frame_control, len);
+
         memcpy(IEEE80211_SKB_RXCB(rxb->skb), stats, sizeof(*stats));
         ieee80211_rx_irqsafe(priv->hw, rxb->skb);
         rxb->skb = NULL;
@@ -679,6 +679,7 @@ static void iwl3945_rx_reply_rx(struct iwl_priv *priv,
 
         /* Set "1" to report good data frames in groups of 100 */
         iwl3945_dbg_report_frame(priv, pkt, header, 1);
+        iwl_dbg_log_rx_data_frame(priv, le16_to_cpu(rx_hdr->len), header);
 
         if (network_packet) {
                 priv->last_beacon_time = le32_to_cpu(rx_end->beacon_timestamp);
@@ -2851,8 +2852,8 @@ static struct iwl_lib_ops iwl3945_lib = {
                         EEPROM_REGULATORY_BAND_3_CHANNELS,
                         EEPROM_REGULATORY_BAND_4_CHANNELS,
                         EEPROM_REGULATORY_BAND_5_CHANNELS,
-                        EEPROM_REGULATORY_BAND_NO_FAT,
-                        EEPROM_REGULATORY_BAND_NO_FAT,
+                        EEPROM_REGULATORY_BAND_NO_HT40,
+                        EEPROM_REGULATORY_BAND_NO_HT40,
                 },
                 .verify_signature  = iwlcore_eeprom_verify_signature,
                 .acquire_semaphore = iwl3945_eeprom_acquire_semaphore,
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965-hw.h b/drivers/net/wireless/iwlwifi/iwl-4965-hw.h
index a71a489096ff..b34322a32458 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965-hw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-4965-hw.h
@@ -188,7 +188,7 @@ static inline int iwl4965_hw_valid_rtc_data_addr(u32 addr)
  *
  * 1)  Regulatory information (max txpower and channel usage flags) is provided
  *     separately for each channel that can possibly supported by 4965.
- *     40 MHz wide (.11n fat) channels are listed separately from 20 MHz
+ *     40 MHz wide (.11n HT40) channels are listed separately from 20 MHz
  *     (legacy) channels.
  *
  *     See struct iwl4965_eeprom_channel for format, and struct iwl4965_eeprom
@@ -251,8 +251,8 @@ static inline int iwl4965_hw_valid_rtc_data_addr(u32 addr)
  *     no reduction (such as with regulatory txpower limits) is required.
  *
  *     Saturation and Backoff values apply equally to 20 Mhz (legacy) channel
- *     widths and 40 Mhz (.11n fat) channel widths; there is no separate
- *     factory measurement for fat channels.
+ *     widths and 40 Mhz (.11n HT40) channel widths; there is no separate
+ *     factory measurement for ht40 channels.
  *
  *     The result of this step is the final target txpower.  The rest of
  *     the steps figure out the proper settings for the device to achieve
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965.c b/drivers/net/wireless/iwlwifi/iwl-4965.c
index 670214823cb9..e427a8937ed8 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965.c
+++ b/drivers/net/wireless/iwlwifi/iwl-4965.c
@@ -46,7 +46,7 @@
 #include "iwl-sta.h"
 
 static int iwl4965_send_tx_power(struct iwl_priv *priv);
-static int iwl4965_hw_get_temperature(const struct iwl_priv *priv);
+static int iwl4965_hw_get_temperature(struct iwl_priv *priv);
 
 /* Highest firmware API version supported */
 #define IWL4965_UCODE_API_MAX 2
@@ -146,7 +146,7 @@ static int iwl4965_load_bsm(struct iwl_priv *priv)
 
         IWL_DEBUG_INFO(priv, "Begin load bsm\n");
 
-        priv->ucode_type = UCODE_INIT;
+        priv->ucode_type = UCODE_RT;
 
         /* make sure bootstrap program is no larger than BSM's SRAM size */
         if (len > IWL49_MAX_BSM_SIZE)
@@ -256,8 +256,6 @@ static int iwl4965_set_ucode_ptrs(struct iwl_priv *priv)
 */
 static void iwl4965_init_alive_start(struct iwl_priv *priv)
 {
-        int ret;
-
         /* Check alive response for "valid" sign from uCode */
         if (priv->card_alive_init.is_valid != UCODE_VALID_OK) {
                 /* We had an error bringing up the hardware, so take it
@@ -289,35 +287,13 @@ static void iwl4965_init_alive_start(struct iwl_priv *priv)
                 IWL_DEBUG_INFO(priv, "Couldn't set up uCode pointers.\n");
                 goto restart;
         }
-        priv->ucode_type = UCODE_RT;
-        if (test_bit(STATUS_RT_UCODE_ALIVE, &priv->status)) {
-                IWL_WARN(priv, "Runtime uCode already alive? "
-                        "Waiting for alive anyway\n");
-                clear_bit(STATUS_RT_UCODE_ALIVE, &priv->status);
-        }
-        ret = wait_event_interruptible_timeout(
-                        priv->wait_command_queue,
-                        test_bit(STATUS_RT_UCODE_ALIVE, &priv->status),
-                        UCODE_ALIVE_TIMEOUT);
-        if (!ret) {
-                /* FIXME: if STATUS_RT_UCODE_ALIVE timeout
-                 * go back to restart the download Init uCode again
-                 * this might cause to trap in the restart loop
-                 */
-                priv->ucode_type = UCODE_NONE;
-                if (!test_bit(STATUS_RT_UCODE_ALIVE, &priv->status)) {
-                        IWL_ERR(priv, "Runtime timeout after %dms\n",
-                                jiffies_to_msecs(UCODE_ALIVE_TIMEOUT));
-                        goto restart;
-                }
-        }
         return;
 
 restart:
         queue_work(priv->workqueue, &priv->restart);
 }
 
-static bool is_fat_channel(__le32 rxon_flags)
+static bool is_ht40_channel(__le32 rxon_flags)
 {
         int chan_mod = le32_to_cpu(rxon_flags & RXON_FLG_CHANNEL_MODE_MSK)
                                     >> RXON_FLG_CHANNEL_MODE_POS;
@@ -806,7 +782,7 @@ static int iwl4965_hw_set_hw_params(struct iwl_priv *priv)
         priv->hw_params.max_data_size = IWL49_RTC_DATA_SIZE;
         priv->hw_params.max_inst_size = IWL49_RTC_INST_SIZE;
         priv->hw_params.max_bsm_size = BSM_SRAM_SIZE;
-        priv->hw_params.fat_channel = BIT(IEEE80211_BAND_5GHZ);
+        priv->hw_params.ht40_channel = BIT(IEEE80211_BAND_5GHZ);
 
         priv->hw_params.rx_wrt_ptr_reg = FH_RSCSR_CHNL0_WPTR;
 
@@ -1266,7 +1242,7 @@ static const struct gain_entry gain_table[2][108] = {
 };
 
 static int iwl4965_fill_txpower_tbl(struct iwl_priv *priv, u8 band, u16 channel,
-                                    u8 is_fat, u8 ctrl_chan_high,
+                                    u8 is_ht40, u8 ctrl_chan_high,
                                     struct iwl4965_tx_power_db *tx_power_tbl)
 {
         u8 saturation_power;
@@ -1298,8 +1274,8 @@ static int iwl4965_fill_txpower_tbl(struct iwl_priv *priv, u8 band, u16 channel,
         user_target_power = 2 * priv->tx_power_user_lmt;
 
         /* Get current (RXON) channel, band, width */
-        IWL_DEBUG_TXPOWER(priv, "chan %d band %d is_fat %d\n", channel, band,
-                          is_fat);
+        IWL_DEBUG_TXPOWER(priv, "chan %d band %d is_ht40 %d\n", channel, band,
+                          is_ht40);
 
         ch_info = iwl_get_channel_info(priv, priv->band, channel);
 
@@ -1318,7 +1294,7 @@ static int iwl4965_fill_txpower_tbl(struct iwl_priv *priv, u8 band, u16 channel,
         IWL_DEBUG_TXPOWER(priv, "channel %d belongs to txatten group %d\n",
                           channel, txatten_grp);
 
-        if (is_fat) {
+        if (is_ht40) {
                 if (ctrl_chan_high)
                         channel -= 2;
                 else
@@ -1342,8 +1318,8 @@ static int iwl4965_fill_txpower_tbl(struct iwl_priv *priv, u8 band, u16 channel,
 
         /* regulatory txpower limits ... reg_limit values are in half-dBm,
          *   max_power_avg values are in dBm, convert * 2 */
-        if (is_fat)
-                reg_limit = ch_info->fat_max_power_avg * 2;
+        if (is_ht40)
+                reg_limit = ch_info->ht40_max_power_avg * 2;
         else
                 reg_limit = ch_info->max_power_avg * 2;
 
@@ -1509,7 +1485,7 @@ static int iwl4965_fill_txpower_tbl(struct iwl_priv *priv, u8 band, u16 channel,
 /**
  * iwl4965_send_tx_power - Configure the TXPOWER level user limit
  *
- * Uses the active RXON for channel, band, and characteristics (fat, high)
+ * Uses the active RXON for channel, band, and characteristics (ht40, high)
  * The power limit is taken from priv->tx_power_user_lmt.
  */
 static int iwl4965_send_tx_power(struct iwl_priv *priv)
@@ -1517,7 +1493,7 @@ static int iwl4965_send_tx_power(struct iwl_priv *priv)
         struct iwl4965_txpowertable_cmd cmd = { 0 };
         int ret;
         u8 band = 0;
-        bool is_fat = false;
+        bool is_ht40 = false;
         u8 ctrl_chan_high = 0;
 
         if (test_bit(STATUS_SCANNING, &priv->status)) {
@@ -1530,9 +1506,9 @@ static int iwl4965_send_tx_power(struct iwl_priv *priv)
 
         band = priv->band == IEEE80211_BAND_2GHZ;
 
-        is_fat =  is_fat_channel(priv->active_rxon.flags);
+        is_ht40 =  is_ht40_channel(priv->active_rxon.flags);
 
-        if (is_fat &&
+        if (is_ht40 &&
             (priv->active_rxon.flags & RXON_FLG_CTRL_CHANNEL_LOC_HI_MSK))
                 ctrl_chan_high = 1;
 
@@ -1541,7 +1517,7 @@ static int iwl4965_send_tx_power(struct iwl_priv *priv)
 
         ret = iwl4965_fill_txpower_tbl(priv, band,
                                 le16_to_cpu(priv->active_rxon.channel),
-                                is_fat, ctrl_chan_high, &cmd.tx_power);
+                                is_ht40, ctrl_chan_high, &cmd.tx_power);
         if (ret)
                 goto out;
 
@@ -1595,7 +1571,7 @@ static int iwl4965_hw_channel_switch(struct iwl_priv *priv, u16 channel)
 {
         int rc;
         u8 band = 0;
-        bool is_fat = false;
+        bool is_ht40 = false;
         u8 ctrl_chan_high = 0;
         struct iwl4965_channel_switch_cmd cmd = { 0 };
         const struct iwl_channel_info *ch_info;
@@ -1604,9 +1580,9 @@ static int iwl4965_hw_channel_switch(struct iwl_priv *priv, u16 channel)
 
         ch_info = iwl_get_channel_info(priv, priv->band, channel);
 
-        is_fat = is_fat_channel(priv->staging_rxon.flags);
+        is_ht40 = is_ht40_channel(priv->staging_rxon.flags);
 
-        if (is_fat &&
+        if (is_ht40 &&
             (priv->active_rxon.flags & RXON_FLG_CTRL_CHANNEL_LOC_HI_MSK))
                 ctrl_chan_high = 1;
 
@@ -1621,7 +1597,7 @@ static int iwl4965_hw_channel_switch(struct iwl_priv *priv, u16 channel)
         else
                 cmd.expect_beacon = 1;
 
-        rc = iwl4965_fill_txpower_tbl(priv, band, channel, is_fat,
+        rc = iwl4965_fill_txpower_tbl(priv, band, channel, is_ht40,
                                       ctrl_chan_high, &cmd.tx_power);
         if (rc) {
                 IWL_DEBUG_11H(priv, "error:%d  fill txpower_tbl\n", rc);
@@ -1680,7 +1656,7 @@ static s32 sign_extend(u32 oper, int index)
  *
  * A return of <0 indicates bogus data in the statistics
  */
-static int iwl4965_hw_get_temperature(const struct iwl_priv *priv)
+static int iwl4965_hw_get_temperature(struct iwl_priv *priv)
 {
         s32 temperature;
         s32 vt;
@@ -1688,8 +1664,8 @@ static int iwl4965_hw_get_temperature(const struct iwl_priv *priv)
         u32 R4;
 
         if (test_bit(STATUS_TEMPERATURE, &priv->status) &&
-                (priv->statistics.flag & STATISTICS_REPLY_FLG_FAT_MODE_MSK)) {
-                IWL_DEBUG_TEMP(priv, "Running FAT temperature calibration\n");
+                (priv->statistics.flag & STATISTICS_REPLY_FLG_HT40_MODE_MSK)) {
+                IWL_DEBUG_TEMP(priv, "Running HT40 temperature calibration\n");
                 R1 = (s32)le32_to_cpu(priv->card_alive_init.therm_r1[1]);
                 R2 = (s32)le32_to_cpu(priv->card_alive_init.therm_r2[1]);
                 R3 = (s32)le32_to_cpu(priv->card_alive_init.therm_r3[1]);
@@ -2330,8 +2306,8 @@ static struct iwl_lib_ops iwl4965_lib = {
                         EEPROM_REGULATORY_BAND_3_CHANNELS,
                         EEPROM_REGULATORY_BAND_4_CHANNELS,
                         EEPROM_REGULATORY_BAND_5_CHANNELS,
-                        EEPROM_4965_REGULATORY_BAND_24_FAT_CHANNELS,
-                        EEPROM_4965_REGULATORY_BAND_52_FAT_CHANNELS
+                        EEPROM_4965_REGULATORY_BAND_24_HT40_CHANNELS,
+                        EEPROM_4965_REGULATORY_BAND_52_HT40_CHANNELS
                 },
                 .verify_signature  = iwlcore_eeprom_verify_signature,
                 .acquire_semaphore = iwlcore_eeprom_acquire_semaphore,
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
index 87957c052839..755c184b3ecb 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -845,7 +845,7 @@ int iwl5000_hw_set_hw_params(struct iwl_priv *priv)
         }
 
         priv->hw_params.max_bsm_size = 0;
-        priv->hw_params.fat_channel =  BIT(IEEE80211_BAND_2GHZ) |
+        priv->hw_params.ht40_channel =  BIT(IEEE80211_BAND_2GHZ) |
                                         BIT(IEEE80211_BAND_5GHZ);
         priv->hw_params.rx_wrt_ptr_reg = FH_RSCSR_CHNL0_WPTR;
 
@@ -1547,8 +1547,8 @@ struct iwl_lib_ops iwl5000_lib = {
                         EEPROM_5000_REG_BAND_3_CHANNELS,
                         EEPROM_5000_REG_BAND_4_CHANNELS,
                         EEPROM_5000_REG_BAND_5_CHANNELS,
-                        EEPROM_5000_REG_BAND_24_FAT_CHANNELS,
-                        EEPROM_5000_REG_BAND_52_FAT_CHANNELS
+                        EEPROM_5000_REG_BAND_24_HT40_CHANNELS,
+                        EEPROM_5000_REG_BAND_52_HT40_CHANNELS
                 },
                 .verify_signature  = iwlcore_eeprom_verify_signature,
                 .acquire_semaphore = iwlcore_eeprom_acquire_semaphore,
@@ -1597,8 +1597,8 @@ static struct iwl_lib_ops iwl5150_lib = {
                         EEPROM_5000_REG_BAND_3_CHANNELS,
                         EEPROM_5000_REG_BAND_4_CHANNELS,
                         EEPROM_5000_REG_BAND_5_CHANNELS,
-                        EEPROM_5000_REG_BAND_24_FAT_CHANNELS,
-                        EEPROM_5000_REG_BAND_52_FAT_CHANNELS
+                        EEPROM_5000_REG_BAND_24_HT40_CHANNELS,
+                        EEPROM_5000_REG_BAND_52_HT40_CHANNELS
                 },
                 .verify_signature  = iwlcore_eeprom_verify_signature,
                 .acquire_semaphore = iwlcore_eeprom_acquire_semaphore,
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
index 4450943d3dac..c3ec6c20cc94 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -118,8 +118,8 @@ static struct iwl_lib_ops iwl6000_lib = {
                         EEPROM_5000_REG_BAND_3_CHANNELS,
                         EEPROM_5000_REG_BAND_4_CHANNELS,
                         EEPROM_5000_REG_BAND_5_CHANNELS,
-                        EEPROM_5000_REG_BAND_24_FAT_CHANNELS,
-                        EEPROM_5000_REG_BAND_52_FAT_CHANNELS
+                        EEPROM_5000_REG_BAND_24_HT40_CHANNELS,
+                        EEPROM_5000_REG_BAND_52_HT40_CHANNELS
                 },
                 .verify_signature  = iwlcore_eeprom_verify_signature,
                 .acquire_semaphore = iwlcore_eeprom_acquire_semaphore,
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
index 52a4810274e9..21331552ff2c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
@@ -97,7 +97,7 @@ struct iwl_scale_tbl_info {
         enum iwl_table_type lq_type;
         u8 ant_type;
         u8 is_SGI;      /* 1 = short guard interval */
-        u8 is_fat;      /* 1 = 40 MHz channel width */
+        u8 is_ht40;     /* 1 = 40 MHz channel width */
         u8 is_dup;      /* 1 = duplicated data streams */
         u8 action;      /* change modulation; IWL_[LEGACY/SISO/MIMO]_SWITCH_* */
         u8 max_search;  /* maximun number of tables we can search */
@@ -539,11 +539,11 @@ static u32 rate_n_flags_from_tbl(struct iwl_priv *priv,
                                                      RATE_MCS_ANT_ABC_MSK);
 
         if (is_Ht(tbl->lq_type)) {
-                if (tbl->is_fat) {
+                if (tbl->is_ht40) {
                         if (tbl->is_dup)
                                 rate_n_flags |= RATE_MCS_DUP_MSK;
                         else
-                                rate_n_flags |= RATE_MCS_FAT_MSK;
+                                rate_n_flags |= RATE_MCS_HT40_MSK;
                 }
                 if (tbl->is_SGI)
                         rate_n_flags |= RATE_MCS_SGI_MSK;
@@ -579,7 +579,7 @@ static int rs_get_tbl_info_from_mcs(const u32 rate_n_flags,
                 return -EINVAL;
         }
         tbl->is_SGI = 0;        /* default legacy setup */
-        tbl->is_fat = 0;
+        tbl->is_ht40 = 0;
         tbl->is_dup = 0;
         tbl->ant_type = (ant_msk >> RATE_MCS_ANT_POS);
         tbl->lq_type = LQ_NONE;
@@ -598,9 +598,9 @@ static int rs_get_tbl_info_from_mcs(const u32 rate_n_flags,
                 if (rate_n_flags & RATE_MCS_SGI_MSK)
                         tbl->is_SGI = 1;
 
-                if ((rate_n_flags & RATE_MCS_FAT_MSK) ||
+                if ((rate_n_flags & RATE_MCS_HT40_MSK) ||
                     (rate_n_flags & RATE_MCS_DUP_MSK))
-                        tbl->is_fat = 1;
+                        tbl->is_ht40 = 1;
 
                 if (rate_n_flags & RATE_MCS_DUP_MSK)
                         tbl->is_dup = 1;
@@ -776,7 +776,7 @@ static u32 rs_get_lower_rate(struct iwl_lq_sta *lq_sta,
                 if (num_of_ant(tbl->ant_type) > 1)
                         tbl->ant_type = ANT_A;/*FIXME:RS*/
 
-                tbl->is_fat = 0;
+                tbl->is_ht40 = 0;
                 tbl->is_SGI = 0;
                 tbl->max_search = IWL_MAX_SEARCH;
         }
@@ -880,7 +880,7 @@ static void rs_tx_status(void *priv_r, struct ieee80211_supported_band *sband,
 
         if ((info->status.rates[0].idx < 0) ||
             (tbl_type.is_SGI != !!(info->status.rates[0].flags & IEEE80211_TX_RC_SHORT_GI)) ||
-            (tbl_type.is_fat != !!(info->status.rates[0].flags & IEEE80211_TX_RC_40_MHZ_WIDTH)) ||
+            (tbl_type.is_ht40 != !!(info->status.rates[0].flags & IEEE80211_TX_RC_40_MHZ_WIDTH)) ||
             (tbl_type.is_dup != !!(info->status.rates[0].flags & IEEE80211_TX_RC_DUP_DATA)) ||
             (tbl_type.ant_type != info->antenna_sel_tx) ||
             (!!(tx_rate & RATE_MCS_HT_MSK) != !!(info->status.rates[0].flags & IEEE80211_TX_RC_MCS)) ||
@@ -1049,7 +1049,7 @@ static void rs_set_expected_tpt_table(struct iwl_lq_sta *lq_sta,
                 else
                         tbl->expected_tpt = expected_tpt_A;
         } else if (is_siso(tbl->lq_type)) {
-                if (tbl->is_fat && !lq_sta->is_dup)
+                if (tbl->is_ht40 && !lq_sta->is_dup)
                         if (tbl->is_SGI)
                                 tbl->expected_tpt = expected_tpt_siso40MHzSGI;
                         else
@@ -1059,7 +1059,7 @@ static void rs_set_expected_tpt_table(struct iwl_lq_sta *lq_sta,
                 else
                         tbl->expected_tpt = expected_tpt_siso20MHz;
         } else if (is_mimo2(tbl->lq_type)) {
-                if (tbl->is_fat && !lq_sta->is_dup)
+                if (tbl->is_ht40 && !lq_sta->is_dup)
                         if (tbl->is_SGI)
                                 tbl->expected_tpt = expected_tpt_mimo2_40MHzSGI;
                         else
@@ -1069,7 +1069,7 @@ static void rs_set_expected_tpt_table(struct iwl_lq_sta *lq_sta,
                 else
                         tbl->expected_tpt = expected_tpt_mimo2_20MHz;
         } else if (is_mimo3(tbl->lq_type)) {
-                if (tbl->is_fat && !lq_sta->is_dup)
+                if (tbl->is_ht40 && !lq_sta->is_dup)
                         if (tbl->is_SGI)
                                 tbl->expected_tpt = expected_tpt_mimo3_40MHzSGI;
                         else
@@ -1217,13 +1217,13 @@ static int rs_switch_to_mimo2(struct iwl_priv *priv,
         tbl->max_search = IWL_MAX_SEARCH;
         rate_mask = lq_sta->active_mimo2_rate;
 
-        if (iwl_is_fat_tx_allowed(priv, &sta->ht_cap))
-                tbl->is_fat = 1;
+        if (iwl_is_ht40_tx_allowed(priv, &sta->ht_cap))
+                tbl->is_ht40 = 1;
         else
-                tbl->is_fat = 0;
+                tbl->is_ht40 = 0;
 
         /* FIXME: - don't toggle SGI here
-        if (tbl->is_fat) {
+        if (tbl->is_ht40) {
                 if (priv->current_ht_config.sgf & HT_SHORT_GI_40MHZ_ONLY)
                         tbl->is_SGI = 1;
                 else
@@ -1283,13 +1283,13 @@ static int rs_switch_to_mimo3(struct iwl_priv *priv,
         tbl->max_search = IWL_MAX_11N_MIMO3_SEARCH;
         rate_mask = lq_sta->active_mimo3_rate;
 
-        if (iwl_is_fat_tx_allowed(priv, &sta->ht_cap))
-                tbl->is_fat = 1;
+        if (iwl_is_ht40_tx_allowed(priv, &sta->ht_cap))
+                tbl->is_ht40 = 1;
         else
-                tbl->is_fat = 0;
+                tbl->is_ht40 = 0;
 
         /* FIXME: - don't toggle SGI here
-        if (tbl->is_fat) {
+        if (tbl->is_ht40) {
                 if (priv->current_ht_config.sgf & HT_SHORT_GI_40MHZ_ONLY)
                         tbl->is_SGI = 1;
                 else
@@ -1342,13 +1342,13 @@ static int rs_switch_to_siso(struct iwl_priv *priv,
         tbl->max_search = IWL_MAX_SEARCH;
         rate_mask = lq_sta->active_siso_rate;
 
-        if (iwl_is_fat_tx_allowed(priv, &sta->ht_cap))
-                tbl->is_fat = 1;
+        if (iwl_is_ht40_tx_allowed(priv, &sta->ht_cap))
+                tbl->is_ht40 = 1;
         else
-                tbl->is_fat = 0;
+                tbl->is_ht40 = 0;
 
         /* FIXME: - don't toggle SGI here
-        if (tbl->is_fat) {
+        if (tbl->is_ht40) {
                 if (priv->current_ht_config.sgf & HT_SHORT_GI_40MHZ_ONLY)
                         tbl->is_SGI = 1;
                 else
@@ -1401,7 +1401,7 @@ static int rs_move_legacy_other(struct iwl_priv *priv,
         if (!iwl_ht_enabled(priv))
                 /* stay in Legacy */
                 tbl->action = IWL_LEGACY_SWITCH_ANTENNA1;
-        else if (iwl_tx_ant_restriction(priv) == IWL_TX_SINGLE &&
+        else if (iwl_tx_ant_restriction(priv) == IWL_ANT_OK_SINGLE &&
                    tbl->action > IWL_LEGACY_SWITCH_SISO)
                 tbl->action = IWL_LEGACY_SWITCH_SISO;
         for (; ;) {
@@ -1535,7 +1535,7 @@ static int rs_move_siso_to_other(struct iwl_priv *priv,
         u8 update_search_tbl_counter = 0;
         int ret;
 
-        if (iwl_tx_ant_restriction(priv) == IWL_TX_SINGLE &&
+        if (iwl_tx_ant_restriction(priv) == IWL_ANT_OK_SINGLE &&
             tbl->action > IWL_SISO_SWITCH_ANTENNA2) {
                 /* stay in SISO */
                 tbl->action = IWL_SISO_SWITCH_ANTENNA1;
@@ -1586,11 +1586,11 @@ static int rs_move_siso_to_other(struct iwl_priv *priv,
                                 goto out;
                         break;
                 case IWL_SISO_SWITCH_GI:
-                        if (!tbl->is_fat &&
+                        if (!tbl->is_ht40 &&
                                 !(priv->current_ht_config.sgf &
                                                 HT_SHORT_GI_20MHZ))
                                 break;
-                        if (tbl->is_fat &&
+                        if (tbl->is_ht40 &&
                                 !(priv->current_ht_config.sgf &
                                                 HT_SHORT_GI_40MHZ))
                                 break;
@@ -1674,7 +1674,7 @@ static int rs_move_mimo2_to_other(struct iwl_priv *priv,
         u8 update_search_tbl_counter = 0;
         int ret;
 
-        if ((iwl_tx_ant_restriction(priv) == IWL_TX_SINGLE) &&
+        if ((iwl_tx_ant_restriction(priv) == IWL_ANT_OK_SINGLE) &&
             (tbl->action < IWL_MIMO2_SWITCH_SISO_A ||
              tbl->action > IWL_MIMO2_SWITCH_SISO_C)) {
                 /* switch in SISO */
@@ -1726,11 +1726,11 @@ static int rs_move_mimo2_to_other(struct iwl_priv *priv,
                         break;
 
                 case IWL_MIMO2_SWITCH_GI:
-                        if (!tbl->is_fat &&
+                        if (!tbl->is_ht40 &&
                                 !(priv->current_ht_config.sgf &
                                                 HT_SHORT_GI_20MHZ))
                                 break;
-                        if (tbl->is_fat &&
+                        if (tbl->is_ht40 &&
                                 !(priv->current_ht_config.sgf &
                                                 HT_SHORT_GI_40MHZ))
                                 break;
@@ -1816,7 +1816,7 @@ static int rs_move_mimo3_to_other(struct iwl_priv *priv,
         int ret;
         u8 update_search_tbl_counter = 0;
 
-        if ((iwl_tx_ant_restriction(priv) == IWL_TX_SINGLE) &&
+        if ((iwl_tx_ant_restriction(priv) == IWL_ANT_OK_SINGLE) &&
             (tbl->action < IWL_MIMO3_SWITCH_SISO_A ||
              tbl->action > IWL_MIMO3_SWITCH_SISO_C)) {
                 /* switch in SISO */
@@ -1890,11 +1890,11 @@ static int rs_move_mimo3_to_other(struct iwl_priv *priv,
                         break;
 
                 case IWL_MIMO3_SWITCH_GI:
-                        if (!tbl->is_fat &&
+                        if (!tbl->is_ht40 &&
                                 !(priv->current_ht_config.sgf &
                                                 HT_SHORT_GI_20MHZ))
                                 break;
-                        if (tbl->is_fat &&
+                        if (tbl->is_ht40 &&
                                 !(priv->current_ht_config.sgf &
                                                 HT_SHORT_GI_40MHZ))
                                 break;
@@ -2202,7 +2202,7 @@ static void rs_rate_scale_perform(struct iwl_priv *priv,
 
         /* If we are searching for better modulation mode, check success. */
         if (lq_sta->search_better_tbl &&
-            (iwl_tx_ant_restriction(priv) == IWL_TX_MULTI)) {
+            (iwl_tx_ant_restriction(priv) == IWL_ANT_OK_MULTI)) {
                 /* If good success, continue using the "search" mode;
                  * no need to send new link quality command, since we're
                  * continuing to use the setup that we've been trying. */
@@ -2332,7 +2332,7 @@ static void rs_rate_scale_perform(struct iwl_priv *priv,
                 scale_action = 0;
         if (!iwl_ht_enabled(priv) && !is_legacy(tbl->lq_type))
                 scale_action = -1;
-        if (iwl_tx_ant_restriction(priv) != IWL_TX_MULTI &&
+        if (iwl_tx_ant_restriction(priv) != IWL_ANT_OK_MULTI &&
                 (is_mimo2(tbl->lq_type) || is_mimo3(tbl->lq_type)))
                 scale_action = -1;
         switch (scale_action) {
@@ -2368,7 +2368,7 @@ lq_update:
                 rate = rs_update_rate_tbl(priv, lq_sta,
                                           tbl, index, is_green);
 
-        if (iwl_tx_ant_restriction(priv) == IWL_TX_MULTI) {
+        if (iwl_tx_ant_restriction(priv) == IWL_ANT_OK_MULTI) {
                 /* Should we stay with this modulation mode,
                  * or search for a new one? */
                 rs_stay_in_table(lq_sta);
@@ -2576,7 +2576,7 @@ static void rs_get_rate(void *priv_r, struct ieee80211_sta *sta, void *priv_sta,
                         info->control.rates[0].flags |= IEEE80211_TX_RC_SHORT_GI;
                 if (lq_sta->last_rate_n_flags & RATE_MCS_DUP_MSK)
                         info->control.rates[0].flags |= IEEE80211_TX_RC_DUP_DATA;
-                if (lq_sta->last_rate_n_flags & RATE_MCS_FAT_MSK)
+                if (lq_sta->last_rate_n_flags & RATE_MCS_HT40_MSK)
                         info->control.rates[0].flags |= IEEE80211_TX_RC_40_MHZ_WIDTH;
                 if (lq_sta->last_rate_n_flags & RATE_MCS_GF_MSK)
                         info->control.rates[0].flags |= IEEE80211_TX_RC_GREEN_FIELD;
@@ -2963,7 +2963,7 @@ static ssize_t rs_sta_dbgfs_scale_table_read(struct file *file,
                    (is_siso(tbl->lq_type)) ? "SISO" :
                    ((is_mimo2(tbl->lq_type)) ? "MIMO2" : "MIMO3"));
                    desc += sprintf(buff+desc, " %s",
-                   (tbl->is_fat) ? "40MHz" : "20MHz");
+                   (tbl->is_ht40) ? "40MHz" : "20MHz");
                    desc += sprintf(buff+desc, " %s %s\n", (tbl->is_SGI) ? "SGI" : "",
                    (lq_sta->is_green) ? "GF enabled" : "");
         }
@@ -3028,12 +3028,13 @@ static ssize_t rs_sta_dbgfs_stats_table_read(struct file *file,
                 return -ENOMEM;
 
         for (i = 0; i < LQ_SIZE; i++) {
-                desc += sprintf(buff+desc, "%s type=%d SGI=%d FAT=%d DUP=%d GF=%d\n"
+                desc += sprintf(buff+desc,
+                                "%s type=%d SGI=%d HT40=%d DUP=%d GF=%d\n"
                                 "rate=0x%X\n",
                                 lq_sta->active_tbl == i ? "*" : "x",
                                 lq_sta->lq_info[i].lq_type,
                                 lq_sta->lq_info[i].is_SGI,
-                                lq_sta->lq_info[i].is_fat,
+                                lq_sta->lq_info[i].is_ht40,
                                 lq_sta->lq_info[i].is_dup,
                                 lq_sta->is_green,
                                 lq_sta->lq_info[i].current_rate);
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index db580cbf5982..2232b1794e76 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -533,16 +533,12 @@ static void iwl_rx_reply_alive(struct iwl_priv *priv,
 
         if (palive->ver_subtype == INITIALIZE_SUBTYPE) {
                 IWL_DEBUG_INFO(priv, "Initialization Alive received.\n");
-                set_bit(STATUS_INIT_UCODE_ALIVE, &priv->status);
-                wake_up_interruptible(&priv->wait_command_queue);
                 memcpy(&priv->card_alive_init,
                        &pkt->u.alive_frame,
                        sizeof(struct iwl_init_alive_resp));
                 pwork = &priv->init_alive_start;
         } else {
                 IWL_DEBUG_INFO(priv, "Runtime Alive received.\n");
-                set_bit(STATUS_RT_UCODE_ALIVE, &priv->status);
-                wake_up_interruptible(&priv->wait_command_queue);
                 memcpy(&priv->card_alive, &pkt->u.alive_frame,
                        sizeof(struct iwl_alive_resp));
                 pwork = &priv->alive_start;
@@ -896,7 +892,7 @@ static void iwl_irq_tasklet_legacy(struct iwl_priv *priv)
         iwl_write32(priv, CSR_FH_INT_STATUS, inta_fh);
 
 #ifdef CONFIG_IWLWIFI_DEBUG
-        if (iwl_debug_level & IWL_DL_ISR) {
+        if (iwl_get_debug_level(priv) & IWL_DL_ISR) {
                 /* just for debug */
                 inta_mask = iwl_read32(priv, CSR_INT_MASK);
                 IWL_DEBUG_ISR(priv, "inta 0x%08x, enabled 0x%08x, fh 0x%08x\n",
@@ -931,7 +927,7 @@ static void iwl_irq_tasklet_legacy(struct iwl_priv *priv)
         }
 
 #ifdef CONFIG_IWLWIFI_DEBUG
-        if (iwl_debug_level & (IWL_DL_ISR)) {
+        if (iwl_get_debug_level(priv) & (IWL_DL_ISR)) {
                 /* NIC fires this, but we don't use it, redundant with WAKEUP */
                 if (inta & CSR_INT_BIT_SCD) {
                         IWL_DEBUG_ISR(priv, "Scheduler finished to transmit "
@@ -1045,7 +1041,7 @@ static void iwl_irq_tasklet_legacy(struct iwl_priv *priv)
                 iwl_enable_interrupts(priv);
 
 #ifdef CONFIG_IWLWIFI_DEBUG
-        if (iwl_debug_level & (IWL_DL_ISR)) {
+        if (iwl_get_debug_level(priv) & (IWL_DL_ISR)) {
                 inta = iwl_read32(priv, CSR_INT);
                 inta_mask = iwl_read32(priv, CSR_INT_MASK);
                 inta_fh = iwl_read32(priv, CSR_FH_INT_STATUS);
@@ -1076,7 +1072,7 @@ static void iwl_irq_tasklet(struct iwl_priv *priv)
         inta = priv->inta;
 
 #ifdef CONFIG_IWLWIFI_DEBUG
-        if (iwl_debug_level & IWL_DL_ISR) {
+        if (iwl_get_debug_level(priv) & IWL_DL_ISR) {
                 /* just for debug */
                 inta_mask = iwl_read32(priv, CSR_INT_MASK);
                 IWL_DEBUG_ISR(priv, "inta 0x%08x, enabled 0x%08x\n ",
@@ -1104,7 +1100,7 @@ static void iwl_irq_tasklet(struct iwl_priv *priv)
         }
 
 #ifdef CONFIG_IWLWIFI_DEBUG
-        if (iwl_debug_level & (IWL_DL_ISR)) {
+        if (iwl_get_debug_level(priv) & (IWL_DL_ISR)) {
                 /* NIC fires this, but we don't use it, redundant with WAKEUP */
                 if (inta & CSR_INT_BIT_SCD) {
                         IWL_DEBUG_ISR(priv, "Scheduler finished to transmit "
@@ -1610,7 +1606,7 @@ static void iwl_alive_start(struct iwl_priv *priv)
         set_bit(STATUS_READY, &priv->status);
         wake_up_interruptible(&priv->wait_command_queue);
 
-        iwl_power_update_mode(priv, 1);
+        iwl_power_update_mode(priv, true);
 
         /* reassociate for ADHOC mode */
         if (priv->vif && (priv->iw_mode == NL80211_IFTYPE_ADHOC)) {
@@ -1784,7 +1780,6 @@ static int __iwl_up(struct iwl_priv *priv)
 {
         int i;
         int ret;
-        unsigned long status;
 
         if (test_bit(STATUS_EXIT_PENDING, &priv->status)) {
                 IWL_WARN(priv, "Exit pending; will not bring the NIC up\n");
@@ -1862,51 +1857,6 @@ static int __iwl_up(struct iwl_priv *priv)
                 /* start card; "initialize" will load runtime ucode */
                 iwl_nic_start(priv);
 
-                /* Just finish download Init or Runtime uCode image to device
-                 * now we wait here for uCode send REPLY_ALIVE notification
-                 * to indicate uCode is ready.
-                 * 1) For Init uCode image, all iwlagn devices should wait here
-                 * on STATUS_INIT_UCODE_ALIVE status bit; if timeout before
-                 * receive the REPLY_ALIVE notification, go back and try to
-                 * download the Init uCode image again.
-                 * 2) For Runtime uCode image, all iwlagn devices except 4965
-                 * wait here on STATUS_RT_UCODE_ALIVE status bit; if
-                 * timeout before receive the REPLY_ALIVE notification, go back
-                 * and download the Runtime uCode image again.
-                 * 3) For 4965 Runtime uCode, it will not go through this path,
-                 * need to wait for STATUS_RT_UCODE_ALIVE status bit in
-                 * iwl4965_init_alive_start() function; if timeout, need to
-                 * restart and download Init uCode image.
-                 */
-                if (priv->ucode_type == UCODE_INIT)
-                        status = STATUS_INIT_UCODE_ALIVE;
-                else
-                        status = STATUS_RT_UCODE_ALIVE;
-                if (test_bit(status, &priv->status)) {
-                        IWL_WARN(priv,
-                                "%s uCode already alive? "
-                                "Waiting for alive anyway\n",
-                                (status == STATUS_INIT_UCODE_ALIVE)
-                                ? "INIT" : "Runtime");
-                        clear_bit(status, &priv->status);
-                }
-                ret = wait_event_interruptible_timeout(
-                                priv->wait_command_queue,
-                                test_bit(status, &priv->status),
-                                UCODE_ALIVE_TIMEOUT);
-                if (!ret) {
-                        if (!test_bit(status, &priv->status)) {
-                                priv->ucode_type =
-                                        (status == STATUS_INIT_UCODE_ALIVE)
-                                        ? UCODE_NONE : UCODE_INIT;
-                                IWL_ERR(priv,
-                                        "%s timeout after %dms\n",
-                                        (status == STATUS_INIT_UCODE_ALIVE)
-                                        ? "INIT" : "Runtime",
-                                        jiffies_to_msecs(UCODE_ALIVE_TIMEOUT));
-                                continue;
-                        }
-                }
                 IWL_DEBUG_INFO(priv, DRV_NAME " is coming up\n");
 
                 return 0;
@@ -2125,7 +2075,7 @@ void iwl_post_associate(struct iwl_priv *priv)
          * If chain noise has already been run, then we need to enable
          * power management here */
         if (priv->chain_noise_data.state == IWL_CHAIN_NOISE_DONE)
-                iwl_power_update_mode(priv, 0);
+                iwl_power_update_mode(priv, false);
 
         /* Enable Rx differential gain and sensitivity calibrations */
         iwl_chain_noise_reset(priv);
@@ -2455,15 +2405,15 @@ static int iwl_mac_get_stats(struct ieee80211_hw *hw,
  *
  * See the level definitions in iwl for details.
  *
- * FIXME This file can be deprecated as the module parameter is
- * writable and users can thus also change the debug level
- * using the /sys/module/iwl3945/parameters/debug file.
+ * The debug_level being managed using sysfs below is a per device debug
+ * level that is used instead of the global debug level if it (the per
+ * device debug level) is set.
  */
-
 static ssize_t show_debug_level(struct device *d,
                                 struct device_attribute *attr, char *buf)
 {
-        return sprintf(buf, "0x%08X\n", iwl_debug_level);
+        struct iwl_priv *priv = dev_get_drvdata(d);
+        return sprintf(buf, "0x%08X\n", iwl_get_debug_level(priv));
 }
 static ssize_t store_debug_level(struct device *d,
                                 struct device_attribute *attr,
@@ -2476,9 +2426,12 @@ static ssize_t store_debug_level(struct device *d,
         ret = strict_strtoul(buf, 0, &val);
         if (ret)
                 IWL_ERR(priv, "%s is not in hex or decimal form.\n", buf);
-        else
-                iwl_debug_level = val;
-
+        else {
+                priv->debug_level = val;
+                if (iwl_alloc_traffic_mem(priv))
+                        IWL_ERR(priv,
+                                "Not enough memory to generate traffic log\n");
+        }
         return strnlen(buf, count);
 }
 
@@ -2612,47 +2565,6 @@ static ssize_t store_filter_flags(struct device *d,
 static DEVICE_ATTR(filter_flags, S_IWUSR | S_IRUGO, show_filter_flags,
                    store_filter_flags);
 
-static ssize_t store_power_level(struct device *d,
-                                 struct device_attribute *attr,
-                                 const char *buf, size_t count)
-{
-        struct iwl_priv *priv = dev_get_drvdata(d);
-        int ret;
-        unsigned long mode;
-
-
-        mutex_lock(&priv->mutex);
-
-        ret = strict_strtoul(buf, 10, &mode);
-        if (ret)
-                goto out;
-
-        ret = iwl_power_set_user_mode(priv, mode);
-        if (ret) {
-                IWL_DEBUG_MAC80211(priv, "failed setting power mode.\n");
-                goto out;
-        }
-        ret = count;
-
- out:
-        mutex_unlock(&priv->mutex);
-        return ret;
-}
-
-static ssize_t show_power_level(struct device *d,
-                                struct device_attribute *attr, char *buf)
-{
-        struct iwl_priv *priv = dev_get_drvdata(d);
-        int level = priv->power_data.power_mode;
-        char *p = buf;
-
-        p += sprintf(p, "%d\n", level);
-        return p - buf + 1;
-}
-
-static DEVICE_ATTR(power_level, S_IWUSR | S_IRUSR, show_power_level,
-                   store_power_level);
-
 
 static ssize_t show_statistics(struct device *d,
                                struct device_attribute *attr, char *buf)
@@ -2745,7 +2657,6 @@ static void iwl_cancel_deferred_work(struct iwl_priv *priv)
 static struct attribute *iwl_sysfs_entries[] = {
         &dev_attr_flags.attr,
         &dev_attr_filter_flags.attr,
-        &dev_attr_power_level.attr,
         &dev_attr_statistics.attr,
         &dev_attr_temperature.attr,
         &dev_attr_tx_power.attr,
@@ -2819,6 +2730,8 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 #ifdef CONFIG_IWLWIFI_DEBUG
         atomic_set(&priv->restrict_refcnt, 0);
 #endif
+        if (iwl_alloc_traffic_mem(priv))
+                IWL_ERR(priv, "Not enough memory to generate traffic log\n");
 
         /**************************
          * 2. Initializing PCI bus
@@ -3003,6 +2916,7 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         pci_disable_device(pdev);
  out_ieee80211_free_hw:
         ieee80211_free_hw(priv->hw);
+        iwl_free_traffic_mem(priv);
  out:
         return err;
 }
@@ -3061,6 +2975,7 @@ static void __devexit iwl_pci_remove(struct pci_dev *pdev)
          * until now... */
         destroy_workqueue(priv->workqueue);
         priv->workqueue = NULL;
+        iwl_free_traffic_mem(priv);
 
         free_irq(priv->pci_dev->irq, priv);
         pci_disable_msi(priv->pci_dev);
diff --git a/drivers/net/wireless/iwlwifi/iwl-calib.c b/drivers/net/wireless/iwlwifi/iwl-calib.c
index 13180d6ee2f7..c4b565a2de94 100644
--- a/drivers/net/wireless/iwlwifi/iwl-calib.c
+++ b/drivers/net/wireless/iwlwifi/iwl-calib.c
@@ -852,7 +852,7 @@ void iwl_chain_noise_calibration(struct iwl_priv *priv,
                 priv->cfg->ops->lib->update_chain_flags(priv);
 
         data->state = IWL_CHAIN_NOISE_DONE;
-        iwl_power_update_mode(priv, 0);
+        iwl_power_update_mode(priv, false);
 }
 EXPORT_SYMBOL(iwl_chain_noise_calibration);
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-commands.h b/drivers/net/wireless/iwlwifi/iwl-commands.h
index 39ede5727fe4..68d7719071f7 100644
--- a/drivers/net/wireless/iwlwifi/iwl-commands.h
+++ b/drivers/net/wireless/iwlwifi/iwl-commands.h
@@ -283,7 +283,7 @@ struct iwl3945_power_per_rate {
  *        1)  Dual stream (MIMO)
  *        2)  Triple stream (MIMO)
  *
- *    5:  Value of 0x20 in bits 7:0 indicates 6 Mbps FAT duplicate data
+ *    5:  Value of 0x20 in bits 7:0 indicates 6 Mbps HT40 duplicate data
  *
  * Legacy OFDM rate format for bits 7:0 (bit 8 must be "0", bit 9 "0"):
  *  3-0:  0xD)   6 Mbps
@@ -320,11 +320,11 @@ struct iwl3945_power_per_rate {
 #define RATE_MCS_GF_POS 10
 #define RATE_MCS_GF_MSK 0x400
 
-/* Bit 11: (1) Use 40Mhz FAT chnl width, (0) use 20 MHz legacy chnl width */
-#define RATE_MCS_FAT_POS 11
-#define RATE_MCS_FAT_MSK 0x800
+/* Bit 11: (1) Use 40Mhz HT40 chnl width, (0) use 20 MHz legacy chnl width */
+#define RATE_MCS_HT40_POS 11
+#define RATE_MCS_HT40_MSK 0x800
 
-/* Bit 12: (1) Duplicate data on both 20MHz chnls.  FAT (bit 11) must be set. */
+/* Bit 12: (1) Duplicate data on both 20MHz chnls. HT40 (bit 11) must be set. */
 #define RATE_MCS_DUP_POS 12
 #define RATE_MCS_DUP_MSK 0x1000
 
@@ -459,7 +459,7 @@ struct iwl_init_alive_resp {
 
         /* calibration values from "initialize" uCode */
         __le32 voltage;         /* signed, higher value is lower voltage */
-        __le32 therm_r1[2];     /* signed, 1st for normal, 2nd for FAT channel*/
+        __le32 therm_r1[2];     /* signed, 1st for normal, 2nd for HT40 */
         __le32 therm_r2[2];     /* signed */
         __le32 therm_r3[2];     /* signed */
         __le32 therm_r4[2];     /* signed */
@@ -610,7 +610,7 @@ enum {
 #define RXON_FLG_HT_OPERATING_MODE_POS          (23)
 
 #define RXON_FLG_HT_PROT_MSK                    cpu_to_le32(0x1 << 23)
-#define RXON_FLG_FAT_PROT_MSK                   cpu_to_le32(0x2 << 23)
+#define RXON_FLG_HT40_PROT_MSK                  cpu_to_le32(0x2 << 23)
 
 #define RXON_FLG_CHANNEL_MODE_POS               (25)
 #define RXON_FLG_CHANNEL_MODE_MSK               cpu_to_le32(0x3 << 25)
@@ -891,7 +891,7 @@ struct iwl_qosparam_cmd {
 #define STA_FLG_AGG_MPDU_8US_MSK        cpu_to_le32(1 << 18)
 #define STA_FLG_MAX_AGG_SIZE_POS        (19)
 #define STA_FLG_MAX_AGG_SIZE_MSK        cpu_to_le32(3 << 19)
-#define STA_FLG_FAT_EN_MSK              cpu_to_le32(1 << 21)
+#define STA_FLG_HT40_EN_MSK             cpu_to_le32(1 << 21)
 #define STA_FLG_MIMO_DIS_MSK            cpu_to_le32(1 << 22)
 #define STA_FLG_AGG_MPDU_DENSITY_POS    (23)
 #define STA_FLG_AGG_MPDU_DENSITY_MSK    cpu_to_le32(7 << 23)
@@ -1984,10 +1984,10 @@ struct iwl_link_qual_agg_params {
  *     a) Use this same initial rate for first 3 entries.
  *     b) Find next lower available rate using same mode (SISO or MIMO),
  *        use for next 3 entries.  If no lower rate available, switch to
- *        legacy mode (no FAT channel, no MIMO, no short guard interval).
+ *        legacy mode (no HT40 channel, no MIMO, no short guard interval).
  *     c) If using MIMO, set command's mimo_delimiter to number of entries
  *        using MIMO (3 or 6).
- *     d) After trying 2 HT rates, switch to legacy mode (no FAT channel,
+ *     d) After trying 2 HT rates, switch to legacy mode (no HT40 channel,
  *        no MIMO, no short guard interval), at the next lower bit rate
  *        (e.g. if second HT bit rate was 54, try 48 legacy), and follow
  *        legacy procedure for remaining table entries.
@@ -2313,15 +2313,22 @@ struct iwl_spectrum_notification {
  * PM allow:
  *   bit 0 - '0' Driver not allow power management
  *           '1' Driver allow PM (use rest of parameters)
+ *
  * uCode send sleep notifications:
  *   bit 1 - '0' Don't send sleep notification
  *           '1' send sleep notification (SEND_PM_NOTIFICATION)
+ *
  * Sleep over DTIM
  *   bit 2 - '0' PM have to walk up every DTIM
  *           '1' PM could sleep over DTIM till listen Interval.
+ *
  * PCI power managed
  *   bit 3 - '0' (PCI_CFG_LINK_CTRL & 0x1)
  *           '1' !(PCI_CFG_LINK_CTRL & 0x1)
+ *
+ * Fast PD
+ *   bit 4 - '1' Put radio to sleep when receiving frame for others
+ *
  * Force sleep Modes
  *   bit 31/30- '00' use both mac/xtal sleeps
  *              '01' force Mac sleep
@@ -3017,7 +3024,7 @@ struct iwl_statistics_cmd {
  * one channel that has just been scanned.
  */
 #define STATISTICS_REPLY_FLG_BAND_24G_MSK         cpu_to_le32(0x2)
-#define STATISTICS_REPLY_FLG_FAT_MODE_MSK         cpu_to_le32(0x8)
+#define STATISTICS_REPLY_FLG_HT40_MODE_MSK        cpu_to_le32(0x8)
 
 struct iwl3945_notif_statistics {
         __le32 flag;
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index 2ffbd27d01d2..af735128333a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -105,7 +105,7 @@ void iwl_hwrate_to_tx_control(struct iwl_priv *priv, u32 rate_n_flags,
                 r->flags |= IEEE80211_TX_RC_MCS;
         if (rate_n_flags & RATE_MCS_GF_MSK)
                 r->flags |= IEEE80211_TX_RC_GREEN_FIELD;
-        if (rate_n_flags & RATE_MCS_FAT_MSK)
+        if (rate_n_flags & RATE_MCS_HT40_MSK)
                 r->flags |= IEEE80211_TX_RC_40_MHZ_WIDTH;
         if (rate_n_flags & RATE_MCS_DUP_MSK)
                 r->flags |= IEEE80211_TX_RC_DUP_DATA;
@@ -400,7 +400,7 @@ static void iwlcore_init_ht_hw_capab(const struct iwl_priv *priv,
                              (WLAN_HT_CAP_SM_PS_DISABLED << 2));
 
         max_bit_rate = MAX_BIT_RATE_20_MHZ;
-        if (priv->hw_params.fat_channel & BIT(band)) {
+        if (priv->hw_params.ht40_channel & BIT(band)) {
                 ht_info->cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
                 ht_info->cap |= IEEE80211_HT_CAP_SGI_40;
                 ht_info->mcs.rx_mask[4] = 0x01;
@@ -540,7 +540,7 @@ int iwlcore_init_geos(struct iwl_priv *priv)
                         if (ch->flags & EEPROM_CHANNEL_RADAR)
                                 geo_ch->flags |= IEEE80211_CHAN_RADAR;
 
-                        geo_ch->flags |= ch->fat_extension_channel;
+                        geo_ch->flags |= ch->ht40_extension_channel;
 
                         if (ch->max_power_avg > priv->tx_power_channel_lmt)
                                 priv->tx_power_channel_lmt = ch->max_power_avg;
@@ -604,16 +604,16 @@ static u8 iwl_is_channel_extension(struct iwl_priv *priv,
                 return 0;
 
         if (extension_chan_offset == IEEE80211_HT_PARAM_CHA_SEC_ABOVE)
-                return !(ch_info->fat_extension_channel &
+                return !(ch_info->ht40_extension_channel &
                                         IEEE80211_CHAN_NO_HT40PLUS);
         else if (extension_chan_offset == IEEE80211_HT_PARAM_CHA_SEC_BELOW)
-                return !(ch_info->fat_extension_channel &
+                return !(ch_info->ht40_extension_channel &
                                         IEEE80211_CHAN_NO_HT40MINUS);
 
         return 0;
 }
 
-u8 iwl_is_fat_tx_allowed(struct iwl_priv *priv,
+u8 iwl_is_ht40_tx_allowed(struct iwl_priv *priv,
                          struct ieee80211_sta_ht_cap *sta_ht_inf)
 {
         struct iwl_ht_info *iwl_ht_conf = &priv->current_ht_config;
@@ -637,7 +637,7 @@ u8 iwl_is_fat_tx_allowed(struct iwl_priv *priv,
                         le16_to_cpu(priv->staging_rxon.channel),
                         iwl_ht_conf->extension_chan_offset);
 }
-EXPORT_SYMBOL(iwl_is_fat_tx_allowed);
+EXPORT_SYMBOL(iwl_is_ht40_tx_allowed);
 
 static u16 iwl_adjust_beacon_interval(u16 beacon_val, u16 max_beacon_val)
 {
@@ -866,7 +866,7 @@ void iwl_set_rxon_ht(struct iwl_priv *priv, struct iwl_ht_info *ht_info)
         if (!ht_info->is_ht) {
                 rxon->flags &= ~(RXON_FLG_CHANNEL_MODE_MSK |
                         RXON_FLG_CTRL_CHANNEL_LOC_HI_MSK |
-                        RXON_FLG_FAT_PROT_MSK |
+                        RXON_FLG_HT40_PROT_MSK |
                         RXON_FLG_HT_PROT_MSK);
                 return;
         }
@@ -877,12 +877,12 @@ void iwl_set_rxon_ht(struct iwl_priv *priv, struct iwl_ht_info *ht_info)
         rxon->flags |= cpu_to_le32(ht_info->ht_protection << RXON_FLG_HT_OPERATING_MODE_POS);
 
         /* Set up channel bandwidth:
-         * 20 MHz only, 20/40 mixed or pure 40 if fat ok */
+         * 20 MHz only, 20/40 mixed or pure 40 if ht40 ok */
         /* clear the HT channel mode before set the mode */
         rxon->flags &= ~(RXON_FLG_CHANNEL_MODE_MSK |
                          RXON_FLG_CTRL_CHANNEL_LOC_HI_MSK);
-        if (iwl_is_fat_tx_allowed(priv, NULL)) {
-                /* pure 40 fat */
+        if (iwl_is_ht40_tx_allowed(priv, NULL)) {
+                /* pure ht40 */
                 if (ht_info->ht_protection == IEEE80211_HT_OP_MODE_PROTECTION_20MHZ) {
                         rxon->flags |= RXON_FLG_CHANNEL_MODE_PURE_40;
                         /* Note: control channel is opposite of extension channel */
@@ -1278,7 +1278,7 @@ static void iwl_print_rx_config_cmd(struct iwl_priv *priv)
         struct iwl_rxon_cmd *rxon = &priv->staging_rxon;
 
         IWL_DEBUG_RADIO(priv, "RX CONFIG:\n");
-        iwl_print_hex_dump(IWL_DL_RADIO, (u8 *) rxon, sizeof(*rxon));
+        iwl_print_hex_dump(priv, IWL_DL_RADIO, (u8 *) rxon, sizeof(*rxon));
         IWL_DEBUG_RADIO(priv, "u16 channel: 0x%x\n", le16_to_cpu(rxon->channel));
         IWL_DEBUG_RADIO(priv, "u32 flags: 0x%08X\n", le32_to_cpu(rxon->flags));
         IWL_DEBUG_RADIO(priv, "u32 filter_flags: 0x%08x\n",
@@ -1343,17 +1343,10 @@ static void iwl_dump_nic_error_log(struct iwl_priv *priv)
         u32 desc, time, count, base, data1;
         u32 blink1, blink2, ilink1, ilink2;
 
-        switch (priv->ucode_type) {
-        case UCODE_RT:
-                base = le32_to_cpu(priv->card_alive.error_event_table_ptr);
-                break;
-        case UCODE_INIT:
+        if (priv->ucode_type == UCODE_INIT)
                 base = le32_to_cpu(priv->card_alive_init.error_event_table_ptr);
-                break;
-        default:
-                IWL_ERR(priv, "uCode image not available\n");
-                return;
-        }
+        else
+                base = le32_to_cpu(priv->card_alive.error_event_table_ptr);
 
         if (!priv->cfg->ops->lib->is_valid_rtc_data_addr(base)) {
                 IWL_ERR(priv, "Not valid error log pointer 0x%08X\n", base);
@@ -1405,17 +1398,10 @@ static void iwl_print_event_log(struct iwl_priv *priv, u32 start_idx,
 
         if (num_events == 0)
                 return;
-        switch (priv->ucode_type) {
-        case UCODE_RT:
-                base = le32_to_cpu(priv->card_alive.log_event_table_ptr);
-                break;
-        case UCODE_INIT:
+        if (priv->ucode_type == UCODE_INIT)
                 base = le32_to_cpu(priv->card_alive_init.log_event_table_ptr);
-                break;
-        default:
-                IWL_ERR(priv, "uCode image not available\n");
-                return;
-        }
+        else
+                base = le32_to_cpu(priv->card_alive.log_event_table_ptr);
 
         if (mode == 0)
                 event_size = 2 * sizeof(u32);
@@ -1452,17 +1438,10 @@ void iwl_dump_nic_event_log(struct iwl_priv *priv)
         u32 next_entry; /* index of next entry to be written by uCode */
         u32 size;       /* # entries that we'll print */
 
-        switch (priv->ucode_type) {
-        case UCODE_RT:
-                base = le32_to_cpu(priv->card_alive.log_event_table_ptr);
-                break;
-        case UCODE_INIT:
+        if (priv->ucode_type == UCODE_INIT)
                 base = le32_to_cpu(priv->card_alive_init.log_event_table_ptr);
-                break;
-        default:
-                IWL_ERR(priv, "uCode image not available\n");
-                return;
-        }
+        else
+                base = le32_to_cpu(priv->card_alive.log_event_table_ptr);
 
         if (!priv->cfg->ops->lib->is_valid_rtc_data_addr(base)) {
                 IWL_ERR(priv, "Invalid event log pointer 0x%08X\n", base);
@@ -1508,7 +1487,7 @@ void iwl_irq_handle_error(struct iwl_priv *priv)
         clear_bit(STATUS_HCMD_ACTIVE, &priv->status);
 
 #ifdef CONFIG_IWLWIFI_DEBUG
-        if (iwl_debug_level & IWL_DL_FW_ERRORS) {
+        if (iwl_get_debug_level(priv) & IWL_DL_FW_ERRORS) {
                 iwl_dump_nic_error_log(priv);
                 iwl_dump_nic_event_log(priv);
                 iwl_print_rx_config_cmd(priv);
@@ -1589,7 +1568,8 @@ int iwl_setup_mac(struct iwl_priv *priv)
                     IEEE80211_HW_NOISE_DBM |
                     IEEE80211_HW_AMPDU_AGGREGATION |
                     IEEE80211_HW_SPECTRUM_MGMT |
-                    IEEE80211_HW_SUPPORTS_PS;
+                    IEEE80211_HW_SUPPORTS_PS |
+                    IEEE80211_HW_SUPPORTS_DYNAMIC_PS;
         hw->wiphy->interface_modes =
                 BIT(NL80211_IFTYPE_STATION) |
                 BIT(NL80211_IFTYPE_ADHOC);
@@ -1684,8 +1664,6 @@ int iwl_init_drv(struct iwl_priv *priv)
         priv->qos_data.qos_cap.val = 0;
 
         priv->rates_mask = IWL_RATES_MASK;
-        /* If power management is turned on, default to CAM mode */
-        priv->power_mode = IWL_POWER_MODE_CAM;
         priv->tx_power_user_lmt = IWL_TX_POWER_TARGET_POWER_MAX;
 
         ret = iwl_init_channel_map(priv);
@@ -1985,7 +1963,7 @@ static irqreturn_t iwl_isr(int irq, void *data)
         }
 
 #ifdef CONFIG_IWLWIFI_DEBUG
-        if (iwl_debug_level & (IWL_DL_ISR)) {
+        if (iwl_get_debug_level(priv) & (IWL_DL_ISR)) {
                 inta_fh = iwl_read32(priv, CSR_FH_INT_STATUS);
                 IWL_DEBUG_ISR(priv, "ISR inta 0x%08x, enabled 0x%08x, "
                               "fh 0x%08x\n", inta, inta_mask, inta_fh);
@@ -2235,7 +2213,7 @@ void iwl_rf_kill_ct_config(struct iwl_priv *priv)
         iwl_write32(priv, CSR_UCODE_DRV_GP1_CLR,
                     CSR_UCODE_DRV_GP1_REG_BIT_CT_KILL_EXIT);
         spin_unlock_irqrestore(&priv->lock, flags);
-        priv->power_data.ct_kill_toggle = false;
+        priv->thermal_throttle.ct_kill_toggle = false;
 
         switch (priv->hw_rev & CSR_HW_REV_TYPE_MSK) {
         case CSR_HW_REV_TYPE_1000:
@@ -2248,6 +2226,15 @@ void iwl_rf_kill_ct_config(struct iwl_priv *priv)
 
                 ret = iwl_send_cmd_pdu(priv, REPLY_CT_KILL_CONFIG_CMD,
                                        sizeof(adv_cmd), &adv_cmd);
+                if (ret)
+                        IWL_ERR(priv, "REPLY_CT_KILL_CONFIG_CMD failed\n");
+                else
+                        IWL_DEBUG_INFO(priv, "REPLY_CT_KILL_CONFIG_CMD "
+                                        "succeeded, "
+                                        "critical temperature enter is %d,"
+                                        "exit is %d\n",
+                                       priv->hw_params.ct_kill_threshold,
+                                       priv->hw_params.ct_kill_exit_threshold);
                 break;
         default:
                 cmd.critical_temperature_R =
@@ -2255,16 +2242,15 @@ void iwl_rf_kill_ct_config(struct iwl_priv *priv)
 
                 ret = iwl_send_cmd_pdu(priv, REPLY_CT_KILL_CONFIG_CMD,
                                        sizeof(cmd), &cmd);
+                if (ret)
+                        IWL_ERR(priv, "REPLY_CT_KILL_CONFIG_CMD failed\n");
+                else
+                        IWL_DEBUG_INFO(priv, "REPLY_CT_KILL_CONFIG_CMD "
+                                        "succeeded, "
+                                        "critical temperature is %d\n",
+                                        priv->hw_params.ct_kill_threshold);
                 break;
         }
-        ret = iwl_send_cmd_pdu(priv, REPLY_CT_KILL_CONFIG_CMD,
-                               sizeof(cmd), &cmd);
-        if (ret)
-                IWL_ERR(priv, "REPLY_CT_KILL_CONFIG_CMD failed\n");
-        else
-                IWL_DEBUG_INFO(priv, "REPLY_CT_KILL_CONFIG_CMD succeeded, "
-                        "critical temperature is %d\n",
-                        cmd.critical_temperature_R);
 }
 EXPORT_SYMBOL(iwl_rf_kill_ct_config);
 
@@ -2310,7 +2296,7 @@ void iwl_rx_pm_debug_statistics_notif(struct iwl_priv *priv,
         IWL_DEBUG_RADIO(priv, "Dumping %d bytes of unhandled "
                         "notification for %s:\n",
                         le32_to_cpu(pkt->len), get_cmd_string(pkt->hdr.cmd));
-        iwl_print_hex_dump(IWL_DL_RADIO, pkt->u.raw, le32_to_cpu(pkt->len));
+        iwl_print_hex_dump(priv, IWL_DL_RADIO, pkt->u.raw, le32_to_cpu(pkt->len));
 }
 EXPORT_SYMBOL(iwl_rx_pm_debug_statistics_notif);
 
@@ -2428,7 +2414,7 @@ static void iwl_ht_conf(struct iwl_priv *priv,
         else if (conf_is_ht40_plus(&priv->hw->conf))
                 iwl_conf->extension_chan_offset = IEEE80211_HT_PARAM_CHA_SEC_ABOVE;
 
-        /* If no above or below channel supplied disable FAT channel */
+        /* If no above or below channel supplied disable HT40 channel */
         if (iwl_conf->extension_chan_offset != IEEE80211_HT_PARAM_CHA_SEC_ABOVE &&
             iwl_conf->extension_chan_offset != IEEE80211_HT_PARAM_CHA_SEC_BELOW)
                 iwl_conf->supported_chan_width = 0;
@@ -2564,7 +2550,6 @@ void iwl_bss_info_changed(struct ieee80211_hw *hw,
                 if (bss_conf->assoc) {
                         priv->assoc_id = bss_conf->aid;
                         priv->beacon_int = bss_conf->beacon_int;
-                        priv->power_data.dtim_period = bss_conf->dtim_period;
                         priv->timestamp = bss_conf->timestamp;
                         priv->assoc_capability = bss_conf->assoc_capability;
 
@@ -2814,13 +2799,10 @@ int iwl_mac_config(struct ieee80211_hw *hw, u32 changed)
                 iwl_set_rate(priv);
         }
 
-        if (changed & IEEE80211_CONF_CHANGE_PS &&
-            priv->iw_mode == NL80211_IFTYPE_STATION) {
-                priv->power_data.power_disabled =
-                        !(conf->flags & IEEE80211_CONF_PS);
-                ret = iwl_power_update_mode(priv, 0);
+        if (changed & IEEE80211_CONF_CHANGE_PS) {
+                ret = iwl_power_update_mode(priv, false);
                 if (ret)
-                        IWL_DEBUG_MAC80211(priv, "Error setting power level\n");
+                        IWL_DEBUG_MAC80211(priv, "Error setting sleep level\n");
         }
 
         if (changed & IEEE80211_CONF_CHANGE_POWER) {
@@ -2953,6 +2935,248 @@ void iwl_mac_reset_tsf(struct ieee80211_hw *hw)
 }
 EXPORT_SYMBOL(iwl_mac_reset_tsf);
 
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+
+#define IWL_TRAFFIC_DUMP_SIZE   (IWL_TRAFFIC_ENTRY_SIZE * IWL_TRAFFIC_ENTRIES)
+
+void iwl_reset_traffic_log(struct iwl_priv *priv)
+{
+        priv->tx_traffic_idx = 0;
+        priv->rx_traffic_idx = 0;
+        if (priv->tx_traffic)
+                memset(priv->tx_traffic, 0, IWL_TRAFFIC_DUMP_SIZE);
+        if (priv->rx_traffic)
+                memset(priv->rx_traffic, 0, IWL_TRAFFIC_DUMP_SIZE);
+}
+
+int iwl_alloc_traffic_mem(struct iwl_priv *priv)
+{
+        u32 traffic_size = IWL_TRAFFIC_DUMP_SIZE;
+
+        if (iwl_debug_level & IWL_DL_TX) {
+                if (!priv->tx_traffic) {
+                        priv->tx_traffic =
+                                kzalloc(traffic_size, GFP_KERNEL);
+                        if (!priv->tx_traffic)
+                                return -ENOMEM;
+                }
+        }
+        if (iwl_debug_level & IWL_DL_RX) {
+                if (!priv->rx_traffic) {
+                        priv->rx_traffic =
+                                kzalloc(traffic_size, GFP_KERNEL);
+                        if (!priv->rx_traffic)
+                                return -ENOMEM;
+                }
+        }
+        iwl_reset_traffic_log(priv);
+        return 0;
+}
+EXPORT_SYMBOL(iwl_alloc_traffic_mem);
+
+void iwl_free_traffic_mem(struct iwl_priv *priv)
+{
+        kfree(priv->tx_traffic);
+        priv->tx_traffic = NULL;
+
+        kfree(priv->rx_traffic);
+        priv->rx_traffic = NULL;
+}
+EXPORT_SYMBOL(iwl_free_traffic_mem);
+
+void iwl_dbg_log_tx_data_frame(struct iwl_priv *priv,
+                      u16 length, struct ieee80211_hdr *header)
+{
+        __le16 fc;
+        u16 len;
+
+        if (likely(!(iwl_debug_level & IWL_DL_TX)))
+                return;
+
+        if (!priv->tx_traffic)
+                return;
+
+        fc = header->frame_control;
+        if (ieee80211_is_data(fc)) {
+                len = (length > IWL_TRAFFIC_ENTRY_SIZE)
+                       ? IWL_TRAFFIC_ENTRY_SIZE : length;
+                memcpy((priv->tx_traffic +
+                       (priv->tx_traffic_idx * IWL_TRAFFIC_ENTRY_SIZE)),
+                       header, len);
+                priv->tx_traffic_idx =
+                        (priv->tx_traffic_idx + 1) % IWL_TRAFFIC_ENTRIES;
+        }
+}
+EXPORT_SYMBOL(iwl_dbg_log_tx_data_frame);
+
+void iwl_dbg_log_rx_data_frame(struct iwl_priv *priv,
+                      u16 length, struct ieee80211_hdr *header)
+{
+        __le16 fc;
+        u16 len;
+
+        if (likely(!(iwl_debug_level & IWL_DL_RX)))
+                return;
+
+        if (!priv->rx_traffic)
+                return;
+
+        fc = header->frame_control;
+        if (ieee80211_is_data(fc)) {
+                len = (length > IWL_TRAFFIC_ENTRY_SIZE)
+                       ? IWL_TRAFFIC_ENTRY_SIZE : length;
+                memcpy((priv->rx_traffic +
+                       (priv->rx_traffic_idx * IWL_TRAFFIC_ENTRY_SIZE)),
+                       header, len);
+                priv->rx_traffic_idx =
+                        (priv->rx_traffic_idx + 1) % IWL_TRAFFIC_ENTRIES;
+        }
+}
+EXPORT_SYMBOL(iwl_dbg_log_rx_data_frame);
+
+const char *get_mgmt_string(int cmd)
+{
+        switch (cmd) {
+                IWL_CMD(MANAGEMENT_ASSOC_REQ);
+                IWL_CMD(MANAGEMENT_ASSOC_RESP);
+                IWL_CMD(MANAGEMENT_REASSOC_REQ);
+                IWL_CMD(MANAGEMENT_REASSOC_RESP);
+                IWL_CMD(MANAGEMENT_PROBE_REQ);
+                IWL_CMD(MANAGEMENT_PROBE_RESP);
+                IWL_CMD(MANAGEMENT_BEACON);
+                IWL_CMD(MANAGEMENT_ATIM);
+                IWL_CMD(MANAGEMENT_DISASSOC);
+                IWL_CMD(MANAGEMENT_AUTH);
+                IWL_CMD(MANAGEMENT_DEAUTH);
+                IWL_CMD(MANAGEMENT_ACTION);
+        default:
+                return "UNKNOWN";
+
+        }
+}
+
+const char *get_ctrl_string(int cmd)
+{
+        switch (cmd) {
+                IWL_CMD(CONTROL_BACK_REQ);
+                IWL_CMD(CONTROL_BACK);
+                IWL_CMD(CONTROL_PSPOLL);
+                IWL_CMD(CONTROL_RTS);
+                IWL_CMD(CONTROL_CTS);
+                IWL_CMD(CONTROL_ACK);
+                IWL_CMD(CONTROL_CFEND);
+                IWL_CMD(CONTROL_CFENDACK);
+        default:
+                return "UNKNOWN";
+
+        }
+}
+
+void iwl_clear_tx_stats(struct iwl_priv *priv)
+{
+        memset(&priv->tx_stats, 0, sizeof(struct traffic_stats));
+
+}
+
+void iwl_clear_rx_stats(struct iwl_priv *priv)
+{
+        memset(&priv->rx_stats, 0, sizeof(struct traffic_stats));
+}
+
+/*
+ * if CONFIG_IWLWIFI_DEBUGFS defined, iwl_update_stats function will
+ * record all the MGMT, CTRL and DATA pkt for both TX and Rx pass.
+ * Use debugFs to display the rx/rx_statistics
+ * if CONFIG_IWLWIFI_DEBUGFS not being defined, then no MGMT and CTRL
+ * information will be recorded, but DATA pkt still will be recorded
+ * for the reason of iwl_led.c need to control the led blinking based on
+ * number of tx and rx data.
+ *
+ */
+void iwl_update_stats(struct iwl_priv *priv, bool is_tx, __le16 fc, u16 len)
+{
+        struct traffic_stats    *stats;
+
+        if (is_tx)
+                stats = &priv->tx_stats;
+        else
+                stats = &priv->rx_stats;
+
+        if (ieee80211_is_mgmt(fc)) {
+                switch (fc & cpu_to_le16(IEEE80211_FCTL_STYPE)) {
+                case cpu_to_le16(IEEE80211_STYPE_ASSOC_REQ):
+                        stats->mgmt[MANAGEMENT_ASSOC_REQ]++;
+                        break;
+                case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP):
+                        stats->mgmt[MANAGEMENT_ASSOC_RESP]++;
+                        break;
+                case cpu_to_le16(IEEE80211_STYPE_REASSOC_REQ):
+                        stats->mgmt[MANAGEMENT_REASSOC_REQ]++;
+                        break;
+                case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP):
+                        stats->mgmt[MANAGEMENT_REASSOC_RESP]++;
+                        break;
+                case cpu_to_le16(IEEE80211_STYPE_PROBE_REQ):
+                        stats->mgmt[MANAGEMENT_PROBE_REQ]++;
+                        break;
+                case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
+                        stats->mgmt[MANAGEMENT_PROBE_RESP]++;
+                        break;
+                case cpu_to_le16(IEEE80211_STYPE_BEACON):
+                        stats->mgmt[MANAGEMENT_BEACON]++;
+                        break;
+                case cpu_to_le16(IEEE80211_STYPE_ATIM):
+                        stats->mgmt[MANAGEMENT_ATIM]++;
+                        break;
+                case cpu_to_le16(IEEE80211_STYPE_DISASSOC):
+                        stats->mgmt[MANAGEMENT_DISASSOC]++;
+                        break;
+                case cpu_to_le16(IEEE80211_STYPE_AUTH):
+                        stats->mgmt[MANAGEMENT_AUTH]++;
+                        break;
+                case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
+                        stats->mgmt[MANAGEMENT_DEAUTH]++;
+                        break;
+                case cpu_to_le16(IEEE80211_STYPE_ACTION):
+                        stats->mgmt[MANAGEMENT_ACTION]++;
+                        break;
+                }
+        } else if (ieee80211_is_ctl(fc)) {
+                switch (fc & cpu_to_le16(IEEE80211_FCTL_STYPE)) {
+                case cpu_to_le16(IEEE80211_STYPE_BACK_REQ):
+                        stats->ctrl[CONTROL_BACK_REQ]++;
+                        break;
+                case cpu_to_le16(IEEE80211_STYPE_BACK):
+                        stats->ctrl[CONTROL_BACK]++;
+                        break;
+                case cpu_to_le16(IEEE80211_STYPE_PSPOLL):
+                        stats->ctrl[CONTROL_PSPOLL]++;
+                        break;
+                case cpu_to_le16(IEEE80211_STYPE_RTS):
+                        stats->ctrl[CONTROL_RTS]++;
+                        break;
+                case cpu_to_le16(IEEE80211_STYPE_CTS):
+                        stats->ctrl[CONTROL_CTS]++;
+                        break;
+                case cpu_to_le16(IEEE80211_STYPE_ACK):
+                        stats->ctrl[CONTROL_ACK]++;
+                        break;
+                case cpu_to_le16(IEEE80211_STYPE_CFEND):
+                        stats->ctrl[CONTROL_CFEND]++;
+                        break;
+                case cpu_to_le16(IEEE80211_STYPE_CFENDACK):
+                        stats->ctrl[CONTROL_CFENDACK]++;
+                        break;
+                }
+        } else {
+                /* data */
+                stats->data_cnt++;
+                stats->data_bytes += len;
+        }
+}
+EXPORT_SYMBOL(iwl_update_stats);
+#endif
+
 #ifdef CONFIG_PM
 
 int iwl_pci_suspend(struct pci_dev *pdev, pm_message_t state)
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.h b/drivers/net/wireless/iwlwifi/iwl-core.h
index 10ddcdda1041..32750f4f1ce1 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.h
+++ b/drivers/net/wireless/iwlwifi/iwl-core.h
@@ -83,6 +83,8 @@ struct iwl_cmd;
 #define IWL_SKU_A       0x2
 #define IWL_SKU_N       0x8
 
+#define IWL_CMD(x) case x: return #x
+
 struct iwl_hcmd_ops {
         int (*rxon_assoc)(struct iwl_priv *priv);
         int (*commit_rxon)(struct iwl_priv *priv);
@@ -264,7 +266,7 @@ int iwl_full_rxon_required(struct iwl_priv *priv);
 void iwl_set_rxon_chain(struct iwl_priv *priv);
 int iwl_set_rxon_channel(struct iwl_priv *priv, struct ieee80211_channel *ch);
 void iwl_set_rxon_ht(struct iwl_priv *priv, struct iwl_ht_info *ht_info);
-u8 iwl_is_fat_tx_allowed(struct iwl_priv *priv,
+u8 iwl_is_ht40_tx_allowed(struct iwl_priv *priv,
                          struct ieee80211_sta_ht_cap *sta_ht_inf);
 void iwl_set_flags_for_band(struct iwl_priv *priv, enum ieee80211_band band);
 void iwl_connection_init_rx_config(struct iwl_priv *priv, int mode);
@@ -300,7 +302,55 @@ void iwl_config_ap(struct iwl_priv *priv);
 int iwl_mac_get_tx_stats(struct ieee80211_hw *hw,
                          struct ieee80211_tx_queue_stats *stats);
 void iwl_mac_reset_tsf(struct ieee80211_hw *hw);
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+int iwl_alloc_traffic_mem(struct iwl_priv *priv);
+void iwl_free_traffic_mem(struct iwl_priv *priv);
+void iwl_reset_traffic_log(struct iwl_priv *priv);
+void iwl_dbg_log_tx_data_frame(struct iwl_priv *priv,
+                                u16 length, struct ieee80211_hdr *header);
+void iwl_dbg_log_rx_data_frame(struct iwl_priv *priv,
+                                u16 length, struct ieee80211_hdr *header);
+const char *get_mgmt_string(int cmd);
+const char *get_ctrl_string(int cmd);
+void iwl_clear_tx_stats(struct iwl_priv *priv);
+void iwl_clear_rx_stats(struct iwl_priv *priv);
+void iwl_update_stats(struct iwl_priv *priv, bool is_tx, __le16 fc,
+                      u16 len);
+#else
+static inline int iwl_alloc_traffic_mem(struct iwl_priv *priv)
+{
+        return 0;
+}
+static inline void iwl_free_traffic_mem(struct iwl_priv *priv)
+{
+}
+static inline void iwl_reset_traffic_log(struct iwl_priv *priv)
+{
+}
+static inline void iwl_dbg_log_tx_data_frame(struct iwl_priv *priv,
+                      u16 length, struct ieee80211_hdr *header)
+{
+}
+static inline void iwl_dbg_log_rx_data_frame(struct iwl_priv *priv,
+                      u16 length, struct ieee80211_hdr *header)
+{
+}
+static inline void iwl_update_stats(struct iwl_priv *priv, bool is_tx,
+                                    __le16 fc, u16 len)
+{
+        struct traffic_stats    *stats;
+
+        if (is_tx)
+                stats = &priv->tx_stats;
+        else
+                stats = &priv->rx_stats;
 
+        if (ieee80211_is_data(fc)) {
+                /* data */
+                stats->data_bytes += len;
+        }
+}
+#endif
 /*****************************************************
  * RX handlers.
  * **************************************************/
@@ -512,8 +562,6 @@ void iwlcore_free_geos(struct iwl_priv *priv);
 #define STATUS_POWER_PMI        16
 #define STATUS_FW_ERROR         17
 #define STATUS_MODE_PENDING     18
-#define STATUS_INIT_UCODE_ALIVE 19
-#define STATUS_RT_UCODE_ALIVE   20
 
 
 static inline int iwl_is_ready(struct iwl_priv *priv)
diff --git a/drivers/net/wireless/iwlwifi/iwl-debug.h b/drivers/net/wireless/iwlwifi/iwl-debug.h
index fbe177608bc7..723f38a023ce 100644
--- a/drivers/net/wireless/iwlwifi/iwl-debug.h
+++ b/drivers/net/wireless/iwlwifi/iwl-debug.h
@@ -46,7 +46,7 @@ do {									\
 #ifdef CONFIG_IWLWIFI_DEBUG
 #define IWL_DEBUG(__priv, level, fmt, args...)                          \
 do {                                                                    \
-        if (iwl_debug_level & (level))                                  \
+        if (iwl_get_debug_level(__priv) & (level))                                      \
                 dev_printk(KERN_ERR, &(__priv->hw->wiphy->dev),         \
                          "%c %s " fmt, in_interrupt() ? 'I' : 'U',      \
                         __func__ , ## args);                            \
@@ -54,15 +54,15 @@ do {									\
 
 #define IWL_DEBUG_LIMIT(__priv, level, fmt, args...)                    \
 do {                                                                    \
-        if ((iwl_debug_level & (level)) && net_ratelimit())             \
+        if ((iwl_get_debug_level(__priv) & (level)) && net_ratelimit())         \
                 dev_printk(KERN_ERR, &(__priv->hw->wiphy->dev),         \
                         "%c %s " fmt, in_interrupt() ? 'I' : 'U',       \
                          __func__ , ## args);                           \
 } while (0)
 
-#define iwl_print_hex_dump(level, p, len)                               \
+#define iwl_print_hex_dump(priv, level, p, len)                         \
 do {                                                                    \
-        if (iwl_debug_level & level)                                    \
+        if (iwl_get_debug_level(priv) & level)                          \
                 print_hex_dump(KERN_DEBUG, "iwl data: ",                \
                                DUMP_PREFIX_OFFSET, 16, 1, p, len, 1);   \
 } while (0)
@@ -72,13 +72,12 @@ struct iwl_debugfs {
         const char *name;
         struct dentry *dir_drv;
         struct dentry *dir_data;
+        struct dentry *dir_debug;
         struct dentry *dir_rf;
         struct dir_data_files {
                 struct dentry *file_sram;
                 struct dentry *file_nvm;
                 struct dentry *file_stations;
-                struct dentry *file_rx_statistics;
-                struct dentry *file_tx_statistics;
                 struct dentry *file_log_event;
                 struct dentry *file_channels;
                 struct dentry *file_status;
@@ -89,12 +88,26 @@ struct iwl_debugfs {
                 struct dentry *file_led;
 #endif
                 struct dentry *file_disable_ht40;
+                struct dentry *file_sleep_level_override;
+                struct dentry *file_current_sleep_command;
         } dbgfs_data_files;
         struct dir_rf_files {
                 struct dentry *file_disable_sensitivity;
                 struct dentry *file_disable_chain_noise;
                 struct dentry *file_disable_tx_power;
         } dbgfs_rf_files;
+        struct dir_debug_files {
+                struct dentry *file_rx_statistics;
+                struct dentry *file_tx_statistics;
+                struct dentry *file_traffic_log;
+                struct dentry *file_rx_queue;
+                struct dentry *file_tx_queue;
+                struct dentry *file_ucode_rx_stats;
+                struct dentry *file_ucode_tx_stats;
+                struct dentry *file_ucode_general_stats;
+                struct dentry *file_sensitivity;
+                struct dentry *file_chain_noise;
+        } dbgfs_debug_files;
         u32 sram_offset;
         u32 sram_len;
 };
@@ -106,7 +119,8 @@ void iwl_dbgfs_unregister(struct iwl_priv *priv);
 #else
 #define IWL_DEBUG(__priv, level, fmt, args...)
 #define IWL_DEBUG_LIMIT(__priv, level, fmt, args...)
-static inline void iwl_print_hex_dump(int level, void *p, u32 len)
+static inline void iwl_print_hex_dump(struct iwl_priv *priv, int level,
+                                      void *p, u32 len)
 {}
 #endif                          /* CONFIG_IWLWIFI_DEBUG */
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-debugfs.c b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
index 6748a3fb9669..f68fb4711da2 100644
--- a/drivers/net/wireless/iwlwifi/iwl-debugfs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
@@ -38,7 +38,7 @@
 #include "iwl-debug.h"
 #include "iwl-core.h"
 #include "iwl-io.h"
-
+#include "iwl-calib.h"
 
 /* create and remove of files */
 #define DEBUGFS_ADD_DIR(name, parent) do {                              \
@@ -126,18 +126,58 @@ static ssize_t iwl_dbgfs_tx_statistics_read(struct file *file,
                                                 size_t count, loff_t *ppos) {
 
         struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
-        char buf[256];
+        char *buf;
         int pos = 0;
-        const size_t bufsz = sizeof(buf);
 
-        pos += scnprintf(buf + pos, bufsz - pos, "mgmt: %u\n",
-                                                priv->tx_stats[0].cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, "ctrl: %u\n",
-                                                priv->tx_stats[1].cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, "data: %u\n",
-                                                priv->tx_stats[2].cnt);
+        int cnt;
+        ssize_t ret;
+        const size_t bufsz = 100 + sizeof(char) * 24 * (MANAGEMENT_MAX + CONTROL_MAX);
+        buf = kzalloc(bufsz, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+        pos += scnprintf(buf + pos, bufsz - pos, "Management:\n");
+        for (cnt = 0; cnt < MANAGEMENT_MAX; cnt++) {
+                pos += scnprintf(buf + pos, bufsz - pos,
+                                 "\t%s\t\t: %u\n",
+                                 get_mgmt_string(cnt),
+                                 priv->tx_stats.mgmt[cnt]);
+        }
+        pos += scnprintf(buf + pos, bufsz - pos, "Control\n");
+        for (cnt = 0; cnt < CONTROL_MAX; cnt++) {
+                pos += scnprintf(buf + pos, bufsz - pos,
+                                 "\t%s\t\t: %u\n",
+                                 get_ctrl_string(cnt),
+                                 priv->tx_stats.ctrl[cnt]);
+        }
+        pos += scnprintf(buf + pos, bufsz - pos, "Data:\n");
+        pos += scnprintf(buf + pos, bufsz - pos, "\tcnt: %u\n",
+                         priv->tx_stats.data_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, "\tbytes: %llu\n",
+                         priv->tx_stats.data_bytes);
+        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+        kfree(buf);
+        return ret;
+}
 
-        return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+static ssize_t iwl_dbgfs_tx_statistics_write(struct file *file,
+                                        const char __user *user_buf,
+                                        size_t count, loff_t *ppos)
+{
+        struct iwl_priv *priv = file->private_data;
+        u32 clear_flag;
+        char buf[8];
+        int buf_size;
+
+        memset(buf, 0, sizeof(buf));
+        buf_size = min(count, sizeof(buf) -  1);
+        if (copy_from_user(buf, user_buf, buf_size))
+                return -EFAULT;
+        if (sscanf(buf, "%x", &clear_flag) != 1)
+                return -EFAULT;
+        if (clear_flag == 1)
+                iwl_clear_tx_stats(priv);
+
+        return count;
 }
 
 static ssize_t iwl_dbgfs_rx_statistics_read(struct file *file,
@@ -145,18 +185,59 @@ static ssize_t iwl_dbgfs_rx_statistics_read(struct file *file,
                                                 size_t count, loff_t *ppos) {
 
         struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
-        char buf[256];
+        char *buf;
         int pos = 0;
-        const size_t bufsz = sizeof(buf);
+        int cnt;
+        ssize_t ret;
+        const size_t bufsz = 100 +
+                sizeof(char) * 24 * (MANAGEMENT_MAX + CONTROL_MAX);
+        buf = kzalloc(bufsz, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
 
-        pos += scnprintf(buf + pos, bufsz - pos, "mgmt: %u\n",
-                                                priv->rx_stats[0].cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, "ctrl: %u\n",
-                                                priv->rx_stats[1].cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, "data: %u\n",
-                                                priv->rx_stats[2].cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, "Management:\n");
+        for (cnt = 0; cnt < MANAGEMENT_MAX; cnt++) {
+                pos += scnprintf(buf + pos, bufsz - pos,
+                                 "\t%s\t\t: %u\n",
+                                 get_mgmt_string(cnt),
+                                 priv->rx_stats.mgmt[cnt]);
+        }
+        pos += scnprintf(buf + pos, bufsz - pos, "Control:\n");
+        for (cnt = 0; cnt < CONTROL_MAX; cnt++) {
+                pos += scnprintf(buf + pos, bufsz - pos,
+                                 "\t%s\t\t: %u\n",
+                                 get_ctrl_string(cnt),
+                                 priv->rx_stats.ctrl[cnt]);
+        }
+        pos += scnprintf(buf + pos, bufsz - pos, "Data:\n");
+        pos += scnprintf(buf + pos, bufsz - pos, "\tcnt: %u\n",
+                         priv->rx_stats.data_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, "\tbytes: %llu\n",
+                         priv->rx_stats.data_bytes);
 
-        return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+        kfree(buf);
+        return ret;
+}
+
+static ssize_t iwl_dbgfs_rx_statistics_write(struct file *file,
+                                        const char __user *user_buf,
+                                        size_t count, loff_t *ppos)
+{
+        struct iwl_priv *priv = file->private_data;
+        u32 clear_flag;
+        char buf[8];
+        int buf_size;
+
+        memset(buf, 0, sizeof(buf));
+        buf_size = min(count, sizeof(buf) -  1);
+        if (copy_from_user(buf, user_buf, buf_size))
+                return -EFAULT;
+        if (sscanf(buf, "%x", &clear_flag) != 1)
+                return -EFAULT;
+        if (clear_flag == 1)
+                iwl_clear_rx_stats(priv);
+        return count;
 }
 
 #define BYTE1_MASK 0x000000ff;
@@ -623,7 +704,7 @@ static ssize_t iwl_dbgfs_thermal_throttling_read(struct file *file,
                                 size_t count, loff_t *ppos)
 {
         struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
-        struct iwl_tt_mgmt *tt = &priv->power_data.tt;
+        struct iwl_tt_mgmt *tt = &priv->thermal_throttle;
         struct iwl_tt_restriction *restriction;
         char buf[100];
         int pos = 0;
@@ -632,12 +713,11 @@ static ssize_t iwl_dbgfs_thermal_throttling_read(struct file *file,
 
         pos += scnprintf(buf + pos, bufsz - pos,
                         "Thermal Throttling Mode: %s\n",
-                        (priv->power_data.adv_tt)
-                        ? "Advance" : "Legacy");
+                        tt->advanced_tt ? "Advance" : "Legacy");
         pos += scnprintf(buf + pos, bufsz - pos,
                         "Thermal Throttling State: %d\n",
                         tt->state);
-        if (priv->power_data.adv_tt) {
+        if (tt->advanced_tt) {
                 restriction = tt->restriction + tt->state;
                 pos += scnprintf(buf + pos, bufsz - pos,
                                 "Tx mode: %d\n",
@@ -696,12 +776,87 @@ static ssize_t iwl_dbgfs_disable_ht40_read(struct file *file,
         return ret;
 }
 
+static ssize_t iwl_dbgfs_sleep_level_override_write(struct file *file,
+                                                    const char __user *user_buf,
+                                                    size_t count, loff_t *ppos)
+{
+        struct iwl_priv *priv = file->private_data;
+        char buf[8];
+        int buf_size;
+        int value;
+
+        memset(buf, 0, sizeof(buf));
+        buf_size = min(count, sizeof(buf) -  1);
+        if (copy_from_user(buf, user_buf, buf_size))
+                return -EFAULT;
+
+        if (sscanf(buf, "%d", &value) != 1)
+                return -EINVAL;
+
+        /*
+         * Our users expect 0 to be "CAM", but 0 isn't actually
+         * valid here. However, let's not confuse them and present
+         * IWL_POWER_INDEX_1 as "1", not "0".
+         */
+        if (value > 0)
+                value -= 1;
+
+        if (value != -1 && (value < 0 || value >= IWL_POWER_NUM))
+                return -EINVAL;
+
+        priv->power_data.debug_sleep_level_override = value;
+
+        iwl_power_update_mode(priv, false);
+
+        return count;
+}
+
+static ssize_t iwl_dbgfs_sleep_level_override_read(struct file *file,
+                                                   char __user *user_buf,
+                                                   size_t count, loff_t *ppos)
+{
+        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        char buf[10];
+        int pos, value;
+        const size_t bufsz = sizeof(buf);
+
+        /* see the write function */
+        value = priv->power_data.debug_sleep_level_override;
+        if (value >= 0)
+                value += 1;
+
+        pos = scnprintf(buf, bufsz, "%d\n", value);
+        return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+}
+
+static ssize_t iwl_dbgfs_current_sleep_command_read(struct file *file,
+                                                    char __user *user_buf,
+                                                    size_t count, loff_t *ppos)
+{
+        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        char buf[200];
+        int pos = 0, i;
+        const size_t bufsz = sizeof(buf);
+        struct iwl_powertable_cmd *cmd = &priv->power_data.sleep_cmd;
+
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "flags: %#.2x\n", le16_to_cpu(cmd->flags));
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "RX/TX timeout: %d/%d usec\n",
+                         le32_to_cpu(cmd->rx_data_timeout),
+                         le32_to_cpu(cmd->tx_data_timeout));
+        for (i = 0; i < IWL_POWER_VEC_SIZE; i++)
+                pos += scnprintf(buf + pos, bufsz - pos,
+                                 "sleep_interval[%d]: %d\n", i,
+                                 le32_to_cpu(cmd->sleep_interval[i]));
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+}
+
 DEBUGFS_READ_WRITE_FILE_OPS(sram);
 DEBUGFS_WRITE_FILE_OPS(log_event);
 DEBUGFS_READ_FILE_OPS(nvm);
 DEBUGFS_READ_FILE_OPS(stations);
-DEBUGFS_READ_FILE_OPS(rx_statistics);
-DEBUGFS_READ_FILE_OPS(tx_statistics);
 DEBUGFS_READ_FILE_OPS(channels);
 DEBUGFS_READ_FILE_OPS(status);
 DEBUGFS_READ_WRITE_FILE_OPS(interrupt);
@@ -711,6 +866,713 @@ DEBUGFS_READ_FILE_OPS(led);
 #endif
 DEBUGFS_READ_FILE_OPS(thermal_throttling);
 DEBUGFS_READ_WRITE_FILE_OPS(disable_ht40);
+DEBUGFS_READ_WRITE_FILE_OPS(sleep_level_override);
+DEBUGFS_READ_FILE_OPS(current_sleep_command);
+
+static ssize_t iwl_dbgfs_traffic_log_read(struct file *file,
+                                         char __user *user_buf,
+                                         size_t count, loff_t *ppos)
+{
+        struct iwl_priv *priv = file->private_data;
+        int pos = 0, ofs = 0;
+        int cnt = 0, entry;
+        struct iwl_tx_queue *txq;
+        struct iwl_queue *q;
+        struct iwl_rx_queue *rxq = &priv->rxq;
+        char *buf;
+        int bufsz = ((IWL_TRAFFIC_ENTRIES * IWL_TRAFFIC_ENTRY_SIZE * 64) * 2) +
+                (IWL_MAX_NUM_QUEUES * 32 * 8) + 400;
+        const u8 *ptr;
+        ssize_t ret;
+
+        buf = kzalloc(bufsz, GFP_KERNEL);
+        if (!buf) {
+                IWL_ERR(priv, "Can not allocate buffer\n");
+                return -ENOMEM;
+        }
+        pos += scnprintf(buf + pos, bufsz - pos, "Tx Queue\n");
+        for (cnt = 0; cnt < priv->hw_params.max_txq_num; cnt++) {
+                txq = &priv->txq[cnt];
+                q = &txq->q;
+                pos += scnprintf(buf + pos, bufsz - pos,
+                                "q[%d]: read_ptr: %u, write_ptr: %u\n",
+                                cnt, q->read_ptr, q->write_ptr);
+        }
+        if (priv->tx_traffic && (iwl_debug_level & IWL_DL_TX)) {
+                ptr = priv->tx_traffic;
+                pos += scnprintf(buf + pos, bufsz - pos,
+                                "Tx Traffic idx: %u\n", priv->tx_traffic_idx);
+                for (cnt = 0, ofs = 0; cnt < IWL_TRAFFIC_ENTRIES; cnt++) {
+                        for (entry = 0; entry < IWL_TRAFFIC_ENTRY_SIZE / 16;
+                             entry++,  ofs += 16) {
+                                pos += scnprintf(buf + pos, bufsz - pos,
+                                                "0x%.4x ", ofs);
+                                hex_dump_to_buffer(ptr + ofs, 16, 16, 2,
+                                                   buf + pos, bufsz - pos, 0);
+                                pos += strlen(buf);
+                                if (bufsz - pos > 0)
+                                        buf[pos++] = '\n';
+                        }
+                }
+        }
+
+        pos += scnprintf(buf + pos, bufsz - pos, "Rx Queue\n");
+        pos += scnprintf(buf + pos, bufsz - pos,
+                        "read: %u, write: %u\n",
+                         rxq->read, rxq->write);
+
+        if (priv->rx_traffic && (iwl_debug_level & IWL_DL_RX)) {
+                ptr = priv->rx_traffic;
+                pos += scnprintf(buf + pos, bufsz - pos,
+                                "Rx Traffic idx: %u\n", priv->rx_traffic_idx);
+                for (cnt = 0, ofs = 0; cnt < IWL_TRAFFIC_ENTRIES; cnt++) {
+                        for (entry = 0; entry < IWL_TRAFFIC_ENTRY_SIZE / 16;
+                             entry++,  ofs += 16) {
+                                pos += scnprintf(buf + pos, bufsz - pos,
+                                                "0x%.4x ", ofs);
+                                hex_dump_to_buffer(ptr + ofs, 16, 16, 2,
+                                                   buf + pos, bufsz - pos, 0);
+                                pos += strlen(buf);
+                                if (bufsz - pos > 0)
+                                        buf[pos++] = '\n';
+                        }
+                }
+        }
+
+        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+        kfree(buf);
+        return ret;
+}
+
+static ssize_t iwl_dbgfs_traffic_log_write(struct file *file,
+                                         const char __user *user_buf,
+                                         size_t count, loff_t *ppos)
+{
+        struct iwl_priv *priv = file->private_data;
+        char buf[8];
+        int buf_size;
+        int traffic_log;
+
+        memset(buf, 0, sizeof(buf));
+        buf_size = min(count, sizeof(buf) -  1);
+        if (copy_from_user(buf, user_buf, buf_size))
+                return -EFAULT;
+        if (sscanf(buf, "%d", &traffic_log) != 1)
+                return -EFAULT;
+        if (traffic_log == 0)
+                iwl_reset_traffic_log(priv);
+
+        return count;
+}
+
+static ssize_t iwl_dbgfs_tx_queue_read(struct file *file,
+                                                char __user *user_buf,
+                                                size_t count, loff_t *ppos) {
+
+        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        struct iwl_tx_queue *txq;
+        struct iwl_queue *q;
+        char *buf;
+        int pos = 0;
+        int cnt;
+        int ret;
+        const size_t bufsz = sizeof(char) * 60 * IWL_MAX_NUM_QUEUES;
+
+        buf = kzalloc(bufsz, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
+        for (cnt = 0; cnt < priv->hw_params.max_txq_num; cnt++) {
+                txq = &priv->txq[cnt];
+                q = &txq->q;
+                pos += scnprintf(buf + pos, bufsz - pos,
+                                "hwq %.2d: read=%u write=%u stop=%d"
+                                " swq_id=%#.2x (ac %d/hwq %d)\n",
+                                cnt, q->read_ptr, q->write_ptr,
+                                !!test_bit(cnt, priv->queue_stopped),
+                                txq->swq_id,
+                                txq->swq_id & 0x80 ? txq->swq_id & 3 :
+                                txq->swq_id,
+                                txq->swq_id & 0x80 ? (txq->swq_id >> 2) &
+                                0x1f : txq->swq_id);
+                if (cnt >= 4)
+                        continue;
+                /* for the ACs, display the stop count too */
+                pos += scnprintf(buf + pos, bufsz - pos,
+                                "        stop-count: %d\n",
+                                atomic_read(&priv->queue_stop_count[cnt]));
+        }
+        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+        kfree(buf);
+        return ret;
+}
+
+static ssize_t iwl_dbgfs_rx_queue_read(struct file *file,
+                                                char __user *user_buf,
+                                                size_t count, loff_t *ppos) {
+
+        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        struct iwl_rx_queue *rxq = &priv->rxq;
+        char buf[256];
+        int pos = 0;
+        const size_t bufsz = sizeof(buf);
+
+        pos += scnprintf(buf + pos, bufsz - pos, "read: %u\n",
+                                                rxq->read);
+        pos += scnprintf(buf + pos, bufsz - pos, "write: %u\n",
+                                                rxq->write);
+        pos += scnprintf(buf + pos, bufsz - pos, "free_count: %u\n",
+                                                rxq->free_count);
+        pos += scnprintf(buf + pos, bufsz - pos, "closed_rb_num: %u\n",
+                         le16_to_cpu(rxq->rb_stts->closed_rb_num) &  0x0FFF);
+        return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+}
+
+#define UCODE_STATISTICS_CLEAR_MSK              (0x1 << 0)
+#define UCODE_STATISTICS_FREQUENCY_MSK          (0x1 << 1)
+#define UCODE_STATISTICS_NARROW_BAND_MSK        (0x1 << 2)
+
+static int iwl_dbgfs_statistics_flag(struct iwl_priv *priv, char *buf,
+                                     int bufsz)
+{
+        int p = 0;
+
+        p += scnprintf(buf + p, bufsz - p,
+                "Statistics Flag(0x%X):\n",
+                le32_to_cpu(priv->statistics.flag));
+        if (le32_to_cpu(priv->statistics.flag) & UCODE_STATISTICS_CLEAR_MSK)
+                p += scnprintf(buf + p, bufsz - p,
+                "\tStatistics have been cleared\n");
+        p += scnprintf(buf + p, bufsz - p,
+                "\tOperational Frequency: %s\n",
+                (le32_to_cpu(priv->statistics.flag) &
+                UCODE_STATISTICS_FREQUENCY_MSK)
+                 ? "2.4 GHz" : "5.2 GHz");
+        p += scnprintf(buf + p, bufsz - p,
+                "\tTGj Narrow Band: %s\n",
+                (le32_to_cpu(priv->statistics.flag) &
+                UCODE_STATISTICS_NARROW_BAND_MSK)
+                 ? "enabled" : "disabled");
+        return p;
+}
+
+
+static ssize_t iwl_dbgfs_ucode_rx_stats_read(struct file *file,
+                                        char __user *user_buf,
+                                        size_t count, loff_t *ppos)
+{
+        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        int pos = 0;
+        char *buf;
+        int bufsz = sizeof(struct statistics_rx_phy) * 20 +
+                sizeof(struct statistics_rx_non_phy) * 20 +
+                sizeof(struct statistics_rx_ht_phy) * 20 + 400;
+        ssize_t ret;
+        struct statistics_rx_phy *ofdm;
+        struct statistics_rx_phy *cck;
+        struct statistics_rx_non_phy *general;
+        struct statistics_rx_ht_phy *ht;
+
+        if (!iwl_is_alive(priv))
+                return -EAGAIN;
+
+        /* make request to uCode to retrieve statistics information */
+        mutex_lock(&priv->mutex);
+        ret = iwl_send_statistics_request(priv, 0);
+        mutex_unlock(&priv->mutex);
+
+        if (ret) {
+                IWL_ERR(priv,
+                        "Error sending statistics request: %zd\n", ret);
+                return -EAGAIN;
+        }
+        buf = kzalloc(bufsz, GFP_KERNEL);
+        if (!buf) {
+                IWL_ERR(priv, "Can not allocate Buffer\n");
+                return -ENOMEM;
+        }
+
+        /* the statistic information display here is based on
+         * the last statistics notification from uCode
+         * might not reflect the current uCode activity
+         */
+        ofdm = &priv->statistics.rx.ofdm;
+        cck = &priv->statistics.rx.cck;
+        general = &priv->statistics.rx.general;
+        ht = &priv->statistics.rx.ofdm_ht;
+        pos += iwl_dbgfs_statistics_flag(priv, buf, bufsz);
+        pos += scnprintf(buf + pos, bufsz - pos, "Statistics_Rx - OFDM:\n");
+        pos += scnprintf(buf + pos, bufsz - pos, "ina_cnt: %u\n",
+                         le32_to_cpu(ofdm->ina_cnt));
+        pos += scnprintf(buf + pos, bufsz - pos, "fina_cnt: %u\n",
+                         le32_to_cpu(ofdm->fina_cnt));
+        pos += scnprintf(buf + pos, bufsz - pos, "plcp_err: %u\n",
+                         le32_to_cpu(ofdm->plcp_err));
+        pos += scnprintf(buf + pos, bufsz - pos, "crc32_err: %u\n",
+                         le32_to_cpu(ofdm->crc32_err));
+        pos += scnprintf(buf + pos, bufsz - pos, "overrun_err: %u\n",
+                         le32_to_cpu(ofdm->overrun_err));
+        pos += scnprintf(buf + pos, bufsz - pos, "early_overrun_err: %u\n",
+                         le32_to_cpu(ofdm->early_overrun_err));
+        pos += scnprintf(buf + pos, bufsz - pos, "crc32_good: %u\n",
+                         le32_to_cpu(ofdm->crc32_good));
+        pos += scnprintf(buf + pos, bufsz - pos, "false_alarm_cnt: %u\n",
+                         le32_to_cpu(ofdm->false_alarm_cnt));
+        pos += scnprintf(buf + pos, bufsz - pos, "fina_sync_err_cnt: %u\n",
+                         le32_to_cpu(ofdm->fina_sync_err_cnt));
+        pos += scnprintf(buf + pos, bufsz - pos, "sfd_timeout: %u\n",
+                         le32_to_cpu(ofdm->sfd_timeout));
+        pos += scnprintf(buf + pos, bufsz - pos, "fina_timeout: %u\n",
+                         le32_to_cpu(ofdm->fina_timeout));
+        pos += scnprintf(buf + pos, bufsz - pos, "unresponded_rts: %u\n",
+                         le32_to_cpu(ofdm->unresponded_rts));
+        pos += scnprintf(buf + pos, bufsz - pos,
+                        "rxe_frame_limit_overrun: %u\n",
+                        le32_to_cpu(ofdm->rxe_frame_limit_overrun));
+        pos += scnprintf(buf + pos, bufsz - pos, "sent_ack_cnt: %u\n",
+                         le32_to_cpu(ofdm->sent_ack_cnt));
+        pos += scnprintf(buf + pos, bufsz - pos, "sent_cts_cnt: %u\n",
+                         le32_to_cpu(ofdm->sent_cts_cnt));
+        pos += scnprintf(buf + pos, bufsz - pos, "sent_ba_rsp_cnt: %u\n",
+                         le32_to_cpu(ofdm->sent_ba_rsp_cnt));
+        pos += scnprintf(buf + pos, bufsz - pos, "dsp_self_kill: %u\n",
+                         le32_to_cpu(ofdm->dsp_self_kill));
+        pos += scnprintf(buf + pos, bufsz - pos, "mh_format_err: %u\n",
+                         le32_to_cpu(ofdm->mh_format_err));
+        pos += scnprintf(buf + pos, bufsz - pos, "re_acq_main_rssi_sum: %u\n",
+                         le32_to_cpu(ofdm->re_acq_main_rssi_sum));
+
+        pos += scnprintf(buf + pos, bufsz - pos, "Statistics_Rx - CCK:\n");
+        pos += scnprintf(buf + pos, bufsz - pos, "ina_cnt: %u\n",
+                         le32_to_cpu(cck->ina_cnt));
+        pos += scnprintf(buf + pos, bufsz - pos, "fina_cnt: %u\n",
+                         le32_to_cpu(cck->fina_cnt));
+        pos += scnprintf(buf + pos, bufsz - pos, "plcp_err: %u\n",
+                         le32_to_cpu(cck->plcp_err));
+        pos += scnprintf(buf + pos, bufsz - pos, "crc32_err: %u\n",
+                         le32_to_cpu(cck->crc32_err));
+        pos += scnprintf(buf + pos, bufsz - pos, "overrun_err: %u\n",
+                         le32_to_cpu(cck->overrun_err));
+        pos += scnprintf(buf + pos, bufsz - pos, "early_overrun_err: %u\n",
+                         le32_to_cpu(cck->early_overrun_err));
+        pos += scnprintf(buf + pos, bufsz - pos, "crc32_good: %u\n",
+                         le32_to_cpu(cck->crc32_good));
+        pos += scnprintf(buf + pos, bufsz - pos, "false_alarm_cnt: %u\n",
+                         le32_to_cpu(cck->false_alarm_cnt));
+        pos += scnprintf(buf + pos, bufsz - pos, "fina_sync_err_cnt: %u\n",
+                         le32_to_cpu(cck->fina_sync_err_cnt));
+        pos += scnprintf(buf + pos, bufsz - pos, "sfd_timeout: %u\n",
+                         le32_to_cpu(cck->sfd_timeout));
+        pos += scnprintf(buf + pos, bufsz - pos, "fina_timeout: %u\n",
+                         le32_to_cpu(cck->fina_timeout));
+        pos += scnprintf(buf + pos, bufsz - pos, "unresponded_rts: %u\n",
+                         le32_to_cpu(cck->unresponded_rts));
+        pos += scnprintf(buf + pos, bufsz - pos,
+                        "rxe_frame_limit_overrun: %u\n",
+                        le32_to_cpu(cck->rxe_frame_limit_overrun));
+        pos += scnprintf(buf + pos, bufsz - pos, "sent_ack_cnt: %u\n",
+                         le32_to_cpu(cck->sent_ack_cnt));
+        pos += scnprintf(buf + pos, bufsz - pos, "sent_cts_cnt: %u\n",
+                         le32_to_cpu(cck->sent_cts_cnt));
+        pos += scnprintf(buf + pos, bufsz - pos, "sent_ba_rsp_cnt: %u\n",
+                         le32_to_cpu(cck->sent_ba_rsp_cnt));
+        pos += scnprintf(buf + pos, bufsz - pos, "dsp_self_kill: %u\n",
+                         le32_to_cpu(cck->dsp_self_kill));
+        pos += scnprintf(buf + pos, bufsz - pos, "mh_format_err: %u\n",
+                         le32_to_cpu(cck->mh_format_err));
+        pos += scnprintf(buf + pos, bufsz - pos, "re_acq_main_rssi_sum: %u\n",
+                         le32_to_cpu(cck->re_acq_main_rssi_sum));
+
+        pos += scnprintf(buf + pos, bufsz - pos, "Statistics_Rx - GENERAL:\n");
+        pos += scnprintf(buf + pos, bufsz - pos, "bogus_cts: %u\n",
+                         le32_to_cpu(general->bogus_cts));
+        pos += scnprintf(buf + pos, bufsz - pos, "bogus_ack: %u\n",
+                         le32_to_cpu(general->bogus_ack));
+        pos += scnprintf(buf + pos, bufsz - pos, "non_bssid_frames: %u\n",
+                         le32_to_cpu(general->non_bssid_frames));
+        pos += scnprintf(buf + pos, bufsz - pos, "filtered_frames: %u\n",
+                         le32_to_cpu(general->filtered_frames));
+        pos += scnprintf(buf + pos, bufsz - pos, "non_channel_beacons: %u\n",
+                         le32_to_cpu(general->non_channel_beacons));
+        pos += scnprintf(buf + pos, bufsz - pos, "channel_beacons: %u\n",
+                         le32_to_cpu(general->channel_beacons));
+        pos += scnprintf(buf + pos, bufsz - pos, "num_missed_bcon: %u\n",
+                         le32_to_cpu(general->num_missed_bcon));
+        pos += scnprintf(buf + pos, bufsz - pos,
+                        "adc_rx_saturation_time: %u\n",
+                        le32_to_cpu(general->adc_rx_saturation_time));
+        pos += scnprintf(buf + pos, bufsz - pos,
+                        "ina_detection_search_time: %u\n",
+                        le32_to_cpu(general->ina_detection_search_time));
+        pos += scnprintf(buf + pos, bufsz - pos, "beacon_silence_rssi_a: %u\n",
+                         le32_to_cpu(general->beacon_silence_rssi_a));
+        pos += scnprintf(buf + pos, bufsz - pos, "beacon_silence_rssi_b: %u\n",
+                         le32_to_cpu(general->beacon_silence_rssi_b));
+        pos += scnprintf(buf + pos, bufsz - pos, "beacon_silence_rssi_c: %u\n",
+                         le32_to_cpu(general->beacon_silence_rssi_c));
+        pos += scnprintf(buf + pos, bufsz - pos,
+                        "interference_data_flag: %u\n",
+                        le32_to_cpu(general->interference_data_flag));
+        pos += scnprintf(buf + pos, bufsz - pos, "channel_load: %u\n",
+                         le32_to_cpu(general->channel_load));
+        pos += scnprintf(buf + pos, bufsz - pos, "dsp_false_alarms: %u\n",
+                         le32_to_cpu(general->dsp_false_alarms));
+        pos += scnprintf(buf + pos, bufsz - pos, "beacon_rssi_a: %u\n",
+                         le32_to_cpu(general->beacon_rssi_a));
+        pos += scnprintf(buf + pos, bufsz - pos, "beacon_rssi_b: %u\n",
+                         le32_to_cpu(general->beacon_rssi_b));
+        pos += scnprintf(buf + pos, bufsz - pos, "beacon_rssi_c: %u\n",
+                         le32_to_cpu(general->beacon_rssi_c));
+        pos += scnprintf(buf + pos, bufsz - pos, "beacon_energy_a: %u\n",
+                         le32_to_cpu(general->beacon_energy_a));
+        pos += scnprintf(buf + pos, bufsz - pos, "beacon_energy_b: %u\n",
+                         le32_to_cpu(general->beacon_energy_b));
+        pos += scnprintf(buf + pos, bufsz - pos, "beacon_energy_c: %u\n",
+                         le32_to_cpu(general->beacon_energy_c));
+
+        pos += scnprintf(buf + pos, bufsz - pos, "Statistics_Rx - OFDM_HT:\n");
+        pos += scnprintf(buf + pos, bufsz - pos, "plcp_err: %u\n",
+                         le32_to_cpu(ht->plcp_err));
+        pos += scnprintf(buf + pos, bufsz - pos, "overrun_err: %u\n",
+                         le32_to_cpu(ht->overrun_err));
+        pos += scnprintf(buf + pos, bufsz - pos, "early_overrun_err: %u\n",
+                         le32_to_cpu(ht->early_overrun_err));
+        pos += scnprintf(buf + pos, bufsz - pos, "crc32_good: %u\n",
+                         le32_to_cpu(ht->crc32_good));
+        pos += scnprintf(buf + pos, bufsz - pos, "crc32_err: %u\n",
+                         le32_to_cpu(ht->crc32_err));
+        pos += scnprintf(buf + pos, bufsz - pos, "mh_format_err: %u\n",
+                         le32_to_cpu(ht->mh_format_err));
+        pos += scnprintf(buf + pos, bufsz - pos, "agg_crc32_good: %u\n",
+                         le32_to_cpu(ht->agg_crc32_good));
+        pos += scnprintf(buf + pos, bufsz - pos, "agg_mpdu_cnt: %u\n",
+                         le32_to_cpu(ht->agg_mpdu_cnt));
+        pos += scnprintf(buf + pos, bufsz - pos, "agg_cnt: %u\n",
+                         le32_to_cpu(ht->agg_cnt));
+
+        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+        kfree(buf);
+        return ret;
+}
+
+static ssize_t iwl_dbgfs_ucode_tx_stats_read(struct file *file,
+                                        char __user *user_buf,
+                                        size_t count, loff_t *ppos)
+{
+        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        int pos = 0;
+        char *buf;
+        int bufsz = (sizeof(struct statistics_tx) * 24) + 250;
+        ssize_t ret;
+        struct statistics_tx *tx;
+
+        if (!iwl_is_alive(priv))
+                return -EAGAIN;
+
+        /* make request to uCode to retrieve statistics information */
+        mutex_lock(&priv->mutex);
+        ret = iwl_send_statistics_request(priv, 0);
+        mutex_unlock(&priv->mutex);
+
+        if (ret) {
+                IWL_ERR(priv,
+                        "Error sending statistics request: %zd\n", ret);
+                return -EAGAIN;
+        }
+        buf = kzalloc(bufsz, GFP_KERNEL);
+        if (!buf) {
+                IWL_ERR(priv, "Can not allocate Buffer\n");
+                return -ENOMEM;
+        }
+
+        /* the statistic information display here is based on
+         * the last statistics notification from uCode
+         * might not reflect the current uCode activity
+         */
+        tx = &priv->statistics.tx;
+        pos += iwl_dbgfs_statistics_flag(priv, buf, bufsz);
+        pos += scnprintf(buf + pos, bufsz - pos, "Statistics_Tx:\n");
+        pos += scnprintf(buf + pos, bufsz - pos, "preamble: %u\n",
+                         le32_to_cpu(tx->preamble_cnt));
+        pos += scnprintf(buf + pos, bufsz - pos, "rx_detected_cnt: %u\n",
+                         le32_to_cpu(tx->rx_detected_cnt));
+        pos += scnprintf(buf + pos, bufsz - pos, "bt_prio_defer_cnt: %u\n",
+                         le32_to_cpu(tx->bt_prio_defer_cnt));
+        pos += scnprintf(buf + pos, bufsz - pos, "bt_prio_kill_cnt: %u\n",
+                         le32_to_cpu(tx->bt_prio_kill_cnt));
+        pos += scnprintf(buf + pos, bufsz - pos, "few_bytes_cnt: %u\n",
+                         le32_to_cpu(tx->few_bytes_cnt));
+        pos += scnprintf(buf + pos, bufsz - pos, "cts_timeout: %u\n",
+                         le32_to_cpu(tx->cts_timeout));
+        pos += scnprintf(buf + pos, bufsz - pos, "ack_timeout: %u\n",
+                         le32_to_cpu(tx->ack_timeout));
+        pos += scnprintf(buf + pos, bufsz - pos, "expected_ack_cnt: %u\n",
+                         le32_to_cpu(tx->expected_ack_cnt));
+        pos += scnprintf(buf + pos, bufsz - pos, "actual_ack_cnt: %u\n",
+                         le32_to_cpu(tx->actual_ack_cnt));
+        pos += scnprintf(buf + pos, bufsz - pos, "dump_msdu_cnt: %u\n",
+                         le32_to_cpu(tx->dump_msdu_cnt));
+        pos += scnprintf(buf + pos, bufsz - pos,
+                        "burst_abort_next_frame_mismatch_cnt: %u\n",
+                        le32_to_cpu(tx->burst_abort_next_frame_mismatch_cnt));
+        pos += scnprintf(buf + pos, bufsz - pos,
+                        "burst_abort_missing_next_frame_cnt: %u\n",
+                        le32_to_cpu(tx->burst_abort_missing_next_frame_cnt));
+        pos += scnprintf(buf + pos, bufsz - pos, "cts_timeout_collision: %u\n",
+                         le32_to_cpu(tx->cts_timeout_collision));
+        pos += scnprintf(buf + pos, bufsz - pos,
+                        "ack_or_ba_timeout_collision: %u\n",
+                        le32_to_cpu(tx->ack_or_ba_timeout_collision));
+        pos += scnprintf(buf + pos, bufsz - pos, "agg ba_timeout: %u\n",
+                         le32_to_cpu(tx->agg.ba_timeout));
+        pos += scnprintf(buf + pos, bufsz - pos,
+                        "agg ba_reschedule_frames: %u\n",
+                        le32_to_cpu(tx->agg.ba_reschedule_frames));
+        pos += scnprintf(buf + pos, bufsz - pos,
+                        "agg scd_query_agg_frame_cnt: %u\n",
+                        le32_to_cpu(tx->agg.scd_query_agg_frame_cnt));
+        pos += scnprintf(buf + pos, bufsz - pos, "agg scd_query_no_agg: %u\n",
+                         le32_to_cpu(tx->agg.scd_query_no_agg));
+        pos += scnprintf(buf + pos, bufsz - pos, "agg scd_query_agg: %u\n",
+                         le32_to_cpu(tx->agg.scd_query_agg));
+        pos += scnprintf(buf + pos, bufsz - pos,
+                        "agg scd_query_mismatch: %u\n",
+                        le32_to_cpu(tx->agg.scd_query_mismatch));
+        pos += scnprintf(buf + pos, bufsz - pos, "agg frame_not_ready: %u\n",
+                         le32_to_cpu(tx->agg.frame_not_ready));
+        pos += scnprintf(buf + pos, bufsz - pos, "agg underrun: %u\n",
+                         le32_to_cpu(tx->agg.underrun));
+        pos += scnprintf(buf + pos, bufsz - pos, "agg bt_prio_kill: %u\n",
+                         le32_to_cpu(tx->agg.bt_prio_kill));
+        pos += scnprintf(buf + pos, bufsz - pos, "agg rx_ba_rsp_cnt: %u\n",
+                         le32_to_cpu(tx->agg.rx_ba_rsp_cnt));
+
+        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+        kfree(buf);
+        return ret;
+}
+
+static ssize_t iwl_dbgfs_ucode_general_stats_read(struct file *file,
+                                        char __user *user_buf,
+                                        size_t count, loff_t *ppos)
+{
+        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        int pos = 0;
+        char *buf;
+        int bufsz = sizeof(struct statistics_general) * 4 + 250;
+        ssize_t ret;
+        struct statistics_general *general;
+        struct statistics_dbg *dbg;
+        struct statistics_div *div;
+
+        if (!iwl_is_alive(priv))
+                return -EAGAIN;
+
+        /* make request to uCode to retrieve statistics information */
+        mutex_lock(&priv->mutex);
+        ret = iwl_send_statistics_request(priv, 0);
+        mutex_unlock(&priv->mutex);
+
+        if (ret) {
+                IWL_ERR(priv,
+                        "Error sending statistics request: %zd\n", ret);
+                return -EAGAIN;
+        }
+        buf = kzalloc(bufsz, GFP_KERNEL);
+        if (!buf) {
+                IWL_ERR(priv, "Can not allocate Buffer\n");
+                return -ENOMEM;
+        }
+
+        /* the statistic information display here is based on
+         * the last statistics notification from uCode
+         * might not reflect the current uCode activity
+         */
+        general = &priv->statistics.general;
+        dbg = &priv->statistics.general.dbg;
+        div = &priv->statistics.general.div;
+        pos += iwl_dbgfs_statistics_flag(priv, buf, bufsz);
+        pos += scnprintf(buf + pos, bufsz - pos, "Statistics_General:\n");
+        pos += scnprintf(buf + pos, bufsz - pos, "temperature: %u\n",
+                         le32_to_cpu(general->temperature));
+        pos += scnprintf(buf + pos, bufsz - pos, "temperature_m: %u\n",
+                         le32_to_cpu(general->temperature_m));
+        pos += scnprintf(buf + pos, bufsz - pos, "burst_check: %u\n",
+                         le32_to_cpu(dbg->burst_check));
+        pos += scnprintf(buf + pos, bufsz - pos, "burst_count: %u\n",
+                         le32_to_cpu(dbg->burst_count));
+        pos += scnprintf(buf + pos, bufsz - pos, "sleep_time: %u\n",
+                         le32_to_cpu(general->sleep_time));
+        pos += scnprintf(buf + pos, bufsz - pos, "slots_out: %u\n",
+                         le32_to_cpu(general->slots_out));
+        pos += scnprintf(buf + pos, bufsz - pos, "slots_idle: %u\n",
+                         le32_to_cpu(general->slots_idle));
+        pos += scnprintf(buf + pos, bufsz - pos, "ttl_timestamp: %u\n",
+                         le32_to_cpu(general->ttl_timestamp));
+        pos += scnprintf(buf + pos, bufsz - pos, "tx_on_a: %u\n",
+                         le32_to_cpu(div->tx_on_a));
+        pos += scnprintf(buf + pos, bufsz - pos, "tx_on_b: %u\n",
+                         le32_to_cpu(div->tx_on_b));
+        pos += scnprintf(buf + pos, bufsz - pos, "exec_time: %u\n",
+                         le32_to_cpu(div->exec_time));
+        pos += scnprintf(buf + pos, bufsz - pos, "probe_time: %u\n",
+                         le32_to_cpu(div->probe_time));
+        pos += scnprintf(buf + pos, bufsz - pos, "rx_enable_counter: %u\n",
+                         le32_to_cpu(general->rx_enable_counter));
+        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+        kfree(buf);
+        return ret;
+}
+
+static ssize_t iwl_dbgfs_sensitivity_read(struct file *file,
+                                        char __user *user_buf,
+                                        size_t count, loff_t *ppos) {
+
+        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        int pos = 0;
+        int cnt = 0;
+        char *buf;
+        int bufsz = sizeof(struct iwl_sensitivity_data) * 4 + 100;
+        ssize_t ret;
+        struct iwl_sensitivity_data *data;
+
+        data = &priv->sensitivity_data;
+        buf = kzalloc(bufsz, GFP_KERNEL);
+        if (!buf) {
+                IWL_ERR(priv, "Can not allocate Buffer\n");
+                return -ENOMEM;
+        }
+
+        pos += scnprintf(buf + pos, bufsz - pos, "auto_corr_ofdm:\t\t\t %u\n",
+                        data->auto_corr_ofdm);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                        "auto_corr_ofdm_mrc:\t\t %u\n",
+                        data->auto_corr_ofdm_mrc);
+        pos += scnprintf(buf + pos, bufsz - pos, "auto_corr_ofdm_x1:\t\t %u\n",
+                        data->auto_corr_ofdm_x1);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                        "auto_corr_ofdm_mrc_x1:\t\t %u\n",
+                        data->auto_corr_ofdm_mrc_x1);
+        pos += scnprintf(buf + pos, bufsz - pos, "auto_corr_cck:\t\t\t %u\n",
+                        data->auto_corr_cck);
+        pos += scnprintf(buf + pos, bufsz - pos, "auto_corr_cck_mrc:\t\t %u\n",
+                        data->auto_corr_cck_mrc);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                        "last_bad_plcp_cnt_ofdm:\t\t %u\n",
+                        data->last_bad_plcp_cnt_ofdm);
+        pos += scnprintf(buf + pos, bufsz - pos, "last_fa_cnt_ofdm:\t\t %u\n",
+                        data->last_fa_cnt_ofdm);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                        "last_bad_plcp_cnt_cck:\t\t %u\n",
+                        data->last_bad_plcp_cnt_cck);
+        pos += scnprintf(buf + pos, bufsz - pos, "last_fa_cnt_cck:\t\t %u\n",
+                        data->last_fa_cnt_cck);
+        pos += scnprintf(buf + pos, bufsz - pos, "nrg_curr_state:\t\t\t %u\n",
+                        data->nrg_curr_state);
+        pos += scnprintf(buf + pos, bufsz - pos, "nrg_prev_state:\t\t\t %u\n",
+                        data->nrg_prev_state);
+        pos += scnprintf(buf + pos, bufsz - pos, "nrg_value:\t\t\t");
+        for (cnt = 0; cnt < 10; cnt++) {
+                pos += scnprintf(buf + pos, bufsz - pos, " %u",
+                                data->nrg_value[cnt]);
+        }
+        pos += scnprintf(buf + pos, bufsz - pos, "\n");
+        pos += scnprintf(buf + pos, bufsz - pos, "nrg_silence_rssi:\t\t");
+        for (cnt = 0; cnt < NRG_NUM_PREV_STAT_L; cnt++) {
+                pos += scnprintf(buf + pos, bufsz - pos, " %u",
+                                data->nrg_silence_rssi[cnt]);
+        }
+        pos += scnprintf(buf + pos, bufsz - pos, "\n");
+        pos += scnprintf(buf + pos, bufsz - pos, "nrg_silence_ref:\t\t %u\n",
+                        data->nrg_silence_ref);
+        pos += scnprintf(buf + pos, bufsz - pos, "nrg_energy_idx:\t\t\t %u\n",
+                        data->nrg_energy_idx);
+        pos += scnprintf(buf + pos, bufsz - pos, "nrg_silence_idx:\t\t %u\n",
+                        data->nrg_silence_idx);
+        pos += scnprintf(buf + pos, bufsz - pos, "nrg_th_cck:\t\t\t %u\n",
+                        data->nrg_th_cck);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                        "nrg_auto_corr_silence_diff:\t %u\n",
+                        data->nrg_auto_corr_silence_diff);
+        pos += scnprintf(buf + pos, bufsz - pos, "num_in_cck_no_fa:\t\t %u\n",
+                        data->num_in_cck_no_fa);
+        pos += scnprintf(buf + pos, bufsz - pos, "nrg_th_ofdm:\t\t\t %u\n",
+                        data->nrg_th_ofdm);
+
+        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+        kfree(buf);
+        return ret;
+}
+
+
+static ssize_t iwl_dbgfs_chain_noise_read(struct file *file,
+                                        char __user *user_buf,
+                                        size_t count, loff_t *ppos) {
+
+        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        int pos = 0;
+        int cnt = 0;
+        char *buf;
+        int bufsz = sizeof(struct iwl_chain_noise_data) * 4 + 100;
+        ssize_t ret;
+        struct iwl_chain_noise_data *data;
+
+        data = &priv->chain_noise_data;
+        buf = kzalloc(bufsz, GFP_KERNEL);
+        if (!buf) {
+                IWL_ERR(priv, "Can not allocate Buffer\n");
+                return -ENOMEM;
+        }
+
+        pos += scnprintf(buf + pos, bufsz - pos, "active_chains:\t\t\t %u\n",
+                        data->active_chains);
+        pos += scnprintf(buf + pos, bufsz - pos, "chain_noise_a:\t\t\t %u\n",
+                        data->chain_noise_a);
+        pos += scnprintf(buf + pos, bufsz - pos, "chain_noise_b:\t\t\t %u\n",
+                        data->chain_noise_b);
+        pos += scnprintf(buf + pos, bufsz - pos, "chain_noise_c:\t\t\t %u\n",
+                        data->chain_noise_c);
+        pos += scnprintf(buf + pos, bufsz - pos, "chain_signal_a:\t\t\t %u\n",
+                        data->chain_signal_a);
+        pos += scnprintf(buf + pos, bufsz - pos, "chain_signal_b:\t\t\t %u\n",
+                        data->chain_signal_b);
+        pos += scnprintf(buf + pos, bufsz - pos, "chain_signal_c:\t\t\t %u\n",
+                        data->chain_signal_c);
+        pos += scnprintf(buf + pos, bufsz - pos, "beacon_count:\t\t\t %u\n",
+                        data->beacon_count);
+
+        pos += scnprintf(buf + pos, bufsz - pos, "disconn_array:\t\t\t");
+        for (cnt = 0; cnt < NUM_RX_CHAINS; cnt++) {
+                pos += scnprintf(buf + pos, bufsz - pos, " %u",
+                                data->disconn_array[cnt]);
+        }
+        pos += scnprintf(buf + pos, bufsz - pos, "\n");
+        pos += scnprintf(buf + pos, bufsz - pos, "delta_gain_code:\t\t");
+        for (cnt = 0; cnt < NUM_RX_CHAINS; cnt++) {
+                pos += scnprintf(buf + pos, bufsz - pos, " %u",
+                                data->delta_gain_code[cnt]);
+        }
+        pos += scnprintf(buf + pos, bufsz - pos, "\n");
+        pos += scnprintf(buf + pos, bufsz - pos, "radio_write:\t\t\t %u\n",
+                        data->radio_write);
+        pos += scnprintf(buf + pos, bufsz - pos, "state:\t\t\t\t %u\n",
+                        data->state);
+
+        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+        kfree(buf);
+        return ret;
+}
+
+DEBUGFS_READ_WRITE_FILE_OPS(rx_statistics);
+DEBUGFS_READ_WRITE_FILE_OPS(tx_statistics);
+DEBUGFS_READ_WRITE_FILE_OPS(traffic_log);
+DEBUGFS_READ_FILE_OPS(rx_queue);
+DEBUGFS_READ_FILE_OPS(tx_queue);
+DEBUGFS_READ_FILE_OPS(ucode_rx_stats);
+DEBUGFS_READ_FILE_OPS(ucode_tx_stats);
+DEBUGFS_READ_FILE_OPS(ucode_general_stats);
+DEBUGFS_READ_FILE_OPS(sensitivity);
+DEBUGFS_READ_FILE_OPS(chain_noise);
 
 /*
  * Create the debugfs files and directories
@@ -738,12 +1600,11 @@ int iwl_dbgfs_register(struct iwl_priv *priv, const char *name)
 
         DEBUGFS_ADD_DIR(data, dbgfs->dir_drv);
         DEBUGFS_ADD_DIR(rf, dbgfs->dir_drv);
+        DEBUGFS_ADD_DIR(debug, dbgfs->dir_drv);
         DEBUGFS_ADD_FILE(nvm, data);
         DEBUGFS_ADD_FILE(sram, data);
         DEBUGFS_ADD_FILE(log_event, data);
         DEBUGFS_ADD_FILE(stations, data);
-        DEBUGFS_ADD_FILE(rx_statistics, data);
-        DEBUGFS_ADD_FILE(tx_statistics, data);
         DEBUGFS_ADD_FILE(channels, data);
         DEBUGFS_ADD_FILE(status, data);
         DEBUGFS_ADD_FILE(interrupt, data);
@@ -751,8 +1612,22 @@ int iwl_dbgfs_register(struct iwl_priv *priv, const char *name)
 #ifdef CONFIG_IWLWIFI_LEDS
         DEBUGFS_ADD_FILE(led, data);
 #endif
+        DEBUGFS_ADD_FILE(sleep_level_override, data);
+        DEBUGFS_ADD_FILE(current_sleep_command, data);
         DEBUGFS_ADD_FILE(thermal_throttling, data);
         DEBUGFS_ADD_FILE(disable_ht40, data);
+        DEBUGFS_ADD_FILE(rx_statistics, debug);
+        DEBUGFS_ADD_FILE(tx_statistics, debug);
+        DEBUGFS_ADD_FILE(traffic_log, debug);
+        DEBUGFS_ADD_FILE(rx_queue, debug);
+        DEBUGFS_ADD_FILE(tx_queue, debug);
+        if ((priv->hw_rev & CSR_HW_REV_TYPE_MSK) != CSR_HW_REV_TYPE_3945) {
+                DEBUGFS_ADD_FILE(ucode_rx_stats, debug);
+                DEBUGFS_ADD_FILE(ucode_tx_stats, debug);
+                DEBUGFS_ADD_FILE(ucode_general_stats, debug);
+                DEBUGFS_ADD_FILE(sensitivity, debug);
+                DEBUGFS_ADD_FILE(chain_noise, debug);
+        }
         DEBUGFS_ADD_BOOL(disable_sensitivity, rf, &priv->disable_sens_cal);
         DEBUGFS_ADD_BOOL(disable_chain_noise, rf,
                          &priv->disable_chain_noise_cal);
@@ -778,9 +1653,9 @@ void iwl_dbgfs_unregister(struct iwl_priv *priv)
         if (!priv->dbgfs)
                 return;
 
+        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_data_files.file_sleep_level_override);
+        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_data_files.file_current_sleep_command);
         DEBUGFS_REMOVE(priv->dbgfs->dbgfs_data_files.file_nvm);
-        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_data_files.file_rx_statistics);
-        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_data_files.file_tx_statistics);
         DEBUGFS_REMOVE(priv->dbgfs->dbgfs_data_files.file_sram);
         DEBUGFS_REMOVE(priv->dbgfs->dbgfs_data_files.file_log_event);
         DEBUGFS_REMOVE(priv->dbgfs->dbgfs_data_files.file_stations);
@@ -794,6 +1669,24 @@ void iwl_dbgfs_unregister(struct iwl_priv *priv)
         DEBUGFS_REMOVE(priv->dbgfs->dbgfs_data_files.file_thermal_throttling);
         DEBUGFS_REMOVE(priv->dbgfs->dbgfs_data_files.file_disable_ht40);
         DEBUGFS_REMOVE(priv->dbgfs->dir_data);
+        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.file_rx_statistics);
+        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.file_tx_statistics);
+        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.file_traffic_log);
+        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.file_rx_queue);
+        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.file_tx_queue);
+        if ((priv->hw_rev & CSR_HW_REV_TYPE_MSK) != CSR_HW_REV_TYPE_3945) {
+                DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.
+                        file_ucode_rx_stats);
+                DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.
+                        file_ucode_tx_stats);
+                DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.
+                        file_ucode_general_stats);
+                DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.
+                        file_sensitivity);
+                DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.
+                        file_chain_noise);
+        }
+        DEBUGFS_REMOVE(priv->dbgfs->dir_debug);
         DEBUGFS_REMOVE(priv->dbgfs->dbgfs_rf_files.file_disable_sensitivity);
         DEBUGFS_REMOVE(priv->dbgfs->dbgfs_rf_files.file_disable_chain_noise);
         if (((priv->hw_rev & CSR_HW_REV_TYPE_MSK) == CSR_HW_REV_TYPE_4965) ||
diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h
index cab6255210d5..b96c3c9e92a9 100644
--- a/drivers/net/wireless/iwlwifi/iwl-dev.h
+++ b/drivers/net/wireless/iwlwifi/iwl-dev.h
@@ -277,8 +277,8 @@ struct iwl_channel_info {
         struct iwl4965_channel_tgd_info tgd;
         struct iwl4965_channel_tgh_info tgh;
         struct iwl_eeprom_channel eeprom;       /* EEPROM regulatory limit */
-        struct iwl_eeprom_channel fat_eeprom;   /* EEPROM regulatory limit for
-                                                 * FAT channel */
+        struct iwl_eeprom_channel ht40_eeprom;  /* EEPROM regulatory limit for
+                                                 * HT40 channel */
 
         u8 channel;       /* channel number */
         u8 flags;         /* flags copied from EEPROM */
@@ -291,13 +291,13 @@ struct iwl_channel_info {
         u8 band_index;    /* 0-4, maps channel to band1/2/3/4/5 */
         enum ieee80211_band band;
 
-        /* FAT channel info */
-        s8 fat_max_power_avg;   /* (dBm) regul. eeprom, normal Tx, any rate */
-        s8 fat_curr_txpow;      /* (dBm) regulatory/spectrum/user (not h/w) */
-        s8 fat_min_power;       /* always 0 */
-        s8 fat_scan_power;      /* (dBm) eeprom, direct scans, any rate */
-        u8 fat_flags;           /* flags copied from EEPROM */
-        u8 fat_extension_channel; /* HT_IE_EXT_CHANNEL_* */
+        /* HT40 channel info */
+        s8 ht40_max_power_avg;  /* (dBm) regul. eeprom, normal Tx, any rate */
+        s8 ht40_curr_txpow;     /* (dBm) regulatory/spectrum/user (not h/w) */
+        s8 ht40_min_power;      /* always 0 */
+        s8 ht40_scan_power;     /* (dBm) eeprom, direct scans, any rate */
+        u8 ht40_flags;          /* flags copied from EEPROM */
+        u8 ht40_extension_channel; /* HT_IE_EXT_CHANNEL_* */
 
         /* Radio/DSP gain settings for each "normal" data Tx rate.
          * These include, in addition to RF and DSP gain, a few fields for
@@ -649,7 +649,7 @@ struct iwl_sensitivity_ranges {
  * @rx_wrt_ptr_reg: FH{39}_RSCSR_CHNL0_WPTR
  * @max_stations:
  * @bcast_sta_id:
- * @fat_channel: is 40MHz width possible in band 2.4
+ * @ht40_channel: is 40MHz width possible in band 2.4
  * BIT(IEEE80211_BAND_5GHZ) BIT(IEEE80211_BAND_5GHZ)
  * @sw_crypto: 0 for hw, 1 for sw
  * @max_xxx_size: for ucode uses
@@ -673,7 +673,7 @@ struct iwl_hw_params {
         u32 max_pkt_size;
         u8  max_stations;
         u8  bcast_sta_id;
-        u8 fat_channel;
+        u8  ht40_channel;
         u8  max_beacon_itrvl;   /* in 1024 ms */
         u32 max_inst_size;
         u32 max_data_size;
@@ -823,8 +823,6 @@ struct iwl_calib_result {
         size_t buf_len;
 };
 
-#define UCODE_ALIVE_TIMEOUT     (5 * HZ)
-
 enum ucode_type {
         UCODE_NONE = 0,
         UCODE_INIT,
@@ -877,6 +875,8 @@ struct iwl_chain_noise_data {
 #define EEPROM_SEM_TIMEOUT 10           /* milliseconds */
 #define EEPROM_SEM_RETRY_LIMIT 1000     /* number of attempts (not time) */
 
+#define IWL_TRAFFIC_ENTRIES     (256)
+#define IWL_TRAFFIC_ENTRY_SIZE  (64)
 
 enum {
         MEASUREMENT_READY = (1 << 0),
@@ -917,6 +917,48 @@ struct isr_statistics {
         u32 unhandled;
 };
 
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+/* management statistics */
+enum iwl_mgmt_stats {
+        MANAGEMENT_ASSOC_REQ = 0,
+        MANAGEMENT_ASSOC_RESP,
+        MANAGEMENT_REASSOC_REQ,
+        MANAGEMENT_REASSOC_RESP,
+        MANAGEMENT_PROBE_REQ,
+        MANAGEMENT_PROBE_RESP,
+        MANAGEMENT_BEACON,
+        MANAGEMENT_ATIM,
+        MANAGEMENT_DISASSOC,
+        MANAGEMENT_AUTH,
+        MANAGEMENT_DEAUTH,
+        MANAGEMENT_ACTION,
+        MANAGEMENT_MAX,
+};
+/* control statistics */
+enum iwl_ctrl_stats {
+        CONTROL_BACK_REQ =  0,
+        CONTROL_BACK,
+        CONTROL_PSPOLL,
+        CONTROL_RTS,
+        CONTROL_CTS,
+        CONTROL_ACK,
+        CONTROL_CFEND,
+        CONTROL_CFENDACK,
+        CONTROL_MAX,
+};
+
+struct traffic_stats {
+        u32 mgmt[MANAGEMENT_MAX];
+        u32 ctrl[CONTROL_MAX];
+        u32 data_cnt;
+        u64 data_bytes;
+};
+#else
+struct traffic_stats {
+        u64 data_bytes;
+};
+#endif
+
 #define IWL_MAX_NUM_QUEUES      20 /* FIXME: do dynamic allocation */
 
 struct iwl_priv {
@@ -1062,15 +1104,14 @@ struct iwl_priv {
         int last_rx_noise;      /* From beacon statistics */
 
         /* counts mgmt, ctl, and data packets */
-        struct traffic_stats {
-                u32 cnt;
-                u64 bytes;
-        } tx_stats[3], rx_stats[3];
+        struct traffic_stats tx_stats;
+        struct traffic_stats rx_stats;
 
         /* counts interrupts */
         struct isr_statistics isr_stats;
 
         struct iwl_power_mgr power_data;
+        struct iwl_tt_mgmt thermal_throttle;
 
         struct iwl_notif_statistics statistics;
         unsigned long last_statistics_time;
@@ -1078,7 +1119,6 @@ struct iwl_priv {
         /* context information */
         u16 rates_mask;
 
-        u32 power_mode;
         u8 bssid[ETH_ALEN];
         u16 rts_threshold;
         u8 mac_addr[ETH_ALEN];
@@ -1157,6 +1197,9 @@ struct iwl_priv {
         struct work_struct report_work;
         struct work_struct request_scan;
         struct work_struct beacon_update;
+        struct work_struct tt_work;
+        struct work_struct ct_enter;
+        struct work_struct ct_exit;
 
         struct tasklet_struct irq_tasklet;
 
@@ -1175,11 +1218,17 @@ struct iwl_priv {
 
 #ifdef CONFIG_IWLWIFI_DEBUG
         /* debugging info */
+        u32 debug_level; /* per device debugging will override global
+                            iwl_debug_level if set */
         u32 framecnt_to_us;
         atomic_t restrict_refcnt;
         bool disable_ht40;
 #ifdef CONFIG_IWLWIFI_DEBUGFS
         /* debugfs */
+        u16 tx_traffic_idx;
+        u16 rx_traffic_idx;
+        u8 *tx_traffic;
+        u8 *rx_traffic;
         struct iwl_debugfs *dbgfs;
 #endif /* CONFIG_IWLWIFI_DEBUGFS */
 #endif /* CONFIG_IWLWIFI_DEBUG */
@@ -1211,8 +1260,27 @@ static inline void iwl_txq_ctx_deactivate(struct iwl_priv *priv, int txq_id)
 
 #ifdef CONFIG_IWLWIFI_DEBUG
 const char *iwl_get_tx_fail_reason(u32 status);
+/*
+ * iwl_get_debug_level: Return active debug level for device
+ *
+ * Using sysfs it is possible to set per device debug level. This debug
+ * level will be used if set, otherwise the global debug level which can be
+ * set via module parameter is used.
+ */
+static inline u32 iwl_get_debug_level(struct iwl_priv *priv)
+{
+        if (priv->debug_level)
+                return priv->debug_level;
+        else
+                return iwl_debug_level;
+}
 #else
 static inline const char *iwl_get_tx_fail_reason(u32 status) { return ""; }
+
+static inline u32 iwl_get_debug_level(struct iwl_priv *priv)
+{
+        return iwl_debug_level;
+}
 #endif
 
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom.c b/drivers/net/wireless/iwlwifi/iwl-eeprom.c
index 51eed7226669..78c4a324a3b5 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom.c
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.c
@@ -127,11 +127,11 @@ static const u8 iwl_eeprom_band_5[] = {	/* 5725-5825MHz */
         145, 149, 153, 157, 161, 165
 };
 
-static const u8 iwl_eeprom_band_6[] = {       /* 2.4 FAT channel */
+static const u8 iwl_eeprom_band_6[] = {       /* 2.4 ht40 channel */
         1, 2, 3, 4, 5, 6, 7
 };
 
-static const u8 iwl_eeprom_band_7[] = {       /* 5.2 FAT channel */
+static const u8 iwl_eeprom_band_7[] = {       /* 5.2 ht40 channel */
         36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157
 };
 
@@ -462,13 +462,13 @@ static void iwl_init_band_reference(const struct iwl_priv *priv,
                                 iwl_eeprom_query_addr(priv, offset);
                 *eeprom_ch_index = iwl_eeprom_band_5;
                 break;
-        case 6:         /* 2.4GHz FAT channels */
+        case 6:         /* 2.4GHz ht40 channels */
                 *eeprom_ch_count = ARRAY_SIZE(iwl_eeprom_band_6);
                 *eeprom_ch_info = (struct iwl_eeprom_channel *)
                                 iwl_eeprom_query_addr(priv, offset);
                 *eeprom_ch_index = iwl_eeprom_band_6;
                 break;
-        case 7:         /* 5 GHz FAT channels */
+        case 7:         /* 5 GHz ht40 channels */
                 *eeprom_ch_count = ARRAY_SIZE(iwl_eeprom_band_7);
                 *eeprom_ch_info = (struct iwl_eeprom_channel *)
                                 iwl_eeprom_query_addr(priv, offset);
@@ -484,14 +484,14 @@ static void iwl_init_band_reference(const struct iwl_priv *priv,
                             ? # x " " : "")
 
 /**
- * iwl_set_fat_chan_info - Copy fat channel info into driver's priv.
+ * iwl_set_ht40_chan_info - Copy ht40 channel info into driver's priv.
  *
  * Does not set up a command, or touch hardware.
  */
-static int iwl_set_fat_chan_info(struct iwl_priv *priv,
+static int iwl_set_ht40_chan_info(struct iwl_priv *priv,
                               enum ieee80211_band band, u16 channel,
                               const struct iwl_eeprom_channel *eeprom_ch,
-                              u8 fat_extension_channel)
+                              u8 ht40_extension_channel)
 {
         struct iwl_channel_info *ch_info;
 
@@ -501,7 +501,7 @@ static int iwl_set_fat_chan_info(struct iwl_priv *priv,
         if (!is_channel_valid(ch_info))
                 return -1;
 
-        IWL_DEBUG_INFO(priv, "FAT Ch. %d [%sGHz] %s%s%s%s%s(0x%02x %ddBm):"
+        IWL_DEBUG_INFO(priv, "HT40 Ch. %d [%sGHz] %s%s%s%s%s(0x%02x %ddBm):"
                         " Ad-Hoc %ssupported\n",
                         ch_info->channel,
                         is_channel_a_band(ch_info) ?
@@ -517,13 +517,13 @@ static int iwl_set_fat_chan_info(struct iwl_priv *priv,
                          && !(eeprom_ch->flags & EEPROM_CHANNEL_RADAR)) ?
                         "" : "not ");
 
-        ch_info->fat_eeprom = *eeprom_ch;
-        ch_info->fat_max_power_avg = eeprom_ch->max_power_avg;
-        ch_info->fat_curr_txpow = eeprom_ch->max_power_avg;
-        ch_info->fat_min_power = 0;
-        ch_info->fat_scan_power = eeprom_ch->max_power_avg;
-        ch_info->fat_flags = eeprom_ch->flags;
-        ch_info->fat_extension_channel = fat_extension_channel;
+        ch_info->ht40_eeprom = *eeprom_ch;
+        ch_info->ht40_max_power_avg = eeprom_ch->max_power_avg;
+        ch_info->ht40_curr_txpow = eeprom_ch->max_power_avg;
+        ch_info->ht40_min_power = 0;
+        ch_info->ht40_scan_power = eeprom_ch->max_power_avg;
+        ch_info->ht40_flags = eeprom_ch->flags;
+        ch_info->ht40_extension_channel = ht40_extension_channel;
 
         return 0;
 }
@@ -589,9 +589,9 @@ int iwl_init_channel_map(struct iwl_priv *priv)
                         /* Copy the run-time flags so they are there even on
                          * invalid channels */
                         ch_info->flags = eeprom_ch_info[ch].flags;
-                        /* First write that fat is not enabled, and then enable
+                        /* First write that ht40 is not enabled, and then enable
                          * one by one */
-                        ch_info->fat_extension_channel =
+                        ch_info->ht40_extension_channel =
                                 (IEEE80211_CHAN_NO_HT40PLUS |
                                  IEEE80211_CHAN_NO_HT40MINUS);
 
@@ -642,17 +642,17 @@ int iwl_init_channel_map(struct iwl_priv *priv)
                 }
         }
 
-        /* Check if we do have FAT channels */
+        /* Check if we do have HT40 channels */
         if (priv->cfg->ops->lib->eeprom_ops.regulatory_bands[5] ==
-            EEPROM_REGULATORY_BAND_NO_FAT &&
+            EEPROM_REGULATORY_BAND_NO_HT40 &&
             priv->cfg->ops->lib->eeprom_ops.regulatory_bands[6] ==
-            EEPROM_REGULATORY_BAND_NO_FAT)
+            EEPROM_REGULATORY_BAND_NO_HT40)
                 return 0;
 
-        /* Two additional EEPROM bands for 2.4 and 5 GHz FAT channels */
+        /* Two additional EEPROM bands for 2.4 and 5 GHz HT40 channels */
         for (band = 6; band <= 7; band++) {
                 enum ieee80211_band ieeeband;
-                u8 fat_extension_chan;
+                u8 ht40_extension_chan;
 
                 iwl_init_band_reference(priv, band, &eeprom_ch_count,
                                         &eeprom_ch_info, &eeprom_ch_index);
@@ -669,19 +669,19 @@ int iwl_init_channel_map(struct iwl_priv *priv)
                                  (eeprom_ch_index[ch] == 6) ||
                                  (eeprom_ch_index[ch] == 7)))
                                 /* both are allowed: above and below */
-                                fat_extension_chan = 0;
+                                ht40_extension_chan = 0;
                         else
-                                fat_extension_chan =
+                                ht40_extension_chan =
                                         IEEE80211_CHAN_NO_HT40MINUS;
 
                         /* Set up driver's info for lower half */
-                        iwl_set_fat_chan_info(priv, ieeeband,
+                        iwl_set_ht40_chan_info(priv, ieeeband,
                                                 eeprom_ch_index[ch],
                                                 &(eeprom_ch_info[ch]),
-                                                fat_extension_chan);
+                                                ht40_extension_chan);
 
                         /* Set up driver's info for upper half */
-                        iwl_set_fat_chan_info(priv, ieeeband,
+                        iwl_set_ht40_chan_info(priv, ieeeband,
                                                 (eeprom_ch_index[ch] + 4),
                                                 &(eeprom_ch_info[ch]),
                                                 IEEE80211_CHAN_NO_HT40PLUS);
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom.h b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
index 195b4ef12c27..05d4fc4451dc 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom.h
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
@@ -88,10 +88,10 @@ struct iwl_priv;
  * requirement for establishing a new network for legal operation on channels
  * requiring RADAR detection or restricting ACTIVE scanning.
  *
- * NOTE:  "WIDE" flag does not indicate anything about "FAT" 40 MHz channels.
- *        It only indicates that 20 MHz channel use is supported; FAT channel
+ * NOTE:  "WIDE" flag does not indicate anything about "HT40" 40 MHz channels.
+ *        It only indicates that 20 MHz channel use is supported; HT40 channel
  *        usage is indicated by a separate set of regulatory flags for each
- *        FAT channel pair.
+ *        HT40 channel pair.
  *
  * NOTE:  Using a channel inappropriately will result in a uCode error!
  */
@@ -112,7 +112,7 @@ enum {
 #define EEPROM_SKU_CAP_HW_RF_KILL_ENABLE                (1 << 1)
 
 /* *regulatory* channel data format in eeprom, one for each channel.
- * There are separate entries for FAT (40 MHz) vs. normal (20 MHz) channels. */
+ * There are separate entries for HT40 (40 MHz) vs. normal (20 MHz) channels. */
 struct iwl_eeprom_channel {
         u8 flags;               /* EEPROM_CHANNEL_* flags copied from EEPROM */
         s8 max_power_avg;       /* max power (dBm) on this chnl, limit 31 */
@@ -170,9 +170,9 @@ struct iwl_eeprom_channel {
                 | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 22 bytes */
 #define EEPROM_5000_REG_BAND_5_CHANNELS       ((0x74)\
                 | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 12 bytes */
-#define EEPROM_5000_REG_BAND_24_FAT_CHANNELS  ((0x82)\
+#define EEPROM_5000_REG_BAND_24_HT40_CHANNELS  ((0x82)\
                 | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 14  bytes */
-#define EEPROM_5000_REG_BAND_52_FAT_CHANNELS  ((0x92)\
+#define EEPROM_5000_REG_BAND_52_HT40_CHANNELS  ((0x92)\
                 | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 22  bytes */
 
 /* 5050 Specific */
@@ -313,7 +313,7 @@ struct iwl_eeprom_calib_info {
  * in EEPROM containing EEPROM_CHANNEL_* usage flags (LSB) and max regulatory
  * txpower (MSB).
  *
- * Entries immediately below are for 20 MHz channel width.  FAT (40 MHz)
+ * Entries immediately below are for 20 MHz channel width.  HT40 (40 MHz)
  * channels (only for 4965, not supported by 3945) appear later in the EEPROM.
  *
  * 2.4 GHz channels 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14
@@ -352,29 +352,29 @@ struct iwl_eeprom_calib_info {
 #define EEPROM_REGULATORY_BAND_5_CHANNELS   (2*0x99)    /* 12 bytes */
 
 /*
- * 2.4 GHz FAT channels 1 (5), 2 (6), 3 (7), 4 (8), 5 (9), 6 (10), 7 (11)
+ * 2.4 GHz HT40 channels 1 (5), 2 (6), 3 (7), 4 (8), 5 (9), 6 (10), 7 (11)
  *
  * The channel listed is the center of the lower 20 MHz half of the channel.
  * The overall center frequency is actually 2 channels (10 MHz) above that,
- * and the upper half of each FAT channel is centered 4 channels (20 MHz) away
- * from the lower half; e.g. the upper half of FAT channel 1 is channel 5,
- * and the overall FAT channel width centers on channel 3.
+ * and the upper half of each HT40 channel is centered 4 channels (20 MHz) away
+ * from the lower half; e.g. the upper half of HT40 channel 1 is channel 5,
+ * and the overall HT40 channel width centers on channel 3.
  *
  * NOTE:  The RXON command uses 20 MHz channel numbers to specify the
  *        control channel to which to tune.  RXON also specifies whether the
- *        control channel is the upper or lower half of a FAT channel.
+ *        control channel is the upper or lower half of a HT40 channel.
  *
- * NOTE:  4965 does not support FAT channels on 2.4 GHz.
+ * NOTE:  4965 does not support HT40 channels on 2.4 GHz.
  */
-#define EEPROM_4965_REGULATORY_BAND_24_FAT_CHANNELS (2*0xA0)    /* 14 bytes */
+#define EEPROM_4965_REGULATORY_BAND_24_HT40_CHANNELS (2*0xA0)   /* 14 bytes */
 
 /*
- * 5.2 GHz FAT channels 36 (40), 44 (48), 52 (56), 60 (64),
+ * 5.2 GHz HT40 channels 36 (40), 44 (48), 52 (56), 60 (64),
  * 100 (104), 108 (112), 116 (120), 124 (128), 132 (136), 149 (153), 157 (161)
  */
-#define EEPROM_4965_REGULATORY_BAND_52_FAT_CHANNELS (2*0xA8)    /* 22 bytes */
+#define EEPROM_4965_REGULATORY_BAND_52_HT40_CHANNELS (2*0xA8)   /* 22 bytes */
 
-#define EEPROM_REGULATORY_BAND_NO_FAT                   (0)
+#define EEPROM_REGULATORY_BAND_NO_HT40                  (0)
 
 struct iwl_eeprom_ops {
         const u32 regulatory_bands[7];
diff --git a/drivers/net/wireless/iwlwifi/iwl-hcmd.c b/drivers/net/wireless/iwlwifi/iwl-hcmd.c
index b82ad15d5189..532c8d6cd8da 100644
--- a/drivers/net/wireless/iwlwifi/iwl-hcmd.c
+++ b/drivers/net/wireless/iwlwifi/iwl-hcmd.c
@@ -36,8 +36,6 @@
 #include "iwl-core.h"
 
 
-#define IWL_CMD(x) case x: return #x
-
 const char *get_cmd_string(u8 cmd)
 {
         switch (cmd) {
diff --git a/drivers/net/wireless/iwlwifi/iwl-led.c b/drivers/net/wireless/iwlwifi/iwl-led.c
index 3d61cb43151c..f420c99e7240 100644
--- a/drivers/net/wireless/iwlwifi/iwl-led.c
+++ b/drivers/net/wireless/iwlwifi/iwl-led.c
@@ -272,7 +272,8 @@ static int iwl_get_blink_rate(struct iwl_priv *priv)
         /* count both tx and rx traffic to be able to
          * handle traffic in either direction
          */
-        u64 current_tpt = priv->tx_stats[2].bytes + priv->rx_stats[2].bytes;
+        u64 current_tpt = priv->tx_stats.data_bytes +
+                          priv->rx_stats.data_bytes;
         s64 tpt = current_tpt - priv->led_tpt;
 
         if (tpt < 0) /* wraparound */
diff --git a/drivers/net/wireless/iwlwifi/iwl-power.c b/drivers/net/wireless/iwlwifi/iwl-power.c
index 00937b3ee8ec..0b16841f45f4 100644
--- a/drivers/net/wireless/iwlwifi/iwl-power.c
+++ b/drivers/net/wireless/iwlwifi/iwl-power.c
@@ -42,20 +42,35 @@
 #include "iwl-power.h"
 
 /*
- * Setting power level allow the card to go to sleep when not busy.
+ * Setting power level allows the card to go to sleep when not busy.
  *
- * The power level is set to INDEX_1 (the least deep state) by
- * default, and will, in the future, be the deepest state unless
- * otherwise required by pm_qos network latency requirements.
- *
- * Using INDEX_1 without pm_qos is ok because mac80211 will disable
- * PS when even checking every beacon for the TIM bit would exceed
- * the required latency.
+ * We calculate a sleep command based on the required latency, which
+ * we get from mac80211. In order to handle thermal throttling, we can
+ * also use pre-defined power levels.
  */
 
-#define IWL_POWER_RANGE_0_MAX  (2)
-#define IWL_POWER_RANGE_1_MAX  (10)
+/*
+ * For now, keep using power level 1 instead of automatically
+ * adjusting ...
+ */
+bool no_sleep_autoadjust = true;
+module_param(no_sleep_autoadjust, bool, S_IRUGO);
+MODULE_PARM_DESC(no_sleep_autoadjust,
+                 "don't automatically adjust sleep level "
+                 "according to maximum network latency");
 
+/*
+ * This defines the old power levels. They are still used by default
+ * (level 1) and for thermal throttle (levels 3 through 5)
+ */
+
+struct iwl_power_vec_entry {
+        struct iwl_powertable_cmd cmd;
+        u8 no_dtim;
+};
+
+#define IWL_DTIM_RANGE_0_MAX    2
+#define IWL_DTIM_RANGE_1_MAX    10
 
 #define NOSLP cpu_to_le16(0), 0, 0
 #define SLP IWL_POWER_DRIVER_ALLOW_SLEEP_MSK, 0, 0
@@ -67,9 +82,8 @@
                                      cpu_to_le32(X3), \
                                      cpu_to_le32(X4)}
 /* default power management (not Tx power) table values */
-/* for DTIM period 0 through IWL_POWER_RANGE_0_MAX */
+/* for DTIM period 0 through IWL_DTIM_RANGE_0_MAX */
 static const struct iwl_power_vec_entry range_0[IWL_POWER_NUM] = {
-        {{NOSLP, SLP_TOUT(0), SLP_TOUT(0), SLP_VEC(0, 0, 0, 0, 0)}, 0},
         {{SLP, SLP_TOUT(200), SLP_TOUT(500), SLP_VEC(1, 2, 2, 2, 0xFF)}, 0},
         {{SLP, SLP_TOUT(200), SLP_TOUT(300), SLP_VEC(1, 2, 2, 2, 0xFF)}, 0},
         {{SLP, SLP_TOUT(50), SLP_TOUT(100), SLP_VEC(2, 2, 2, 2, 0xFF)}, 0},
@@ -78,9 +92,8 @@ static const struct iwl_power_vec_entry range_0[IWL_POWER_NUM] = {
 };
 
 
-/* for DTIM period IWL_POWER_RANGE_0_MAX + 1 through IWL_POWER_RANGE_1_MAX */
+/* for DTIM period IWL_DTIM_RANGE_0_MAX + 1 through IWL_DTIM_RANGE_1_MAX */
 static const struct iwl_power_vec_entry range_1[IWL_POWER_NUM] = {
-        {{NOSLP, SLP_TOUT(0), SLP_TOUT(0), SLP_VEC(0, 0, 0, 0, 0)}, 0},
         {{SLP, SLP_TOUT(200), SLP_TOUT(500), SLP_VEC(1, 2, 3, 4, 4)}, 0},
         {{SLP, SLP_TOUT(200), SLP_TOUT(300), SLP_VEC(1, 2, 3, 4, 7)}, 0},
         {{SLP, SLP_TOUT(50), SLP_TOUT(100), SLP_VEC(2, 4, 6, 7, 9)}, 0},
@@ -88,9 +101,8 @@ static const struct iwl_power_vec_entry range_1[IWL_POWER_NUM] = {
         {{SLP, SLP_TOUT(25), SLP_TOUT(25), SLP_VEC(2, 4, 7, 10, 10)}, 2}
 };
 
-/* for DTIM period > IWL_POWER_RANGE_1_MAX */
+/* for DTIM period > IWL_DTIM_RANGE_1_MAX */
 static const struct iwl_power_vec_entry range_2[IWL_POWER_NUM] = {
-        {{NOSLP, SLP_TOUT(0), SLP_TOUT(0), SLP_VEC(0, 0, 0, 0, 0)}, 0},
         {{SLP, SLP_TOUT(200), SLP_TOUT(500), SLP_VEC(1, 2, 3, 4, 0xFF)}, 0},
         {{SLP, SLP_TOUT(200), SLP_TOUT(300), SLP_VEC(2, 4, 6, 7, 0xFF)}, 0},
         {{SLP, SLP_TOUT(50), SLP_TOUT(100), SLP_VEC(2, 7, 9, 9, 0xFF)}, 0},
@@ -98,6 +110,56 @@ static const struct iwl_power_vec_entry range_2[IWL_POWER_NUM] = {
         {{SLP, SLP_TOUT(25), SLP_TOUT(25), SLP_VEC(4, 7, 10, 10, 0xFF)}, 0}
 };
 
+static void iwl_static_sleep_cmd(struct iwl_priv *priv,
+                                 struct iwl_powertable_cmd *cmd,
+                                 enum iwl_power_level lvl, int period)
+{
+        const struct iwl_power_vec_entry *table;
+        int max_sleep, i;
+        bool skip;
+
+        table = range_2;
+        if (period < IWL_DTIM_RANGE_1_MAX)
+                table = range_1;
+        if (period < IWL_DTIM_RANGE_0_MAX)
+                table = range_0;
+
+        BUG_ON(lvl < 0 || lvl >= IWL_POWER_NUM);
+
+        *cmd = table[lvl].cmd;
+
+        if (period == 0) {
+                skip = false;
+                period = 1;
+        } else {
+                skip = !!table[lvl].no_dtim;
+        }
+
+        if (skip) {
+                __le32 slp_itrvl = cmd->sleep_interval[IWL_POWER_VEC_SIZE - 1];
+                max_sleep = le32_to_cpu(slp_itrvl);
+                if (max_sleep == 0xFF)
+                        max_sleep = period * (skip + 1);
+                else if (max_sleep > period)
+                        max_sleep = (le32_to_cpu(slp_itrvl) / period) * period;
+                cmd->flags |= IWL_POWER_SLEEP_OVER_DTIM_MSK;
+        } else {
+                max_sleep = period;
+                cmd->flags &= ~IWL_POWER_SLEEP_OVER_DTIM_MSK;
+        }
+
+        for (i = 0; i < IWL_POWER_VEC_SIZE; i++)
+                if (le32_to_cpu(cmd->sleep_interval[i]) > max_sleep)
+                        cmd->sleep_interval[i] = cpu_to_le32(max_sleep);
+
+        if (priv->power_data.pci_pm)
+                cmd->flags |= IWL_POWER_PCI_PM_MSK;
+        else
+                cmd->flags &= ~IWL_POWER_PCI_PM_MSK;
+
+        IWL_DEBUG_POWER(priv, "Sleep command for index %d\n", lvl + 1);
+}
+
 /* default Thermal Throttling transaction table
  * Current state   |         Throttling Down               |  Throttling Up
  *=============================================================================
@@ -132,104 +194,50 @@ static const struct iwl_tt_trans tt_range_3[IWL_TI_STATE_MAX - 1] = {
 
 /* Advance Thermal Throttling default restriction table */
 static const struct iwl_tt_restriction restriction_range[IWL_TI_STATE_MAX] = {
-        {IWL_TX_MULTI, true, IWL_RX_MULTI},
-        {IWL_TX_SINGLE, true, IWL_RX_MULTI},
-        {IWL_TX_SINGLE, false, IWL_RX_SINGLE},
-        {IWL_TX_NONE, false, IWL_RX_NONE}
+        {IWL_ANT_OK_MULTI, IWL_ANT_OK_MULTI, true },
+        {IWL_ANT_OK_SINGLE, IWL_ANT_OK_MULTI, true },
+        {IWL_ANT_OK_SINGLE, IWL_ANT_OK_SINGLE, false },
+        {IWL_ANT_OK_NONE, IWL_ANT_OK_NONE, false }
 };
 
-/* set card power command */
-static int iwl_set_power(struct iwl_priv *priv, void *cmd)
-{
-        return iwl_send_cmd_pdu(priv, POWER_TABLE_CMD,
-                                sizeof(struct iwl_powertable_cmd), cmd);
-}
 
-/* initialize to default */
-static void iwl_power_init_handle(struct iwl_priv *priv)
+static void iwl_power_sleep_cam_cmd(struct iwl_priv *priv,
+                                    struct iwl_powertable_cmd *cmd)
 {
-        struct iwl_power_mgr *pow_data;
-        int size = sizeof(struct iwl_power_vec_entry) * IWL_POWER_NUM;
-        struct iwl_powertable_cmd *cmd;
-        int i;
-        u16 lctl;
-
-        IWL_DEBUG_POWER(priv, "Initialize power \n");
-
-        pow_data = &priv->power_data;
-
-        memset(pow_data, 0, sizeof(*pow_data));
+        memset(cmd, 0, sizeof(*cmd));
 
-        memcpy(&pow_data->pwr_range_0[0], &range_0[0], size);
-        memcpy(&pow_data->pwr_range_1[0], &range_1[0], size);
-        memcpy(&pow_data->pwr_range_2[0], &range_2[0], size);
+        if (priv->power_data.pci_pm)
+                cmd->flags |= IWL_POWER_PCI_PM_MSK;
 
-        lctl = iwl_pcie_link_ctl(priv);
-
-        IWL_DEBUG_POWER(priv, "adjust power command flags\n");
-
-        for (i = 0; i < IWL_POWER_NUM; i++) {
-                cmd = &pow_data->pwr_range_0[i].cmd;
-
-                if (lctl & PCI_CFG_LINK_CTRL_VAL_L0S_EN)
-                        cmd->flags &= ~IWL_POWER_PCI_PM_MSK;
-                else
-                        cmd->flags |= IWL_POWER_PCI_PM_MSK;
-        }
+        IWL_DEBUG_POWER(priv, "Sleep command for CAM\n");
 }
 
-/* adjust power command according to DTIM period and power level*/
-static int iwl_update_power_cmd(struct iwl_priv *priv,
-                                struct iwl_powertable_cmd *cmd, u16 mode)
+static void iwl_power_fill_sleep_cmd(struct iwl_priv *priv,
+                                     struct iwl_powertable_cmd *cmd,
+                                     int dynps_ms, int wakeup_period)
 {
-        struct iwl_power_vec_entry *range;
-        struct iwl_power_mgr *pow_data;
         int i;
-        u32 max_sleep = 0;
-        u8 period;
-        bool skip;
 
-        if (mode > IWL_POWER_INDEX_5) {
-                IWL_DEBUG_POWER(priv, "Error invalid power mode \n");
-                return -EINVAL;
-        }
+        memset(cmd, 0, sizeof(*cmd));
 
-        pow_data = &priv->power_data;
-
-        if (pow_data->dtim_period <= IWL_POWER_RANGE_0_MAX)
-                range = &pow_data->pwr_range_0[0];
-        else if (pow_data->dtim_period <= IWL_POWER_RANGE_1_MAX)
-                range = &pow_data->pwr_range_1[0];
-        else
-                range = &pow_data->pwr_range_2[0];
+        cmd->flags = IWL_POWER_DRIVER_ALLOW_SLEEP_MSK |
+                     IWL_POWER_FAST_PD; /* no use seeing frames for others */
 
-        period = pow_data->dtim_period;
-        memcpy(cmd, &range[mode].cmd, sizeof(struct iwl_powertable_cmd));
+        if (priv->power_data.pci_pm)
+                cmd->flags |= IWL_POWER_PCI_PM_MSK;
 
-        if (period == 0) {
-                period = 1;
-                skip = false;
-        } else {
-                skip = !!range[mode].no_dtim;
-        }
-
-        if (skip) {
-                __le32 slp_itrvl = cmd->sleep_interval[IWL_POWER_VEC_SIZE - 1];
-                max_sleep = le32_to_cpu(slp_itrvl);
-                if (max_sleep == 0xFF)
-                        max_sleep = period * (skip + 1);
-                else if (max_sleep >  period)
-                        max_sleep = (le32_to_cpu(slp_itrvl) / period) * period;
-                cmd->flags |= IWL_POWER_SLEEP_OVER_DTIM_MSK;
-        } else {
-                max_sleep = period;
-                cmd->flags &= ~IWL_POWER_SLEEP_OVER_DTIM_MSK;
-        }
+        cmd->rx_data_timeout = cpu_to_le32(1000 * dynps_ms);
+        cmd->tx_data_timeout = cpu_to_le32(1000 * dynps_ms);
 
         for (i = 0; i < IWL_POWER_VEC_SIZE; i++)
-                if (le32_to_cpu(cmd->sleep_interval[i]) > max_sleep)
-                        cmd->sleep_interval[i] = cpu_to_le32(max_sleep);
+                cmd->sleep_interval[i] = cpu_to_le32(wakeup_period);
+
+        IWL_DEBUG_POWER(priv, "Automatic sleep command\n");
+}
 
+static int iwl_set_power(struct iwl_priv *priv, struct iwl_powertable_cmd *cmd)
+{
+        IWL_DEBUG_POWER(priv, "Sending power/sleep command\n");
         IWL_DEBUG_POWER(priv, "Flags value = 0x%08X\n", cmd->flags);
         IWL_DEBUG_POWER(priv, "Tx timeout = %u\n", le32_to_cpu(cmd->tx_data_timeout));
         IWL_DEBUG_POWER(priv, "Rx timeout = %u\n", le32_to_cpu(cmd->rx_data_timeout));
@@ -240,113 +248,107 @@ static int iwl_update_power_cmd(struct iwl_priv *priv,
                         le32_to_cpu(cmd->sleep_interval[3]),
                         le32_to_cpu(cmd->sleep_interval[4]));
 
-        return 0;
+        return iwl_send_cmd_pdu(priv, POWER_TABLE_CMD,
+                                sizeof(struct iwl_powertable_cmd), cmd);
 }
 
 
-/*
- * compute the final power mode index
- */
 int iwl_power_update_mode(struct iwl_priv *priv, bool force)
 {
-        struct iwl_power_mgr *setting = &(priv->power_data);
         int ret = 0;
-        struct iwl_tt_mgmt *tt = &priv->power_data.tt;
-        u16 uninitialized_var(final_mode);
+        struct iwl_tt_mgmt *tt = &priv->thermal_throttle;
+        bool enabled = (priv->iw_mode == NL80211_IFTYPE_STATION) &&
+                        (priv->hw->conf.flags & IEEE80211_CONF_PS);
         bool update_chains;
+        struct iwl_powertable_cmd cmd;
+        int dtimper;
 
         /* Don't update the RX chain when chain noise calibration is running */
         update_chains = priv->chain_noise_data.state == IWL_CHAIN_NOISE_DONE ||
                         priv->chain_noise_data.state == IWL_CHAIN_NOISE_ALIVE;
 
-        final_mode = priv->power_data.user_power_setting;
-
-        if (setting->power_disabled)
-                final_mode = IWL_POWER_MODE_CAM;
+        if (priv->vif)
+                dtimper = priv->vif->bss_conf.dtim_period;
+        else
+                dtimper = 1;
+
+        /* TT power setting overwrites everything */
+        if (tt->state >= IWL_TI_1)
+                iwl_static_sleep_cmd(priv, &cmd, tt->tt_power_mode, dtimper);
+        else if (!enabled)
+                iwl_power_sleep_cam_cmd(priv, &cmd);
+        else if (priv->power_data.debug_sleep_level_override >= 0)
+                iwl_static_sleep_cmd(priv, &cmd,
+                                     priv->power_data.debug_sleep_level_override,
+                                     dtimper);
+        else if (no_sleep_autoadjust)
+                iwl_static_sleep_cmd(priv, &cmd, IWL_POWER_INDEX_1, dtimper);
+        else
+                iwl_power_fill_sleep_cmd(priv, &cmd,
+                                         priv->hw->conf.dynamic_ps_timeout,
+                                         priv->hw->conf.max_sleep_period);
 
-        if (tt->state >= IWL_TI_1) {
-                /* TT power setting overwrite user & system power setting */
-                final_mode = tt->tt_power_mode;
-        }
         if (iwl_is_ready_rf(priv) &&
-            ((setting->power_mode != final_mode) || force)) {
-                struct iwl_powertable_cmd cmd;
-
-                if (final_mode != IWL_POWER_MODE_CAM)
+            (memcmp(&priv->power_data.sleep_cmd, &cmd, sizeof(cmd)) || force)) {
+                if (cmd.flags & IWL_POWER_DRIVER_ALLOW_SLEEP_MSK)
                         set_bit(STATUS_POWER_PMI, &priv->status);
 
-                iwl_update_power_cmd(priv, &cmd, final_mode);
-                cmd.keep_alive_beacons = 0;
-
-                if (final_mode == IWL_POWER_INDEX_5)
-                        cmd.flags |= IWL_POWER_FAST_PD;
-
                 ret = iwl_set_power(priv, &cmd);
-
-                if (final_mode == IWL_POWER_MODE_CAM)
-                        clear_bit(STATUS_POWER_PMI, &priv->status);
-
-                if (priv->cfg->ops->lib->update_chain_flags && update_chains)
-                        priv->cfg->ops->lib->update_chain_flags(priv);
-                else
-                        IWL_DEBUG_POWER(priv, "Cannot update the power, chain noise "
+                if (!ret) {
+                        if (!(cmd.flags & IWL_POWER_DRIVER_ALLOW_SLEEP_MSK))
+                                clear_bit(STATUS_POWER_PMI, &priv->status);
+
+                        if (priv->cfg->ops->lib->update_chain_flags &&
+                            update_chains)
+                                priv->cfg->ops->lib->update_chain_flags(priv);
+                        else
+                                IWL_DEBUG_POWER(priv,
+                                        "Cannot update the power, chain noise "
                                         "calibration running: %d\n",
                                         priv->chain_noise_data.state);
-                if (!ret)
-                        setting->power_mode = final_mode;
+                        memcpy(&priv->power_data.sleep_cmd, &cmd, sizeof(cmd));
+                } else
+                        IWL_ERR(priv, "set power fail, ret = %d", ret);
         }
 
         return ret;
 }
 EXPORT_SYMBOL(iwl_power_update_mode);
 
-/* set user_power_setting */
-int iwl_power_set_user_mode(struct iwl_priv *priv, u16 mode)
-{
-        if (mode >= IWL_POWER_NUM)
-                return -EINVAL;
-
-        priv->power_data.user_power_setting = mode;
-
-        return iwl_power_update_mode(priv, 0);
-}
-EXPORT_SYMBOL(iwl_power_set_user_mode);
-
 bool iwl_ht_enabled(struct iwl_priv *priv)
 {
-        struct iwl_tt_mgmt *tt = &priv->power_data.tt;
+        struct iwl_tt_mgmt *tt = &priv->thermal_throttle;
         struct iwl_tt_restriction *restriction;
 
-        if (!priv->power_data.adv_tt)
+        if (!priv->thermal_throttle.advanced_tt)
                 return true;
         restriction = tt->restriction + tt->state;
         return restriction->is_ht;
 }
 EXPORT_SYMBOL(iwl_ht_enabled);
 
-u8 iwl_tx_ant_restriction(struct iwl_priv *priv)
+enum iwl_antenna_ok iwl_tx_ant_restriction(struct iwl_priv *priv)
 {
-        struct iwl_tt_mgmt *tt = &priv->power_data.tt;
+        struct iwl_tt_mgmt *tt = &priv->thermal_throttle;
         struct iwl_tt_restriction *restriction;
 
-        if (!priv->power_data.adv_tt)
-                return IWL_TX_MULTI;
+        if (!priv->thermal_throttle.advanced_tt)
+                return IWL_ANT_OK_MULTI;
         restriction = tt->restriction + tt->state;
         return restriction->tx_stream;
 }
 EXPORT_SYMBOL(iwl_tx_ant_restriction);
 
-u8 iwl_rx_ant_restriction(struct iwl_priv *priv)
+enum iwl_antenna_ok iwl_rx_ant_restriction(struct iwl_priv *priv)
 {
-        struct iwl_tt_mgmt *tt = &priv->power_data.tt;
+        struct iwl_tt_mgmt *tt = &priv->thermal_throttle;
         struct iwl_tt_restriction *restriction;
 
-        if (!priv->power_data.adv_tt)
-                return IWL_RX_MULTI;
+        if (!priv->thermal_throttle.advanced_tt)
+                return IWL_ANT_OK_MULTI;
         restriction = tt->restriction + tt->state;
         return restriction->rx_stream;
 }
-EXPORT_SYMBOL(iwl_rx_ant_restriction);
 
 #define CT_KILL_EXIT_DURATION (5)       /* 5 seconds duration */
 
@@ -361,21 +363,21 @@ EXPORT_SYMBOL(iwl_rx_ant_restriction);
 static void iwl_tt_check_exit_ct_kill(unsigned long data)
 {
         struct iwl_priv *priv = (struct iwl_priv *)data;
-        struct iwl_tt_mgmt *tt = &priv->power_data.tt;
+        struct iwl_tt_mgmt *tt = &priv->thermal_throttle;
         unsigned long flags;
 
         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
                 return;
 
         if (tt->state == IWL_TI_CT_KILL) {
-                if (priv->power_data.ct_kill_toggle) {
+                if (priv->thermal_throttle.ct_kill_toggle) {
                         iwl_write32(priv, CSR_UCODE_DRV_GP1_CLR,
                                     CSR_UCODE_DRV_GP1_REG_BIT_CT_KILL_EXIT);
-                        priv->power_data.ct_kill_toggle = false;
+                        priv->thermal_throttle.ct_kill_toggle = false;
                 } else {
                         iwl_write32(priv, CSR_UCODE_DRV_GP1_SET,
                                     CSR_UCODE_DRV_GP1_REG_BIT_CT_KILL_EXIT);
-                        priv->power_data.ct_kill_toggle = true;
+                        priv->thermal_throttle.ct_kill_toggle = true;
                 }
                 iwl_read32(priv, CSR_UCODE_DRV_GP1);
                 spin_lock_irqsave(&priv->reg_lock, flags);
@@ -386,7 +388,7 @@ static void iwl_tt_check_exit_ct_kill(unsigned long data)
                 /* Reschedule the ct_kill timer to occur in
                  * CT_KILL_EXIT_DURATION seconds to ensure we get a
                  * thermal update */
-                mod_timer(&priv->power_data.ct_kill_exit_tm, jiffies +
+                mod_timer(&priv->thermal_throttle.ct_kill_exit_tm, jiffies +
                           CT_KILL_EXIT_DURATION * HZ);
         }
 }
@@ -400,7 +402,7 @@ static void iwl_perform_ct_kill_task(struct iwl_priv *priv,
                         ieee80211_stop_queues(priv->hw);
                 IWL_DEBUG_POWER(priv,
                                 "Schedule 5 seconds CT_KILL Timer\n");
-                mod_timer(&priv->power_data.ct_kill_exit_tm, jiffies +
+                mod_timer(&priv->thermal_throttle.ct_kill_exit_tm, jiffies +
                           CT_KILL_EXIT_DURATION * HZ);
         } else {
                 IWL_DEBUG_POWER(priv, "Wake all queues\n");
@@ -424,9 +426,8 @@ static void iwl_perform_ct_kill_task(struct iwl_priv *priv,
  */
 static void iwl_legacy_tt_handler(struct iwl_priv *priv, s32 temp)
 {
-        struct iwl_tt_mgmt *tt = &priv->power_data.tt;
-        enum iwl_tt_state new_state;
-        struct iwl_power_mgr *setting = &priv->power_data;
+        struct iwl_tt_mgmt *tt = &priv->thermal_throttle;
+        enum iwl_tt_state old_state;
 
 #ifdef CONFIG_IWLWIFI_DEBUG
         if ((tt->tt_previous_temp) &&
@@ -438,38 +439,28 @@ static void iwl_legacy_tt_handler(struct iwl_priv *priv, s32 temp)
                         (temp - tt->tt_previous_temp));
         }
 #endif
+        old_state = tt->state;
         /* in Celsius */
         if (temp >= IWL_MINIMAL_POWER_THRESHOLD)
-                new_state = IWL_TI_CT_KILL;
+                tt->state = IWL_TI_CT_KILL;
         else if (temp >= IWL_REDUCED_PERFORMANCE_THRESHOLD_2)
-                new_state = IWL_TI_2;
+                tt->state = IWL_TI_2;
         else if (temp >= IWL_REDUCED_PERFORMANCE_THRESHOLD_1)
-                new_state = IWL_TI_1;
+                tt->state = IWL_TI_1;
         else
-                new_state = IWL_TI_0;
+                tt->state = IWL_TI_0;
 
 #ifdef CONFIG_IWLWIFI_DEBUG
         tt->tt_previous_temp = temp;
 #endif
-        if (tt->state != new_state) {
-                if (tt->state == IWL_TI_0) {
-                        tt->sys_power_mode = setting->power_mode;
-                        IWL_DEBUG_POWER(priv, "current power mode: %u\n",
-                                setting->power_mode);
-                }
-                switch (new_state) {
+        if (tt->state != old_state) {
+                switch (tt->state) {
                 case IWL_TI_0:
-                        /* when system ready to go back to IWL_TI_0 state
-                         * using system power mode instead of TT power mode
-                         * revert back to the orginal power mode which was saved
-                         * before enter Thermal Throttling state
-                         * update priv->power_data.user_power_setting to the
-                         * required power mode to make sure
-                         * iwl_power_update_mode() will update power correctly.
+                        /*
+                         * When the system is ready to go back to IWL_TI_0
+                         * we only have to call iwl_power_update_mode() to
+                         * do so.
                          */
-                        priv->power_data.user_power_setting =
-                                tt->sys_power_mode;
-                        tt->tt_power_mode = tt->sys_power_mode;
                         break;
                 case IWL_TI_1:
                         tt->tt_power_mode = IWL_POWER_INDEX_3;
@@ -481,24 +472,26 @@ static void iwl_legacy_tt_handler(struct iwl_priv *priv, s32 temp)
                         tt->tt_power_mode = IWL_POWER_INDEX_5;
                         break;
                 }
+                mutex_lock(&priv->mutex);
                 if (iwl_power_update_mode(priv, true)) {
                         /* TT state not updated
                          * try again during next temperature read
                          */
+                        tt->state = old_state;
                         IWL_ERR(priv, "Cannot update power mode, "
                                         "TT state not updated\n");
                 } else {
-                        if (new_state == IWL_TI_CT_KILL)
+                        if (tt->state == IWL_TI_CT_KILL)
                                 iwl_perform_ct_kill_task(priv, true);
-                        else if (tt->state == IWL_TI_CT_KILL &&
-                                 new_state != IWL_TI_CT_KILL)
+                        else if (old_state == IWL_TI_CT_KILL &&
+                                 tt->state != IWL_TI_CT_KILL)
                                 iwl_perform_ct_kill_task(priv, false);
-                        tt->state = new_state;
                         IWL_DEBUG_POWER(priv, "Temperature state changed %u\n",
                                         tt->state);
                         IWL_DEBUG_POWER(priv, "Power Index change to %u\n",
                                         tt->tt_power_mode);
                 }
+                mutex_unlock(&priv->mutex);
         }
 }
 
@@ -525,7 +518,7 @@ static void iwl_legacy_tt_handler(struct iwl_priv *priv, s32 temp)
  */
 static void iwl_advance_tt_handler(struct iwl_priv *priv, s32 temp)
 {
-        struct iwl_tt_mgmt *tt = &priv->power_data.tt;
+        struct iwl_tt_mgmt *tt = &priv->thermal_throttle;
         int i;
         bool changed = false;
         enum iwl_tt_state old_state;
@@ -570,20 +563,15 @@ static void iwl_advance_tt_handler(struct iwl_priv *priv, s32 temp)
         }
         if (changed) {
                 struct iwl_rxon_cmd *rxon = &priv->staging_rxon;
-                struct iwl_power_mgr *setting = &priv->power_data;
 
                 if (tt->state >= IWL_TI_1) {
-                        /* if switching from IWL_TI_0 to other TT state
-                         * save previous power setting in tt->sys_power_mode */
-                        if (old_state == IWL_TI_0)
-                                tt->sys_power_mode = setting->power_mode;
                         /* force PI = IWL_POWER_INDEX_5 in the case of TI > 0 */
                         tt->tt_power_mode = IWL_POWER_INDEX_5;
                         if (!iwl_ht_enabled(priv))
                                 /* disable HT */
                                 rxon->flags &= ~(RXON_FLG_CHANNEL_MODE_MSK |
                                         RXON_FLG_CTRL_CHANNEL_LOC_HI_MSK |
-                                        RXON_FLG_FAT_PROT_MSK |
+                                        RXON_FLG_HT40_PROT_MSK |
                                         RXON_FLG_HT_PROT_MSK);
                         else {
                                 /* check HT capability and set
@@ -593,22 +581,17 @@ static void iwl_advance_tt_handler(struct iwl_priv *priv, s32 temp)
                         }
 
                 } else {
-                        /* restore system power setting */
-                        /* the previous power mode was saved in
-                         * tt->sys_power_mode when system move into
-                         * Thermal Throttling state
-                         * set power_data.user_power_setting to the previous
-                         * system power mode to make sure power will get
-                         * updated correctly
+                        /*
+                         * restore system power setting -- it will be
+                         * recalculated automatically.
                          */
-                        priv->power_data.user_power_setting =
-                                tt->sys_power_mode;
-                        tt->tt_power_mode = tt->sys_power_mode;
+
                         /* check HT capability and set
                          * according to the system HT capability
                          * in case get disabled before */
                         iwl_set_rxon_ht(priv, &priv->current_ht_config);
                 }
+                mutex_lock(&priv->mutex);
                 if (iwl_power_update_mode(priv, true)) {
                         /* TT state not updated
                          * try again during next temperature read
@@ -631,6 +614,7 @@ static void iwl_advance_tt_handler(struct iwl_priv *priv, s32 temp)
                                 iwl_perform_ct_kill_task(priv, false);
                         }
                 }
+                mutex_unlock(&priv->mutex);
         }
 }
 
@@ -644,17 +628,21 @@ static void iwl_advance_tt_handler(struct iwl_priv *priv, s32 temp)
  * for advance mode
  * pass CT_KILL_THRESHOLD+1 to make sure move into IWL_TI_CT_KILL state
  */
-void iwl_tt_enter_ct_kill(struct iwl_priv *priv)
+static void iwl_bg_ct_enter(struct work_struct *work)
 {
-        struct iwl_tt_mgmt *tt = &priv->power_data.tt;
+        struct iwl_priv *priv = container_of(work, struct iwl_priv, ct_enter);
+        struct iwl_tt_mgmt *tt = &priv->thermal_throttle;
 
         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
                 return;
 
+        if (!iwl_is_ready(priv))
+                return;
+
         if (tt->state != IWL_TI_CT_KILL) {
                 IWL_ERR(priv, "Device reached critical temperature "
                               "- ucode going to sleep!\n");
-                if (!priv->power_data.adv_tt)
+                if (!priv->thermal_throttle.advanced_tt)
                         iwl_legacy_tt_handler(priv,
                                               IWL_MINIMAL_POWER_THRESHOLD);
                 else
@@ -662,38 +650,61 @@ void iwl_tt_enter_ct_kill(struct iwl_priv *priv)
                                                CT_KILL_THRESHOLD + 1);
         }
 }
-EXPORT_SYMBOL(iwl_tt_enter_ct_kill);
 
 /* Card State Notification indicated out of critical temperature
  * since Card State Notification will not provide any temperature reading
  * so pass the IWL_REDUCED_PERFORMANCE_THRESHOLD_2 temperature
  * to iwl_legacy_tt_handler() to get out of IWL_CT_KILL state
  */
-void iwl_tt_exit_ct_kill(struct iwl_priv *priv)
+static void iwl_bg_ct_exit(struct work_struct *work)
 {
-        struct iwl_tt_mgmt *tt = &priv->power_data.tt;
+        struct iwl_priv *priv = container_of(work, struct iwl_priv, ct_exit);
+        struct iwl_tt_mgmt *tt = &priv->thermal_throttle;
 
         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
                 return;
 
+        if (!iwl_is_ready(priv))
+                return;
+
         /* stop ct_kill_exit_tm timer */
-        del_timer_sync(&priv->power_data.ct_kill_exit_tm);
+        del_timer_sync(&priv->thermal_throttle.ct_kill_exit_tm);
 
         if (tt->state == IWL_TI_CT_KILL) {
                 IWL_ERR(priv,
                         "Device temperature below critical"
                         "- ucode awake!\n");
-                if (!priv->power_data.adv_tt)
+                if (!priv->thermal_throttle.advanced_tt)
                         iwl_legacy_tt_handler(priv,
                                         IWL_REDUCED_PERFORMANCE_THRESHOLD_2);
                 else
                         iwl_advance_tt_handler(priv, CT_KILL_EXIT_THRESHOLD);
         }
 }
+
+void iwl_tt_enter_ct_kill(struct iwl_priv *priv)
+{
+        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+                return;
+
+        IWL_DEBUG_POWER(priv, "Queueing critical temperature enter.\n");
+        queue_work(priv->workqueue, &priv->ct_enter);
+}
+EXPORT_SYMBOL(iwl_tt_enter_ct_kill);
+
+void iwl_tt_exit_ct_kill(struct iwl_priv *priv)
+{
+        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+                return;
+
+        IWL_DEBUG_POWER(priv, "Queueing critical temperature exit.\n");
+        queue_work(priv->workqueue, &priv->ct_exit);
+}
 EXPORT_SYMBOL(iwl_tt_exit_ct_kill);
 
-void iwl_tt_handler(struct iwl_priv *priv)
+static void iwl_bg_tt_work(struct work_struct *work)
 {
+        struct iwl_priv *priv = container_of(work, struct iwl_priv, tt_work);
         s32 temp = priv->temperature; /* degrees CELSIUS except 4965 */
 
         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
@@ -702,11 +713,20 @@ void iwl_tt_handler(struct iwl_priv *priv)
         if ((priv->hw_rev & CSR_HW_REV_TYPE_MSK) == CSR_HW_REV_TYPE_4965)
                 temp = KELVIN_TO_CELSIUS(priv->temperature);
 
-        if (!priv->power_data.adv_tt)
+        if (!priv->thermal_throttle.advanced_tt)
                 iwl_legacy_tt_handler(priv, temp);
         else
                 iwl_advance_tt_handler(priv, temp);
 }
+
+void iwl_tt_handler(struct iwl_priv *priv)
+{
+        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+                return;
+
+        IWL_DEBUG_POWER(priv, "Queueing thermal throttling work.\n");
+        queue_work(priv->workqueue, &priv->tt_work);
+}
 EXPORT_SYMBOL(iwl_tt_handler);
 
 /* Thermal throttling initialization
@@ -716,8 +736,7 @@ EXPORT_SYMBOL(iwl_tt_handler);
  */
 void iwl_tt_initialize(struct iwl_priv *priv)
 {
-        struct iwl_tt_mgmt *tt = &priv->power_data.tt;
-        struct iwl_power_mgr *setting = &priv->power_data;
+        struct iwl_tt_mgmt *tt = &priv->thermal_throttle;
         int size = sizeof(struct iwl_tt_trans) * (IWL_TI_STATE_MAX - 1);
         struct iwl_tt_trans *transaction;
 
@@ -726,11 +745,15 @@ void iwl_tt_initialize(struct iwl_priv *priv)
         memset(tt, 0, sizeof(struct iwl_tt_mgmt));
 
         tt->state = IWL_TI_0;
-        tt->sys_power_mode = setting->power_mode;
-        tt->tt_power_mode = tt->sys_power_mode;
-        init_timer(&priv->power_data.ct_kill_exit_tm);
-        priv->power_data.ct_kill_exit_tm.data = (unsigned long)priv;
-        priv->power_data.ct_kill_exit_tm.function = iwl_tt_check_exit_ct_kill;
+        init_timer(&priv->thermal_throttle.ct_kill_exit_tm);
+        priv->thermal_throttle.ct_kill_exit_tm.data = (unsigned long)priv;
+        priv->thermal_throttle.ct_kill_exit_tm.function = iwl_tt_check_exit_ct_kill;
+
+        /* setup deferred ct kill work */
+        INIT_WORK(&priv->tt_work, iwl_bg_tt_work);
+        INIT_WORK(&priv->ct_enter, iwl_bg_ct_enter);
+        INIT_WORK(&priv->ct_exit, iwl_bg_ct_exit);
+
         switch (priv->hw_rev & CSR_HW_REV_TYPE_MSK) {
         case CSR_HW_REV_TYPE_6x00:
         case CSR_HW_REV_TYPE_6x50:
@@ -742,7 +765,7 @@ void iwl_tt_initialize(struct iwl_priv *priv)
                         GFP_KERNEL);
                 if (!tt->restriction || !tt->transaction) {
                         IWL_ERR(priv, "Fallback to Legacy Throttling\n");
-                        priv->power_data.adv_tt = false;
+                        priv->thermal_throttle.advanced_tt = false;
                         kfree(tt->restriction);
                         tt->restriction = NULL;
                         kfree(tt->transaction);
@@ -764,12 +787,12 @@ void iwl_tt_initialize(struct iwl_priv *priv)
                                 IWL_TI_STATE_MAX;
                         memcpy(tt->restriction,
                                 &restriction_range[0], size);
-                        priv->power_data.adv_tt = true;
+                        priv->thermal_throttle.advanced_tt = true;
                 }
                 break;
         default:
                 IWL_DEBUG_POWER(priv, "Legacy Thermal Throttling\n");
-                priv->power_data.adv_tt = false;
+                priv->thermal_throttle.advanced_tt = false;
                 break;
         }
 }
@@ -778,12 +801,15 @@ EXPORT_SYMBOL(iwl_tt_initialize);
 /* cleanup thermal throttling management related memory and timer */
 void iwl_tt_exit(struct iwl_priv *priv)
 {
-        struct iwl_tt_mgmt *tt = &priv->power_data.tt;
+        struct iwl_tt_mgmt *tt = &priv->thermal_throttle;
 
         /* stop ct_kill_exit_tm timer if activated */
-        del_timer_sync(&priv->power_data.ct_kill_exit_tm);
+        del_timer_sync(&priv->thermal_throttle.ct_kill_exit_tm);
+        cancel_work_sync(&priv->tt_work);
+        cancel_work_sync(&priv->ct_enter);
+        cancel_work_sync(&priv->ct_exit);
 
-        if (priv->power_data.adv_tt) {
+        if (priv->thermal_throttle.advanced_tt) {
                 /* free advance thermal throttling memory */
                 kfree(tt->restriction);
                 tt->restriction = NULL;
@@ -796,9 +822,13 @@ EXPORT_SYMBOL(iwl_tt_exit);
 /* initialize to default */
 void iwl_power_initialize(struct iwl_priv *priv)
 {
-        iwl_power_init_handle(priv);
-        priv->power_data.user_power_setting = IWL_POWER_INDEX_1;
-        /* default to disabled until mac80211 says otherwise */
-        priv->power_data.power_disabled = 1;
+        u16 lctl = iwl_pcie_link_ctl(priv);
+
+        priv->power_data.pci_pm = !(lctl & PCI_CFG_LINK_CTRL_VAL_L0S_EN);
+
+        priv->power_data.debug_sleep_level_override = -1;
+
+        memset(&priv->power_data.sleep_cmd, 0,
+                sizeof(priv->power_data.sleep_cmd));
 }
 EXPORT_SYMBOL(iwl_power_initialize);
diff --git a/drivers/net/wireless/iwlwifi/iwl-power.h b/drivers/net/wireless/iwlwifi/iwl-power.h
index 3d49b7a45b74..df6f6a49712b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-power.h
+++ b/drivers/net/wireless/iwlwifi/iwl-power.h
@@ -28,22 +28,17 @@
 #ifndef __iwl_power_setting_h__
 #define __iwl_power_setting_h__
 
-#include <net/mac80211.h>
 #include "iwl-commands.h"
 
-struct iwl_priv;
-
 #define IWL_ABSOLUTE_ZERO               0
 #define IWL_ABSOLUTE_MAX                0xFFFFFFFF
 #define IWL_TT_INCREASE_MARGIN  5
 
-/* Tx/Rx restrictions */
-#define IWL_TX_MULTI            0x02
-#define IWL_TX_SINGLE           0x01
-#define IWL_TX_NONE             0x00
-#define IWL_RX_MULTI            0x02
-#define IWL_RX_SINGLE           0x01
-#define IWL_RX_NONE             0x00
+enum iwl_antenna_ok {
+        IWL_ANT_OK_NONE,
+        IWL_ANT_OK_SINGLE,
+        IWL_ANT_OK_MULTI,
+};
 
 /* Thermal Throttling State Machine states */
 enum  iwl_tt_state {
@@ -55,27 +50,30 @@ enum  iwl_tt_state {
 };
 
 /**
- * struct iwl_tt_restriction - Thermal Throttling restriction table used
- *              by advance thermal throttling management
- *              based on the current thermal throttling state, determine
- *              number of tx/rx streams; and the status of HT operation
+ * struct iwl_tt_restriction - Thermal Throttling restriction table
  * @tx_stream: number of tx stream allowed
  * @is_ht: ht enable/disable
  * @rx_stream: number of rx stream allowed
+ *
+ * This table is used by advance thermal throttling management
+ * based on the current thermal throttling state, and determines
+ * the number of tx/rx streams and the status of HT operation.
  */
 struct iwl_tt_restriction {
-        u8 tx_stream;
+        enum iwl_antenna_ok tx_stream;
+        enum iwl_antenna_ok rx_stream;
         bool is_ht;
-        u8 rx_stream;
 };
 
 /**
- * struct iwl_tt_trans - Thermal Throttling transaction table; used by
- *              advance thermal throttling algorithm to determine next
- *              thermal state to go based on the current temperature
+ * struct iwl_tt_trans - Thermal Throttling transaction table
  * @next_state:  next thermal throttling mode
  * @tt_low: low temperature threshold to change state
  * @tt_high: high temperature threshold to change state
+ *
+ * This is used by the advanced thermal throttling algorithm
+ * to determine the next thermal state to go based on the
+ * current temperature.
  */
 struct iwl_tt_trans {
         enum iwl_tt_state next_state;
@@ -85,34 +83,36 @@ struct iwl_tt_trans {
 
 /**
  * struct iwl_tt_mgnt - Thermal Throttling Management structure
+ * @advanced_tt:    advanced thermal throttle required
  * @state:          current Thermal Throttling state
  * @tt_power_mode:  Thermal Throttling power mode index
  *                  being used to set power level when
  *                  when thermal throttling state != IWL_TI_0
  *                  the tt_power_mode should set to different
  *                  power mode based on the current tt state
- * @sys_power_mode: previous system power mode
- *                  before transition into TT state
  * @tt_previous_temperature: last measured temperature
  * @iwl_tt_restriction: ptr to restriction tbl, used by advance
  *                  thermal throttling to determine how many tx/rx streams
  *                  should be used in tt state; and can HT be enabled or not
  * @iwl_tt_trans: ptr to adv trans table, used by advance thermal throttling
  *                  state transaction
+ * @ct_kill_toggle: used to toggle the CSR bit when checking uCode temperature
+ * @ct_kill_exit_tm: timer to exit thermal kill
  */
 struct iwl_tt_mgmt {
         enum iwl_tt_state state;
+        bool advanced_tt;
         u8 tt_power_mode;
-        u8 sys_power_mode;
+        bool ct_kill_toggle;
 #ifdef CONFIG_IWLWIFI_DEBUG
         s32 tt_previous_temp;
 #endif
         struct iwl_tt_restriction *restriction;
         struct iwl_tt_trans *transaction;
+        struct timer_list ct_kill_exit_tm;
 };
 
-enum {
-        IWL_POWER_MODE_CAM, /* Continuously Aware Mode, always on */
+enum iwl_power_level {
         IWL_POWER_INDEX_1,
         IWL_POWER_INDEX_2,
         IWL_POWER_INDEX_3,
@@ -121,36 +121,16 @@ enum {
         IWL_POWER_NUM
 };
 
-/* Power management (not Tx power) structures */
-
-struct iwl_power_vec_entry {
-        struct iwl_powertable_cmd cmd;
-        u8 no_dtim;
-};
-
 struct iwl_power_mgr {
-        struct iwl_power_vec_entry pwr_range_0[IWL_POWER_NUM];
-        struct iwl_power_vec_entry pwr_range_1[IWL_POWER_NUM];
-        struct iwl_power_vec_entry pwr_range_2[IWL_POWER_NUM];
-        u32 dtim_period;
-        /* final power level that used to calculate final power command */
-        u8 power_mode;
-        u8 user_power_setting; /* set by user through sysfs */
-        u8 power_disabled; /* set by mac80211's CONF_PS */
-        struct iwl_tt_mgmt tt; /* Thermal Throttling Management */
-        bool adv_tt;            /* false: legacy mode */
-                                /* true: advance mode */
-        bool ct_kill_toggle;   /* use to toggle the CSR bit when
-                                * checking uCode temperature
-                                */
-        struct timer_list ct_kill_exit_tm;
+        struct iwl_powertable_cmd sleep_cmd;
+        int debug_sleep_level_override;
+        bool pci_pm;
 };
 
 int iwl_power_update_mode(struct iwl_priv *priv, bool force);
-int iwl_power_set_user_mode(struct iwl_priv *priv, u16 mode);
 bool iwl_ht_enabled(struct iwl_priv *priv);
-u8 iwl_tx_ant_restriction(struct iwl_priv *priv);
-u8 iwl_rx_ant_restriction(struct iwl_priv *priv);
+enum iwl_antenna_ok iwl_tx_ant_restriction(struct iwl_priv *priv);
+enum iwl_antenna_ok iwl_rx_ant_restriction(struct iwl_priv *priv);
 void iwl_tt_enter_ct_kill(struct iwl_priv *priv);
 void iwl_tt_exit_ct_kill(struct iwl_priv *priv);
 void iwl_tt_handler(struct iwl_priv *priv);
@@ -158,4 +138,6 @@ void iwl_tt_initialize(struct iwl_priv *priv);
 void iwl_tt_exit(struct iwl_priv *priv);
 void iwl_power_initialize(struct iwl_priv *priv);
 
+extern bool no_sleep_autoadjust;
+
 #endif  /* __iwl_power_setting_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-rx.c b/drivers/net/wireless/iwlwifi/iwl-rx.c
index e002c8b56c49..43b2fce4cbf0 100644
--- a/drivers/net/wireless/iwlwifi/iwl-rx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-rx.c
@@ -544,8 +544,8 @@ void iwl_rx_statistics(struct iwl_priv *priv,
         change = ((priv->statistics.general.temperature !=
                    pkt->u.stats.general.temperature) ||
                   ((priv->statistics.flag &
-                    STATISTICS_REPLY_FLG_FAT_MODE_MSK) !=
-                   (pkt->u.stats.flag & STATISTICS_REPLY_FLG_FAT_MODE_MSK)));
+                    STATISTICS_REPLY_FLG_HT40_MODE_MSK) !=
+                   (pkt->u.stats.flag & STATISTICS_REPLY_FLG_HT40_MODE_MSK)));
 
         memcpy(&priv->statistics, &pkt->u.stats, sizeof(priv->statistics));
 
@@ -645,7 +645,7 @@ static void iwl_dbg_report_frame(struct iwl_priv *priv,
         u32 tsf_low;
         int rssi;
 
-        if (likely(!(iwl_debug_level & IWL_DL_RX)))
+        if (likely(!(iwl_get_debug_level(priv) & IWL_DL_RX)))
                 return;
 
         /* MAC header */
@@ -741,18 +741,10 @@ static void iwl_dbg_report_frame(struct iwl_priv *priv,
                 }
         }
         if (print_dump)
-                iwl_print_hex_dump(IWL_DL_RX, header, length);
+                iwl_print_hex_dump(priv, IWL_DL_RX, header, length);
 }
 #endif
 
-static void iwl_update_rx_stats(struct iwl_priv *priv, u16 fc, u16 len)
-{
-        /* 0 - mgmt, 1 - cnt, 2 - data */
-        int idx = (fc & IEEE80211_FCTL_FTYPE) >> 2;
-        priv->rx_stats[idx].cnt++;
-        priv->rx_stats[idx].bytes += len;
-}
-
 /*
  * returns non-zero if packet should be dropped
  */
@@ -930,7 +922,7 @@ static void iwl_pass_packet_to_mac80211(struct iwl_priv *priv,
             iwl_set_decrypted_flag(priv, hdr, ampdu_status, stats))
                 return;
 
-        iwl_update_rx_stats(priv, le16_to_cpu(hdr->frame_control), len);
+        iwl_update_stats(priv, false, hdr->frame_control, len);
         memcpy(IEEE80211_SKB_RXCB(rxb->skb), stats, sizeof(*stats));
         ieee80211_rx_irqsafe(priv->hw, rxb->skb);
         priv->alloc_rxb_skb--;
@@ -1060,9 +1052,10 @@ void iwl_rx_reply_rx(struct iwl_priv *priv,
 
         /* Set "1" to report good data frames in groups of 100 */
 #ifdef CONFIG_IWLWIFI_DEBUG
-        if (unlikely(iwl_debug_level & IWL_DL_RX))
+        if (unlikely(iwl_get_debug_level(priv) & IWL_DL_RX))
                 iwl_dbg_report_frame(priv, rx_start, len, header, 1);
 #endif
+        iwl_dbg_log_rx_data_frame(priv, len, header);
         IWL_DEBUG_STATS_LIMIT(priv, "Rssi %d, noise %d, qual %d, TSF %llu\n",
                 rx_status.signal, rx_status.noise, rx_status.qual,
                 (unsigned long long)rx_status.mactime);
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.c b/drivers/net/wireless/iwlwifi/iwl-sta.c
index efcae0d5e193..c6633fec8216 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.c
@@ -214,10 +214,10 @@ static void iwl_set_ht_add_station(struct iwl_priv *priv, u8 index,
         sta_flags |= cpu_to_le32(
               (u32)sta_ht_inf->ampdu_density << STA_FLG_AGG_MPDU_DENSITY_POS);
 
-        if (iwl_is_fat_tx_allowed(priv, sta_ht_inf))
-                sta_flags |= STA_FLG_FAT_EN_MSK;
+        if (iwl_is_ht40_tx_allowed(priv, sta_ht_inf))
+                sta_flags |= STA_FLG_HT40_EN_MSK;
         else
-                sta_flags &= ~STA_FLG_FAT_EN_MSK;
+                sta_flags &= ~STA_FLG_HT40_EN_MSK;
 
         priv->stations[index].sta.station_flags = sta_flags;
  done:
@@ -1088,7 +1088,7 @@ int iwl_get_sta_id(struct iwl_priv *priv, struct ieee80211_hdr *hdr)
                 IWL_DEBUG_DROP(priv, "Station %pM not in station map. "
                                "Defaulting to broadcast...\n",
                                hdr->addr1);
-                iwl_print_hex_dump(IWL_DL_DROP, (u8 *) hdr, sizeof(*hdr));
+                iwl_print_hex_dump(priv, IWL_DL_DROP, (u8 *) hdr, sizeof(*hdr));
                 return priv->hw_params.bcast_sta_id;
 
         default:
diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
index 288b871e974b..9b76bd41f214 100644
--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
@@ -668,14 +668,6 @@ static void iwl_tx_cmd_build_hwcrypto(struct iwl_priv *priv,
         }
 }
 
-static void iwl_update_tx_stats(struct iwl_priv *priv, u16 fc, u16 len)
-{
-        /* 0 - mgmt, 1 - cnt, 2 - data */
-        int idx = (fc & IEEE80211_FCTL_FTYPE) >> 2;
-        priv->tx_stats[idx].cnt++;
-        priv->tx_stats[idx].bytes += len;
-}
-
 /*
  * start REPLY_TX command process
  */
@@ -808,12 +800,12 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
 
         /* TODO need this for burst mode later on */
         iwl_tx_cmd_build_basic(priv, tx_cmd, info, hdr, sta_id);
+        iwl_dbg_log_tx_data_frame(priv, len, hdr);
 
         /* set is_hcca to 0; it probably will never be implemented */
         iwl_tx_cmd_build_rate(priv, tx_cmd, info, fc, sta_id, 0);
 
-        iwl_update_tx_stats(priv, le16_to_cpu(fc), len);
-
+        iwl_update_stats(priv, true, fc, len);
         /*
          * Use the first empty entry in this queue's command buffer array
          * to contain the Tx command and MAC header concatenated together
@@ -884,8 +876,8 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
         IWL_DEBUG_TX(priv, "sequence nr = 0X%x \n",
                      le16_to_cpu(out_cmd->hdr.sequence));
         IWL_DEBUG_TX(priv, "tx_flags = 0X%x \n", le32_to_cpu(tx_cmd->tx_flags));
-        iwl_print_hex_dump(IWL_DL_TX, (u8 *)tx_cmd, sizeof(*tx_cmd));
-        iwl_print_hex_dump(IWL_DL_TX, (u8 *)tx_cmd->hdr, hdr_len);
+        iwl_print_hex_dump(priv, IWL_DL_TX, (u8 *)tx_cmd, sizeof(*tx_cmd));
+        iwl_print_hex_dump(priv, IWL_DL_TX, (u8 *)tx_cmd->hdr, hdr_len);
 
         /* Set up entry for this TFD in Tx byte-count array */
         if (info->flags & IEEE80211_TX_CTL_AMPDU)
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index ea051b739ba2..e617411d0c5e 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -598,7 +598,8 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
         len = (u16)skb->len;
         tx->len = cpu_to_le16(len);
 
-
+        iwl_dbg_log_tx_data_frame(priv, len, hdr);
+        iwl_update_stats(priv, true, fc, len);
         tx->tx_flags &= ~TX_CMD_FLG_ANT_A_MSK;
         tx->tx_flags &= ~TX_CMD_FLG_ANT_B_MSK;
 
@@ -614,8 +615,8 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
         IWL_DEBUG_TX(priv, "sequence nr = 0X%x \n",
                      le16_to_cpu(out_cmd->hdr.sequence));
         IWL_DEBUG_TX(priv, "tx_flags = 0X%x \n", le32_to_cpu(tx->tx_flags));
-        iwl_print_hex_dump(IWL_DL_TX, tx, sizeof(*tx));
-        iwl_print_hex_dump(IWL_DL_TX, (u8 *)tx->hdr,
+        iwl_print_hex_dump(priv, IWL_DL_TX, tx, sizeof(*tx));
+        iwl_print_hex_dump(priv, IWL_DL_TX, (u8 *)tx->hdr,
                            ieee80211_hdrlen(fc));
 
         /*
@@ -1646,7 +1647,7 @@ static void iwl3945_irq_tasklet(struct iwl_priv *priv)
         iwl_write32(priv, CSR_FH_INT_STATUS, inta_fh);
 
 #ifdef CONFIG_IWLWIFI_DEBUG
-        if (iwl_debug_level & IWL_DL_ISR) {
+        if (iwl_get_debug_level(priv) & IWL_DL_ISR) {
                 /* just for debug */
                 inta_mask = iwl_read32(priv, CSR_INT_MASK);
                 IWL_DEBUG_ISR(priv, "inta 0x%08x, enabled 0x%08x, fh 0x%08x\n",
@@ -1681,7 +1682,7 @@ static void iwl3945_irq_tasklet(struct iwl_priv *priv)
         }
 
 #ifdef CONFIG_IWLWIFI_DEBUG
-        if (iwl_debug_level & (IWL_DL_ISR)) {
+        if (iwl_get_debug_level(priv) & (IWL_DL_ISR)) {
                 /* NIC fires this, but we don't use it, redundant with WAKEUP */
                 if (inta & CSR_INT_BIT_SCD) {
                         IWL_DEBUG_ISR(priv, "Scheduler finished to transmit "
@@ -1760,7 +1761,7 @@ static void iwl3945_irq_tasklet(struct iwl_priv *priv)
                 iwl_enable_interrupts(priv);
 
 #ifdef CONFIG_IWLWIFI_DEBUG
-        if (iwl_debug_level & (IWL_DL_ISR)) {
+        if (iwl_get_debug_level(priv) & (IWL_DL_ISR)) {
                 inta = iwl_read32(priv, CSR_INT);
                 inta_mask = iwl_read32(priv, CSR_INT_MASK);
                 inta_fh = iwl_read32(priv, CSR_FH_INT_STATUS);
@@ -3311,14 +3312,15 @@ static int iwl3945_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
  *
  * See the level definitions in iwl for details.
  *
- * FIXME This file can be deprecated as the module parameter is
- * writable and users can thus also change the debug level
- * using the /sys/module/iwl3945/parameters/debug file.
+ * The debug_level being managed using sysfs below is a per device debug
+ * level that is used instead of the global debug level if it (the per
+ * device debug level) is set.
  */
 static ssize_t show_debug_level(struct device *d,
                                 struct device_attribute *attr, char *buf)
 {
-        return sprintf(buf, "0x%08X\n", iwl_debug_level);
+        struct iwl_priv *priv = dev_get_drvdata(d);
+        return sprintf(buf, "0x%08X\n", iwl_get_debug_level(priv));
 }
 static ssize_t store_debug_level(struct device *d,
                                 struct device_attribute *attr,
@@ -3331,9 +3333,12 @@ static ssize_t store_debug_level(struct device *d,
         ret = strict_strtoul(buf, 0, &val);
         if (ret)
                 IWL_INFO(priv, "%s is not in hex or decimal form.\n", buf);
-        else
-                iwl_debug_level = val;
-
+        else {
+                priv->debug_level = val;
+                if (iwl_alloc_traffic_mem(priv))
+                        IWL_ERR(priv,
+                                "Not enough memory to generate traffic log\n");
+        }
         return strnlen(buf, count);
 }
 
@@ -3549,65 +3554,6 @@ static DEVICE_ATTR(retry_rate, S_IWUSR | S_IRUSR, show_retry_rate,
                    store_retry_rate);
 
 
-static ssize_t store_power_level(struct device *d,
-                                 struct device_attribute *attr,
-                                 const char *buf, size_t count)
-{
-        struct iwl_priv *priv = dev_get_drvdata(d);
-        int ret;
-        unsigned long mode;
-
-
-        mutex_lock(&priv->mutex);
-
-        ret = strict_strtoul(buf, 10, &mode);
-        if (ret)
-                goto out;
-
-        ret = iwl_power_set_user_mode(priv, mode);
-        if (ret) {
-                IWL_DEBUG_MAC80211(priv, "failed setting power mode.\n");
-                goto out;
-        }
-        ret = count;
-
- out:
-        mutex_unlock(&priv->mutex);
-        return ret;
-}
-
-static ssize_t show_power_level(struct device *d,
-                                struct device_attribute *attr, char *buf)
-{
-        struct iwl_priv *priv = dev_get_drvdata(d);
-        int level = priv->power_data.power_mode;
-        char *p = buf;
-
-        p += sprintf(p, "%d\n", level);
-        return p - buf + 1;
-}
-
-static DEVICE_ATTR(power_level, S_IWUSR | S_IRUSR,
-                   show_power_level, store_power_level);
-
-#define MAX_WX_STRING 80
-
-/* Values are in microsecond */
-static const s32 timeout_duration[] = {
-        350000,
-        250000,
-        75000,
-        37000,
-        25000,
-};
-static const s32 period_duration[] = {
-        400000,
-        700000,
-        1000000,
-        1000000,
-        1000000
-};
-
 static ssize_t show_channels(struct device *d,
                              struct device_attribute *attr, char *buf)
 {
@@ -3784,7 +3730,6 @@ static struct attribute *iwl3945_sysfs_entries[] = {
 #ifdef CONFIG_IWL3945_SPECTRUM_MEASUREMENT
         &dev_attr_measurement.attr,
 #endif
-        &dev_attr_power_level.attr,
         &dev_attr_retry_rate.attr,
         &dev_attr_statistics.attr,
         &dev_attr_status.attr,
@@ -3849,8 +3794,6 @@ static int iwl3945_init_drv(struct iwl_priv *priv)
         priv->qos_data.qos_cap.val = 0;
 
         priv->rates_mask = IWL_RATES_MASK;
-        /* If power management is turned on, default to CAM mode */
-        priv->power_mode = IWL_POWER_MODE_CAM;
         priv->tx_power_user_lmt = IWL_DEFAULT_TX_POWER;
 
         if (eeprom->version < EEPROM_3945_EEPROM_VERSION) {
@@ -3897,7 +3840,9 @@ static int iwl3945_setup_mac(struct iwl_priv *priv)
         /* Tell mac80211 our characteristics */
         hw->flags = IEEE80211_HW_SIGNAL_DBM |
                     IEEE80211_HW_NOISE_DBM |
-                    IEEE80211_HW_SPECTRUM_MGMT;
+                    IEEE80211_HW_SPECTRUM_MGMT |
+                    IEEE80211_HW_SUPPORTS_PS |
+                    IEEE80211_HW_SUPPORTS_DYNAMIC_PS;
 
         hw->wiphy->interface_modes =
                 BIT(NL80211_IFTYPE_STATION) |
@@ -3975,6 +3920,8 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
 #ifdef CONFIG_IWLWIFI_DEBUG
         atomic_set(&priv->restrict_refcnt, 0);
 #endif
+        if (iwl_alloc_traffic_mem(priv))
+                IWL_ERR(priv, "Not enough memory to generate traffic log\n");
 
         /***************************
          * 2. Initializing PCI bus
@@ -4137,6 +4084,7 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
         pci_disable_device(pdev);
  out_ieee80211_free_hw:
         ieee80211_free_hw(priv->hw);
+        iwl_free_traffic_mem(priv);
  out:
         return err;
 }
@@ -4192,6 +4140,7 @@ static void __devexit iwl3945_pci_remove(struct pci_dev *pdev)
          * until now... */
         destroy_workqueue(priv->workqueue);
         priv->workqueue = NULL;
+        iwl_free_traffic_mem(priv);
 
         free_irq(pdev->irq, priv);
         pci_disable_msi(pdev);
diff --git a/drivers/net/wireless/libertas/main.c b/drivers/net/wireless/libertas/main.c
index 89575e448015..8df1cfd5f93a 100644
--- a/drivers/net/wireless/libertas/main.c
+++ b/drivers/net/wireless/libertas/main.c
@@ -1176,7 +1176,7 @@ struct lbs_private *lbs_add_card(void *card, struct device *dmdev)
         /* Allocate an Ethernet device and register it */
         dev = alloc_etherdev(sizeof(struct lbs_private));
         if (!dev) {
-                lbs_pr_err("init ethX device failed\n");
+                lbs_pr_err("init wlanX device failed\n");
                 goto done;
         }
         priv = netdev_priv(dev);
@@ -1204,6 +1204,7 @@ struct lbs_private *lbs_add_card(void *card, struct device *dmdev)
         SET_NETDEV_DEV(dev, dmdev);
 
         priv->rtap_net_dev = NULL;
+        strcpy(dev->name, "wlan%d");
 
         lbs_deb_thread("Starting main thread...\n");
         init_waitqueue_head(&priv->waitq);
diff --git a/drivers/net/wireless/orinoco/hw.c b/drivers/net/wireless/orinoco/hw.c
index fa508af1a351..40d8dfa7eace 100644
--- a/drivers/net/wireless/orinoco/hw.c
+++ b/drivers/net/wireless/orinoco/hw.c
@@ -642,7 +642,7 @@ int orinoco_hw_get_tkip_iv(struct orinoco_private *priv, int key, u8 *tsc)
 {
         hermes_t *hw = &priv->hw;
         int err = 0;
-        u8 tsc_arr[4][IW_ENCODE_SEQ_MAX_SIZE];
+        u8 tsc_arr[4][ORINOCO_SEQ_LEN];
 
         if ((key < 0) || (key > 4))
                 return -EINVAL;
@@ -768,12 +768,29 @@ int __orinoco_hw_setup_wepkeys(struct orinoco_private *priv)
 {
         hermes_t *hw = &priv->hw;
         int err = 0;
+        int i;
 
         switch (priv->firmware_type) {
         case FIRMWARE_TYPE_AGERE:
+        {
+                struct orinoco_key keys[ORINOCO_MAX_KEYS];
+
+                memset(&keys, 0, sizeof(keys));
+                for (i = 0; i < ORINOCO_MAX_KEYS; i++) {
+                        int len = min(priv->keys[i].key_len,
+                                      ORINOCO_MAX_KEY_SIZE);
+                        memcpy(&keys[i].data, priv->keys[i].key, len);
+                        if (len > SMALL_KEY_SIZE)
+                                keys[i].len = cpu_to_le16(LARGE_KEY_SIZE);
+                        else if (len > 0)
+                                keys[i].len = cpu_to_le16(SMALL_KEY_SIZE);
+                        else
+                                keys[i].len = cpu_to_le16(0);
+                }
+
                 err = HERMES_WRITE_RECORD(hw, USER_BAP,
                                           HERMES_RID_CNFWEPKEYS_AGERE,
-                                          &priv->keys);
+                                          &keys);
                 if (err)
                         return err;
                 err = hermes_write_wordrec(hw, USER_BAP,
@@ -782,28 +799,38 @@ int __orinoco_hw_setup_wepkeys(struct orinoco_private *priv)
                 if (err)
                         return err;
                 break;
+        }
         case FIRMWARE_TYPE_INTERSIL:
         case FIRMWARE_TYPE_SYMBOL:
                 {
                         int keylen;
-                        int i;
 
                         /* Force uniform key length to work around
                          * firmware bugs */
-                        keylen = le16_to_cpu(priv->keys[priv->tx_key].len);
+                        keylen = priv->keys[priv->tx_key].key_len;
 
                         if (keylen > LARGE_KEY_SIZE) {
                                 printk(KERN_ERR "%s: BUG: Key %d has oversize length %d.\n",
                                        priv->ndev->name, priv->tx_key, keylen);
                                 return -E2BIG;
-                        }
+                        } else if (keylen > SMALL_KEY_SIZE)
+                                keylen = LARGE_KEY_SIZE;
+                        else if (keylen > 0)
+                                keylen = SMALL_KEY_SIZE;
+                        else
+                                keylen = 0;
 
                         /* Write all 4 keys */
                         for (i = 0; i < ORINOCO_MAX_KEYS; i++) {
+                                u8 key[LARGE_KEY_SIZE] = { 0 };
+
+                                memcpy(key, priv->keys[i].key,
+                                       priv->keys[i].key_len);
+
                                 err = hermes_write_ltv(hw, USER_BAP,
                                                 HERMES_RID_CNFDEFAULTKEY0 + i,
                                                 HERMES_BYTES_TO_RECLEN(keylen),
-                                                priv->keys[i].data);
+                                                key);
                                 if (err)
                                         return err;
                         }
@@ -829,8 +856,8 @@ int __orinoco_hw_setup_enc(struct orinoco_private *priv)
         int auth_flag;
         int enc_flag;
 
-        /* Setup WEP keys for WEP and WPA */
-        if (priv->encode_alg)
+        /* Setup WEP keys */
+        if (priv->encode_alg == ORINOCO_ALG_WEP)
                 __orinoco_hw_setup_wepkeys(priv);
 
         if (priv->wep_restrict)
@@ -840,14 +867,14 @@ int __orinoco_hw_setup_enc(struct orinoco_private *priv)
 
         if (priv->wpa_enabled)
                 enc_flag = 2;
-        else if (priv->encode_alg == IW_ENCODE_ALG_WEP)
+        else if (priv->encode_alg == ORINOCO_ALG_WEP)
                 enc_flag = 1;
         else
                 enc_flag = 0;
 
         switch (priv->firmware_type) {
         case FIRMWARE_TYPE_AGERE: /* Agere style WEP */
-                if (priv->encode_alg == IW_ENCODE_ALG_WEP) {
+                if (priv->encode_alg == ORINOCO_ALG_WEP) {
                         /* Enable the shared-key authentication. */
                         err = hermes_write_wordrec(hw, USER_BAP,
                                         HERMES_RID_CNFAUTHENTICATION_AGERE,
@@ -872,7 +899,7 @@ int __orinoco_hw_setup_enc(struct orinoco_private *priv)
 
         case FIRMWARE_TYPE_INTERSIL: /* Intersil style WEP */
         case FIRMWARE_TYPE_SYMBOL: /* Symbol style WEP */
-                if (priv->encode_alg == IW_ENCODE_ALG_WEP) {
+                if (priv->encode_alg == ORINOCO_ALG_WEP) {
                         if (priv->wep_restrict ||
                             (priv->firmware_type == FIRMWARE_TYPE_SYMBOL))
                                 master_wep_flag = HERMES_WEP_PRIVACY_INVOKED |
@@ -905,19 +932,20 @@ int __orinoco_hw_setup_enc(struct orinoco_private *priv)
 }
 
 /* key must be 32 bytes, including the tx and rx MIC keys.
- * rsc must be 8 bytes
- * tsc must be 8 bytes or NULL
+ * rsc must be NULL or up to 8 bytes
+ * tsc must be NULL or up to 8 bytes
  */
 int __orinoco_hw_set_tkip_key(struct orinoco_private *priv, int key_idx,
-                              int set_tx, u8 *key, u8 *rsc, u8 *tsc)
+                              int set_tx, u8 *key, u8 *rsc, size_t rsc_len,
+                              u8 *tsc, size_t tsc_len)
 {
         struct {
                 __le16 idx;
-                u8 rsc[IW_ENCODE_SEQ_MAX_SIZE];
+                u8 rsc[ORINOCO_SEQ_LEN];
                 u8 key[TKIP_KEYLEN];
                 u8 tx_mic[MIC_KEYLEN];
                 u8 rx_mic[MIC_KEYLEN];
-                u8 tsc[IW_ENCODE_SEQ_MAX_SIZE];
+                u8 tsc[ORINOCO_SEQ_LEN];
         } __attribute__ ((packed)) buf;
         hermes_t *hw = &priv->hw;
         int ret;
@@ -934,17 +962,22 @@ int __orinoco_hw_set_tkip_key(struct orinoco_private *priv, int key_idx,
         memcpy(buf.key, key,
                sizeof(buf.key) + sizeof(buf.tx_mic) + sizeof(buf.rx_mic));
 
-        if (rsc == NULL)
-                memset(buf.rsc, 0, sizeof(buf.rsc));
-        else
-                memcpy(buf.rsc, rsc, sizeof(buf.rsc));
+        if (rsc_len > sizeof(buf.rsc))
+                rsc_len = sizeof(buf.rsc);
 
-        if (tsc == NULL) {
-                memset(buf.tsc, 0, sizeof(buf.tsc));
+        if (tsc_len > sizeof(buf.tsc))
+                tsc_len = sizeof(buf.tsc);
+
+        memset(buf.rsc, 0, sizeof(buf.rsc));
+        memset(buf.tsc, 0, sizeof(buf.tsc));
+
+        if (rsc != NULL)
+                memcpy(buf.rsc, rsc, rsc_len);
+
+        if (tsc != NULL)
+                memcpy(buf.tsc, tsc, tsc_len);
+        else
                 buf.tsc[4] = 0x10;
-        } else {
-                memcpy(buf.tsc, tsc, sizeof(buf.tsc));
-        }
 
         /* Wait upto 100ms for tx queue to empty */
         for (k = 100; k > 0; k--) {
@@ -970,7 +1003,6 @@ int orinoco_clear_tkip_key(struct orinoco_private *priv, int key_idx)
         hermes_t *hw = &priv->hw;
         int err;
 
-        memset(&priv->tkip_key[key_idx], 0, sizeof(priv->tkip_key[key_idx]));
         err = hermes_write_wordrec(hw, USER_BAP,
                                    HERMES_RID_CNFREMDEFAULTTKIPKEY_AGERE,
                                    key_idx);
@@ -1242,3 +1274,39 @@ int orinoco_hw_trigger_scan(struct orinoco_private *priv,
 
         return err;
 }
+
+/* Disassociate from node with BSSID addr */
+int orinoco_hw_disassociate(struct orinoco_private *priv,
+                            u8 *addr, u16 reason_code)
+{
+        hermes_t *hw = &priv->hw;
+        int err;
+
+        struct {
+                u8 addr[ETH_ALEN];
+                __le16 reason_code;
+        } __attribute__ ((packed)) buf;
+
+        /* Currently only supported by WPA enabled Agere fw */
+        if (!priv->has_wpa)
+                return -EOPNOTSUPP;
+
+        memcpy(buf.addr, addr, ETH_ALEN);
+        buf.reason_code = cpu_to_le16(reason_code);
+        err = HERMES_WRITE_RECORD(hw, USER_BAP,
+                                  HERMES_RID_CNFDISASSOCIATE,
+                                  &buf);
+        return err;
+}
+
+int orinoco_hw_get_current_bssid(struct orinoco_private *priv,
+                                 u8 *addr)
+{
+        hermes_t *hw = &priv->hw;
+        int err;
+
+        err = hermes_read_ltv(hw, USER_BAP, HERMES_RID_CURRENTBSSID,
+                              ETH_ALEN, NULL, addr);
+
+        return err;
+}
diff --git a/drivers/net/wireless/orinoco/hw.h b/drivers/net/wireless/orinoco/hw.h
index 27b427649d1b..8df6e8752be6 100644
--- a/drivers/net/wireless/orinoco/hw.h
+++ b/drivers/net/wireless/orinoco/hw.h
@@ -38,7 +38,8 @@ int __orinoco_hw_set_wap(struct orinoco_private *priv);
 int __orinoco_hw_setup_wepkeys(struct orinoco_private *priv);
 int __orinoco_hw_setup_enc(struct orinoco_private *priv);
 int __orinoco_hw_set_tkip_key(struct orinoco_private *priv, int key_idx,
-                              int set_tx, u8 *key, u8 *rsc, u8 *tsc);
+                              int set_tx, u8 *key, u8 *rsc, size_t rsc_len,
+                              u8 *tsc, size_t tsc_len);
 int orinoco_clear_tkip_key(struct orinoco_private *priv, int key_idx);
 int __orinoco_hw_set_multicast_list(struct orinoco_private *priv,
                                     struct dev_addr_list *mc_list,
@@ -50,5 +51,9 @@ int orinoco_hw_get_bitratelist(struct orinoco_private *priv,
                                int *numrates, s32 *rates, int max);
 int orinoco_hw_trigger_scan(struct orinoco_private *priv,
                             const struct cfg80211_ssid *ssid);
+int orinoco_hw_disassociate(struct orinoco_private *priv,
+                            u8 *addr, u16 reason_code);
+int orinoco_hw_get_current_bssid(struct orinoco_private *priv,
+                                 u8 *addr);
 
 #endif /* _ORINOCO_HW_H_ */
diff --git a/drivers/net/wireless/orinoco/main.c b/drivers/net/wireless/orinoco/main.c
index e8c550a61f33..2c7dc65cd2be 100644
--- a/drivers/net/wireless/orinoco/main.c
+++ b/drivers/net/wireless/orinoco/main.c
@@ -341,12 +341,14 @@ static int orinoco_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct orinoco_private *priv = ndev_priv(dev);
         struct net_device_stats *stats = &priv->stats;
+        struct orinoco_tkip_key *key;
         hermes_t *hw = &priv->hw;
         int err = 0;
         u16 txfid = priv->txfid;
         struct ethhdr *eh;
         int tx_control;
         unsigned long flags;
+        int do_mic;
 
         if (!netif_running(dev)) {
                 printk(KERN_ERR "%s: Tx on stopped device!\n",
@@ -378,9 +380,14 @@ static int orinoco_xmit(struct sk_buff *skb, struct net_device *dev)
         if (skb->len < ETH_HLEN)
                 goto drop;
 
+        key = (struct orinoco_tkip_key *) priv->keys[priv->tx_key].key;
+
+        do_mic = ((priv->encode_alg == ORINOCO_ALG_TKIP) &&
+                  (key != NULL));
+
         tx_control = HERMES_TXCTRL_TX_OK | HERMES_TXCTRL_TX_EX;
 
-        if (priv->encode_alg == IW_ENCODE_ALG_TKIP)
+        if (do_mic)
                 tx_control |= (priv->tx_key << HERMES_MIC_KEY_ID_SHIFT) |
                         HERMES_TXCTRL_MIC;
 
@@ -462,7 +469,7 @@ static int orinoco_xmit(struct sk_buff *skb, struct net_device *dev)
         }
 
         /* Calculate Michael MIC */
-        if (priv->encode_alg == IW_ENCODE_ALG_TKIP) {
+        if (do_mic) {
                 u8 mic_buf[MICHAEL_MIC_LEN + 1];
                 u8 *mic;
                 size_t offset;
@@ -480,8 +487,7 @@ static int orinoco_xmit(struct sk_buff *skb, struct net_device *dev)
                         len = MICHAEL_MIC_LEN;
                 }
 
-                orinoco_mic(priv->tx_tfm_mic,
-                            priv->tkip_key[priv->tx_key].tx_mic,
+                orinoco_mic(priv->tx_tfm_mic, key->tx_mic,
                             eh->h_dest, eh->h_source, 0 /* priority */,
                             skb->data + ETH_HLEN, skb->len - ETH_HLEN, mic);
 
@@ -926,6 +932,7 @@ static void orinoco_rx(struct net_device *dev,
 
         /* Calculate and check MIC */
         if (status & HERMES_RXSTAT_MIC) {
+                struct orinoco_tkip_key *key;
                 int key_id = ((status & HERMES_RXSTAT_MIC_KEY_ID) >>
                               HERMES_MIC_KEY_ID_SHIFT);
                 u8 mic[MICHAEL_MIC_LEN];
@@ -939,14 +946,18 @@ static void orinoco_rx(struct net_device *dev,
                 skb_trim(skb, skb->len - MICHAEL_MIC_LEN);
                 length -= MICHAEL_MIC_LEN;
 
-                orinoco_mic(priv->rx_tfm_mic,
-                            priv->tkip_key[key_id].rx_mic,
-                            desc->addr1,
-                            src,
+                key = (struct orinoco_tkip_key *) priv->keys[key_id].key;
+
+                if (!key) {
+                        printk(KERN_WARNING "%s: Received encrypted frame from "
+                               "%pM using key %i, but key is not installed\n",
+                               dev->name, src, key_id);
+                        goto drop;
+                }
+
+                orinoco_mic(priv->rx_tfm_mic, key->rx_mic, desc->addr1, src,
                             0, /* priority or QoS? */
-                            skb->data,
-                            skb->len,
-                            &mic[0]);
+                            skb->data, skb->len, &mic[0]);
 
                 if (memcmp(mic, rxmic,
                            MICHAEL_MIC_LEN)) {
@@ -2040,7 +2051,7 @@ int orinoco_init(struct orinoco_private *priv)
         priv->channel = 0; /* use firmware default */
 
         priv->promiscuous = 0;
-        priv->encode_alg = IW_ENCODE_ALG_NONE;
+        priv->encode_alg = ORINOCO_ALG_NONE;
         priv->tx_key = 0;
         priv->wpa_enabled = 0;
         priv->tkip_cm_active = 0;
diff --git a/drivers/net/wireless/orinoco/orinoco.h b/drivers/net/wireless/orinoco/orinoco.h
index 5f4f5c9eef79..9ac6f1dda4b0 100644
--- a/drivers/net/wireless/orinoco/orinoco.h
+++ b/drivers/net/wireless/orinoco/orinoco.h
@@ -25,6 +25,7 @@
 
 #define MAX_SCAN_LEN            4096
 
+#define ORINOCO_SEQ_LEN         8
 #define ORINOCO_MAX_KEY_SIZE    14
 #define ORINOCO_MAX_KEYS        4
 
@@ -42,6 +43,12 @@ struct orinoco_tkip_key {
         u8 rx_mic[MIC_KEYLEN];
 };
 
+enum orinoco_alg {
+        ORINOCO_ALG_NONE,
+        ORINOCO_ALG_WEP,
+        ORINOCO_ALG_TKIP
+};
+
 typedef enum {
         FIRMWARE_TYPE_AGERE,
         FIRMWARE_TYPE_INTERSIL,
@@ -107,12 +114,14 @@ struct orinoco_private {
         unsigned int do_fw_download:1;
         unsigned int broken_disableport:1;
         unsigned int broken_monitor:1;
+        unsigned int prefer_port3:1;
 
         /* Configuration paramaters */
         enum nl80211_iftype iw_mode;
-        int prefer_port3;
-        u16 encode_alg, wep_restrict, tx_key;
-        struct orinoco_key keys[ORINOCO_MAX_KEYS];
+        enum orinoco_alg encode_alg;
+        u16 wep_restrict, tx_key;
+        struct key_params keys[ORINOCO_MAX_KEYS];
+
         int bitratemode;
         char nick[IW_ESSID_MAX_SIZE+1];
         char desired_essid[IW_ESSID_MAX_SIZE+1];
@@ -142,7 +151,6 @@ struct orinoco_private {
         u8 *wpa_ie;
         int wpa_ie_len;
 
-        struct orinoco_tkip_key tkip_key[ORINOCO_MAX_KEYS];
         struct crypto_hash *rx_tfm_mic;
         struct crypto_hash *tx_tfm_mic;
 
diff --git a/drivers/net/wireless/orinoco/wext.c b/drivers/net/wireless/orinoco/wext.c
index b6ff3dbb7dd6..3e56f7643df5 100644
--- a/drivers/net/wireless/orinoco/wext.c
+++ b/drivers/net/wireless/orinoco/wext.c
@@ -22,6 +22,67 @@
 
 #define MAX_RID_LEN 1024
 
+/* Helper routine to record keys
+ * Do not call from interrupt context */
+static int orinoco_set_key(struct orinoco_private *priv, int index,
+                           enum orinoco_alg alg, const u8 *key, int key_len,
+                           const u8 *seq, int seq_len)
+{
+        kzfree(priv->keys[index].key);
+        kzfree(priv->keys[index].seq);
+
+        if (key_len) {
+                priv->keys[index].key = kzalloc(key_len, GFP_KERNEL);
+                if (!priv->keys[index].key)
+                        goto nomem;
+        } else
+                priv->keys[index].key = NULL;
+
+        if (seq_len) {
+                priv->keys[index].seq = kzalloc(seq_len, GFP_KERNEL);
+                if (!priv->keys[index].seq)
+                        goto free_key;
+        } else
+                priv->keys[index].seq = NULL;
+
+        priv->keys[index].key_len = key_len;
+        priv->keys[index].seq_len = seq_len;
+
+        if (key_len)
+                memcpy(priv->keys[index].key, key, key_len);
+        if (seq_len)
+                memcpy(priv->keys[index].seq, seq, seq_len);
+
+        switch (alg) {
+        case ORINOCO_ALG_TKIP:
+                priv->keys[index].cipher = WLAN_CIPHER_SUITE_TKIP;
+                break;
+
+        case ORINOCO_ALG_WEP:
+                priv->keys[index].cipher = (key_len > SMALL_KEY_SIZE) ?
+                        WLAN_CIPHER_SUITE_WEP104 : WLAN_CIPHER_SUITE_WEP40;
+                break;
+
+        case ORINOCO_ALG_NONE:
+        default:
+                priv->keys[index].cipher = 0;
+                break;
+        }
+
+        return 0;
+
+free_key:
+        kfree(priv->keys[index].key);
+        priv->keys[index].key = NULL;
+
+nomem:
+        priv->keys[index].key_len = 0;
+        priv->keys[index].seq_len = 0;
+        priv->keys[index].cipher = 0;
+
+        return -ENOMEM;
+}
+
 static struct iw_statistics *orinoco_get_wireless_stats(struct net_device *dev)
 {
         struct orinoco_private *priv = ndev_priv(dev);
@@ -156,7 +217,6 @@ static int orinoco_ioctl_getwap(struct net_device *dev,
 {
         struct orinoco_private *priv = ndev_priv(dev);
 
-        hermes_t *hw = &priv->hw;
         int err = 0;
         unsigned long flags;
 
@@ -164,8 +224,7 @@ static int orinoco_ioctl_getwap(struct net_device *dev,
                 return -EBUSY;
 
         ap_addr->sa_family = ARPHRD_ETHER;
-        err = hermes_read_ltv(hw, USER_BAP, HERMES_RID_CURRENTBSSID,
-                              ETH_ALEN, NULL, ap_addr->sa_data);
+        err = orinoco_hw_get_current_bssid(priv, ap_addr->sa_data);
 
         orinoco_unlock(priv, &flags);
 
@@ -180,9 +239,8 @@ static int orinoco_ioctl_setiwencode(struct net_device *dev,
         struct orinoco_private *priv = ndev_priv(dev);
         int index = (erq->flags & IW_ENCODE_INDEX) - 1;
         int setindex = priv->tx_key;
-        int encode_alg = priv->encode_alg;
+        enum orinoco_alg encode_alg = priv->encode_alg;
         int restricted = priv->wep_restrict;
-        u16 xlen = 0;
         int err = -EINPROGRESS;         /* Call commit handler */
         unsigned long flags;
 
@@ -202,25 +260,17 @@ static int orinoco_ioctl_setiwencode(struct net_device *dev,
                 return -EBUSY;
 
         /* Clear any TKIP key we have */
-        if ((priv->has_wpa) && (priv->encode_alg == IW_ENCODE_ALG_TKIP))
+        if ((priv->has_wpa) && (priv->encode_alg == ORINOCO_ALG_TKIP))
                 (void) orinoco_clear_tkip_key(priv, setindex);
 
         if (erq->length > 0) {
                 if ((index < 0) || (index >= ORINOCO_MAX_KEYS))
                         index = priv->tx_key;
 
-                /* Adjust key length to a supported value */
-                if (erq->length > SMALL_KEY_SIZE)
-                        xlen = LARGE_KEY_SIZE;
-                else if (erq->length > 0)
-                        xlen = SMALL_KEY_SIZE;
-                else
-                        xlen = 0;
-
                 /* Switch on WEP if off */
-                if ((encode_alg != IW_ENCODE_ALG_WEP) && (xlen > 0)) {
+                if (encode_alg != ORINOCO_ALG_WEP) {
                         setindex = index;
-                        encode_alg = IW_ENCODE_ALG_WEP;
+                        encode_alg = ORINOCO_ALG_WEP;
                 }
         } else {
                 /* Important note : if the user do "iwconfig eth0 enc off",
@@ -233,7 +283,7 @@ static int orinoco_ioctl_setiwencode(struct net_device *dev,
                         }
                 } else {
                         /* Set the index : Check that the key is valid */
-                        if (priv->keys[index].len == 0) {
+                        if (priv->keys[index].key_len == 0) {
                                 err = -EINVAL;
                                 goto out;
                         }
@@ -242,17 +292,15 @@ static int orinoco_ioctl_setiwencode(struct net_device *dev,
         }
 
         if (erq->flags & IW_ENCODE_DISABLED)
-                encode_alg = IW_ENCODE_ALG_NONE;
+                encode_alg = ORINOCO_ALG_NONE;
         if (erq->flags & IW_ENCODE_OPEN)
                 restricted = 0;
         if (erq->flags & IW_ENCODE_RESTRICTED)
                 restricted = 1;
 
         if (erq->pointer && erq->length > 0) {
-                priv->keys[index].len = cpu_to_le16(xlen);
-                memset(priv->keys[index].data, 0,
-                       sizeof(priv->keys[index].data));
-                memcpy(priv->keys[index].data, keybuf, erq->length);
+                err = orinoco_set_key(priv, index, ORINOCO_ALG_WEP, keybuf,
+                                      erq->length, NULL, 0);
         }
         priv->tx_key = setindex;
 
@@ -281,7 +329,6 @@ static int orinoco_ioctl_getiwencode(struct net_device *dev,
 {
         struct orinoco_private *priv = ndev_priv(dev);
         int index = (erq->flags & IW_ENCODE_INDEX) - 1;
-        u16 xlen = 0;
         unsigned long flags;
 
         if (!priv->has_wep)
@@ -303,11 +350,9 @@ static int orinoco_ioctl_getiwencode(struct net_device *dev,
         else
                 erq->flags |= IW_ENCODE_OPEN;
 
-        xlen = le16_to_cpu(priv->keys[index].len);
+        erq->length = priv->keys[index].key_len;
 
-        erq->length = xlen;
-
-        memcpy(keybuf, priv->keys[index].data, ORINOCO_MAX_KEY_SIZE);
+        memcpy(keybuf, priv->keys[index].key, erq->length);
 
         orinoco_unlock(priv, &flags);
         return 0;
@@ -793,7 +838,6 @@ static int orinoco_ioctl_set_encodeext(struct net_device *dev,
         int idx, alg = ext->alg, set_key = 1;
         unsigned long flags;
         int err = -EINVAL;
-        u16 key_len;
 
         if (orinoco_lock(priv, &flags) != 0)
                 return -EBUSY;
@@ -825,25 +869,18 @@ static int orinoco_ioctl_set_encodeext(struct net_device *dev,
                 /* Set the requested key first */
                 switch (alg) {
                 case IW_ENCODE_ALG_NONE:
-                        priv->encode_alg = alg;
-                        priv->keys[idx].len = 0;
+                        priv->encode_alg = ORINOCO_ALG_NONE;
+                        err = orinoco_set_key(priv, idx, ORINOCO_ALG_NONE,
+                                              NULL, 0, NULL, 0);
                         break;
 
                 case IW_ENCODE_ALG_WEP:
-                        if (ext->key_len > SMALL_KEY_SIZE)
-                                key_len = LARGE_KEY_SIZE;
-                        else if (ext->key_len > 0)
-                                key_len = SMALL_KEY_SIZE;
-                        else
+                        if (ext->key_len <= 0)
                                 goto out;
 
-                        priv->encode_alg = alg;
-                        priv->keys[idx].len = cpu_to_le16(key_len);
-
-                        key_len = min(ext->key_len, key_len);
-
-                        memset(priv->keys[idx].data, 0, ORINOCO_MAX_KEY_SIZE);
-                        memcpy(priv->keys[idx].data, ext->key, key_len);
+                        priv->encode_alg = ORINOCO_ALG_WEP;
+                        err = orinoco_set_key(priv, idx, ORINOCO_ALG_WEP,
+                                              ext->key, ext->key_len, NULL, 0);
                         break;
 
                 case IW_ENCODE_ALG_TKIP:
@@ -851,21 +888,22 @@ static int orinoco_ioctl_set_encodeext(struct net_device *dev,
                         u8 *tkip_iv = NULL;
 
                         if (!priv->has_wpa ||
-                            (ext->key_len > sizeof(priv->tkip_key[0])))
+                            (ext->key_len > sizeof(struct orinoco_tkip_key)))
                                 goto out;
 
-                        priv->encode_alg = alg;
-                        memset(&priv->tkip_key[idx], 0,
-                               sizeof(priv->tkip_key[idx]));
-                        memcpy(&priv->tkip_key[idx], ext->key, ext->key_len);
+                        priv->encode_alg = ORINOCO_ALG_TKIP;
 
                         if (ext->ext_flags & IW_ENCODE_EXT_RX_SEQ_VALID)
                                 tkip_iv = &ext->rx_seq[0];
 
+                        err = orinoco_set_key(priv, idx, ORINOCO_ALG_TKIP,
+                                              ext->key, ext->key_len, tkip_iv,
+                                              ORINOCO_SEQ_LEN);
+
                         err = __orinoco_hw_set_tkip_key(priv, idx,
                                  ext->ext_flags & IW_ENCODE_EXT_SET_TX_KEY,
-                                 (u8 *) &priv->tkip_key[idx],
-                                 tkip_iv, NULL);
+                                 priv->keys[idx].key,
+                                 tkip_iv, ORINOCO_SEQ_LEN, NULL, 0);
                         if (err)
                                 printk(KERN_ERR "%s: Error %d setting TKIP key"
                                        "\n", dev->name, err);
@@ -914,22 +952,22 @@ static int orinoco_ioctl_get_encodeext(struct net_device *dev,
         encoding->flags = idx + 1;
         memset(ext, 0, sizeof(*ext));
 
-        ext->alg = priv->encode_alg;
         switch (priv->encode_alg) {
-        case IW_ENCODE_ALG_NONE:
+        case ORINOCO_ALG_NONE:
+                ext->alg = IW_ENCODE_ALG_NONE;
                 ext->key_len = 0;
                 encoding->flags |= IW_ENCODE_DISABLED;
                 break;
-        case IW_ENCODE_ALG_WEP:
-                ext->key_len = min_t(u16, le16_to_cpu(priv->keys[idx].len),
-                                     max_key_len);
-                memcpy(ext->key, priv->keys[idx].data, ext->key_len);
+        case ORINOCO_ALG_WEP:
+                ext->alg = IW_ENCODE_ALG_WEP;
+                ext->key_len = min(priv->keys[idx].key_len, max_key_len);
+                memcpy(ext->key, priv->keys[idx].key, ext->key_len);
                 encoding->flags |= IW_ENCODE_ENABLED;
                 break;
-        case IW_ENCODE_ALG_TKIP:
-                ext->key_len = min_t(u16, sizeof(struct orinoco_tkip_key),
-                                     max_key_len);
-                memcpy(ext->key, &priv->tkip_key[idx], ext->key_len);
+        case ORINOCO_ALG_TKIP:
+                ext->alg = IW_ENCODE_ALG_TKIP;
+                ext->key_len = min(priv->keys[idx].key_len, max_key_len);
+                memcpy(ext->key, priv->keys[idx].key, ext->key_len);
                 encoding->flags |= IW_ENCODE_ENABLED;
                 break;
         }
@@ -1136,7 +1174,6 @@ static int orinoco_ioctl_set_mlme(struct net_device *dev,
                                   union iwreq_data *wrqu, char *extra)
 {
         struct orinoco_private *priv = ndev_priv(dev);
-        hermes_t *hw = &priv->hw;
         struct iw_mlme *mlme = (struct iw_mlme *)extra;
         unsigned long flags;
         int ret = 0;
@@ -1150,19 +1187,11 @@ static int orinoco_ioctl_set_mlme(struct net_device *dev,
                 break;
 
         case IW_MLME_DISASSOC:
-        {
-                struct {
-                        u8 addr[ETH_ALEN];
-                        __le16 reason_code;
-                } __attribute__ ((packed)) buf;
-
-                memcpy(buf.addr, mlme->addr.sa_data, ETH_ALEN);
-                buf.reason_code = cpu_to_le16(mlme->reason_code);
-                ret = HERMES_WRITE_RECORD(hw, USER_BAP,
-                                          HERMES_RID_CNFDISASSOCIATE,
-                                          &buf);
+
+                ret = orinoco_hw_disassociate(priv, mlme->addr.sa_data,
+                                              mlme->reason_code);
                 break;
-        }
+
         default:
                 ret = -EOPNOTSUPP;
         }
diff --git a/drivers/net/wireless/p54/fwio.c b/drivers/net/wireless/p54/fwio.c
index 21f19018fab5..e7b9e9cb39f5 100644
--- a/drivers/net/wireless/p54/fwio.c
+++ b/drivers/net/wireless/p54/fwio.c
@@ -320,7 +320,7 @@ int p54_setup_mac(struct p54_common *priv)
                 return -ENOMEM;
 
         setup = (struct p54_setup_mac *) skb_put(skb, sizeof(*setup));
-        if (priv->hw->conf.radio_enabled) {
+        if (!(priv->hw->conf.flags & IEEE80211_CONF_IDLE)) {
                 switch (priv->mode) {
                 case NL80211_IFTYPE_STATION:
                         mode = P54_FILTER_TYPE_STATION;
@@ -348,8 +348,9 @@ int p54_setup_mac(struct p54_common *priv)
                      (priv->filter_flags & FIF_OTHER_BSS)) &&
                     (mode != P54_FILTER_TYPE_PROMISCUOUS))
                         mode |= P54_FILTER_TYPE_TRANSPARENT;
-        } else
+        } else {
                 mode = P54_FILTER_TYPE_HIBERNATE;
+        }
 
         setup->mac_mode = cpu_to_le16(mode);
         memcpy(setup->mac_addr, priv->mac_addr, ETH_ALEN);
diff --git a/drivers/net/wireless/p54/main.c b/drivers/net/wireless/p54/main.c
index a0d0e726bc4e..4a741df9c081 100644
--- a/drivers/net/wireless/p54/main.c
+++ b/drivers/net/wireless/p54/main.c
@@ -288,6 +288,11 @@ static int p54_config(struct ieee80211_hw *dev, u32 changed)
                 if (ret)
                         goto out;
         }
+        if (changed & IEEE80211_CONF_CHANGE_IDLE) {
+                ret = p54_setup_mac(priv);
+                if (ret)
+                        goto out;
+        }
 
 out:
         mutex_unlock(&priv->conf_mutex);
@@ -317,7 +322,7 @@ static int p54_conf_tx(struct ieee80211_hw *dev, u16 queue,
         int ret;
 
         mutex_lock(&priv->conf_mutex);
-        if ((params) && !(queue > 4)) {
+        if (queue < dev->queues) {
                 P54_SET_QUEUE(priv->qos_params[queue], params->aifs,
                         params->cw_min, params->cw_max, params->txop);
                 ret = p54_set_edcf(priv);
diff --git a/drivers/net/wireless/p54/txrx.c b/drivers/net/wireless/p54/txrx.c
index 704685fab177..6fc0b6148c8a 100644
--- a/drivers/net/wireless/p54/txrx.c
+++ b/drivers/net/wireless/p54/txrx.c
@@ -552,6 +552,12 @@ static void p54_rx_trap(struct p54_common *priv, struct sk_buff *skb)
                 break;
         case P54_TRAP_TIMER:
                 break;
+        case P54_TRAP_FAA_RADIO_OFF:
+                wiphy_rfkill_set_hw_state(priv->hw->wiphy, true);
+                break;
+        case P54_TRAP_FAA_RADIO_ON:
+                wiphy_rfkill_set_hw_state(priv->hw->wiphy, false);
+                break;
         default:
                 printk(KERN_INFO "%s: received event:%x freq:%d\n",
                        wiphy_name(priv->hw->wiphy), event, freq);
diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
index 828dc1825bba..d42692dfbc67 100644
--- a/drivers/net/wireless/rndis_wlan.c
+++ b/drivers/net/wireless/rndis_wlan.c
@@ -1764,8 +1764,15 @@ static int rndis_iw_set_essid(struct net_device *dev,
 
         if (!wrqu->essid.flags || length == 0)
                 return disassociate(usbdev, 1);
-        else
+        else {
+                /* Pause and purge rx queue, so we don't pass packets before
+                 * 'media connect'-indication.
+                 */
+                usbnet_pause_rx(usbdev);
+                usbnet_purge_paused_rxq(usbdev);
+
                 return set_essid(usbdev, &ssid);
+        }
 }
 
 
@@ -2328,6 +2335,8 @@ get_bssid:
                         memcpy(evt.ap_addr.sa_data, bssid, ETH_ALEN);
                         wireless_send_event(usbdev->net, SIOCGIWAP, &evt, NULL);
                 }
+
+                usbnet_resume_rx(usbdev);
         }
 
         if (test_and_clear_bit(WORK_LINK_DOWN, &priv->work_pending)) {
@@ -2541,6 +2550,8 @@ static void rndis_wlan_indication(struct usbnet *usbdev, void *ind, int buflen)
 
         switch (msg->status) {
         case RNDIS_STATUS_MEDIA_CONNECT:
+                usbnet_pause_rx(usbdev);
+
                 devinfo(usbdev, "media connect");
 
                 /* queue work to avoid recursive calls into rndis_command */
diff --git a/drivers/net/wireless/rt2x00/rt2400pci.c b/drivers/net/wireless/rt2x00/rt2400pci.c
index 30185ad28d93..164df9347a2f 100644
--- a/drivers/net/wireless/rt2x00/rt2400pci.c
+++ b/drivers/net/wireless/rt2x00/rt2400pci.c
@@ -1069,8 +1069,6 @@ static void rt2400pci_write_beacon(struct queue_entry *entry)
          * otherwise we might be sending out invalid data.
          */
         rt2x00pci_register_read(rt2x00dev, CSR14, &reg);
-        rt2x00_set_field32(&reg, CSR14_TSF_COUNT, 0);
-        rt2x00_set_field32(&reg, CSR14_TBCN, 0);
         rt2x00_set_field32(&reg, CSR14_BEACON_GEN, 0);
         rt2x00pci_register_write(rt2x00dev, CSR14, reg);
 
diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c
index 3b3171578b14..4186582f2770 100644
--- a/drivers/net/wireless/rt2x00/rt2500pci.c
+++ b/drivers/net/wireless/rt2x00/rt2500pci.c
@@ -1227,8 +1227,6 @@ static void rt2500pci_write_beacon(struct queue_entry *entry)
          * otherwise we might be sending out invalid data.
          */
         rt2x00pci_register_read(rt2x00dev, CSR14, &reg);
-        rt2x00_set_field32(&reg, CSR14_TSF_COUNT, 0);
-        rt2x00_set_field32(&reg, CSR14_TBCN, 0);
         rt2x00_set_field32(&reg, CSR14_BEACON_GEN, 0);
         rt2x00pci_register_write(rt2x00dev, CSR14, reg);
 
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c
index de48c5c68eff..09a589432dab 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -1238,8 +1238,6 @@ static void rt2500usb_write_beacon(struct queue_entry *entry)
          * otherwise we might be sending out invalid data.
          */
         rt2500usb_register_read(rt2x00dev, TXRX_CSR19, &reg);
-        rt2x00_set_field16(&reg, TXRX_CSR19_TSF_COUNT, 0);
-        rt2x00_set_field16(&reg, TXRX_CSR19_TBCN, 0);
         rt2x00_set_field16(&reg, TXRX_CSR19_BEACON_GEN, 0);
         rt2500usb_register_write(rt2x00dev, TXRX_CSR19, reg);
 
@@ -1287,7 +1285,7 @@ static int rt2500usb_get_tx_data_len(struct queue_entry *entry)
 static void rt2500usb_kick_tx_queue(struct rt2x00_dev *rt2x00dev,
                                     const enum data_queue_qid queue)
 {
-        u16 reg;
+        u16 reg, reg0;
 
         if (queue != QID_BEACON) {
                 rt2x00usb_kick_tx_queue(rt2x00dev, queue);
@@ -1298,16 +1296,19 @@ static void rt2500usb_kick_tx_queue(struct rt2x00_dev *rt2x00dev,
         if (!rt2x00_get_field16(reg, TXRX_CSR19_BEACON_GEN)) {
                 rt2x00_set_field16(&reg, TXRX_CSR19_TSF_COUNT, 1);
                 rt2x00_set_field16(&reg, TXRX_CSR19_TBCN, 1);
+                reg0 = reg;
                 rt2x00_set_field16(&reg, TXRX_CSR19_BEACON_GEN, 1);
                 /*
                  * Beacon generation will fail initially.
-                 * To prevent this we need to register the TXRX_CSR19
-                 * register several times.
+                 * To prevent this we need to change the TXRX_CSR19
+                 * register several times (reg0 is the same as reg
+                 * except for TXRX_CSR19_BEACON_GEN, which is 0 in reg0
+                 * and 1 in reg).
                  */
                 rt2500usb_register_write(rt2x00dev, TXRX_CSR19, reg);
-                rt2500usb_register_write(rt2x00dev, TXRX_CSR19, 0);
+                rt2500usb_register_write(rt2x00dev, TXRX_CSR19, reg0);
                 rt2500usb_register_write(rt2x00dev, TXRX_CSR19, reg);
-                rt2500usb_register_write(rt2x00dev, TXRX_CSR19, 0);
+                rt2500usb_register_write(rt2x00dev, TXRX_CSR19, reg0);
                 rt2500usb_register_write(rt2x00dev, TXRX_CSR19, reg);
         }
 }
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index 9efb41710508..3856f06fdca7 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -518,7 +518,7 @@ static void rt2800usb_config_filter(struct rt2x00_dev *rt2x00dev,
         rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_RTS,
                            !(filter_flags & FIF_CONTROL));
         rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_PSPOLL,
-                           !(filter_flags & FIF_CONTROL));
+                           !(filter_flags & FIF_PSPOLL));
         rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_BA, 1);
         rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_BAR, 0);
         rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_CNTL,
@@ -2050,8 +2050,6 @@ static void rt2800usb_write_beacon(struct queue_entry *entry)
          * otherwise we might be sending out invalid data.
          */
         rt2x00usb_register_read(rt2x00dev, BCN_TIME_CFG, &reg);
-        rt2x00_set_field32(&reg, BCN_TIME_CFG_TSF_TICKING, 0);
-        rt2x00_set_field32(&reg, BCN_TIME_CFG_TBTT_ENABLE, 0);
         rt2x00_set_field32(&reg, BCN_TIME_CFG_BEACON_GEN, 0);
         rt2x00usb_register_write(rt2x00dev, BCN_TIME_CFG, reg);
 
@@ -2624,6 +2622,13 @@ static int rt2800usb_probe_hw(struct rt2x00_dev *rt2x00dev)
                 return retval;
 
         /*
+         * This device has multiple filters for control frames
+         * and has a separate filter for PS Poll frames.
+         */
+        __set_bit(DRIVER_SUPPORT_CONTROL_FILTERS, &rt2x00dev->flags);
+        __set_bit(DRIVER_SUPPORT_CONTROL_FILTER_PSPOLL, &rt2x00dev->flags);
+
+        /*
          * This device requires firmware.
          */
         __set_bit(DRIVER_REQUIRE_FIRMWARE, &rt2x00dev->flags);
diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
index cbec91ef6f76..5bc100db28d4 100644
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -134,6 +134,17 @@
                                   GET_DURATION(IEEE80211_HEADER + ACK_SIZE, 10) )
 
 /*
+ * Structure for average calculation
+ * The avg field contains the actual average value,
+ * but avg_weight is internally used during calculations
+ * to prevent rounding errors.
+ */
+struct avg_val {
+        int avg;
+        int avg_weight;
+};
+
+/*
  * Chipset identification
  * The chipset on the device is composed of a RT and RF chip.
  * The chipset combination is important for determining device capabilities.
@@ -245,21 +256,18 @@ struct link_ant {
         struct antenna_setup active;
 
         /*
-         * RSSI information for the different antennas.
-         * These statistics are used to determine when
-         * to switch antenna when using software diversity.
-         *
-         *        rssi[0] -> Antenna A RSSI
-         *        rssi[1] -> Antenna B RSSI
+         * RSSI history information for the antenna.
+         * Used to determine when to switch antenna
+         * when using software diversity.
          */
-        int rssi_history[2];
+        int rssi_history;
 
         /*
          * Current RSSI average of the currently active antenna.
          * Similar to the avg_rssi in the link_qual structure
          * this value is updated by using the walking average.
          */
-        int rssi_ant;
+        struct avg_val rssi_ant;
 };
 
 /*
@@ -288,7 +296,7 @@ struct link {
         /*
          * Currently active average RSSI value
          */
-        int avg_rssi;
+        struct avg_val avg_rssi;
 
         /*
          * Currently precalculated percentages of successful
@@ -326,6 +334,11 @@ struct rt2x00_intf {
         u8 bssid[ETH_ALEN];
 
         /*
+         * beacon->skb must be protected with the mutex.
+         */
+        struct mutex beacon_skb_mutex;
+
+        /*
          * Entry in the beacon queue which belongs to
          * this interface. Each interface has its own
          * dedicated beacon entry.
@@ -611,6 +624,8 @@ enum rt2x00_flags {
          */
         CONFIG_SUPPORT_HW_BUTTON,
         CONFIG_SUPPORT_HW_CRYPTO,
+        DRIVER_SUPPORT_CONTROL_FILTERS,
+        DRIVER_SUPPORT_CONTROL_FILTER_PSPOLL,
 
         /*
          * Driver configuration
diff --git a/drivers/net/wireless/rt2x00/rt2x00config.c b/drivers/net/wireless/rt2x00/rt2x00config.c
index 3845316ccd39..3501788ab498 100644
--- a/drivers/net/wireless/rt2x00/rt2x00config.c
+++ b/drivers/net/wireless/rt2x00/rt2x00config.c
@@ -124,8 +124,9 @@ enum antenna rt2x00lib_config_antenna_check(enum antenna current_ant,
 }
 
 void rt2x00lib_config_antenna(struct rt2x00_dev *rt2x00dev,
-                              struct antenna_setup ant)
+                              struct antenna_setup config)
 {
+        struct link_ant *ant = &rt2x00dev->link.ant;
         struct antenna_setup *def = &rt2x00dev->default_ant;
         struct antenna_setup *active = &rt2x00dev->link.ant.active;
 
@@ -134,14 +135,23 @@ void rt2x00lib_config_antenna(struct rt2x00_dev *rt2x00dev,
          * ANTENNA_SW_DIVERSITY state to the driver.
          * If that happens, fallback to hardware defaults,
          * or our own default.
+         * If diversity handling is active for a particular antenna,
+         * we shouldn't overwrite that antenna.
          * The calls to rt2x00lib_config_antenna_check()
          * might have caused that we restore back to the already
          * active setting. If that has happened we can quit.
          */
-        ant.rx = rt2x00lib_config_antenna_check(ant.rx, def->rx);
-        ant.tx = rt2x00lib_config_antenna_check(ant.tx, def->tx);
+        if (!(ant->flags & ANTENNA_RX_DIVERSITY))
+                config.rx = rt2x00lib_config_antenna_check(config.rx, def->rx);
+        else
+                config.rx = active->rx;
 
-        if (ant.rx == active->rx && ant.tx == active->tx)
+        if (!(ant->flags & ANTENNA_TX_DIVERSITY))
+                config.tx = rt2x00lib_config_antenna_check(config.tx, def->tx);
+        else
+                config.tx = active->tx;
+
+        if (config.rx == active->rx && config.tx == active->tx)
                 return;
 
         /*
@@ -156,11 +166,11 @@ void rt2x00lib_config_antenna(struct rt2x00_dev *rt2x00dev,
          * The latter is required since we need to recalibrate the
          * noise-sensitivity ratio for the new setup.
          */
-        rt2x00dev->ops->lib->config_ant(rt2x00dev, &ant);
+        rt2x00dev->ops->lib->config_ant(rt2x00dev, &config);
 
         rt2x00link_reset_tuner(rt2x00dev, true);
 
-        memcpy(active, &ant, sizeof(ant));
+        memcpy(active, &config, sizeof(config));
 
         if (test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags))
                 rt2x00lib_toggle_rx(rt2x00dev, STATE_RADIO_RX_ON_LINK);
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index db54fcc94c8f..b6676c6722fc 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -186,7 +186,6 @@ static void rt2x00lib_intf_scheduled(struct work_struct *work)
 static void rt2x00lib_beacondone_iter(void *data, u8 *mac,
                                       struct ieee80211_vif *vif)
 {
-        struct rt2x00_dev *rt2x00dev = data;
         struct rt2x00_intf *intf = vif_to_intf(vif);
 
         if (vif->type != NL80211_IFTYPE_AP &&
@@ -195,12 +194,6 @@ static void rt2x00lib_beacondone_iter(void *data, u8 *mac,
             vif->type != NL80211_IFTYPE_WDS)
                 return;
 
-        /*
-         * Clean up the beacon skb.
-         */
-        rt2x00queue_free_skb(rt2x00dev, intf->beacon->skb);
-        intf->beacon->skb = NULL;
-
         spin_lock(&intf->lock);
         intf->delayed_flags |= DELAYED_UPDATE_BEACON;
         spin_unlock(&intf->lock);
@@ -785,6 +778,13 @@ int rt2x00lib_start(struct rt2x00_dev *rt2x00dev)
         rt2x00dev->intf_sta_count = 0;
         rt2x00dev->intf_associated = 0;
 
+        /* Enable the radio */
+        retval = rt2x00lib_enable_radio(rt2x00dev);
+        if (retval) {
+                rt2x00queue_uninitialize(rt2x00dev);
+                return retval;
+        }
+
         set_bit(DEVICE_STATE_STARTED, &rt2x00dev->flags);
 
         return 0;
diff --git a/drivers/net/wireless/rt2x00/rt2x00link.c b/drivers/net/wireless/rt2x00/rt2x00link.c
index 917831689ccd..c64db0ba7f40 100644
--- a/drivers/net/wireless/rt2x00/rt2x00link.c
+++ b/drivers/net/wireless/rt2x00/rt2x00link.c
@@ -46,7 +46,15 @@
 #define DEFAULT_PERCENTAGE      50
 
 /*
- * Small helper macro to work with moving/walking averages.
+ * Small helper macro for percentage calculation
+ * This is a very simple macro with the only catch that it will
+ * produce a default value in case no total value was provided.
+ */
+#define PERCENTAGE(__value, __total) \
+        ( (__total) ? (((__value) * 100) / (__total)) : (DEFAULT_PERCENTAGE) )
+
+/*
+ * Helper struct and macro to work with moving/walking averages.
  * When adding a value to the average value the following calculation
  * is needed:
  *
@@ -60,18 +68,28 @@
  * for a few minutes but when the device is moved away from the AP
  * the average will not decrease fast enough to compensate.
  * The walking average compensates this and will move towards
- * the new values correctly allowing a effective link tuning.
- */
-#define MOVING_AVERAGE(__avg, __val, __samples) \
-        ( (((__avg) * ((__samples) - 1)) + (__val)) / (__samples) )
-
-/*
- * Small helper macro for percentage calculation
- * This is a very simple macro with the only catch that it will
- * produce a default value in case no total value was provided.
+ * the new values correctly allowing a effective link tuning,
+ * the speed of the average moving towards other values depends
+ * on the value for the number of samples. The higher the number
+ * of samples, the slower the average will move.
+ * We use two variables to keep track of the average value to
+ * compensate for the rounding errors. This can be a significant
+ * error (>5dBm) if the factor is too low.
  */
-#define PERCENTAGE(__value, __total) \
-        ( (__total) ? (((__value) * 100) / (__total)) : (DEFAULT_PERCENTAGE) )
+#define AVG_SAMPLES     8
+#define AVG_FACTOR      1000
+#define MOVING_AVERAGE(__avg, __val) \
+({ \
+        struct avg_val __new; \
+        __new.avg_weight = \
+            (__avg).avg_weight  ? \
+                ((((__avg).avg_weight * ((AVG_SAMPLES) - 1)) + \
+                  ((__val) * (AVG_FACTOR))) / \
+                 (AVG_SAMPLES) ) : \
+                ((__val) * (AVG_FACTOR)); \
+        __new.avg = __new.avg_weight / (AVG_FACTOR); \
+        __new; \
+})
 
 /*
  * For calculating the Signal quality we have determined
@@ -98,56 +116,41 @@ static int rt2x00link_antenna_get_link_rssi(struct rt2x00_dev *rt2x00dev)
 {
         struct link_ant *ant = &rt2x00dev->link.ant;
 
-        if (ant->rssi_ant && rt2x00dev->link.qual.rx_success)
-                return ant->rssi_ant;
+        if (ant->rssi_ant.avg && rt2x00dev->link.qual.rx_success)
+                return ant->rssi_ant.avg;
         return DEFAULT_RSSI;
 }
 
-static int rt2x00link_antenna_get_rssi_history(struct rt2x00_dev *rt2x00dev,
-                                               enum antenna antenna)
+static int rt2x00link_antenna_get_rssi_history(struct rt2x00_dev *rt2x00dev)
 {
         struct link_ant *ant = &rt2x00dev->link.ant;
 
-        if (ant->rssi_history[antenna - ANTENNA_A])
-                return ant->rssi_history[antenna - ANTENNA_A];
+        if (ant->rssi_history)
+                return ant->rssi_history;
         return DEFAULT_RSSI;
 }
-/* Small wrapper for rt2x00link_antenna_get_rssi_history() */
-#define rt2x00link_antenna_get_rssi_rx_history(__dev) \
-        rt2x00link_antenna_get_rssi_history((__dev), \
-                                            (__dev)->link.ant.active.rx)
-#define rt2x00link_antenna_get_rssi_tx_history(__dev) \
-        rt2x00link_antenna_get_rssi_history((__dev), \
-                                            (__dev)->link.ant.active.tx)
 
 static void rt2x00link_antenna_update_rssi_history(struct rt2x00_dev *rt2x00dev,
-                                                   enum antenna antenna,
                                                    int rssi)
 {
         struct link_ant *ant = &rt2x00dev->link.ant;
-        ant->rssi_history[ant->active.rx - ANTENNA_A] = rssi;
+        ant->rssi_history = rssi;
 }
-/* Small wrapper for rt2x00link_antenna_get_rssi_history() */
-#define rt2x00link_antenna_update_rssi_rx_history(__dev, __rssi) \
-        rt2x00link_antenna_update_rssi_history((__dev), \
-                                               (__dev)->link.ant.active.rx, \
-                                               (__rssi))
-#define rt2x00link_antenna_update_rssi_tx_history(__dev, __rssi) \
-        rt2x00link_antenna_update_rssi_history((__dev), \
-                                               (__dev)->link.ant.active.tx, \
-                                               (__rssi))
 
 static void rt2x00link_antenna_reset(struct rt2x00_dev *rt2x00dev)
 {
-        rt2x00dev->link.ant.rssi_ant = 0;
+        rt2x00dev->link.ant.rssi_ant.avg = 0;
+        rt2x00dev->link.ant.rssi_ant.avg_weight = 0;
 }
 
 static void rt2x00lib_antenna_diversity_sample(struct rt2x00_dev *rt2x00dev)
 {
         struct link_ant *ant = &rt2x00dev->link.ant;
         struct antenna_setup new_ant;
-        int sample_a = rt2x00link_antenna_get_rssi_history(rt2x00dev, ANTENNA_A);
-        int sample_b = rt2x00link_antenna_get_rssi_history(rt2x00dev, ANTENNA_B);
+        int other_antenna;
+
+        int sample_current = rt2x00link_antenna_get_link_rssi(rt2x00dev);
+        int sample_other = rt2x00link_antenna_get_rssi_history(rt2x00dev);
 
         memcpy(&new_ant, &ant->active, sizeof(new_ant));
 
@@ -161,17 +164,22 @@ static void rt2x00lib_antenna_diversity_sample(struct rt2x00_dev *rt2x00dev)
          * from both antennas. It now is time to determine
          * which antenna demonstrated the best performance.
          * When we are already on the antenna with the best
-         * performance, then there really is nothing for us
-         * left to do.
+         * performance, just create a good starting point
+         * for the history and we are done.
          */
-        if (sample_a == sample_b)
+        if (sample_current >= sample_other) {
+                rt2x00link_antenna_update_rssi_history(rt2x00dev,
+                        sample_current);
                 return;
+        }
+
+        other_antenna = (ant->active.rx == ANTENNA_A) ? ANTENNA_B : ANTENNA_A;
 
         if (ant->flags & ANTENNA_RX_DIVERSITY)
-                new_ant.rx = (sample_a > sample_b) ? ANTENNA_A : ANTENNA_B;
+                new_ant.rx = other_antenna;
 
         if (ant->flags & ANTENNA_TX_DIVERSITY)
-                new_ant.tx = (sample_a > sample_b) ? ANTENNA_A : ANTENNA_B;
+                new_ant.tx = other_antenna;
 
         rt2x00lib_config_antenna(rt2x00dev, new_ant);
 }
@@ -190,8 +198,8 @@ static void rt2x00lib_antenna_diversity_eval(struct rt2x00_dev *rt2x00dev)
          * after that update the history with the current value.
          */
         rssi_curr = rt2x00link_antenna_get_link_rssi(rt2x00dev);
-        rssi_old = rt2x00link_antenna_get_rssi_rx_history(rt2x00dev);
-        rt2x00link_antenna_update_rssi_rx_history(rt2x00dev, rssi_curr);
+        rssi_old = rt2x00link_antenna_get_rssi_history(rt2x00dev);
+        rt2x00link_antenna_update_rssi_history(rt2x00dev, rssi_curr);
 
         /*
          * Legacy driver indicates that we should swap antenna's
@@ -216,9 +224,10 @@ static void rt2x00lib_antenna_diversity_eval(struct rt2x00_dev *rt2x00dev)
         rt2x00lib_config_antenna(rt2x00dev, new_ant);
 }
 
-static void rt2x00lib_antenna_diversity(struct rt2x00_dev *rt2x00dev)
+static bool rt2x00lib_antenna_diversity(struct rt2x00_dev *rt2x00dev)
 {
         struct link_ant *ant = &rt2x00dev->link.ant;
+        unsigned int flags = ant->flags;
 
         /*
          * Determine if software diversity is enabled for
@@ -226,30 +235,38 @@ static void rt2x00lib_antenna_diversity(struct rt2x00_dev *rt2x00dev)
          * Always perform this check since within the link
          * tuner interval the configuration might have changed.
          */
-        ant->flags &= ~ANTENNA_RX_DIVERSITY;
-        ant->flags &= ~ANTENNA_TX_DIVERSITY;
+        flags &= ~ANTENNA_RX_DIVERSITY;
+        flags &= ~ANTENNA_TX_DIVERSITY;
 
         if (rt2x00dev->default_ant.rx == ANTENNA_SW_DIVERSITY)
-                ant->flags |= ANTENNA_RX_DIVERSITY;
+                flags |= ANTENNA_RX_DIVERSITY;
         if (rt2x00dev->default_ant.tx == ANTENNA_SW_DIVERSITY)
-                ant->flags |= ANTENNA_TX_DIVERSITY;
+                flags |= ANTENNA_TX_DIVERSITY;
 
         if (!(ant->flags & ANTENNA_RX_DIVERSITY) &&
             !(ant->flags & ANTENNA_TX_DIVERSITY)) {
                 ant->flags = 0;
-                return;
+                return true;
         }
 
+        /* Update flags */
+        ant->flags = flags;
+
         /*
          * If we have only sampled the data over the last period
          * we should now harvest the data. Otherwise just evaluate
          * the data. The latter should only be performed once
          * every 2 seconds.
          */
-        if (ant->flags & ANTENNA_MODE_SAMPLE)
+        if (ant->flags & ANTENNA_MODE_SAMPLE) {
                 rt2x00lib_antenna_diversity_sample(rt2x00dev);
-        else if (rt2x00dev->link.count & 1)
+                return true;
+        } else if (rt2x00dev->link.count & 1) {
                 rt2x00lib_antenna_diversity_eval(rt2x00dev);
+                return true;
+        }
+
+        return false;
 }
 
 void rt2x00link_update_stats(struct rt2x00_dev *rt2x00dev,
@@ -260,8 +277,6 @@ void rt2x00link_update_stats(struct rt2x00_dev *rt2x00dev,
         struct link_qual *qual = &rt2x00dev->link.qual;
         struct link_ant *ant = &rt2x00dev->link.ant;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
-        int avg_rssi = rxdesc->rssi;
-        int ant_rssi = rxdesc->rssi;
 
         /*
          * Frame was received successfully since non-succesfull
@@ -281,16 +296,12 @@ void rt2x00link_update_stats(struct rt2x00_dev *rt2x00dev,
         /*
          * Update global RSSI
          */
-        if (link->avg_rssi)
-                avg_rssi = MOVING_AVERAGE(link->avg_rssi, rxdesc->rssi, 8);
-        link->avg_rssi = avg_rssi;
+        link->avg_rssi = MOVING_AVERAGE(link->avg_rssi, rxdesc->rssi);
 
         /*
          * Update antenna RSSI
          */
-        if (ant->rssi_ant)
-                ant_rssi = MOVING_AVERAGE(ant->rssi_ant, rxdesc->rssi, 8);
-        ant->rssi_ant = ant_rssi;
+        ant->rssi_ant = MOVING_AVERAGE(ant->rssi_ant, rxdesc->rssi);
 }
 
 static void rt2x00link_precalculate_signal(struct rt2x00_dev *rt2x00dev)
@@ -423,10 +434,10 @@ static void rt2x00link_tuner(struct work_struct *work)
          * collect the RSSI data we could use this. Otherwise we
          * must fallback to the default RSSI value.
          */
-        if (!link->avg_rssi || !qual->rx_success)
+        if (!link->avg_rssi.avg || !qual->rx_success)
                 qual->rssi = DEFAULT_RSSI;
         else
-                qual->rssi = link->avg_rssi;
+                qual->rssi = link->avg_rssi.avg;
 
         /*
          * Only perform the link tuning when Link tuning
@@ -444,18 +455,15 @@ static void rt2x00link_tuner(struct work_struct *work)
         /*
          * Send a signal to the led to update the led signal strength.
          */
-        rt2x00leds_led_quality(rt2x00dev, link->avg_rssi);
-
-        /*
-         * Evaluate antenna setup, make this the last step since this could
-         * possibly reset some statistics.
-         */
-        rt2x00lib_antenna_diversity(rt2x00dev);
+        rt2x00leds_led_quality(rt2x00dev, qual->rssi);
 
         /*
-         * Reset the quality counters which recounted during each period.
+         * Evaluate antenna setup, make this the last step when
+         * rt2x00lib_antenna_diversity made changes the quality
+         * statistics will be reset.
          */
-        rt2x00link_reset_qual(rt2x00dev);
+        if (rt2x00lib_antenna_diversity(rt2x00dev))
+                rt2x00link_reset_qual(rt2x00dev);
 
         /*
          * Increase tuner counter, and reschedule the next link tuner run.
diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
index 81febdfd6639..cb7b6d459331 100644
--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
@@ -274,6 +274,7 @@ int rt2x00mac_add_interface(struct ieee80211_hw *hw,
 
         spin_lock_init(&intf->lock);
         spin_lock_init(&intf->seqlock);
+        mutex_init(&intf->beacon_skb_mutex);
         intf->beacon = entry;
 
         if (conf->type == NL80211_IFTYPE_AP)
@@ -338,7 +339,6 @@ int rt2x00mac_config(struct ieee80211_hw *hw, u32 changed)
 {
         struct rt2x00_dev *rt2x00dev = hw->priv;
         struct ieee80211_conf *conf = &hw->conf;
-        int status;
 
         /*
          * mac80211 might be calling this function while we are trying
@@ -348,44 +348,29 @@ int rt2x00mac_config(struct ieee80211_hw *hw, u32 changed)
                 return 0;
 
         /*
-         * Only change device state when the radio is enabled. It does not
-         * matter what parameters we have configured when the radio is disabled
-         * because we won't be able to send or receive anyway. Also note that
-         * some configuration parameters (e.g. channel and antenna values) can
-         * only be set when the radio is enabled.
+         * Some configuration parameters (e.g. channel and antenna values) can
+         * only be set when the radio is enabled, but do require the RX to
+         * be off.
          */
-        if (conf->radio_enabled) {
-                /* For programming the values, we have to turn RX off */
-                rt2x00lib_toggle_rx(rt2x00dev, STATE_RADIO_RX_OFF);
+        rt2x00lib_toggle_rx(rt2x00dev, STATE_RADIO_RX_OFF);
 
-                /* Enable the radio */
-                status = rt2x00lib_enable_radio(rt2x00dev);
-                if (unlikely(status))
-                        return status;
+        /*
+         * When we've just turned on the radio, we want to reprogram
+         * everything to ensure a consistent state
+         */
+        rt2x00lib_config(rt2x00dev, conf, changed);
 
-                /*
-                 * When we've just turned on the radio, we want to reprogram
-                 * everything to ensure a consistent state
-                 */
-                rt2x00lib_config(rt2x00dev, conf, changed);
+        /*
+         * After the radio has been enabled we need to configure
+         * the antenna to the default settings. rt2x00lib_config_antenna()
+         * should determine if any action should be taken based on
+         * checking if diversity has been enabled or no antenna changes
+         * have been made since the last configuration change.
+         */
+        rt2x00lib_config_antenna(rt2x00dev, rt2x00dev->default_ant);
 
-                /*
-                 * The radio was enabled, configure the antenna to the
-                 * default settings, the link tuner will later start
-                 * continue configuring the antenna based on the software
-                 * diversity. But for non-diversity configurations, we need
-                 * to have configured the correct state now.
-                 */
-                if (changed & IEEE80211_CONF_CHANGE_RADIO_ENABLED)
-                        rt2x00lib_config_antenna(rt2x00dev,
-                                                 rt2x00dev->default_ant);
-
-                /* Turn RX back on */
-                rt2x00lib_toggle_rx(rt2x00dev, STATE_RADIO_RX_ON);
-        } else {
-                /* Disable the radio */
-                rt2x00lib_disable_radio(rt2x00dev);
-        }
+        /* Turn RX back on */
+        rt2x00lib_toggle_rx(rt2x00dev, STATE_RADIO_RX_ON);
 
         return 0;
 }
@@ -407,6 +392,7 @@ void rt2x00mac_configure_filter(struct ieee80211_hw *hw,
             FIF_FCSFAIL |
             FIF_PLCPFAIL |
             FIF_CONTROL |
+            FIF_PSPOLL |
             FIF_OTHER_BSS |
             FIF_PROMISC_IN_BSS;
 
@@ -422,6 +408,22 @@ void rt2x00mac_configure_filter(struct ieee80211_hw *hw,
                 *total_flags |= FIF_PROMISC_IN_BSS | FIF_OTHER_BSS;
 
         /*
+         * If the device has a single filter for all control frames,
+         * FIF_CONTROL and FIF_PSPOLL flags imply each other.
+         * And if the device has more than one filter for control frames
+         * of different types, but has no a separate filter for PS Poll frames,
+         * FIF_CONTROL flag implies FIF_PSPOLL.
+         */
+        if (!test_bit(DRIVER_SUPPORT_CONTROL_FILTERS, &rt2x00dev->flags)) {
+                if (*total_flags & FIF_CONTROL || *total_flags & FIF_PSPOLL)
+                        *total_flags |= FIF_CONTROL | FIF_PSPOLL;
+        }
+        if (!test_bit(DRIVER_SUPPORT_CONTROL_FILTER_PSPOLL, &rt2x00dev->flags)) {
+                if (*total_flags & FIF_CONTROL)
+                        *total_flags |= FIF_PSPOLL;
+        }
+
+        /*
          * Check if there is any work left for us.
          */
         if (rt2x00dev->packet_filter == *total_flags)
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index 44e5b3279ca7..06af823efd83 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -324,7 +324,8 @@ static void rt2x00queue_create_tx_descriptor(struct queue_entry *entry,
         /*
          * Check if more fragments are pending
          */
-        if (ieee80211_has_morefrags(hdr->frame_control)) {
+        if (ieee80211_has_morefrags(hdr->frame_control) ||
+            (tx_info->flags & IEEE80211_TX_CTL_MORE_FRAMES)) {
                 __set_bit(ENTRY_TXD_BURST, &txdesc->flags);
                 __set_bit(ENTRY_TXD_MORE_FRAG, &txdesc->flags);
         }
@@ -452,9 +453,21 @@ int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb)
                         rt2x00crypto_tx_remove_iv(skb, &txdesc);
         }
 
+        /*
+         * When DMA allocation is required we should guarentee to the
+         * driver that the DMA is aligned to a 4-byte boundary.
+         * Aligning the header to this boundary can be done by calling
+         * rt2x00queue_payload_align with the header length of 0.
+         * However some drivers require L2 padding to pad the payload
+         * rather then the header. This could be a requirement for
+         * PCI and USB devices, while header alignment only is valid
+         * for PCI devices.
+         */
         if (test_bit(DRIVER_REQUIRE_L2PAD, &queue->rt2x00dev->flags))
                 rt2x00queue_payload_align(entry->skb, true,
                                           txdesc.header_length);
+        else if (test_bit(DRIVER_REQUIRE_DMA, &queue->rt2x00dev->flags))
+                rt2x00queue_payload_align(entry->skb, false, 0);
 
         /*
          * It could be possible that the queue was corrupted and this
@@ -490,14 +503,25 @@ int rt2x00queue_update_beacon(struct rt2x00_dev *rt2x00dev,
         if (unlikely(!intf->beacon))
                 return -ENOBUFS;
 
+        mutex_lock(&intf->beacon_skb_mutex);
+
+        /*
+         * Clean up the beacon skb.
+         */
+        rt2x00queue_free_skb(rt2x00dev, intf->beacon->skb);
+        intf->beacon->skb = NULL;
+
         if (!enable_beacon) {
                 rt2x00dev->ops->lib->kill_tx_queue(rt2x00dev, QID_BEACON);
+                mutex_unlock(&intf->beacon_skb_mutex);
                 return 0;
         }
 
         intf->beacon->skb = ieee80211_beacon_get(rt2x00dev->hw, vif);
-        if (!intf->beacon->skb)
+        if (!intf->beacon->skb) {
+                mutex_unlock(&intf->beacon_skb_mutex);
                 return -ENOMEM;
+        }
 
         /*
          * Copy all TX descriptor information into txdesc,
@@ -535,6 +559,8 @@ int rt2x00queue_update_beacon(struct rt2x00_dev *rt2x00dev,
         rt2x00dev->ops->lib->write_beacon(intf->beacon);
         rt2x00dev->ops->lib->kick_tx_queue(rt2x00dev, QID_BEACON);
 
+        mutex_unlock(&intf->beacon_skb_mutex);
+
         return 0;
 }
 
diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
index e20dd7431f21..f4b4b86da4da 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -530,7 +530,7 @@ static void rt61pci_config_filter(struct rt2x00_dev *rt2x00dev,
         rt2x00_set_field32(&reg, TXRX_CSR0_DROP_PHYSICAL,
                            !(filter_flags & FIF_PLCPFAIL));
         rt2x00_set_field32(&reg, TXRX_CSR0_DROP_CONTROL,
-                           !(filter_flags & FIF_CONTROL));
+                           !(filter_flags & (FIF_CONTROL | FIF_PSPOLL)));
         rt2x00_set_field32(&reg, TXRX_CSR0_DROP_NOT_TO_ME,
                            !(filter_flags & FIF_PROMISC_IN_BSS));
         rt2x00_set_field32(&reg, TXRX_CSR0_DROP_TO_DS,
@@ -1855,8 +1855,6 @@ static void rt61pci_write_beacon(struct queue_entry *entry)
          * otherwise we might be sending out invalid data.
          */
         rt2x00pci_register_read(rt2x00dev, TXRX_CSR9, &reg);
-        rt2x00_set_field32(&reg, TXRX_CSR9_TSF_TICKING, 0);
-        rt2x00_set_field32(&reg, TXRX_CSR9_TBTT_ENABLE, 0);
         rt2x00_set_field32(&reg, TXRX_CSR9_BEACON_GEN, 0);
         rt2x00pci_register_write(rt2x00dev, TXRX_CSR9, reg);
 
@@ -2624,6 +2622,12 @@ static int rt61pci_probe_hw(struct rt2x00_dev *rt2x00dev)
                 return retval;
 
         /*
+         * This device has multiple filters for control frames,
+         * but has no a separate filter for PS Poll frames.
+         */
+        __set_bit(DRIVER_SUPPORT_CONTROL_FILTERS, &rt2x00dev->flags);
+
+        /*
          * This device requires firmware and DMA mapped skbs.
          */
         __set_bit(DRIVER_REQUIRE_FIRMWARE, &rt2x00dev->flags);
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index 4f9b1772e1a1..4d94b65943f1 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -493,7 +493,7 @@ static void rt73usb_config_filter(struct rt2x00_dev *rt2x00dev,
         rt2x00_set_field32(&reg, TXRX_CSR0_DROP_PHYSICAL,
                            !(filter_flags & FIF_PLCPFAIL));
         rt2x00_set_field32(&reg, TXRX_CSR0_DROP_CONTROL,
-                           !(filter_flags & FIF_CONTROL));
+                           !(filter_flags & (FIF_CONTROL | FIF_PSPOLL)));
         rt2x00_set_field32(&reg, TXRX_CSR0_DROP_NOT_TO_ME,
                            !(filter_flags & FIF_PROMISC_IN_BSS));
         rt2x00_set_field32(&reg, TXRX_CSR0_DROP_TO_DS,
@@ -1527,8 +1527,6 @@ static void rt73usb_write_beacon(struct queue_entry *entry)
          * otherwise we might be sending out invalid data.
          */
         rt2x00usb_register_read(rt2x00dev, TXRX_CSR9, &reg);
-        rt2x00_set_field32(&reg, TXRX_CSR9_TSF_TICKING, 0);
-        rt2x00_set_field32(&reg, TXRX_CSR9_TBTT_ENABLE, 0);
         rt2x00_set_field32(&reg, TXRX_CSR9_BEACON_GEN, 0);
         rt2x00usb_register_write(rt2x00dev, TXRX_CSR9, reg);
 
@@ -2144,6 +2142,12 @@ static int rt73usb_probe_hw(struct rt2x00_dev *rt2x00dev)
                 return retval;
 
         /*
+         * This device has multiple filters for control frames,
+         * but has no a separate filter for PS Poll frames.
+         */
+        __set_bit(DRIVER_SUPPORT_CONTROL_FILTERS, &rt2x00dev->flags);
+
+        /*
          * This device requires firmware.
          */
         __set_bit(DRIVER_REQUIRE_FIRMWARE, &rt2x00dev->flags);
diff --git a/drivers/net/wireless/rtl818x/rtl818x.h b/drivers/net/wireless/rtl818x/rtl818x.h
index 34a5555cc19c..562222e6cf1f 100644
--- a/drivers/net/wireless/rtl818x/rtl818x.h
+++ b/drivers/net/wireless/rtl818x/rtl818x.h
@@ -194,8 +194,18 @@ struct rtl818x_rf_ops {
         void (*conf_erp)(struct ieee80211_hw *, struct ieee80211_bss_conf *);
 };
 
-/* Tx/Rx flags are common between RTL818X chips */
-
+/**
+ * enum rtl818x_tx_desc_flags - Tx/Rx flags are common between RTL818X chips
+ *
+ * @RTL818X_TX_DESC_FLAG_NO_ENC: Disable hardware based encryption.
+ * @RTL818X_TX_DESC_FLAG_TX_OK: TX frame was ACKed.
+ * @RTL818X_TX_DESC_FLAG_SPLCP: Use short preamble.
+ * @RTL818X_TX_DESC_FLAG_MOREFRAG: More fragments follow.
+ * @RTL818X_TX_DESC_FLAG_CTS: Use CTS-to-self protection.
+ * @RTL818X_TX_DESC_FLAG_RTS: Use RTS/CTS protection.
+ * @RTL818X_TX_DESC_FLAG_LS: Last segment of the frame.
+ * @RTL818X_TX_DESC_FLAG_FS: First segment of the frame.
+ */
 enum rtl818x_tx_desc_flags {
         RTL818X_TX_DESC_FLAG_NO_ENC     = (1 << 15),
         RTL818X_TX_DESC_FLAG_TX_OK      = (1 << 15),
diff --git a/drivers/net/wireless/wl12xx/Kconfig b/drivers/net/wireless/wl12xx/Kconfig
index 82a0f97975de..7b14d5bc63d6 100644
--- a/drivers/net/wireless/wl12xx/Kconfig
+++ b/drivers/net/wireless/wl12xx/Kconfig
@@ -7,12 +7,46 @@ menuconfig WL12XX
 
 config WL1251
         tristate "TI wl1251 support"
-        depends on WL12XX && SPI_MASTER && GENERIC_HARDIRQS
+        depends on WL12XX && GENERIC_HARDIRQS
         select FW_LOADER
         select CRC7
         ---help---
           This module adds support for wireless adapters based on
           TI wl1251 chipset.
 
-          If you choose to build a module, it'll be called wl1251. Say N if
+          If you choose to build a module, it'll be called wl1251. Say
+          N if unsure.
+
+config WL1251_SPI
+        tristate "TI wl1251 SPI support"
+        depends on WL1251 && SPI_MASTER
+        ---help---
+          This module adds support for the SPI interface of adapters using
+          TI wl1251 chipset.  Select this if your platform is using
+          the SPI bus.
+
+          If you choose to build a module, it'll be called wl1251_spi.
+          Say N if unsure.
+
+config WL1251_SDIO
+        tristate "TI wl1251 SDIO support"
+        depends on WL1251 && MMC
+        ---help---
+          This module adds support for the SDIO interface of adapters using
+          TI wl1251 chipset.  Select this if your platform is using
+          the SDIO bus.
+
+          If you choose to build a module, it'll be called
+          wl1251_sdio. Say N if unsure.
+
+config WL1271
+        tristate "TI wl1271 support"
+        depends on WL12XX && SPI_MASTER && GENERIC_HARDIRQS
+        select FW_LOADER
+        select CRC7
+        ---help---
+          This module adds support for wireless adapters based on the
+          TI wl1271 chipset.
+
+          If you choose to build a module, it'll be called wl1271. Say N if
           unsure.
diff --git a/drivers/net/wireless/wl12xx/Makefile b/drivers/net/wireless/wl12xx/Makefile
index d5595a841f5f..62e37ad01cc0 100644
--- a/drivers/net/wireless/wl12xx/Makefile
+++ b/drivers/net/wireless/wl12xx/Makefile
@@ -1,5 +1,14 @@
-wl1251-objs             = wl1251_main.o wl1251_spi.o wl1251_event.o \
+wl1251-objs             = wl1251_main.o wl1251_event.o \
                           wl1251_tx.o wl1251_rx.o wl1251_ps.o wl1251_cmd.o \
                           wl1251_acx.o wl1251_boot.o wl1251_init.o \
-                          wl1251_ops.o wl1251_debugfs.o
+                          wl1251_debugfs.o wl1251_io.o
+
 obj-$(CONFIG_WL1251)    += wl1251.o
+obj-$(CONFIG_WL1251_SPI)        += wl1251_spi.o
+obj-$(CONFIG_WL1251_SDIO)       += wl1251_sdio.o
+
+wl1271-objs             = wl1271_main.o  wl1271_spi.o wl1271_cmd.o  \
+                          wl1271_event.o wl1271_tx.o  wl1271_rx.o   \
+                          wl1271_ps.o    wl1271_acx.o wl1271_boot.o \
+                          wl1271_init.o  wl1271_debugfs.o
+obj-$(CONFIG_WL1271)    += wl1271.o
diff --git a/drivers/net/wireless/wl12xx/wl1251.h b/drivers/net/wireless/wl12xx/wl1251.h
index 665aca02bea9..998e4b6252bd 100644
--- a/drivers/net/wireless/wl12xx/wl1251.h
+++ b/drivers/net/wireless/wl12xx/wl1251.h
@@ -143,35 +143,6 @@ struct wl1251_partition_set {
 
 struct wl1251;
 
-/* FIXME: I'm not sure about this structure name */
-struct wl1251_chip {
-        u32 id;
-
-        const char *fw_filename;
-        const char *nvs_filename;
-
-        char fw_ver[21];
-
-        unsigned int power_on_sleep;
-        int intr_cmd_complete;
-        int intr_init_complete;
-
-        int (*op_upload_fw)(struct wl1251 *wl);
-        int (*op_upload_nvs)(struct wl1251 *wl);
-        int (*op_boot)(struct wl1251 *wl);
-        void (*op_set_ecpu_ctrl)(struct wl1251 *wl, u32 flag);
-        void (*op_target_enable_interrupts)(struct wl1251 *wl);
-        int (*op_hw_init)(struct wl1251 *wl);
-        int (*op_plt_init)(struct wl1251 *wl);
-        void (*op_tx_flush)(struct wl1251 *wl);
-        void (*op_fw_version)(struct wl1251 *wl);
-        int (*op_cmd_join)(struct wl1251 *wl, u8 bss_type, u8 dtim_interval,
-                            u16 beacon_interval, u8 wait);
-
-        struct wl1251_partition_set *p_table;
-        enum wl12xx_acx_int_reg *acx_reg_table;
-};
-
 struct wl1251_stats {
         struct acx_statistics *fw_stats;
         unsigned long fw_stats_update;
@@ -281,11 +252,20 @@ struct wl1251_debugfs {
         struct dentry *excessive_retries;
 };
 
+struct wl1251_if_operations {
+        void (*read)(struct wl1251 *wl, int addr, void *buf, size_t len);
+        void (*write)(struct wl1251 *wl, int addr, void *buf, size_t len);
+        void (*reset)(struct wl1251 *wl);
+        void (*enable_irq)(struct wl1251 *wl);
+        void (*disable_irq)(struct wl1251 *wl);
+};
+
 struct wl1251 {
         struct ieee80211_hw *hw;
         bool mac80211_registered;
 
-        struct spi_device *spi;
+        void *if_priv;
+        const struct wl1251_if_operations *if_ops;
 
         void (*set_power)(bool enable);
         int irq;
@@ -298,8 +278,6 @@ struct wl1251 {
         int virtual_mem_addr;
         int virtual_reg_addr;
 
-        struct wl1251_chip chip;
-
         int cmd_box_addr;
         int event_box_addr;
         struct boot_attr boot_attr;
@@ -382,6 +360,9 @@ struct wl1251 {
         /* PSM mode requested */
         bool psm_requested;
 
+        u16 beacon_int;
+        u8 dtim_period;
+
         /* in dBm */
         int power_level;
 
@@ -392,11 +373,20 @@ struct wl1251 {
         u32 buffer_cmd;
         u8 buffer_busyword[WL1251_BUSY_WORD_LEN];
         struct wl1251_rx_descriptor *rx_descriptor;
+
+        u32 chip_id;
+        char fw_ver[21];
 };
 
 int wl1251_plt_start(struct wl1251 *wl);
 int wl1251_plt_stop(struct wl1251 *wl);
 
+struct ieee80211_hw *wl1251_alloc_hw(void);
+int wl1251_free_hw(struct wl1251 *wl);
+int wl1251_init_ieee80211(struct wl1251 *wl);
+void wl1251_enable_interrupts(struct wl1251 *wl);
+void wl1251_disable_interrupts(struct wl1251 *wl);
+
 #define DEFAULT_HW_GEN_MODULATION_TYPE    CCK_LONG /* Long Preamble */
 #define DEFAULT_HW_GEN_TX_RATE          RATE_2MBPS
 #define JOIN_TIMEOUT 5000 /* 5000 milliseconds to join */
@@ -405,11 +395,10 @@ int wl1251_plt_stop(struct wl1251 *wl);
 
 #define WL1251_TX_QUEUE_MAX_LENGTH 20
 
-/* Different chips need different sleep times after power on.  WL1271 needs
- * 200ms, WL1251 needs only 10ms.  By default we use 200ms, but as soon as we
- * know the chip ID, we change the sleep value in the wl1251 chip structure,
- * so in subsequent power ons, we don't waste more time then needed.  */
-#define WL1251_DEFAULT_POWER_ON_SLEEP 200
+#define WL1251_DEFAULT_BEACON_INT 100
+#define WL1251_DEFAULT_DTIM_PERIOD 1
+
+#define WL1251_DEFAULT_CHANNEL 0
 
 #define CHIP_ID_1251_PG10                  (0x7010101)
 #define CHIP_ID_1251_PG11                  (0x7020101)
@@ -417,4 +406,19 @@ int wl1251_plt_stop(struct wl1251 *wl);
 #define CHIP_ID_1271_PG10                  (0x4030101)
 #define CHIP_ID_1271_PG20                  (0x4030111)
 
+#define WL1251_FW_NAME "wl1251-fw.bin"
+#define WL1251_NVS_NAME "wl1251-nvs.bin"
+
+#define WL1251_POWER_ON_SLEEP 10 /* in miliseconds */
+
+#define WL1251_PART_DOWN_MEM_START      0x0
+#define WL1251_PART_DOWN_MEM_SIZE       0x16800
+#define WL1251_PART_DOWN_REG_START      REGISTERS_BASE
+#define WL1251_PART_DOWN_REG_SIZE       REGISTERS_DOWN_SIZE
+
+#define WL1251_PART_WORK_MEM_START      0x28000
+#define WL1251_PART_WORK_MEM_SIZE       0x14000
+#define WL1251_PART_WORK_REG_START      REGISTERS_BASE
+#define WL1251_PART_WORK_REG_SIZE       REGISTERS_WORK_SIZE
+
 #endif
diff --git a/drivers/net/wireless/wl12xx/wl1251_acx.c b/drivers/net/wireless/wl12xx/wl1251_acx.c
index a46c92a29526..10b26c4532c9 100644
--- a/drivers/net/wireless/wl12xx/wl1251_acx.c
+++ b/drivers/net/wireless/wl12xx/wl1251_acx.c
@@ -2,11 +2,10 @@
 
 #include <linux/module.h>
 #include <linux/crc7.h>
-#include <linux/spi/spi.h>
 
 #include "wl1251.h"
-#include "reg.h"
-#include "wl1251_spi.h"
+#include "wl1251_reg.h"
+#include "wl1251_cmd.h"
 #include "wl1251_ps.h"
 
 int wl1251_acx_frame_rates(struct wl1251 *wl, u8 ctrl_rate, u8 ctrl_mod,
@@ -838,3 +837,82 @@ int wl1251_acx_statistics(struct wl1251 *wl, struct acx_statistics *stats)
 
         return 0;
 }
+
+int wl1251_acx_rate_policies(struct wl1251 *wl)
+{
+        struct acx_rate_policy *acx;
+        int ret = 0;
+
+        wl1251_debug(DEBUG_ACX, "acx rate policies");
+
+        acx = kzalloc(sizeof(*acx), GFP_KERNEL);
+
+        if (!acx) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        /* configure one default (one-size-fits-all) rate class */
+        acx->rate_class_cnt = 1;
+        acx->rate_class[0].enabled_rates = ACX_RATE_MASK_UNSPECIFIED;
+        acx->rate_class[0].short_retry_limit = ACX_RATE_RETRY_LIMIT;
+        acx->rate_class[0].long_retry_limit = ACX_RATE_RETRY_LIMIT;
+        acx->rate_class[0].aflags = 0;
+
+        ret = wl1251_cmd_configure(wl, ACX_RATE_POLICY, acx, sizeof(*acx));
+        if (ret < 0) {
+                wl1251_warning("Setting of rate policies failed: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(acx);
+        return ret;
+}
+
+int wl1251_acx_mem_cfg(struct wl1251 *wl)
+{
+        struct wl1251_acx_config_memory *mem_conf;
+        int ret, i;
+
+        wl1251_debug(DEBUG_ACX, "acx mem cfg");
+
+        mem_conf = kzalloc(sizeof(*mem_conf), GFP_KERNEL);
+        if (!mem_conf) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        /* memory config */
+        mem_conf->mem_config.num_stations = cpu_to_le16(DEFAULT_NUM_STATIONS);
+        mem_conf->mem_config.rx_mem_block_num = 35;
+        mem_conf->mem_config.tx_min_mem_block_num = 64;
+        mem_conf->mem_config.num_tx_queues = MAX_TX_QUEUES;
+        mem_conf->mem_config.host_if_options = HOSTIF_PKT_RING;
+        mem_conf->mem_config.num_ssid_profiles = 1;
+        mem_conf->mem_config.debug_buffer_size =
+                cpu_to_le16(TRACE_BUFFER_MAX_SIZE);
+
+        /* RX queue config */
+        mem_conf->rx_queue_config.dma_address = 0;
+        mem_conf->rx_queue_config.num_descs = ACX_RX_DESC_DEF;
+        mem_conf->rx_queue_config.priority = DEFAULT_RXQ_PRIORITY;
+        mem_conf->rx_queue_config.type = DEFAULT_RXQ_TYPE;
+
+        /* TX queue config */
+        for (i = 0; i < MAX_TX_QUEUES; i++) {
+                mem_conf->tx_queue_config[i].num_descs = ACX_TX_DESC_DEF;
+                mem_conf->tx_queue_config[i].attributes = i;
+        }
+
+        ret = wl1251_cmd_configure(wl, ACX_MEM_CFG, mem_conf,
+                                   sizeof(*mem_conf));
+        if (ret < 0) {
+                wl1251_warning("wl1251 mem config failed: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(mem_conf);
+        return ret;
+}
diff --git a/drivers/net/wireless/wl12xx/wl1251_acx.h b/drivers/net/wireless/wl12xx/wl1251_acx.h
index 2e7b1933a8f9..cafb91459504 100644
--- a/drivers/net/wireless/wl12xx/wl1251_acx.h
+++ b/drivers/net/wireless/wl12xx/wl1251_acx.h
@@ -1031,6 +1031,150 @@ struct acx_statistics {
         struct acx_rxpipe_statistics rxpipe;
 } __attribute__ ((packed));
 
+#define ACX_MAX_RATE_CLASSES       8
+#define ACX_RATE_MASK_UNSPECIFIED  0
+#define ACX_RATE_RETRY_LIMIT      10
+
+struct acx_rate_class {
+        u32 enabled_rates;
+        u8 short_retry_limit;
+        u8 long_retry_limit;
+        u8 aflags;
+        u8 reserved;
+};
+
+struct acx_rate_policy {
+        struct acx_header header;
+
+        u32 rate_class_cnt;
+        struct acx_rate_class rate_class[ACX_MAX_RATE_CLASSES];
+} __attribute__ ((packed));
+
+struct wl1251_acx_memory {
+        __le16 num_stations; /* number of STAs to be supported. */
+        u16 reserved_1;
+
+        /*
+         * Nmber of memory buffers for the RX mem pool.
+         * The actual number may be less if there are
+         * not enough blocks left for the minimum num
+         * of TX ones.
+         */
+        u8 rx_mem_block_num;
+        u8 reserved_2;
+        u8 num_tx_queues; /* From 1 to 16 */
+        u8 host_if_options; /* HOST_IF* */
+        u8 tx_min_mem_block_num;
+        u8 num_ssid_profiles;
+        __le16 debug_buffer_size;
+} __attribute__ ((packed));
+
+
+#define ACX_RX_DESC_MIN                1
+#define ACX_RX_DESC_MAX                127
+#define ACX_RX_DESC_DEF                32
+struct wl1251_acx_rx_queue_config {
+        u8 num_descs;
+        u8 pad;
+        u8 type;
+        u8 priority;
+        __le32 dma_address;
+} __attribute__ ((packed));
+
+#define ACX_TX_DESC_MIN                1
+#define ACX_TX_DESC_MAX                127
+#define ACX_TX_DESC_DEF                16
+struct wl1251_acx_tx_queue_config {
+    u8 num_descs;
+    u8 pad[2];
+    u8 attributes;
+} __attribute__ ((packed));
+
+#define MAX_TX_QUEUE_CONFIGS 5
+#define MAX_TX_QUEUES 4
+struct wl1251_acx_config_memory {
+        struct acx_header header;
+
+        struct wl1251_acx_memory mem_config;
+        struct wl1251_acx_rx_queue_config rx_queue_config;
+        struct wl1251_acx_tx_queue_config tx_queue_config[MAX_TX_QUEUE_CONFIGS];
+} __attribute__ ((packed));
+
+struct wl1251_acx_mem_map {
+        struct acx_header header;
+
+        void *code_start;
+        void *code_end;
+
+        void *wep_defkey_start;
+        void *wep_defkey_end;
+
+        void *sta_table_start;
+        void *sta_table_end;
+
+        void *packet_template_start;
+        void *packet_template_end;
+
+        void *queue_memory_start;
+        void *queue_memory_end;
+
+        void *packet_memory_pool_start;
+        void *packet_memory_pool_end;
+
+        void *debug_buffer1_start;
+        void *debug_buffer1_end;
+
+        void *debug_buffer2_start;
+        void *debug_buffer2_end;
+
+        /* Number of blocks FW allocated for TX packets */
+        u32 num_tx_mem_blocks;
+
+        /* Number of blocks FW allocated for RX packets */
+        u32 num_rx_mem_blocks;
+} __attribute__ ((packed));
+
+/*************************************************************************
+
+    Host Interrupt Register (WiLink -> Host)
+
+**************************************************************************/
+
+/* RX packet is ready in Xfer buffer #0 */
+#define WL1251_ACX_INTR_RX0_DATA      BIT(0)
+
+/* TX result(s) are in the TX complete buffer */
+#define WL1251_ACX_INTR_TX_RESULT       BIT(1)
+
+/* OBSOLETE */
+#define WL1251_ACX_INTR_TX_XFR          BIT(2)
+
+/* RX packet is ready in Xfer buffer #1 */
+#define WL1251_ACX_INTR_RX1_DATA        BIT(3)
+
+/* Event was entered to Event MBOX #A */
+#define WL1251_ACX_INTR_EVENT_A         BIT(4)
+
+/* Event was entered to Event MBOX #B */
+#define WL1251_ACX_INTR_EVENT_B         BIT(5)
+
+/* OBSOLETE */
+#define WL1251_ACX_INTR_WAKE_ON_HOST    BIT(6)
+
+/* Trace meassge on MBOX #A */
+#define WL1251_ACX_INTR_TRACE_A         BIT(7)
+
+/* Trace meassge on MBOX #B */
+#define WL1251_ACX_INTR_TRACE_B         BIT(8)
+
+/* Command processing completion */
+#define WL1251_ACX_INTR_CMD_COMPLETE    BIT(9)
+
+/* Init sequence is done */
+#define WL1251_ACX_INTR_INIT_COMPLETE   BIT(14)
+
+#define WL1251_ACX_INTR_ALL           0xFFFFFFFF
+
 enum {
         ACX_WAKE_UP_CONDITIONS      = 0x0002,
         ACX_MEM_CFG                 = 0x0003,
@@ -1142,5 +1286,7 @@ int wl1251_acx_cts_protect(struct wl1251 *wl,
                             enum acx_ctsprotect_type ctsprotect);
 int wl1251_acx_statistics(struct wl1251 *wl, struct acx_statistics *stats);
 int wl1251_acx_tsf_info(struct wl1251 *wl, u64 *mactime);
+int wl1251_acx_rate_policies(struct wl1251 *wl);
+int wl1251_acx_mem_cfg(struct wl1251 *wl);
 
 #endif /* __WL1251_ACX_H__ */
diff --git a/drivers/net/wireless/wl12xx/wl1251_boot.c b/drivers/net/wireless/wl12xx/wl1251_boot.c
index d8a155dc2fa1..592c3b5cc8f8 100644
--- a/drivers/net/wireless/wl12xx/wl1251_boot.c
+++ b/drivers/net/wireless/wl12xx/wl1251_boot.c
@@ -23,15 +23,12 @@
 
 #include <linux/gpio.h>
 
-#include "reg.h"
+#include "wl1251_reg.h"
 #include "wl1251_boot.h"
+#include "wl1251_io.h"
 #include "wl1251_spi.h"
 #include "wl1251_event.h"
-
-static void wl1251_boot_enable_interrupts(struct wl1251 *wl)
-{
-        enable_irq(wl->irq);
-}
+#include "wl1251_acx.h"
 
 void wl1251_boot_target_enable_interrupts(struct wl1251 *wl)
 {
@@ -212,18 +209,30 @@ int wl1251_boot_init_seq(struct wl1251 *wl)
         return 0;
 }
 
+static void wl1251_boot_set_ecpu_ctrl(struct wl1251 *wl, u32 flag)
+{
+        u32 cpu_ctrl;
+
+        /* 10.5.0 run the firmware (I) */
+        cpu_ctrl = wl1251_reg_read32(wl, ACX_REG_ECPU_CONTROL);
+
+        /* 10.5.1 run the firmware (II) */
+        cpu_ctrl &= ~flag;
+        wl1251_reg_write32(wl, ACX_REG_ECPU_CONTROL, cpu_ctrl);
+}
+
 int wl1251_boot_run_firmware(struct wl1251 *wl)
 {
         int loop, ret;
         u32 chip_id, interrupt;
 
-        wl->chip.op_set_ecpu_ctrl(wl, ECPU_CONTROL_HALT);
+        wl1251_boot_set_ecpu_ctrl(wl, ECPU_CONTROL_HALT);
 
         chip_id = wl1251_reg_read32(wl, CHIP_ID_B);
 
         wl1251_debug(DEBUG_BOOT, "chip id after firmware boot: 0x%x", chip_id);
 
-        if (chip_id != wl->chip.id) {
+        if (chip_id != wl->chip_id) {
                 wl1251_error("chip id doesn't match after firmware boot");
                 return -EIO;
         }
@@ -240,9 +249,9 @@ int wl1251_boot_run_firmware(struct wl1251 *wl)
                         return -EIO;
                 }
                 /* check that ACX_INTR_INIT_COMPLETE is enabled */
-                else if (interrupt & wl->chip.intr_init_complete) {
+                else if (interrupt & WL1251_ACX_INTR_INIT_COMPLETE) {
                         wl1251_reg_write32(wl, ACX_REG_INTERRUPT_ACK,
-                                           wl->chip.intr_init_complete);
+                                           WL1251_ACX_INTR_INIT_COMPLETE);
                         break;
                 }
         }
@@ -260,16 +269,15 @@ int wl1251_boot_run_firmware(struct wl1251 *wl)
         wl->event_box_addr = wl1251_reg_read32(wl, REG_EVENT_MAILBOX_PTR);
 
         /* set the working partition to its "running" mode offset */
-        wl1251_set_partition(wl,
-                             wl->chip.p_table[PART_WORK].mem.start,
-                             wl->chip.p_table[PART_WORK].mem.size,
-                             wl->chip.p_table[PART_WORK].reg.start,
-                             wl->chip.p_table[PART_WORK].reg.size);
+        wl1251_set_partition(wl, WL1251_PART_WORK_MEM_START,
+                             WL1251_PART_WORK_MEM_SIZE,
+                             WL1251_PART_WORK_REG_START,
+                             WL1251_PART_WORK_REG_SIZE);
 
         wl1251_debug(DEBUG_MAILBOX, "cmd_box_addr 0x%x event_box_addr 0x%x",
                      wl->cmd_box_addr, wl->event_box_addr);
 
-        wl->chip.op_fw_version(wl);
+        wl1251_acx_fw_version(wl, wl->fw_ver, sizeof(wl->fw_ver));
 
         /*
          * in case of full asynchronous mode the firmware event must be
@@ -277,9 +285,16 @@ int wl1251_boot_run_firmware(struct wl1251 *wl)
          */
 
         /* enable gpio interrupts */
-        wl1251_boot_enable_interrupts(wl);
+        wl1251_enable_interrupts(wl);
 
-        wl->chip.op_target_enable_interrupts(wl);
+        /* Enable target's interrupts */
+        wl->intr_mask = WL1251_ACX_INTR_RX0_DATA |
+                WL1251_ACX_INTR_RX1_DATA |
+                WL1251_ACX_INTR_TX_RESULT |
+                WL1251_ACX_INTR_EVENT_A |
+                WL1251_ACX_INTR_EVENT_B |
+                WL1251_ACX_INTR_INIT_COMPLETE;
+        wl1251_boot_target_enable_interrupts(wl);
 
         /* unmask all mbox events  */
         wl->event_mask = 0xffffffff;
@@ -295,3 +310,218 @@ int wl1251_boot_run_firmware(struct wl1251 *wl)
         /* firmware startup completed */
         return 0;
 }
+
+static int wl1251_boot_upload_firmware(struct wl1251 *wl)
+{
+        int addr, chunk_num, partition_limit;
+        size_t fw_data_len;
+        u8 *p;
+
+        /* whal_FwCtrl_LoadFwImageSm() */
+
+        wl1251_debug(DEBUG_BOOT, "chip id before fw upload: 0x%x",
+                     wl1251_reg_read32(wl, CHIP_ID_B));
+
+        /* 10.0 check firmware length and set partition */
+        fw_data_len =  (wl->fw[4] << 24) | (wl->fw[5] << 16) |
+                (wl->fw[6] << 8) | (wl->fw[7]);
+
+        wl1251_debug(DEBUG_BOOT, "fw_data_len %zu chunk_size %d", fw_data_len,
+                CHUNK_SIZE);
+
+        if ((fw_data_len % 4) != 0) {
+                wl1251_error("firmware length not multiple of four");
+                return -EIO;
+        }
+
+        wl1251_set_partition(wl, WL1251_PART_DOWN_MEM_START,
+                             WL1251_PART_DOWN_MEM_SIZE,
+                             WL1251_PART_DOWN_REG_START,
+                             WL1251_PART_DOWN_REG_SIZE);
+
+        /* 10.1 set partition limit and chunk num */
+        chunk_num = 0;
+        partition_limit = WL1251_PART_DOWN_MEM_SIZE;
+
+        while (chunk_num < fw_data_len / CHUNK_SIZE) {
+                /* 10.2 update partition, if needed */
+                addr = WL1251_PART_DOWN_MEM_START +
+                        (chunk_num + 2) * CHUNK_SIZE;
+                if (addr > partition_limit) {
+                        addr = WL1251_PART_DOWN_MEM_START +
+                                chunk_num * CHUNK_SIZE;
+                        partition_limit = chunk_num * CHUNK_SIZE +
+                                WL1251_PART_DOWN_MEM_SIZE;
+                        wl1251_set_partition(wl,
+                                             addr,
+                                             WL1251_PART_DOWN_MEM_SIZE,
+                                             WL1251_PART_DOWN_REG_START,
+                                             WL1251_PART_DOWN_REG_SIZE);
+                }
+
+                /* 10.3 upload the chunk */
+                addr = WL1251_PART_DOWN_MEM_START + chunk_num * CHUNK_SIZE;
+                p = wl->fw + FW_HDR_SIZE + chunk_num * CHUNK_SIZE;
+                wl1251_debug(DEBUG_BOOT, "uploading fw chunk 0x%p to 0x%x",
+                             p, addr);
+                wl1251_mem_write(wl, addr, p, CHUNK_SIZE);
+
+                chunk_num++;
+        }
+
+        /* 10.4 upload the last chunk */
+        addr = WL1251_PART_DOWN_MEM_START + chunk_num * CHUNK_SIZE;
+        p = wl->fw + FW_HDR_SIZE + chunk_num * CHUNK_SIZE;
+        wl1251_debug(DEBUG_BOOT, "uploading fw last chunk (%zu B) 0x%p to 0x%x",
+                     fw_data_len % CHUNK_SIZE, p, addr);
+        wl1251_mem_write(wl, addr, p, fw_data_len % CHUNK_SIZE);
+
+        return 0;
+}
+
+static int wl1251_boot_upload_nvs(struct wl1251 *wl)
+{
+        size_t nvs_len, nvs_bytes_written, burst_len;
+        int nvs_start, i;
+        u32 dest_addr, val;
+        u8 *nvs_ptr, *nvs;
+
+        nvs = wl->nvs;
+        if (nvs == NULL)
+                return -ENODEV;
+
+        nvs_ptr = nvs;
+
+        nvs_len = wl->nvs_len;
+        nvs_start = wl->fw_len;
+
+        /*
+         * Layout before the actual NVS tables:
+         * 1 byte : burst length.
+         * 2 bytes: destination address.
+         * n bytes: data to burst copy.
+         *
+         * This is ended by a 0 length, then the NVS tables.
+         */
+
+        while (nvs_ptr[0]) {
+                burst_len = nvs_ptr[0];
+                dest_addr = (nvs_ptr[1] & 0xfe) | ((u32)(nvs_ptr[2] << 8));
+
+                /* We move our pointer to the data */
+                nvs_ptr += 3;
+
+                for (i = 0; i < burst_len; i++) {
+                        val = (nvs_ptr[0] | (nvs_ptr[1] << 8)
+                               | (nvs_ptr[2] << 16) | (nvs_ptr[3] << 24));
+
+                        wl1251_debug(DEBUG_BOOT,
+                                     "nvs burst write 0x%x: 0x%x",
+                                     dest_addr, val);
+                        wl1251_mem_write32(wl, dest_addr, val);
+
+                        nvs_ptr += 4;
+                        dest_addr += 4;
+                }
+        }
+
+        /*
+         * We've reached the first zero length, the first NVS table
+         * is 7 bytes further.
+         */
+        nvs_ptr += 7;
+        nvs_len -= nvs_ptr - nvs;
+        nvs_len = ALIGN(nvs_len, 4);
+
+        /* Now we must set the partition correctly */
+        wl1251_set_partition(wl, nvs_start,
+                             WL1251_PART_DOWN_MEM_SIZE,
+                             WL1251_PART_DOWN_REG_START,
+                             WL1251_PART_DOWN_REG_SIZE);
+
+        /* And finally we upload the NVS tables */
+        nvs_bytes_written = 0;
+        while (nvs_bytes_written < nvs_len) {
+                val = (nvs_ptr[0] | (nvs_ptr[1] << 8)
+                       | (nvs_ptr[2] << 16) | (nvs_ptr[3] << 24));
+
+                val = cpu_to_le32(val);
+
+                wl1251_debug(DEBUG_BOOT,
+                             "nvs write table 0x%x: 0x%x",
+                             nvs_start, val);
+                wl1251_mem_write32(wl, nvs_start, val);
+
+                nvs_ptr += 4;
+                nvs_bytes_written += 4;
+                nvs_start += 4;
+        }
+
+        return 0;
+}
+
+int wl1251_boot(struct wl1251 *wl)
+{
+        int ret = 0, minor_minor_e2_ver;
+        u32 tmp, boot_data;
+
+        ret = wl1251_boot_soft_reset(wl);
+        if (ret < 0)
+                goto out;
+
+        /* 2. start processing NVS file */
+        ret = wl1251_boot_upload_nvs(wl);
+        if (ret < 0)
+                goto out;
+
+        /* write firmware's last address (ie. it's length) to
+         * ACX_EEPROMLESS_IND_REG */
+        wl1251_reg_write32(wl, ACX_EEPROMLESS_IND_REG, wl->fw_len);
+
+        /* 6. read the EEPROM parameters */
+        tmp = wl1251_reg_read32(wl, SCR_PAD2);
+
+        /* 7. read bootdata */
+        wl->boot_attr.radio_type = (tmp & 0x0000FF00) >> 8;
+        wl->boot_attr.major = (tmp & 0x00FF0000) >> 16;
+        tmp = wl1251_reg_read32(wl, SCR_PAD3);
+
+        /* 8. check bootdata and call restart sequence */
+        wl->boot_attr.minor = (tmp & 0x00FF0000) >> 16;
+        minor_minor_e2_ver = (tmp & 0xFF000000) >> 24;
+
+        wl1251_debug(DEBUG_BOOT, "radioType 0x%x majorE2Ver 0x%x "
+                     "minorE2Ver 0x%x minor_minor_e2_ver 0x%x",
+                     wl->boot_attr.radio_type, wl->boot_attr.major,
+                     wl->boot_attr.minor, minor_minor_e2_ver);
+
+        ret = wl1251_boot_init_seq(wl);
+        if (ret < 0)
+                goto out;
+
+        /* 9. NVS processing done */
+        boot_data = wl1251_reg_read32(wl, ACX_REG_ECPU_CONTROL);
+
+        wl1251_debug(DEBUG_BOOT, "halt boot_data 0x%x", boot_data);
+
+        /* 10. check that ECPU_CONTROL_HALT bits are set in
+         * pWhalBus->uBootData and start uploading firmware
+         */
+        if ((boot_data & ECPU_CONTROL_HALT) == 0) {
+                wl1251_error("boot failed, ECPU_CONTROL_HALT not set");
+                ret = -EIO;
+                goto out;
+        }
+
+        ret = wl1251_boot_upload_firmware(wl);
+        if (ret < 0)
+                goto out;
+
+        /* 10.5 start firmware */
+        ret = wl1251_boot_run_firmware(wl);
+        if (ret < 0)
+                goto out;
+
+out:
+        return ret;
+}
diff --git a/drivers/net/wireless/wl12xx/wl1251_boot.h b/drivers/net/wireless/wl12xx/wl1251_boot.h
index 798362d71e3f..90063697e8f2 100644
--- a/drivers/net/wireless/wl12xx/wl1251_boot.h
+++ b/drivers/net/wireless/wl12xx/wl1251_boot.h
@@ -30,6 +30,7 @@ int wl1251_boot_soft_reset(struct wl1251 *wl);
 int wl1251_boot_init_seq(struct wl1251 *wl);
 int wl1251_boot_run_firmware(struct wl1251 *wl);
 void wl1251_boot_target_enable_interrupts(struct wl1251 *wl);
+int wl1251_boot(struct wl1251 *wl);
 
 /* number of times we try to read the INIT interrupt */
 #define INIT_LOOP 20000
diff --git a/drivers/net/wireless/wl12xx/wl1251_cmd.c b/drivers/net/wireless/wl12xx/wl1251_cmd.c
index dc04d1fc2ee4..770f260726bd 100644
--- a/drivers/net/wireless/wl12xx/wl1251_cmd.c
+++ b/drivers/net/wireless/wl12xx/wl1251_cmd.c
@@ -2,11 +2,10 @@
 
 #include <linux/module.h>
 #include <linux/crc7.h>
-#include <linux/spi/spi.h>
 
 #include "wl1251.h"
-#include "reg.h"
-#include "wl1251_spi.h"
+#include "wl1251_reg.h"
+#include "wl1251_io.h"
 #include "wl1251_ps.h"
 #include "wl1251_acx.h"
 
@@ -31,14 +30,14 @@ int wl1251_cmd_send(struct wl1251 *wl, u16 id, void *buf, size_t len)
 
         WARN_ON(len % 4 != 0);
 
-        wl1251_spi_mem_write(wl, wl->cmd_box_addr, buf, len);
+        wl1251_mem_write(wl, wl->cmd_box_addr, buf, len);
 
         wl1251_reg_write32(wl, ACX_REG_INTERRUPT_TRIG, INTR_TRIG_CMD);
 
         timeout = jiffies + msecs_to_jiffies(WL1251_COMMAND_TIMEOUT);
 
         intr = wl1251_reg_read32(wl, ACX_REG_INTERRUPT_NO_CLEAR);
-        while (!(intr & wl->chip.intr_cmd_complete)) {
+        while (!(intr & WL1251_ACX_INTR_CMD_COMPLETE)) {
                 if (time_after(jiffies, timeout)) {
                         wl1251_error("command complete timeout");
                         ret = -ETIMEDOUT;
@@ -51,7 +50,7 @@ int wl1251_cmd_send(struct wl1251 *wl, u16 id, void *buf, size_t len)
         }
 
         wl1251_reg_write32(wl, ACX_REG_INTERRUPT_ACK,
-                           wl->chip.intr_cmd_complete);
+                           WL1251_ACX_INTR_CMD_COMPLETE);
 
 out:
         return ret;
@@ -86,7 +85,7 @@ int wl1251_cmd_test(struct wl1251 *wl, void *buf, size_t buf_len, u8 answer)
                  * The answer would be a wl1251_command, where the
                  * parameter array contains the actual answer.
                  */
-                wl1251_spi_mem_read(wl, wl->cmd_box_addr, buf, buf_len);
+                wl1251_mem_read(wl, wl->cmd_box_addr, buf, buf_len);
 
                 cmd_answer = buf;
 
@@ -125,7 +124,7 @@ int wl1251_cmd_interrogate(struct wl1251 *wl, u16 id, void *buf, size_t len)
         }
 
         /* the interrogate command got in, we can read the answer */
-        wl1251_spi_mem_read(wl, wl->cmd_box_addr, buf, len);
+        wl1251_mem_read(wl, wl->cmd_box_addr, buf, len);
 
         acx = buf;
         if (acx->cmd.status != CMD_STATUS_SUCCESS)
@@ -252,10 +251,9 @@ out:
         return ret;
 }
 
-int wl1251_cmd_join(struct wl1251 *wl, u8 bss_type, u8 dtim_interval,
-                    u16 beacon_interval, u8 wait)
+int wl1251_cmd_join(struct wl1251 *wl, u8 bss_type, u8 channel,
+                    u16 beacon_interval, u8 dtim_interval)
 {
-        unsigned long timeout;
         struct cmd_join *join;
         int ret, i;
         u8 *bssid;
@@ -266,15 +264,9 @@ int wl1251_cmd_join(struct wl1251 *wl, u8 bss_type, u8 dtim_interval,
                 goto out;
         }
 
-        /* FIXME: this should be in main.c */
-        ret = wl1251_acx_frame_rates(wl, DEFAULT_HW_GEN_TX_RATE,
-                                     DEFAULT_HW_GEN_MODULATION_TYPE,
-                                     wl->tx_mgmt_frm_rate,
-                                     wl->tx_mgmt_frm_mod);
-        if (ret < 0)
-                goto out;
-
-        wl1251_debug(DEBUG_CMD, "cmd join");
+        wl1251_debug(DEBUG_CMD, "cmd join%s ch %d %d/%d",
+                     bss_type == BSS_TYPE_IBSS ? " ibss" : "",
+                     channel, beacon_interval, dtim_interval);
 
         /* Reverse order BSSID */
         bssid = (u8 *) &join->bssid_lsb;
@@ -284,13 +276,22 @@ int wl1251_cmd_join(struct wl1251 *wl, u8 bss_type, u8 dtim_interval,
         join->rx_config_options = wl->rx_config;
         join->rx_filter_options = wl->rx_filter;
 
+        /*
+         * FIXME: disable temporarily all filters because after commit
+         * 9cef8737 "mac80211: fix managed mode BSSID handling" broke
+         * association. The filter logic needs to be implemented properly
+         * and once that is done, this hack can be removed.
+         */
+        join->rx_config_options = 0;
+        join->rx_filter_options = WL1251_DEFAULT_RX_FILTER;
+
         join->basic_rate_set = RATE_MASK_1MBPS | RATE_MASK_2MBPS |
                 RATE_MASK_5_5MBPS | RATE_MASK_11MBPS;
 
         join->beacon_interval = beacon_interval;
         join->dtim_interval = dtim_interval;
         join->bss_type = bss_type;
-        join->channel = wl->channel;
+        join->channel = channel;
         join->ctrl = JOIN_CMD_CTRL_TX_FLUSH;
 
         ret = wl1251_cmd_send(wl, CMD_START_JOIN, join, sizeof(*join));
@@ -299,15 +300,6 @@ int wl1251_cmd_join(struct wl1251 *wl, u8 bss_type, u8 dtim_interval,
                 goto out;
         }
 
-        timeout = msecs_to_jiffies(JOIN_TIMEOUT);
-
-        /*
-         * ugly hack: we should wait for JOIN_EVENT_COMPLETE_ID but to
-         * simplify locking we just sleep instead, for now
-         */
-        if (wait)
-                msleep(10);
-
 out:
         kfree(join);
         return ret;
@@ -318,14 +310,6 @@ int wl1251_cmd_ps_mode(struct wl1251 *wl, u8 ps_mode)
         struct wl1251_cmd_ps_params *ps_params = NULL;
         int ret = 0;
 
-        /* FIXME: this should be in ps.c */
-        ret = wl1251_acx_wake_up_conditions(wl, WAKE_UP_EVENT_DTIM_BITMAP,
-                                            wl->listen_int);
-        if (ret < 0) {
-                wl1251_error("couldn't set wake up conditions");
-                goto out;
-        }
-
         wl1251_debug(DEBUG_CMD, "cmd set ps mode");
 
         ps_params = kzalloc(sizeof(*ps_params), GFP_KERNEL);
@@ -379,7 +363,7 @@ int wl1251_cmd_read_memory(struct wl1251 *wl, u32 addr, void *answer,
         }
 
         /* the read command got in, we can now read the answer */
-        wl1251_spi_mem_read(wl, wl->cmd_box_addr, cmd, sizeof(*cmd));
+        wl1251_mem_read(wl, wl->cmd_box_addr, cmd, sizeof(*cmd));
 
         if (cmd->header.status != CMD_STATUS_SUCCESS)
                 wl1251_error("error in read command result: %d",
diff --git a/drivers/net/wireless/wl12xx/wl1251_cmd.h b/drivers/net/wireless/wl12xx/wl1251_cmd.h
index 64f228dd9a9b..dff798ad0ef5 100644
--- a/drivers/net/wireless/wl12xx/wl1251_cmd.h
+++ b/drivers/net/wireless/wl12xx/wl1251_cmd.h
@@ -36,8 +36,8 @@ int wl1251_cmd_configure(struct wl1251 *wl, u16 id, void *buf, size_t len);
 int wl1251_cmd_vbm(struct wl1251 *wl, u8 identity,
                    void *bitmap, u16 bitmap_len, u8 bitmap_control);
 int wl1251_cmd_data_path(struct wl1251 *wl, u8 channel, bool enable);
-int wl1251_cmd_join(struct wl1251 *wl, u8 bss_type, u8 dtim_interval,
-                    u16 beacon_interval, u8 wait);
+int wl1251_cmd_join(struct wl1251 *wl, u8 bss_type, u8 channel,
+                    u16 beacon_interval, u8 dtim_interval);
 int wl1251_cmd_ps_mode(struct wl1251 *wl, u8 ps_mode);
 int wl1251_cmd_read_memory(struct wl1251 *wl, u32 addr, void *answer,
                            size_t len);
diff --git a/drivers/net/wireless/wl12xx/wl1251_event.c b/drivers/net/wireless/wl12xx/wl1251_event.c
index 1a0a0bc1a31f..00076c4a8a21 100644
--- a/drivers/net/wireless/wl12xx/wl1251_event.c
+++ b/drivers/net/wireless/wl12xx/wl1251_event.c
@@ -23,8 +23,8 @@
  */
 
 #include "wl1251.h"
-#include "reg.h"
-#include "wl1251_spi.h"
+#include "wl1251_reg.h"
+#include "wl1251_io.h"
 #include "wl1251_event.h"
 #include "wl1251_ps.h"
 
@@ -39,6 +39,7 @@ static int wl1251_event_scan_complete(struct wl1251 *wl,
                 mutex_unlock(&wl->mutex);
                 ieee80211_scan_completed(wl->hw, false);
                 mutex_lock(&wl->mutex);
+                wl1251_debug(DEBUG_MAC80211, "mac80211 hw scan completed");
                 wl->scanning = false;
         }
 
@@ -112,7 +113,7 @@ int wl1251_event_handle(struct wl1251 *wl, u8 mbox_num)
                 return -EINVAL;
 
         /* first we read the mbox descriptor */
-        wl1251_spi_mem_read(wl, wl->mbox_ptr[mbox_num], &mbox,
+        wl1251_mem_read(wl, wl->mbox_ptr[mbox_num], &mbox,
                             sizeof(struct event_mailbox));
 
         /* process the descriptor */
diff --git a/drivers/net/wireless/wl12xx/wl1251_init.c b/drivers/net/wireless/wl12xx/wl1251_init.c
index df6c60f0fd66..b2ee4f468fc4 100644
--- a/drivers/net/wireless/wl12xx/wl1251_init.c
+++ b/drivers/net/wireless/wl12xx/wl1251_init.c
@@ -28,6 +28,7 @@
 #include "wl12xx_80211.h"
 #include "wl1251_acx.h"
 #include "wl1251_cmd.h"
+#include "wl1251_reg.h"
 
 int wl1251_hw_init_hwenc_config(struct wl1251 *wl)
 {
@@ -198,3 +199,215 @@ int wl1251_hw_init_power_auth(struct wl1251 *wl)
 {
         return wl1251_acx_sleep_auth(wl, WL1251_PSM_CAM);
 }
+
+int wl1251_hw_init_mem_config(struct wl1251 *wl)
+{
+        int ret;
+
+        ret = wl1251_acx_mem_cfg(wl);
+        if (ret < 0)
+                return ret;
+
+        wl->target_mem_map = kzalloc(sizeof(struct wl1251_acx_mem_map),
+                                          GFP_KERNEL);
+        if (!wl->target_mem_map) {
+                wl1251_error("couldn't allocate target memory map");
+                return -ENOMEM;
+        }
+
+        /* we now ask for the firmware built memory map */
+        ret = wl1251_acx_mem_map(wl, wl->target_mem_map,
+                                 sizeof(struct wl1251_acx_mem_map));
+        if (ret < 0) {
+                wl1251_error("couldn't retrieve firmware memory map");
+                kfree(wl->target_mem_map);
+                wl->target_mem_map = NULL;
+                return ret;
+        }
+
+        return 0;
+}
+
+static int wl1251_hw_init_txq_fill(u8 qid,
+                                   struct acx_tx_queue_qos_config *config,
+                                   u32 num_blocks)
+{
+        config->qid = qid;
+
+        switch (qid) {
+        case QOS_AC_BE:
+                config->high_threshold =
+                        (QOS_TX_HIGH_BE_DEF * num_blocks) / 100;
+                config->low_threshold =
+                        (QOS_TX_LOW_BE_DEF * num_blocks) / 100;
+                break;
+        case QOS_AC_BK:
+                config->high_threshold =
+                        (QOS_TX_HIGH_BK_DEF * num_blocks) / 100;
+                config->low_threshold =
+                        (QOS_TX_LOW_BK_DEF * num_blocks) / 100;
+                break;
+        case QOS_AC_VI:
+                config->high_threshold =
+                        (QOS_TX_HIGH_VI_DEF * num_blocks) / 100;
+                config->low_threshold =
+                        (QOS_TX_LOW_VI_DEF * num_blocks) / 100;
+                break;
+        case QOS_AC_VO:
+                config->high_threshold =
+                        (QOS_TX_HIGH_VO_DEF * num_blocks) / 100;
+                config->low_threshold =
+                        (QOS_TX_LOW_VO_DEF * num_blocks) / 100;
+                break;
+        default:
+                wl1251_error("Invalid TX queue id: %d", qid);
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+static int wl1251_hw_init_tx_queue_config(struct wl1251 *wl)
+{
+        struct acx_tx_queue_qos_config *config;
+        struct wl1251_acx_mem_map *wl_mem_map = wl->target_mem_map;
+        int ret, i;
+
+        wl1251_debug(DEBUG_ACX, "acx tx queue config");
+
+        config = kzalloc(sizeof(*config), GFP_KERNEL);
+        if (!config) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        for (i = 0; i < MAX_NUM_OF_AC; i++) {
+                ret = wl1251_hw_init_txq_fill(i, config,
+                                              wl_mem_map->num_tx_mem_blocks);
+                if (ret < 0)
+                        goto out;
+
+                ret = wl1251_cmd_configure(wl, ACX_TX_QUEUE_CFG,
+                                           config, sizeof(*config));
+                if (ret < 0)
+                        goto out;
+        }
+
+out:
+        kfree(config);
+        return ret;
+}
+
+static int wl1251_hw_init_data_path_config(struct wl1251 *wl)
+{
+        int ret;
+
+        /* asking for the data path parameters */
+        wl->data_path = kzalloc(sizeof(struct acx_data_path_params_resp),
+                                GFP_KERNEL);
+        if (!wl->data_path) {
+                wl1251_error("Couldnt allocate data path parameters");
+                return -ENOMEM;
+        }
+
+        ret = wl1251_acx_data_path_params(wl, wl->data_path);
+        if (ret < 0) {
+                kfree(wl->data_path);
+                wl->data_path = NULL;
+                return ret;
+        }
+
+        return 0;
+}
+
+
+int wl1251_hw_init(struct wl1251 *wl)
+{
+        struct wl1251_acx_mem_map *wl_mem_map;
+        int ret;
+
+        ret = wl1251_hw_init_hwenc_config(wl);
+        if (ret < 0)
+                return ret;
+
+        /* Template settings */
+        ret = wl1251_hw_init_templates_config(wl);
+        if (ret < 0)
+                return ret;
+
+        /* Default memory configuration */
+        ret = wl1251_hw_init_mem_config(wl);
+        if (ret < 0)
+                return ret;
+
+        /* Default data path configuration  */
+        ret = wl1251_hw_init_data_path_config(wl);
+        if (ret < 0)
+                goto out_free_memmap;
+
+        /* RX config */
+        ret = wl1251_hw_init_rx_config(wl,
+                                       RX_CFG_PROMISCUOUS | RX_CFG_TSF,
+                                       RX_FILTER_OPTION_DEF);
+        /* RX_CONFIG_OPTION_ANY_DST_ANY_BSS,
+           RX_FILTER_OPTION_FILTER_ALL); */
+        if (ret < 0)
+                goto out_free_data_path;
+
+        /* TX queues config */
+        ret = wl1251_hw_init_tx_queue_config(wl);
+        if (ret < 0)
+                goto out_free_data_path;
+
+        /* PHY layer config */
+        ret = wl1251_hw_init_phy_config(wl);
+        if (ret < 0)
+                goto out_free_data_path;
+
+        /* Beacon filtering */
+        ret = wl1251_hw_init_beacon_filter(wl);
+        if (ret < 0)
+                goto out_free_data_path;
+
+        /* Bluetooth WLAN coexistence */
+        ret = wl1251_hw_init_pta(wl);
+        if (ret < 0)
+                goto out_free_data_path;
+
+        /* Energy detection */
+        ret = wl1251_hw_init_energy_detection(wl);
+        if (ret < 0)
+                goto out_free_data_path;
+
+        /* Beacons and boradcast settings */
+        ret = wl1251_hw_init_beacon_broadcast(wl);
+        if (ret < 0)
+                goto out_free_data_path;
+
+        /* Enable data path */
+        ret = wl1251_cmd_data_path(wl, wl->channel, 1);
+        if (ret < 0)
+                goto out_free_data_path;
+
+        /* Default power state */
+        ret = wl1251_hw_init_power_auth(wl);
+        if (ret < 0)
+                goto out_free_data_path;
+
+        wl_mem_map = wl->target_mem_map;
+        wl1251_info("%d tx blocks at 0x%x, %d rx blocks at 0x%x",
+                    wl_mem_map->num_tx_mem_blocks,
+                    wl->data_path->tx_control_addr,
+                    wl_mem_map->num_rx_mem_blocks,
+                    wl->data_path->rx_control_addr);
+
+        return 0;
+
+ out_free_data_path:
+        kfree(wl->data_path);
+
+ out_free_memmap:
+        kfree(wl->target_mem_map);
+
+        return ret;
+}
diff --git a/drivers/net/wireless/wl12xx/wl1251_init.h b/drivers/net/wireless/wl12xx/wl1251_init.h
index 8596188e834e..b3b25ec885ea 100644
--- a/drivers/net/wireless/wl12xx/wl1251_init.h
+++ b/drivers/net/wireless/wl12xx/wl1251_init.h
@@ -35,5 +35,7 @@ int wl1251_hw_init_pta(struct wl1251 *wl);
 int wl1251_hw_init_energy_detection(struct wl1251 *wl);
 int wl1251_hw_init_beacon_broadcast(struct wl1251 *wl);
 int wl1251_hw_init_power_auth(struct wl1251 *wl);
+int wl1251_hw_init_mem_config(struct wl1251 *wl);
+int wl1251_hw_init(struct wl1251 *wl);
 
 #endif
diff --git a/drivers/net/wireless/wl12xx/wl1251_io.c b/drivers/net/wireless/wl12xx/wl1251_io.c
new file mode 100644
index 000000000000..f1c232e0887f
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/wl1251_io.c
@@ -0,0 +1,196 @@
+/*
+ * This file is part of wl12xx
+ *
+ * Copyright (C) 2008 Nokia Corporation
+ *
+ * Contact: Kalle Valo <kalle.valo@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#include "wl1251.h"
+#include "wl1251_reg.h"
+#include "wl1251_io.h"
+
+/* FIXME: this is static data nowadays and the table can be removed */
+static enum wl12xx_acx_int_reg wl1251_io_reg_table[ACX_REG_TABLE_LEN] = {
+        [ACX_REG_INTERRUPT_TRIG]     = (REGISTERS_BASE + 0x0474),
+        [ACX_REG_INTERRUPT_TRIG_H]   = (REGISTERS_BASE + 0x0478),
+        [ACX_REG_INTERRUPT_MASK]     = (REGISTERS_BASE + 0x0494),
+        [ACX_REG_HINT_MASK_SET]      = (REGISTERS_BASE + 0x0498),
+        [ACX_REG_HINT_MASK_CLR]      = (REGISTERS_BASE + 0x049C),
+        [ACX_REG_INTERRUPT_NO_CLEAR] = (REGISTERS_BASE + 0x04B0),
+        [ACX_REG_INTERRUPT_CLEAR]    = (REGISTERS_BASE + 0x04A4),
+        [ACX_REG_INTERRUPT_ACK]      = (REGISTERS_BASE + 0x04A8),
+        [ACX_REG_SLV_SOFT_RESET]     = (REGISTERS_BASE + 0x0000),
+        [ACX_REG_EE_START]           = (REGISTERS_BASE + 0x080C),
+        [ACX_REG_ECPU_CONTROL]       = (REGISTERS_BASE + 0x0804)
+};
+
+static int wl1251_translate_reg_addr(struct wl1251 *wl, int addr)
+{
+        /* If the address is lower than REGISTERS_BASE, it means that this is
+         * a chip-specific register address, so look it up in the registers
+         * table */
+        if (addr < REGISTERS_BASE) {
+                /* Make sure we don't go over the table */
+                if (addr >= ACX_REG_TABLE_LEN) {
+                        wl1251_error("address out of range (%d)", addr);
+                        return -EINVAL;
+                }
+                addr = wl1251_io_reg_table[addr];
+        }
+
+        return addr - wl->physical_reg_addr + wl->virtual_reg_addr;
+}
+
+static int wl1251_translate_mem_addr(struct wl1251 *wl, int addr)
+{
+        return addr - wl->physical_mem_addr + wl->virtual_mem_addr;
+}
+
+void wl1251_mem_read(struct wl1251 *wl, int addr, void *buf, size_t len)
+{
+        int physical;
+
+        physical = wl1251_translate_mem_addr(wl, addr);
+
+        wl->if_ops->read(wl, physical, buf, len);
+}
+
+void wl1251_mem_write(struct wl1251 *wl, int addr, void *buf, size_t len)
+{
+        int physical;
+
+        physical = wl1251_translate_mem_addr(wl, addr);
+
+        wl->if_ops->write(wl, physical, buf, len);
+}
+
+u32 wl1251_mem_read32(struct wl1251 *wl, int addr)
+{
+        return wl1251_read32(wl, wl1251_translate_mem_addr(wl, addr));
+}
+
+void wl1251_mem_write32(struct wl1251 *wl, int addr, u32 val)
+{
+        wl1251_write32(wl, wl1251_translate_mem_addr(wl, addr), val);
+}
+
+u32 wl1251_reg_read32(struct wl1251 *wl, int addr)
+{
+        return wl1251_read32(wl, wl1251_translate_reg_addr(wl, addr));
+}
+
+void wl1251_reg_write32(struct wl1251 *wl, int addr, u32 val)
+{
+        wl1251_write32(wl, wl1251_translate_reg_addr(wl, addr), val);
+}
+
+/* Set the partitions to access the chip addresses.
+ *
+ * There are two VIRTUAL partitions (the memory partition and the
+ * registers partition), which are mapped to two different areas of the
+ * PHYSICAL (hardware) memory.  This function also makes other checks to
+ * ensure that the partitions are not overlapping.  In the diagram below, the
+ * memory partition comes before the register partition, but the opposite is
+ * also supported.
+ *
+ *                               PHYSICAL address
+ *                                     space
+ *
+ *                                    |    |
+ *                                 ...+----+--> mem_start
+ *          VIRTUAL address     ...   |    |
+ *               space       ...      |    | [PART_0]
+ *                        ...         |    |
+ * 0x00000000 <--+----+...         ...+----+--> mem_start + mem_size
+ *               |    |         ...   |    |
+ *               |MEM |      ...      |    |
+ *               |    |   ...         |    |
+ *  part_size <--+----+...            |    | {unused area)
+ *               |    |   ...         |    |
+ *               |REG |      ...      |    |
+ *  part_size    |    |         ...   |    |
+ *      +     <--+----+...         ...+----+--> reg_start
+ *  reg_size              ...         |    |
+ *                           ...      |    | [PART_1]
+ *                              ...   |    |
+ *                                 ...+----+--> reg_start + reg_size
+ *                                    |    |
+ *
+ */
+void wl1251_set_partition(struct wl1251 *wl,
+                          u32 mem_start, u32 mem_size,
+                          u32 reg_start, u32 reg_size)
+{
+        struct wl1251_partition partition[2];
+
+        wl1251_debug(DEBUG_SPI, "mem_start %08X mem_size %08X",
+                     mem_start, mem_size);
+        wl1251_debug(DEBUG_SPI, "reg_start %08X reg_size %08X",
+                     reg_start, reg_size);
+
+        /* Make sure that the two partitions together don't exceed the
+         * address range */
+        if ((mem_size + reg_size) > HW_ACCESS_MEMORY_MAX_RANGE) {
+                wl1251_debug(DEBUG_SPI, "Total size exceeds maximum virtual"
+                             " address range.  Truncating partition[0].");
+                mem_size = HW_ACCESS_MEMORY_MAX_RANGE - reg_size;
+                wl1251_debug(DEBUG_SPI, "mem_start %08X mem_size %08X",
+                             mem_start, mem_size);
+                wl1251_debug(DEBUG_SPI, "reg_start %08X reg_size %08X",
+                             reg_start, reg_size);
+        }
+
+        if ((mem_start < reg_start) &&
+            ((mem_start + mem_size) > reg_start)) {
+                /* Guarantee that the memory partition doesn't overlap the
+                 * registers partition */
+                wl1251_debug(DEBUG_SPI, "End of partition[0] is "
+                             "overlapping partition[1].  Adjusted.");
+                mem_size = reg_start - mem_start;
+                wl1251_debug(DEBUG_SPI, "mem_start %08X mem_size %08X",
+                             mem_start, mem_size);
+                wl1251_debug(DEBUG_SPI, "reg_start %08X reg_size %08X",
+                             reg_start, reg_size);
+        } else if ((reg_start < mem_start) &&
+                   ((reg_start + reg_size) > mem_start)) {
+                /* Guarantee that the register partition doesn't overlap the
+                 * memory partition */
+                wl1251_debug(DEBUG_SPI, "End of partition[1] is"
+                             " overlapping partition[0].  Adjusted.");
+                reg_size = mem_start - reg_start;
+                wl1251_debug(DEBUG_SPI, "mem_start %08X mem_size %08X",
+                             mem_start, mem_size);
+                wl1251_debug(DEBUG_SPI, "reg_start %08X reg_size %08X",
+                             reg_start, reg_size);
+        }
+
+        partition[0].start = mem_start;
+        partition[0].size  = mem_size;
+        partition[1].start = reg_start;
+        partition[1].size  = reg_size;
+
+        wl->physical_mem_addr = mem_start;
+        wl->physical_reg_addr = reg_start;
+
+        wl->virtual_mem_addr = 0;
+        wl->virtual_reg_addr = mem_size;
+
+        wl->if_ops->write(wl, HW_ACCESS_PART0_SIZE_ADDR, partition,
+                sizeof(partition));
+}
diff --git a/drivers/net/wireless/wl12xx/wl1251_io.h b/drivers/net/wireless/wl12xx/wl1251_io.h
new file mode 100644
index 000000000000..b89d2ac62efb
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/wl1251_io.h
@@ -0,0 +1,64 @@
+/*
+ * This file is part of wl12xx
+ *
+ * Copyright (C) 2008 Nokia Corporation
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+#ifndef __WL1251_IO_H__
+#define __WL1251_IO_H__
+
+#include "wl1251.h"
+
+#define HW_ACCESS_MEMORY_MAX_RANGE              0x1FFC0
+
+#define HW_ACCESS_PART0_SIZE_ADDR           0x1FFC0
+#define HW_ACCESS_PART0_START_ADDR          0x1FFC4
+#define HW_ACCESS_PART1_SIZE_ADDR           0x1FFC8
+#define HW_ACCESS_PART1_START_ADDR          0x1FFCC
+
+#define HW_ACCESS_REGISTER_SIZE             4
+
+#define HW_ACCESS_PRAM_MAX_RANGE                0x3c000
+
+static inline u32 wl1251_read32(struct wl1251 *wl, int addr)
+{
+        u32 response;
+
+        wl->if_ops->read(wl, addr, &response, sizeof(u32));
+
+        return response;
+}
+
+static inline void wl1251_write32(struct wl1251 *wl, int addr, u32 val)
+{
+        wl->if_ops->write(wl, addr, &val, sizeof(u32));
+}
+
+/* Memory target IO, address is translated to partition 0 */
+void wl1251_mem_read(struct wl1251 *wl, int addr, void *buf, size_t len);
+void wl1251_mem_write(struct wl1251 *wl, int addr, void *buf, size_t len);
+u32 wl1251_mem_read32(struct wl1251 *wl, int addr);
+void wl1251_mem_write32(struct wl1251 *wl, int addr, u32 val);
+/* Registers IO */
+u32 wl1251_reg_read32(struct wl1251 *wl, int addr);
+void wl1251_reg_write32(struct wl1251 *wl, int addr, u32 val);
+
+void wl1251_set_partition(struct wl1251 *wl,
+                          u32 part_start, u32 part_size,
+                          u32 reg_start,  u32 reg_size);
+
+#endif
diff --git a/drivers/net/wireless/wl12xx/wl1251_main.c b/drivers/net/wireless/wl12xx/wl1251_main.c
index da4c688c46af..7148934e464d 100644
--- a/drivers/net/wireless/wl12xx/wl1251_main.c
+++ b/drivers/net/wireless/wl12xx/wl1251_main.c
@@ -26,26 +26,30 @@
 #include <linux/firmware.h>
 #include <linux/delay.h>
 #include <linux/irq.h>
-#include <linux/spi/spi.h>
 #include <linux/crc32.h>
 #include <linux/etherdevice.h>
-#include <linux/spi/wl12xx.h>
 
 #include "wl1251.h"
 #include "wl12xx_80211.h"
-#include "reg.h"
-#include "wl1251_ops.h"
-#include "wl1251_spi.h"
+#include "wl1251_reg.h"
+#include "wl1251_io.h"
+#include "wl1251_cmd.h"
 #include "wl1251_event.h"
 #include "wl1251_tx.h"
 #include "wl1251_rx.h"
 #include "wl1251_ps.h"
 #include "wl1251_init.h"
 #include "wl1251_debugfs.h"
+#include "wl1251_boot.h"
 
-static void wl1251_disable_interrupts(struct wl1251 *wl)
+void wl1251_enable_interrupts(struct wl1251 *wl)
 {
-        disable_irq(wl->irq);
+        wl->if_ops->enable_irq(wl);
+}
+
+void wl1251_disable_interrupts(struct wl1251 *wl)
+{
+        wl->if_ops->disable_irq(wl);
 }
 
 static void wl1251_power_off(struct wl1251 *wl)
@@ -58,25 +62,13 @@ static void wl1251_power_on(struct wl1251 *wl)
         wl->set_power(true);
 }
 
-static irqreturn_t wl1251_irq(int irq, void *cookie)
-{
-        struct wl1251 *wl;
-
-        wl1251_debug(DEBUG_IRQ, "IRQ");
-
-        wl = cookie;
-
-        schedule_work(&wl->irq_work);
-
-        return IRQ_HANDLED;
-}
-
 static int wl1251_fetch_firmware(struct wl1251 *wl)
 {
         const struct firmware *fw;
+        struct device *dev = wiphy_dev(wl->hw->wiphy);
         int ret;
 
-        ret = request_firmware(&fw, wl->chip.fw_filename, &wl->spi->dev);
+        ret = request_firmware(&fw, WL1251_FW_NAME, dev);
 
         if (ret < 0) {
                 wl1251_error("could not get firmware: %d", ret);
@@ -112,9 +104,10 @@ out:
 static int wl1251_fetch_nvs(struct wl1251 *wl)
 {
         const struct firmware *fw;
+        struct device *dev = wiphy_dev(wl->hw->wiphy);
         int ret;
 
-        ret = request_firmware(&fw, wl->chip.nvs_filename, &wl->spi->dev);
+        ret = request_firmware(&fw, WL1251_NVS_NAME, dev);
 
         if (ret < 0) {
                 wl1251_error("could not get nvs file: %d", ret);
@@ -164,9 +157,8 @@ static int wl1251_chip_wakeup(struct wl1251 *wl)
         int ret = 0;
 
         wl1251_power_on(wl);
-        msleep(wl->chip.power_on_sleep);
-        wl1251_spi_reset(wl);
-        wl1251_spi_init(wl);
+        msleep(WL1251_POWER_ON_SLEEP);
+        wl->if_ops->reset(wl);
 
         /* We don't need a real memory partition here, because we only want
          * to use the registers at this point. */
@@ -182,22 +174,19 @@ static int wl1251_chip_wakeup(struct wl1251 *wl)
         /* whal_FwCtrl_BootSm() */
 
         /* 0. read chip id from CHIP_ID */
-        wl->chip.id = wl1251_reg_read32(wl, CHIP_ID_B);
+        wl->chip_id = wl1251_reg_read32(wl, CHIP_ID_B);
 
         /* 1. check if chip id is valid */
 
-        switch (wl->chip.id) {
+        switch (wl->chip_id) {
         case CHIP_ID_1251_PG12:
                 wl1251_debug(DEBUG_BOOT, "chip id 0x%x (1251 PG12)",
-                             wl->chip.id);
-
-                wl1251_setup(wl);
-
+                             wl->chip_id);
                 break;
         case CHIP_ID_1251_PG10:
         case CHIP_ID_1251_PG11:
         default:
-                wl1251_error("unsupported chip id: 0x%x", wl->chip.id);
+                wl1251_error("unsupported chip id: 0x%x", wl->chip_id);
                 ret = -ENODEV;
                 goto out;
         }
@@ -219,6 +208,135 @@ out:
         return ret;
 }
 
+static void wl1251_irq_work(struct work_struct *work)
+{
+        u32 intr;
+        struct wl1251 *wl =
+                container_of(work, struct wl1251, irq_work);
+        int ret;
+
+        mutex_lock(&wl->mutex);
+
+        wl1251_debug(DEBUG_IRQ, "IRQ work");
+
+        if (wl->state == WL1251_STATE_OFF)
+                goto out;
+
+        ret = wl1251_ps_elp_wakeup(wl);
+        if (ret < 0)
+                goto out;
+
+        wl1251_reg_write32(wl, ACX_REG_INTERRUPT_MASK, WL1251_ACX_INTR_ALL);
+
+        intr = wl1251_reg_read32(wl, ACX_REG_INTERRUPT_CLEAR);
+        wl1251_debug(DEBUG_IRQ, "intr: 0x%x", intr);
+
+        if (wl->data_path) {
+                wl->rx_counter =
+                        wl1251_mem_read32(wl, wl->data_path->rx_control_addr);
+
+                /* We handle a frmware bug here */
+                switch ((wl->rx_counter - wl->rx_handled) & 0xf) {
+                case 0:
+                        wl1251_debug(DEBUG_IRQ, "RX: FW and host in sync");
+                        intr &= ~WL1251_ACX_INTR_RX0_DATA;
+                        intr &= ~WL1251_ACX_INTR_RX1_DATA;
+                        break;
+                case 1:
+                        wl1251_debug(DEBUG_IRQ, "RX: FW +1");
+                        intr |= WL1251_ACX_INTR_RX0_DATA;
+                        intr &= ~WL1251_ACX_INTR_RX1_DATA;
+                        break;
+                case 2:
+                        wl1251_debug(DEBUG_IRQ, "RX: FW +2");
+                        intr |= WL1251_ACX_INTR_RX0_DATA;
+                        intr |= WL1251_ACX_INTR_RX1_DATA;
+                        break;
+                default:
+                        wl1251_warning("RX: FW and host out of sync: %d",
+                                       wl->rx_counter - wl->rx_handled);
+                        break;
+                }
+
+                wl->rx_handled = wl->rx_counter;
+
+
+                wl1251_debug(DEBUG_IRQ, "RX counter: %d", wl->rx_counter);
+        }
+
+        intr &= wl->intr_mask;
+
+        if (intr == 0) {
+                wl1251_debug(DEBUG_IRQ, "INTR is 0");
+                wl1251_reg_write32(wl, ACX_REG_INTERRUPT_MASK,
+                                   ~(wl->intr_mask));
+
+                goto out_sleep;
+        }
+
+        if (intr & WL1251_ACX_INTR_RX0_DATA) {
+                wl1251_debug(DEBUG_IRQ, "WL1251_ACX_INTR_RX0_DATA");
+                wl1251_rx(wl);
+        }
+
+        if (intr & WL1251_ACX_INTR_RX1_DATA) {
+                wl1251_debug(DEBUG_IRQ, "WL1251_ACX_INTR_RX1_DATA");
+                wl1251_rx(wl);
+        }
+
+        if (intr & WL1251_ACX_INTR_TX_RESULT) {
+                wl1251_debug(DEBUG_IRQ, "WL1251_ACX_INTR_TX_RESULT");
+                wl1251_tx_complete(wl);
+        }
+
+        if (intr & (WL1251_ACX_INTR_EVENT_A | WL1251_ACX_INTR_EVENT_B)) {
+                wl1251_debug(DEBUG_IRQ, "WL1251_ACX_INTR_EVENT (0x%x)", intr);
+                if (intr & WL1251_ACX_INTR_EVENT_A)
+                        wl1251_event_handle(wl, 0);
+                else
+                        wl1251_event_handle(wl, 1);
+        }
+
+        if (intr & WL1251_ACX_INTR_INIT_COMPLETE)
+                wl1251_debug(DEBUG_IRQ, "WL1251_ACX_INTR_INIT_COMPLETE");
+
+        wl1251_reg_write32(wl, ACX_REG_INTERRUPT_MASK, ~(wl->intr_mask));
+
+out_sleep:
+        wl1251_ps_elp_sleep(wl);
+
+out:
+        mutex_unlock(&wl->mutex);
+}
+
+static int wl1251_join(struct wl1251 *wl, u8 bss_type, u8 channel,
+                       u16 beacon_interval, u8 dtim_period)
+{
+        int ret;
+
+        ret = wl1251_acx_frame_rates(wl, DEFAULT_HW_GEN_TX_RATE,
+                                     DEFAULT_HW_GEN_MODULATION_TYPE,
+                                     wl->tx_mgmt_frm_rate,
+                                     wl->tx_mgmt_frm_mod);
+        if (ret < 0)
+                goto out;
+
+
+        ret = wl1251_cmd_join(wl, bss_type, channel, beacon_interval,
+                              dtim_period);
+        if (ret < 0)
+                goto out;
+
+        /*
+         * FIXME: we should wait for JOIN_EVENT_COMPLETE_ID but to simplify
+         * locking we just sleep instead, for now
+         */
+        msleep(10);
+
+out:
+        return ret;
+}
+
 static void wl1251_filter_work(struct work_struct *work)
 {
         struct wl1251 *wl =
@@ -234,8 +352,8 @@ static void wl1251_filter_work(struct work_struct *work)
         if (ret < 0)
                 goto out;
 
-        /* FIXME: replace the magic numbers with proper definitions */
-        ret = wl->chip.op_cmd_join(wl, wl->bss_type, 1, 100, 0);
+        ret = wl1251_join(wl, wl->bss_type, wl->channel, wl->beacon_int,
+                          wl->dtim_period);
         if (ret < 0)
                 goto out_sleep;
 
@@ -257,7 +375,7 @@ static int wl1251_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
          * before that, the tx_work will not be initialized!
          */
 
-        schedule_work(&wl->tx_work);
+        ieee80211_queue_work(wl->hw, &wl->tx_work);
 
         /*
          * The workqueue is slow to process the tx_queue and we need stop
@@ -297,11 +415,11 @@ static int wl1251_op_start(struct ieee80211_hw *hw)
         if (ret < 0)
                 goto out;
 
-        ret = wl->chip.op_boot(wl);
+        ret = wl1251_boot(wl);
         if (ret < 0)
                 goto out;
 
-        ret = wl->chip.op_hw_init(wl);
+        ret = wl1251_hw_init(wl);
         if (ret < 0)
                 goto out;
 
@@ -311,7 +429,7 @@ static int wl1251_op_start(struct ieee80211_hw *hw)
 
         wl->state = WL1251_STATE_ON;
 
-        wl1251_info("firmware booted (%s)", wl->chip.fw_ver);
+        wl1251_info("firmware booted (%s)", wl->fw_ver);
 
 out:
         if (ret < 0)
@@ -354,7 +472,7 @@ static void wl1251_op_stop(struct ieee80211_hw *hw)
         mutex_lock(&wl->mutex);
 
         /* let's notify MAC80211 about the remaining pending TX frames */
-        wl->chip.op_tx_flush(wl);
+        wl1251_tx_flush(wl);
         wl1251_power_off(wl);
 
         memset(wl->bssid, 0, ETH_ALEN);
@@ -371,6 +489,7 @@ static void wl1251_op_stop(struct ieee80211_hw *hw)
         wl->psm = 0;
         wl->tx_queue_stopped = false;
         wl->power_level = WL1251_DEFAULT_POWER_LEVEL;
+        wl->channel = WL1251_DEFAULT_CHANNEL;
 
         wl1251_debugfs_reset(wl);
 
@@ -474,12 +593,12 @@ static int wl1251_op_config(struct ieee80211_hw *hw, u32 changed)
                 goto out;
 
         if (channel != wl->channel) {
-                /* FIXME: use beacon interval provided by mac80211 */
-                ret = wl->chip.op_cmd_join(wl, wl->bss_type, 1, 100, 0);
+                wl->channel = channel;
+
+                ret = wl1251_join(wl, wl->bss_type, wl->channel,
+                                  wl->beacon_int, wl->dtim_period);
                 if (ret < 0)
                         goto out_sleep;
-
-                wl->channel = channel;
         }
 
         ret = wl1251_build_null_data(wl);
@@ -877,7 +996,7 @@ static int wl1251_hw_scan(struct wl1251 *wl, u8 *ssid, size_t len,
         if (ret < 0)
                 wl1251_error("SCAN failed");
 
-        wl1251_spi_mem_read(wl, wl->cmd_box_addr, params, sizeof(*params));
+        wl1251_mem_read(wl, wl->cmd_box_addr, params, sizeof(*params));
 
         if (params->header.status != CMD_STATUS_SUCCESS) {
                 wl1251_error("TEST command answer error: %d",
@@ -967,6 +1086,11 @@ static void wl1251_op_bss_info_changed(struct ieee80211_hw *hw,
 
         if (changed & BSS_CHANGED_ASSOC) {
                 if (bss_conf->assoc) {
+                        wl->beacon_int = bss_conf->beacon_int;
+                        wl->dtim_period = bss_conf->dtim_period;
+
+                        /* FIXME: call join */
+
                         wl->aid = bss_conf->aid;
 
                         ret = wl1251_build_ps_poll(wl, wl->aid);
@@ -984,6 +1108,10 @@ static void wl1251_op_bss_info_changed(struct ieee80211_hw *hw,
                                 if (ret < 0)
                                         goto out_sleep;
                         }
+                } else {
+                        /* use defaults when not associated */
+                        wl->beacon_int = WL1251_DEFAULT_BEACON_INT;
+                        wl->dtim_period = WL1251_DEFAULT_DTIM_PERIOD;
                 }
         }
         if (changed & BSS_CHANGED_ERP_SLOT) {
@@ -1023,7 +1151,8 @@ static void wl1251_op_bss_info_changed(struct ieee80211_hw *hw,
                         goto out;
 
                 if (wl->bss_type != BSS_TYPE_IBSS) {
-                        ret = wl1251_cmd_join(wl, wl->bss_type, 5, 100, 1);
+                        ret = wl1251_join(wl, wl->bss_type, wl->channel,
+                                          wl->beacon_int, wl->dtim_period);
                         if (ret < 0)
                                 goto out_sleep;
                         wl1251_warning("Set ctsprotect failed %d", ret);
@@ -1049,7 +1178,8 @@ static void wl1251_op_bss_info_changed(struct ieee80211_hw *hw,
                 if (ret < 0)
                         goto out;
 
-                ret = wl->chip.op_cmd_join(wl, wl->bss_type, 1, 100, 0);
+                ret = wl1251_join(wl, wl->bss_type, wl->beacon_int,
+                                  wl->channel, wl->dtim_period);
 
                 if (ret < 0)
                         goto out;
@@ -1167,8 +1297,10 @@ static int wl1251_register_hw(struct wl1251 *wl)
         return 0;
 }
 
-static int wl1251_init_ieee80211(struct wl1251 *wl)
+int wl1251_init_ieee80211(struct wl1251 *wl)
 {
+        int ret;
+
         /* The tx descriptor buffer and the TKIP space */
         wl->hw->extra_tx_headroom = sizeof(struct tx_double_buffer_desc)
                 + WL1251_TKIP_IV_SPACE;
@@ -1184,38 +1316,37 @@ static int wl1251_init_ieee80211(struct wl1251 *wl)
         wl->hw->wiphy->max_scan_ssids = 1;
         wl->hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &wl1251_band_2ghz;
 
-        SET_IEEE80211_DEV(wl->hw, &wl->spi->dev);
+        ret = wl1251_register_hw(wl);
+        if (ret)
+                goto out;
 
-        return 0;
+        wl1251_debugfs_init(wl);
+        wl1251_notice("initialized");
+
+        ret = 0;
+
+out:
+        return ret;
 }
+EXPORT_SYMBOL_GPL(wl1251_init_ieee80211);
 
-#define WL1251_DEFAULT_CHANNEL 1
-static int __devinit wl1251_probe(struct spi_device *spi)
+struct ieee80211_hw *wl1251_alloc_hw(void)
 {
-        struct wl12xx_platform_data *pdata;
         struct ieee80211_hw *hw;
         struct wl1251 *wl;
-        int ret, i;
+        int i;
         static const u8 nokia_oui[3] = {0x00, 0x1f, 0xdf};
 
-        pdata = spi->dev.platform_data;
-        if (!pdata) {
-                wl1251_error("no platform data");
-                return -ENODEV;
-        }
-
         hw = ieee80211_alloc_hw(sizeof(*wl), &wl1251_ops);
         if (!hw) {
                 wl1251_error("could not alloc ieee80211_hw");
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
         }
 
         wl = hw->priv;
         memset(wl, 0, sizeof(*wl));
 
         wl->hw = hw;
-        dev_set_drvdata(&spi->dev, wl);
-        wl->spi = spi;
 
         wl->data_in_count = 0;
 
@@ -1237,16 +1368,17 @@ static int __devinit wl1251_probe(struct spi_device *spi)
         wl->psm_requested = false;
         wl->tx_queue_stopped = false;
         wl->power_level = WL1251_DEFAULT_POWER_LEVEL;
-
-        /* We use the default power on sleep time until we know which chip
-         * we're using */
-        wl->chip.power_on_sleep = WL1251_DEFAULT_POWER_ON_SLEEP;
+        wl->beacon_int = WL1251_DEFAULT_BEACON_INT;
+        wl->dtim_period = WL1251_DEFAULT_DTIM_PERIOD;
 
         for (i = 0; i < FW_TX_CMPLT_BLOCK_SIZE; i++)
                 wl->tx_frames[i] = NULL;
 
         wl->next_tx_complete = 0;
 
+        INIT_WORK(&wl->irq_work, wl1251_irq_work);
+        INIT_WORK(&wl->tx_work, wl1251_tx_work);
+
         /*
          * In case our MAC address is not correctly set,
          * we use a random but Nokia MAC.
@@ -1263,79 +1395,20 @@ static int __devinit wl1251_probe(struct spi_device *spi)
         wl->rx_descriptor = kmalloc(sizeof(*wl->rx_descriptor), GFP_KERNEL);
         if (!wl->rx_descriptor) {
                 wl1251_error("could not allocate memory for rx descriptor");
-                ret = -ENOMEM;
-                goto out_free;
-        }
-
-        /* This is the only SPI value that we need to set here, the rest
-         * comes from the board-peripherals file */
-        spi->bits_per_word = 32;
-
-        ret = spi_setup(spi);
-        if (ret < 0) {
-                wl1251_error("spi_setup failed");
-                goto out_free;
+                ieee80211_free_hw(hw);
+                return ERR_PTR(-ENOMEM);
         }
 
-        wl->set_power = pdata->set_power;
-        if (!wl->set_power) {
-                wl1251_error("set power function missing in platform data");
-                ret = -ENODEV;
-                goto out_free;
-        }
-
-        wl->irq = spi->irq;
-        if (wl->irq < 0) {
-                wl1251_error("irq missing in platform data");
-                ret = -ENODEV;
-                goto out_free;
-        }
-
-        ret = request_irq(wl->irq, wl1251_irq, 0, DRIVER_NAME, wl);
-        if (ret < 0) {
-                wl1251_error("request_irq() failed: %d", ret);
-                goto out_free;
-        }
-
-        set_irq_type(wl->irq, IRQ_TYPE_EDGE_RISING);
-
-        disable_irq(wl->irq);
-
-        ret = wl1251_init_ieee80211(wl);
-        if (ret)
-                goto out_irq;
-
-        ret = wl1251_register_hw(wl);
-        if (ret)
-                goto out_irq;
-
-        wl1251_debugfs_init(wl);
-
-        wl1251_notice("initialized");
-
-        return 0;
-
- out_irq:
-        free_irq(wl->irq, wl);
-
- out_free:
-        kfree(wl->rx_descriptor);
-        wl->rx_descriptor = NULL;
-
-        ieee80211_free_hw(hw);
-
-        return ret;
+        return hw;
 }
+EXPORT_SYMBOL_GPL(wl1251_alloc_hw);
 
-static int __devexit wl1251_remove(struct spi_device *spi)
+int wl1251_free_hw(struct wl1251 *wl)
 {
-        struct wl1251 *wl = dev_get_drvdata(&spi->dev);
-
         ieee80211_unregister_hw(wl->hw);
 
         wl1251_debugfs_exit(wl);
 
-        free_irq(wl->irq, wl);
         kfree(wl->target_mem_map);
         kfree(wl->data_path);
         kfree(wl->fw);
@@ -1350,44 +1423,8 @@ static int __devexit wl1251_remove(struct spi_device *spi)
 
         return 0;
 }
+EXPORT_SYMBOL_GPL(wl1251_free_hw);
 
-
-static struct spi_driver wl1251_spi_driver = {
-        .driver = {
-                /* FIXME: use wl12xx name to not break the user space */
-                .name           = "wl12xx",
-                .bus            = &spi_bus_type,
-                .owner          = THIS_MODULE,
-        },
-
-        .probe          = wl1251_probe,
-        .remove         = __devexit_p(wl1251_remove),
-};
-
-static int __init wl1251_init(void)
-{
-        int ret;
-
-        ret = spi_register_driver(&wl1251_spi_driver);
-        if (ret < 0) {
-                wl1251_error("failed to register spi driver: %d", ret);
-                goto out;
-        }
-
-out:
-        return ret;
-}
-
-static void __exit wl1251_exit(void)
-{
-        spi_unregister_driver(&wl1251_spi_driver);
-
-        wl1251_notice("unloaded");
-}
-
-module_init(wl1251_init);
-module_exit(wl1251_exit);
-
+MODULE_DESCRIPTION("TI wl1251 Wireles LAN Driver Core");
 MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Kalle Valo <Kalle.Valo@nokia.com>, "
-                "Luciano Coelho <luciano.coelho@nokia.com>");
+MODULE_AUTHOR("Kalle Valo <kalle.valo@nokia.com>");
diff --git a/drivers/net/wireless/wl12xx/wl1251_ops.c b/drivers/net/wireless/wl12xx/wl1251_ops.c
deleted file mode 100644
index e7b9aab3682f..000000000000
--- a/drivers/net/wireless/wl12xx/wl1251_ops.c
+++ /dev/null
@@ -1,728 +0,0 @@
-/*
- * This file is part of wl1251
- *
- * Copyright (C) 2008-2009 Nokia Corporation
- *
- * Contact: Kalle Valo <kalle.valo@nokia.com>
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * version 2 as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
- * 02110-1301 USA
- *
- */
-
-#include <linux/kernel.h>
-#include <linux/module.h>
-
-#include "wl1251_ops.h"
-#include "reg.h"
-#include "wl1251_spi.h"
-#include "wl1251_boot.h"
-#include "wl1251_event.h"
-#include "wl1251_acx.h"
-#include "wl1251_tx.h"
-#include "wl1251_rx.h"
-#include "wl1251_ps.h"
-#include "wl1251_init.h"
-
-static struct wl1251_partition_set wl1251_part_table[PART_TABLE_LEN] = {
-        [PART_DOWN] = {
-                .mem = {
-                        .start = 0x00000000,
-                        .size  = 0x00016800
-                },
-                .reg = {
-                        .start = REGISTERS_BASE,
-                        .size  = REGISTERS_DOWN_SIZE
-                },
-        },
-
-        [PART_WORK] = {
-                .mem = {
-                        .start = 0x00028000,
-                        .size  = 0x00014000
-                },
-                .reg = {
-                        .start = REGISTERS_BASE,
-                        .size  = REGISTERS_WORK_SIZE
-                },
-        },
-
-        /* WL1251 doesn't use the DRPW partition, so we don't set it here */
-};
-
-static enum wl12xx_acx_int_reg wl1251_acx_reg_table[ACX_REG_TABLE_LEN] = {
-        [ACX_REG_INTERRUPT_TRIG]     = (REGISTERS_BASE + 0x0474),
-        [ACX_REG_INTERRUPT_TRIG_H]   = (REGISTERS_BASE + 0x0478),
-        [ACX_REG_INTERRUPT_MASK]     = (REGISTERS_BASE + 0x0494),
-        [ACX_REG_HINT_MASK_SET]      = (REGISTERS_BASE + 0x0498),
-        [ACX_REG_HINT_MASK_CLR]      = (REGISTERS_BASE + 0x049C),
-        [ACX_REG_INTERRUPT_NO_CLEAR] = (REGISTERS_BASE + 0x04B0),
-        [ACX_REG_INTERRUPT_CLEAR]    = (REGISTERS_BASE + 0x04A4),
-        [ACX_REG_INTERRUPT_ACK]      = (REGISTERS_BASE + 0x04A8),
-        [ACX_REG_SLV_SOFT_RESET]     = (REGISTERS_BASE + 0x0000),
-        [ACX_REG_EE_START]           = (REGISTERS_BASE + 0x080C),
-        [ACX_REG_ECPU_CONTROL]       = (REGISTERS_BASE + 0x0804)
-};
-
-static int wl1251_upload_firmware(struct wl1251 *wl)
-{
-        struct wl1251_partition_set *p_table = wl->chip.p_table;
-        int addr, chunk_num, partition_limit;
-        size_t fw_data_len;
-        u8 *p;
-
-        /* whal_FwCtrl_LoadFwImageSm() */
-
-        wl1251_debug(DEBUG_BOOT, "chip id before fw upload: 0x%x",
-                     wl1251_reg_read32(wl, CHIP_ID_B));
-
-        /* 10.0 check firmware length and set partition */
-        fw_data_len =  (wl->fw[4] << 24) | (wl->fw[5] << 16) |
-                (wl->fw[6] << 8) | (wl->fw[7]);
-
-        wl1251_debug(DEBUG_BOOT, "fw_data_len %zu chunk_size %d", fw_data_len,
-                CHUNK_SIZE);
-
-        if ((fw_data_len % 4) != 0) {
-                wl1251_error("firmware length not multiple of four");
-                return -EIO;
-        }
-
-        wl1251_set_partition(wl,
-                             p_table[PART_DOWN].mem.start,
-                             p_table[PART_DOWN].mem.size,
-                             p_table[PART_DOWN].reg.start,
-                             p_table[PART_DOWN].reg.size);
-
-        /* 10.1 set partition limit and chunk num */
-        chunk_num = 0;
-        partition_limit = p_table[PART_DOWN].mem.size;
-
-        while (chunk_num < fw_data_len / CHUNK_SIZE) {
-                /* 10.2 update partition, if needed */
-                addr = p_table[PART_DOWN].mem.start +
-                        (chunk_num + 2) * CHUNK_SIZE;
-                if (addr > partition_limit) {
-                        addr = p_table[PART_DOWN].mem.start +
-                                chunk_num * CHUNK_SIZE;
-                        partition_limit = chunk_num * CHUNK_SIZE +
-                                p_table[PART_DOWN].mem.size;
-                        wl1251_set_partition(wl,
-                                             addr,
-                                             p_table[PART_DOWN].mem.size,
-                                             p_table[PART_DOWN].reg.start,
-                                             p_table[PART_DOWN].reg.size);
-                }
-
-                /* 10.3 upload the chunk */
-                addr = p_table[PART_DOWN].mem.start + chunk_num * CHUNK_SIZE;
-                p = wl->fw + FW_HDR_SIZE + chunk_num * CHUNK_SIZE;
-                wl1251_debug(DEBUG_BOOT, "uploading fw chunk 0x%p to 0x%x",
-                             p, addr);
-                wl1251_spi_mem_write(wl, addr, p, CHUNK_SIZE);
-
-                chunk_num++;
-        }
-
-        /* 10.4 upload the last chunk */
-        addr = p_table[PART_DOWN].mem.start + chunk_num * CHUNK_SIZE;
-        p = wl->fw + FW_HDR_SIZE + chunk_num * CHUNK_SIZE;
-        wl1251_debug(DEBUG_BOOT, "uploading fw last chunk (%zu B) 0x%p to 0x%x",
-                     fw_data_len % CHUNK_SIZE, p, addr);
-        wl1251_spi_mem_write(wl, addr, p, fw_data_len % CHUNK_SIZE);
-
-        return 0;
-}
-
-static int wl1251_upload_nvs(struct wl1251 *wl)
-{
-        size_t nvs_len, nvs_bytes_written, burst_len;
-        int nvs_start, i;
-        u32 dest_addr, val;
-        u8 *nvs_ptr, *nvs;
-
-        nvs = wl->nvs;
-        if (nvs == NULL)
-                return -ENODEV;
-
-        nvs_ptr = nvs;
-
-        nvs_len = wl->nvs_len;
-        nvs_start = wl->fw_len;
-
-        /*
-         * Layout before the actual NVS tables:
-         * 1 byte : burst length.
-         * 2 bytes: destination address.
-         * n bytes: data to burst copy.
-         *
-         * This is ended by a 0 length, then the NVS tables.
-         */
-
-        while (nvs_ptr[0]) {
-                burst_len = nvs_ptr[0];
-                dest_addr = (nvs_ptr[1] & 0xfe) | ((u32)(nvs_ptr[2] << 8));
-
-                /* We move our pointer to the data */
-                nvs_ptr += 3;
-
-                for (i = 0; i < burst_len; i++) {
-                        val = (nvs_ptr[0] | (nvs_ptr[1] << 8)
-                               | (nvs_ptr[2] << 16) | (nvs_ptr[3] << 24));
-
-                        wl1251_debug(DEBUG_BOOT,
-                                     "nvs burst write 0x%x: 0x%x",
-                                     dest_addr, val);
-                        wl1251_mem_write32(wl, dest_addr, val);
-
-                        nvs_ptr += 4;
-                        dest_addr += 4;
-                }
-        }
-
-        /*
-         * We've reached the first zero length, the first NVS table
-         * is 7 bytes further.
-         */
-        nvs_ptr += 7;
-        nvs_len -= nvs_ptr - nvs;
-        nvs_len = ALIGN(nvs_len, 4);
-
-        /* Now we must set the partition correctly */
-        wl1251_set_partition(wl, nvs_start,
-                             wl->chip.p_table[PART_DOWN].mem.size,
-                             wl->chip.p_table[PART_DOWN].reg.start,
-                             wl->chip.p_table[PART_DOWN].reg.size);
-
-        /* And finally we upload the NVS tables */
-        nvs_bytes_written = 0;
-        while (nvs_bytes_written < nvs_len) {
-                val = (nvs_ptr[0] | (nvs_ptr[1] << 8)
-                       | (nvs_ptr[2] << 16) | (nvs_ptr[3] << 24));
-
-                val = cpu_to_le32(val);
-
-                wl1251_debug(DEBUG_BOOT,
-                             "nvs write table 0x%x: 0x%x",
-                             nvs_start, val);
-                wl1251_mem_write32(wl, nvs_start, val);
-
-                nvs_ptr += 4;
-                nvs_bytes_written += 4;
-                nvs_start += 4;
-        }
-
-        return 0;
-}
-
-static int wl1251_boot(struct wl1251 *wl)
-{
-        int ret = 0, minor_minor_e2_ver;
-        u32 tmp, boot_data;
-
-        ret = wl1251_boot_soft_reset(wl);
-        if (ret < 0)
-                goto out;
-
-        /* 2. start processing NVS file */
-        ret = wl->chip.op_upload_nvs(wl);
-        if (ret < 0)
-                goto out;
-
-        /* write firmware's last address (ie. it's length) to
-         * ACX_EEPROMLESS_IND_REG */
-        wl1251_reg_write32(wl, ACX_EEPROMLESS_IND_REG, wl->fw_len);
-
-        /* 6. read the EEPROM parameters */
-        tmp = wl1251_reg_read32(wl, SCR_PAD2);
-
-        /* 7. read bootdata */
-        wl->boot_attr.radio_type = (tmp & 0x0000FF00) >> 8;
-        wl->boot_attr.major = (tmp & 0x00FF0000) >> 16;
-        tmp = wl1251_reg_read32(wl, SCR_PAD3);
-
-        /* 8. check bootdata and call restart sequence */
-        wl->boot_attr.minor = (tmp & 0x00FF0000) >> 16;
-        minor_minor_e2_ver = (tmp & 0xFF000000) >> 24;
-
-        wl1251_debug(DEBUG_BOOT, "radioType 0x%x majorE2Ver 0x%x "
-                     "minorE2Ver 0x%x minor_minor_e2_ver 0x%x",
-                     wl->boot_attr.radio_type, wl->boot_attr.major,
-                     wl->boot_attr.minor, minor_minor_e2_ver);
-
-        ret = wl1251_boot_init_seq(wl);
-        if (ret < 0)
-                goto out;
-
-        /* 9. NVS processing done */
-        boot_data = wl1251_reg_read32(wl, ACX_REG_ECPU_CONTROL);
-
-        wl1251_debug(DEBUG_BOOT, "halt boot_data 0x%x", boot_data);
-
-        /* 10. check that ECPU_CONTROL_HALT bits are set in
-         * pWhalBus->uBootData and start uploading firmware
-         */
-        if ((boot_data & ECPU_CONTROL_HALT) == 0) {
-                wl1251_error("boot failed, ECPU_CONTROL_HALT not set");
-                ret = -EIO;
-                goto out;
-        }
-
-        ret = wl->chip.op_upload_fw(wl);
-        if (ret < 0)
-                goto out;
-
-        /* 10.5 start firmware */
-        ret = wl1251_boot_run_firmware(wl);
-        if (ret < 0)
-                goto out;
-
-out:
-        return ret;
-}
-
-static int wl1251_mem_cfg(struct wl1251 *wl)
-{
-        struct wl1251_acx_config_memory *mem_conf;
-        int ret, i;
-
-        wl1251_debug(DEBUG_ACX, "wl1251 mem cfg");
-
-        mem_conf = kzalloc(sizeof(*mem_conf), GFP_KERNEL);
-        if (!mem_conf) {
-                ret = -ENOMEM;
-                goto out;
-        }
-
-        /* memory config */
-        mem_conf->mem_config.num_stations = cpu_to_le16(DEFAULT_NUM_STATIONS);
-        mem_conf->mem_config.rx_mem_block_num = 35;
-        mem_conf->mem_config.tx_min_mem_block_num = 64;
-        mem_conf->mem_config.num_tx_queues = MAX_TX_QUEUES;
-        mem_conf->mem_config.host_if_options = HOSTIF_PKT_RING;
-        mem_conf->mem_config.num_ssid_profiles = 1;
-        mem_conf->mem_config.debug_buffer_size =
-                cpu_to_le16(TRACE_BUFFER_MAX_SIZE);
-
-        /* RX queue config */
-        mem_conf->rx_queue_config.dma_address = 0;
-        mem_conf->rx_queue_config.num_descs = ACX_RX_DESC_DEF;
-        mem_conf->rx_queue_config.priority = DEFAULT_RXQ_PRIORITY;
-        mem_conf->rx_queue_config.type = DEFAULT_RXQ_TYPE;
-
-        /* TX queue config */
-        for (i = 0; i < MAX_TX_QUEUES; i++) {
-                mem_conf->tx_queue_config[i].num_descs = ACX_TX_DESC_DEF;
-                mem_conf->tx_queue_config[i].attributes = i;
-        }
-
-        ret = wl1251_cmd_configure(wl, ACX_MEM_CFG, mem_conf,
-                                   sizeof(*mem_conf));
-        if (ret < 0) {
-                wl1251_warning("wl1251 mem config failed: %d", ret);
-                goto out;
-        }
-
-out:
-        kfree(mem_conf);
-        return ret;
-}
-
-static int wl1251_hw_init_mem_config(struct wl1251 *wl)
-{
-        int ret;
-
-        ret = wl1251_mem_cfg(wl);
-        if (ret < 0)
-                return ret;
-
-        wl->target_mem_map = kzalloc(sizeof(struct wl1251_acx_mem_map),
-                                          GFP_KERNEL);
-        if (!wl->target_mem_map) {
-                wl1251_error("couldn't allocate target memory map");
-                return -ENOMEM;
-        }
-
-        /* we now ask for the firmware built memory map */
-        ret = wl1251_acx_mem_map(wl, wl->target_mem_map,
-                                 sizeof(struct wl1251_acx_mem_map));
-        if (ret < 0) {
-                wl1251_error("couldn't retrieve firmware memory map");
-                kfree(wl->target_mem_map);
-                wl->target_mem_map = NULL;
-                return ret;
-        }
-
-        return 0;
-}
-
-static void wl1251_set_ecpu_ctrl(struct wl1251 *wl, u32 flag)
-{
-        u32 cpu_ctrl;
-
-        /* 10.5.0 run the firmware (I) */
-        cpu_ctrl = wl1251_reg_read32(wl, ACX_REG_ECPU_CONTROL);
-
-        /* 10.5.1 run the firmware (II) */
-        cpu_ctrl &= ~flag;
-        wl1251_reg_write32(wl, ACX_REG_ECPU_CONTROL, cpu_ctrl);
-}
-
-static void wl1251_target_enable_interrupts(struct wl1251 *wl)
-{
-        /* Enable target's interrupts */
-        wl->intr_mask = WL1251_ACX_INTR_RX0_DATA |
-                WL1251_ACX_INTR_RX1_DATA |
-                WL1251_ACX_INTR_TX_RESULT |
-                WL1251_ACX_INTR_EVENT_A |
-                WL1251_ACX_INTR_EVENT_B |
-                WL1251_ACX_INTR_INIT_COMPLETE;
-        wl1251_boot_target_enable_interrupts(wl);
-}
-
-static void wl1251_fw_version(struct wl1251 *wl)
-{
-        wl1251_acx_fw_version(wl, wl->chip.fw_ver, sizeof(wl->chip.fw_ver));
-}
-
-static void wl1251_irq_work(struct work_struct *work)
-{
-        u32 intr;
-        struct wl1251 *wl =
-                container_of(work, struct wl1251, irq_work);
-        int ret;
-
-        mutex_lock(&wl->mutex);
-
-        wl1251_debug(DEBUG_IRQ, "IRQ work");
-
-        if (wl->state == WL1251_STATE_OFF)
-                goto out;
-
-        ret = wl1251_ps_elp_wakeup(wl);
-        if (ret < 0)
-                goto out;
-
-        wl1251_reg_write32(wl, ACX_REG_INTERRUPT_MASK, WL1251_ACX_INTR_ALL);
-
-        intr = wl1251_reg_read32(wl, ACX_REG_INTERRUPT_CLEAR);
-        wl1251_debug(DEBUG_IRQ, "intr: 0x%x", intr);
-
-        if (wl->data_path) {
-                wl->rx_counter =
-                        wl1251_mem_read32(wl, wl->data_path->rx_control_addr);
-
-                /* We handle a firmware bug here */
-                switch ((wl->rx_counter - wl->rx_handled) & 0xf) {
-                case 0:
-                        wl1251_debug(DEBUG_IRQ, "RX: FW and host in sync");
-                        intr &= ~WL1251_ACX_INTR_RX0_DATA;
-                        intr &= ~WL1251_ACX_INTR_RX1_DATA;
-                        break;
-                case 1:
-                        wl1251_debug(DEBUG_IRQ, "RX: FW +1");
-                        intr |= WL1251_ACX_INTR_RX0_DATA;
-                        intr &= ~WL1251_ACX_INTR_RX1_DATA;
-                        break;
-                case 2:
-                        wl1251_debug(DEBUG_IRQ, "RX: FW +2");
-                        intr |= WL1251_ACX_INTR_RX0_DATA;
-                        intr |= WL1251_ACX_INTR_RX1_DATA;
-                        break;
-                default:
-                        wl1251_warning("RX: FW and host out of sync: %d",
-                                       wl->rx_counter - wl->rx_handled);
-                        break;
-                }
-
-                wl->rx_handled = wl->rx_counter;
-
-
-                wl1251_debug(DEBUG_IRQ, "RX counter: %d", wl->rx_counter);
-        }
-
-        intr &= wl->intr_mask;
-
-        if (intr == 0) {
-                wl1251_debug(DEBUG_IRQ, "INTR is 0");
-                wl1251_reg_write32(wl, ACX_REG_INTERRUPT_MASK,
-                                   ~(wl->intr_mask));
-
-                goto out_sleep;
-        }
-
-        if (intr & WL1251_ACX_INTR_RX0_DATA) {
-                wl1251_debug(DEBUG_IRQ, "WL1251_ACX_INTR_RX0_DATA");
-                wl1251_rx(wl);
-        }
-
-        if (intr & WL1251_ACX_INTR_RX1_DATA) {
-                wl1251_debug(DEBUG_IRQ, "WL1251_ACX_INTR_RX1_DATA");
-                wl1251_rx(wl);
-        }
-
-        if (intr & WL1251_ACX_INTR_TX_RESULT) {
-                wl1251_debug(DEBUG_IRQ, "WL1251_ACX_INTR_TX_RESULT");
-                wl1251_tx_complete(wl);
-        }
-
-        if (intr & (WL1251_ACX_INTR_EVENT_A | WL1251_ACX_INTR_EVENT_B)) {
-                wl1251_debug(DEBUG_IRQ, "WL1251_ACX_INTR_EVENT (0x%x)", intr);
-                if (intr & WL1251_ACX_INTR_EVENT_A)
-                        wl1251_event_handle(wl, 0);
-                else
-                        wl1251_event_handle(wl, 1);
-        }
-
-        if (intr & WL1251_ACX_INTR_INIT_COMPLETE)
-                wl1251_debug(DEBUG_IRQ, "WL1251_ACX_INTR_INIT_COMPLETE");
-
-        wl1251_reg_write32(wl, ACX_REG_INTERRUPT_MASK, ~(wl->intr_mask));
-
-out_sleep:
-        wl1251_ps_elp_sleep(wl);
-
-out:
-        mutex_unlock(&wl->mutex);
-}
-
-static int wl1251_hw_init_txq_fill(u8 qid,
-                                   struct acx_tx_queue_qos_config *config,
-                                   u32 num_blocks)
-{
-        config->qid = qid;
-
-        switch (qid) {
-        case QOS_AC_BE:
-                config->high_threshold =
-                        (QOS_TX_HIGH_BE_DEF * num_blocks) / 100;
-                config->low_threshold =
-                        (QOS_TX_LOW_BE_DEF * num_blocks) / 100;
-                break;
-        case QOS_AC_BK:
-                config->high_threshold =
-                        (QOS_TX_HIGH_BK_DEF * num_blocks) / 100;
-                config->low_threshold =
-                        (QOS_TX_LOW_BK_DEF * num_blocks) / 100;
-                break;
-        case QOS_AC_VI:
-                config->high_threshold =
-                        (QOS_TX_HIGH_VI_DEF * num_blocks) / 100;
-                config->low_threshold =
-                        (QOS_TX_LOW_VI_DEF * num_blocks) / 100;
-                break;
-        case QOS_AC_VO:
-                config->high_threshold =
-                        (QOS_TX_HIGH_VO_DEF * num_blocks) / 100;
-                config->low_threshold =
-                        (QOS_TX_LOW_VO_DEF * num_blocks) / 100;
-                break;
-        default:
-                wl1251_error("Invalid TX queue id: %d", qid);
-                return -EINVAL;
-        }
-
-        return 0;
-}
-
-static int wl1251_hw_init_tx_queue_config(struct wl1251 *wl)
-{
-        struct acx_tx_queue_qos_config *config;
-        struct wl1251_acx_mem_map *wl_mem_map = wl->target_mem_map;
-        int ret, i;
-
-        wl1251_debug(DEBUG_ACX, "acx tx queue config");
-
-        config = kzalloc(sizeof(*config), GFP_KERNEL);
-        if (!config) {
-                ret = -ENOMEM;
-                goto out;
-        }
-
-        for (i = 0; i < MAX_NUM_OF_AC; i++) {
-                ret = wl1251_hw_init_txq_fill(i, config,
-                                              wl_mem_map->num_tx_mem_blocks);
-                if (ret < 0)
-                        goto out;
-
-                ret = wl1251_cmd_configure(wl, ACX_TX_QUEUE_CFG,
-                                           config, sizeof(*config));
-                if (ret < 0)
-                        goto out;
-        }
-
-out:
-        kfree(config);
-        return ret;
-}
-
-static int wl1251_hw_init_data_path_config(struct wl1251 *wl)
-{
-        int ret;
-
-        /* asking for the data path parameters */
-        wl->data_path = kzalloc(sizeof(struct acx_data_path_params_resp),
-                                GFP_KERNEL);
-        if (!wl->data_path) {
-                wl1251_error("Couldn't allocate data path parameters");
-                return -ENOMEM;
-        }
-
-        ret = wl1251_acx_data_path_params(wl, wl->data_path);
-        if (ret < 0) {
-                kfree(wl->data_path);
-                wl->data_path = NULL;
-                return ret;
-        }
-
-        return 0;
-}
-
-static int wl1251_hw_init(struct wl1251 *wl)
-{
-        struct wl1251_acx_mem_map *wl_mem_map;
-        int ret;
-
-        ret = wl1251_hw_init_hwenc_config(wl);
-        if (ret < 0)
-                return ret;
-
-        /* Template settings */
-        ret = wl1251_hw_init_templates_config(wl);
-        if (ret < 0)
-                return ret;
-
-        /* Default memory configuration */
-        ret = wl1251_hw_init_mem_config(wl);
-        if (ret < 0)
-                return ret;
-
-        /* Default data path configuration  */
-        ret = wl1251_hw_init_data_path_config(wl);
-        if (ret < 0)
-                goto out_free_memmap;
-
-        /* RX config */
-        ret = wl1251_hw_init_rx_config(wl,
-                                       RX_CFG_PROMISCUOUS | RX_CFG_TSF,
-                                       RX_FILTER_OPTION_DEF);
-        /* RX_CONFIG_OPTION_ANY_DST_ANY_BSS,
-           RX_FILTER_OPTION_FILTER_ALL); */
-        if (ret < 0)
-                goto out_free_data_path;
-
-        /* TX queues config */
-        ret = wl1251_hw_init_tx_queue_config(wl);
-        if (ret < 0)
-                goto out_free_data_path;
-
-        /* PHY layer config */
-        ret = wl1251_hw_init_phy_config(wl);
-        if (ret < 0)
-                goto out_free_data_path;
-
-        /* Beacon filtering */
-        ret = wl1251_hw_init_beacon_filter(wl);
-        if (ret < 0)
-                goto out_free_data_path;
-
-        /* Bluetooth WLAN coexistence */
-        ret = wl1251_hw_init_pta(wl);
-        if (ret < 0)
-                goto out_free_data_path;
-
-        /* Energy detection */
-        ret = wl1251_hw_init_energy_detection(wl);
-        if (ret < 0)
-                goto out_free_data_path;
-
-        /* Beacons and boradcast settings */
-        ret = wl1251_hw_init_beacon_broadcast(wl);
-        if (ret < 0)
-                goto out_free_data_path;
-
-        /* Enable data path */
-        ret = wl1251_cmd_data_path(wl, wl->channel, 1);
-        if (ret < 0)
-                goto out_free_data_path;
-
-        /* Default power state */
-        ret = wl1251_hw_init_power_auth(wl);
-        if (ret < 0)
-                goto out_free_data_path;
-
-        wl_mem_map = wl->target_mem_map;
-        wl1251_info("%d tx blocks at 0x%x, %d rx blocks at 0x%x",
-                    wl_mem_map->num_tx_mem_blocks,
-                    wl->data_path->tx_control_addr,
-                    wl_mem_map->num_rx_mem_blocks,
-                    wl->data_path->rx_control_addr);
-
-        return 0;
-
- out_free_data_path:
-        kfree(wl->data_path);
-
- out_free_memmap:
-        kfree(wl->target_mem_map);
-
-        return ret;
-}
-
-static int wl1251_plt_init(struct wl1251 *wl)
-{
-        int ret;
-
-        ret = wl1251_hw_init_mem_config(wl);
-        if (ret < 0)
-                return ret;
-
-        ret = wl1251_cmd_data_path(wl, wl->channel, 1);
-        if (ret < 0)
-                return ret;
-
-        return 0;
-}
-
-void wl1251_setup(struct wl1251 *wl)
-{
-        /* FIXME: Is it better to use strncpy here or is this ok? */
-        wl->chip.fw_filename = WL1251_FW_NAME;
-        wl->chip.nvs_filename = WL1251_NVS_NAME;
-
-        /* Now we know what chip we're using, so adjust the power on sleep
-         * time accordingly */
-        wl->chip.power_on_sleep = WL1251_POWER_ON_SLEEP;
-
-        wl->chip.intr_cmd_complete = WL1251_ACX_INTR_CMD_COMPLETE;
-        wl->chip.intr_init_complete = WL1251_ACX_INTR_INIT_COMPLETE;
-
-        wl->chip.op_upload_nvs = wl1251_upload_nvs;
-        wl->chip.op_upload_fw = wl1251_upload_firmware;
-        wl->chip.op_boot = wl1251_boot;
-        wl->chip.op_set_ecpu_ctrl = wl1251_set_ecpu_ctrl;
-        wl->chip.op_target_enable_interrupts = wl1251_target_enable_interrupts;
-        wl->chip.op_hw_init = wl1251_hw_init;
-        wl->chip.op_plt_init = wl1251_plt_init;
-        wl->chip.op_fw_version = wl1251_fw_version;
-        wl->chip.op_tx_flush = wl1251_tx_flush;
-        wl->chip.op_cmd_join = wl1251_cmd_join;
-
-        wl->chip.p_table = wl1251_part_table;
-        wl->chip.acx_reg_table = wl1251_acx_reg_table;
-
-        INIT_WORK(&wl->irq_work, wl1251_irq_work);
-        INIT_WORK(&wl->tx_work, wl1251_tx_work);
-
-}
diff --git a/drivers/net/wireless/wl12xx/wl1251_ops.h b/drivers/net/wireless/wl12xx/wl1251_ops.h
deleted file mode 100644
index 68183c472e43..000000000000
--- a/drivers/net/wireless/wl12xx/wl1251_ops.h
+++ /dev/null
@@ -1,165 +0,0 @@
-/*
- * This file is part of wl1251
- *
- * Copyright (C) 2008 Nokia Corporation
- *
- * Contact: Kalle Valo <kalle.valo@nokia.com>
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * version 2 as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
- * 02110-1301 USA
- *
- */
-
-#ifndef __WL1251_OPS_H__
-#define __WL1251_OPS_H__
-
-#include <linux/bitops.h>
-
-#include "wl1251.h"
-#include "wl1251_acx.h"
-
-#define WL1251_FW_NAME "wl1251-fw.bin"
-#define WL1251_NVS_NAME "wl1251-nvs.bin"
-
-#define WL1251_POWER_ON_SLEEP 10 /* in miliseconds */
-
-void wl1251_setup(struct wl1251 *wl);
-
-
-struct wl1251_acx_memory {
-        __le16 num_stations; /* number of STAs to be supported. */
-        u16 reserved_1;
-
-        /*
-         * Nmber of memory buffers for the RX mem pool.
-         * The actual number may be less if there are
-         * not enough blocks left for the minimum num
-         * of TX ones.
-         */
-        u8 rx_mem_block_num;
-        u8 reserved_2;
-        u8 num_tx_queues; /* From 1 to 16 */
-        u8 host_if_options; /* HOST_IF* */
-        u8 tx_min_mem_block_num;
-        u8 num_ssid_profiles;
-        __le16 debug_buffer_size;
-} __attribute__ ((packed));
-
-
-#define ACX_RX_DESC_MIN                1
-#define ACX_RX_DESC_MAX                127
-#define ACX_RX_DESC_DEF                32
-struct wl1251_acx_rx_queue_config {
-        u8 num_descs;
-        u8 pad;
-        u8 type;
-        u8 priority;
-        __le32 dma_address;
-} __attribute__ ((packed));
-
-#define ACX_TX_DESC_MIN                1
-#define ACX_TX_DESC_MAX                127
-#define ACX_TX_DESC_DEF                16
-struct wl1251_acx_tx_queue_config {
-    u8 num_descs;
-    u8 pad[2];
-    u8 attributes;
-} __attribute__ ((packed));
-
-#define MAX_TX_QUEUE_CONFIGS 5
-#define MAX_TX_QUEUES 4
-struct wl1251_acx_config_memory {
-        struct acx_header header;
-
-        struct wl1251_acx_memory mem_config;
-        struct wl1251_acx_rx_queue_config rx_queue_config;
-        struct wl1251_acx_tx_queue_config tx_queue_config[MAX_TX_QUEUE_CONFIGS];
-} __attribute__ ((packed));
-
-struct wl1251_acx_mem_map {
-        struct acx_header header;
-
-        void *code_start;
-        void *code_end;
-
-        void *wep_defkey_start;
-        void *wep_defkey_end;
-
-        void *sta_table_start;
-        void *sta_table_end;
-
-        void *packet_template_start;
-        void *packet_template_end;
-
-        void *queue_memory_start;
-        void *queue_memory_end;
-
-        void *packet_memory_pool_start;
-        void *packet_memory_pool_end;
-
-        void *debug_buffer1_start;
-        void *debug_buffer1_end;
-
-        void *debug_buffer2_start;
-        void *debug_buffer2_end;
-
-        /* Number of blocks FW allocated for TX packets */
-        u32 num_tx_mem_blocks;
-
-        /* Number of blocks FW allocated for RX packets */
-        u32 num_rx_mem_blocks;
-} __attribute__ ((packed));
-
-/*************************************************************************
-
-    Host Interrupt Register (WiLink -> Host)
-
-**************************************************************************/
-
-/* RX packet is ready in Xfer buffer #0 */
-#define WL1251_ACX_INTR_RX0_DATA      BIT(0)
-
-/* TX result(s) are in the TX complete buffer */
-#define WL1251_ACX_INTR_TX_RESULT       BIT(1)
-
-/* OBSOLETE */
-#define WL1251_ACX_INTR_TX_XFR          BIT(2)
-
-/* RX packet is ready in Xfer buffer #1 */
-#define WL1251_ACX_INTR_RX1_DATA        BIT(3)
-
-/* Event was entered to Event MBOX #A */
-#define WL1251_ACX_INTR_EVENT_A         BIT(4)
-
-/* Event was entered to Event MBOX #B */
-#define WL1251_ACX_INTR_EVENT_B         BIT(5)
-
-/* OBSOLETE */
-#define WL1251_ACX_INTR_WAKE_ON_HOST    BIT(6)
-
-/* Trace meassge on MBOX #A */
-#define WL1251_ACX_INTR_TRACE_A         BIT(7)
-
-/* Trace meassge on MBOX #B */
-#define WL1251_ACX_INTR_TRACE_B         BIT(8)
-
-/* Command processing completion */
-#define WL1251_ACX_INTR_CMD_COMPLETE    BIT(9)
-
-/* Init sequence is done */
-#define WL1251_ACX_INTR_INIT_COMPLETE   BIT(14)
-
-#define WL1251_ACX_INTR_ALL           0xFFFFFFFF
-
-#endif
diff --git a/drivers/net/wireless/wl12xx/wl1251_ps.c b/drivers/net/wireless/wl12xx/wl1251_ps.c
index 68ff7f1900ed..c53e28727ed4 100644
--- a/drivers/net/wireless/wl12xx/wl1251_ps.c
+++ b/drivers/net/wireless/wl12xx/wl1251_ps.c
@@ -21,9 +21,10 @@
  *
  */
 
-#include "reg.h"
+#include "wl1251_reg.h"
 #include "wl1251_ps.h"
-#include "wl1251_spi.h"
+#include "wl1251_cmd.h"
+#include "wl1251_io.h"
 
 #define WL1251_WAKEUP_TIMEOUT 2000
 
@@ -117,6 +118,13 @@ int wl1251_ps_set_mode(struct wl1251 *wl, enum wl1251_cmd_ps_mode mode)
         switch (mode) {
         case STATION_POWER_SAVE_MODE:
                 wl1251_debug(DEBUG_PSM, "entering psm");
+
+                ret = wl1251_acx_wake_up_conditions(wl,
+                                                    WAKE_UP_EVENT_DTIM_BITMAP,
+                                                    wl->listen_int);
+                if (ret < 0)
+                        return ret;
+
                 ret = wl1251_cmd_ps_mode(wl, STATION_POWER_SAVE_MODE);
                 if (ret < 0)
                         return ret;
@@ -134,6 +142,12 @@ int wl1251_ps_set_mode(struct wl1251 *wl, enum wl1251_cmd_ps_mode mode)
                 if (ret < 0)
                         return ret;
 
+                ret = wl1251_acx_wake_up_conditions(wl,
+                                                    WAKE_UP_EVENT_DTIM_BITMAP,
+                                                    wl->listen_int);
+                if (ret < 0)
+                        return ret;
+
                 ret = wl1251_cmd_ps_mode(wl, STATION_ACTIVE_MODE);
                 if (ret < 0)
                         return ret;
diff --git a/drivers/net/wireless/wl12xx/wl1251_reg.h b/drivers/net/wireless/wl12xx/wl1251_reg.h
new file mode 100644
index 000000000000..bdd561001dcb
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/wl1251_reg.h
@@ -0,0 +1,644 @@
+/*
+ * This file is part of wl12xx
+ *
+ * Copyright (c) 1998-2007 Texas Instruments Incorporated
+ * Copyright (C) 2008 Nokia Corporation
+ *
+ * Contact: Kalle Valo <kalle.valo@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#ifndef __REG_H__
+#define __REG_H__
+
+#include <linux/bitops.h>
+
+#define REGISTERS_BASE 0x00300000
+#define DRPW_BASE      0x00310000
+
+#define REGISTERS_DOWN_SIZE 0x00008800
+#define REGISTERS_WORK_SIZE 0x0000b000
+
+#define HW_ACCESS_ELP_CTRL_REG_ADDR         0x1FFFC
+
+/* ELP register commands */
+#define ELPCTRL_WAKE_UP             0x1
+#define ELPCTRL_WAKE_UP_WLAN_READY  0x5
+#define ELPCTRL_SLEEP               0x0
+/* ELP WLAN_READY bit */
+#define ELPCTRL_WLAN_READY          0x2
+
+/* Device Configuration registers*/
+#define SOR_CFG                        (REGISTERS_BASE + 0x0800)
+#define ECPU_CTRL                      (REGISTERS_BASE + 0x0804)
+#define HI_CFG                         (REGISTERS_BASE + 0x0808)
+#define EE_START                       (REGISTERS_BASE + 0x080C)
+
+#define CHIP_ID_B                      (REGISTERS_BASE + 0x5674)
+
+#define CHIP_ID_1251_PG10                  (0x7010101)
+#define CHIP_ID_1251_PG11                  (0x7020101)
+#define CHIP_ID_1251_PG12                  (0x7030101)
+
+#define ENABLE                         (REGISTERS_BASE + 0x5450)
+
+/* Power Management registers */
+#define ELP_CFG_MODE                   (REGISTERS_BASE + 0x5804)
+#define ELP_CMD                        (REGISTERS_BASE + 0x5808)
+#define PLL_CAL_TIME                   (REGISTERS_BASE + 0x5810)
+#define CLK_REQ_TIME                   (REGISTERS_BASE + 0x5814)
+#define CLK_BUF_TIME                   (REGISTERS_BASE + 0x5818)
+
+#define CFG_PLL_SYNC_CNT               (REGISTERS_BASE + 0x5820)
+
+/* Scratch Pad registers*/
+#define SCR_PAD0                       (REGISTERS_BASE + 0x5608)
+#define SCR_PAD1                       (REGISTERS_BASE + 0x560C)
+#define SCR_PAD2                       (REGISTERS_BASE + 0x5610)
+#define SCR_PAD3                       (REGISTERS_BASE + 0x5614)
+#define SCR_PAD4                       (REGISTERS_BASE + 0x5618)
+#define SCR_PAD4_SET                   (REGISTERS_BASE + 0x561C)
+#define SCR_PAD4_CLR                   (REGISTERS_BASE + 0x5620)
+#define SCR_PAD5                       (REGISTERS_BASE + 0x5624)
+#define SCR_PAD5_SET                   (REGISTERS_BASE + 0x5628)
+#define SCR_PAD5_CLR                   (REGISTERS_BASE + 0x562C)
+#define SCR_PAD6                       (REGISTERS_BASE + 0x5630)
+#define SCR_PAD7                       (REGISTERS_BASE + 0x5634)
+#define SCR_PAD8                       (REGISTERS_BASE + 0x5638)
+#define SCR_PAD9                       (REGISTERS_BASE + 0x563C)
+
+/* Spare registers*/
+#define SPARE_A1                       (REGISTERS_BASE + 0x0994)
+#define SPARE_A2                       (REGISTERS_BASE + 0x0998)
+#define SPARE_A3                       (REGISTERS_BASE + 0x099C)
+#define SPARE_A4                       (REGISTERS_BASE + 0x09A0)
+#define SPARE_A5                       (REGISTERS_BASE + 0x09A4)
+#define SPARE_A6                       (REGISTERS_BASE + 0x09A8)
+#define SPARE_A7                       (REGISTERS_BASE + 0x09AC)
+#define SPARE_A8                       (REGISTERS_BASE + 0x09B0)
+#define SPARE_B1                       (REGISTERS_BASE + 0x5420)
+#define SPARE_B2                       (REGISTERS_BASE + 0x5424)
+#define SPARE_B3                       (REGISTERS_BASE + 0x5428)
+#define SPARE_B4                       (REGISTERS_BASE + 0x542C)
+#define SPARE_B5                       (REGISTERS_BASE + 0x5430)
+#define SPARE_B6                       (REGISTERS_BASE + 0x5434)
+#define SPARE_B7                       (REGISTERS_BASE + 0x5438)
+#define SPARE_B8                       (REGISTERS_BASE + 0x543C)
+
+enum wl12xx_acx_int_reg {
+        ACX_REG_INTERRUPT_TRIG,
+        ACX_REG_INTERRUPT_TRIG_H,
+
+/*=============================================
+  Host Interrupt Mask Register - 32bit (RW)
+  ------------------------------------------
+  Setting a bit in this register masks the
+  corresponding interrupt to the host.
+  0 - RX0               - Rx first dubble buffer Data Interrupt
+  1 - TXD               - Tx Data Interrupt
+  2 - TXXFR             - Tx Transfer Interrupt
+  3 - RX1               - Rx second dubble buffer Data Interrupt
+  4 - RXXFR             - Rx Transfer Interrupt
+  5 - EVENT_A   - Event Mailbox interrupt
+  6 - EVENT_B   - Event Mailbox interrupt
+  7 - WNONHST   - Wake On Host Interrupt
+  8 - TRACE_A   - Debug Trace interrupt
+  9 - TRACE_B   - Debug Trace interrupt
+ 10 - CDCMP             - Command Complete Interrupt
+ 11 -
+ 12 -
+ 13 -
+ 14 - ICOMP             - Initialization Complete Interrupt
+ 16 - SG SE             - Soft Gemini - Sense enable interrupt
+ 17 - SG SD             - Soft Gemini - Sense disable interrupt
+ 18 -                   -
+ 19 -                   -
+ 20 -                   -
+ 21-                    -
+ Default: 0x0001
+*==============================================*/
+        ACX_REG_INTERRUPT_MASK,
+
+/*=============================================
+  Host Interrupt Mask Set 16bit, (Write only)
+  ------------------------------------------
+ Setting a bit in this register sets
+ the corresponding bin in ACX_HINT_MASK register
+ without effecting the mask
+ state of other bits (0 = no effect).
+==============================================*/
+        ACX_REG_HINT_MASK_SET,
+
+/*=============================================
+  Host Interrupt Mask Clear 16bit,(Write only)
+  ------------------------------------------
+ Setting a bit in this register clears
+ the corresponding bin in ACX_HINT_MASK register
+ without effecting the mask
+ state of other bits (0 = no effect).
+=============================================*/
+        ACX_REG_HINT_MASK_CLR,
+
+/*=============================================
+  Host Interrupt Status Nondestructive Read
+  16bit,(Read only)
+  ------------------------------------------
+ The host can read this register to determine
+ which interrupts are active.
+ Reading this register doesn't
+ effect its content.
+=============================================*/
+        ACX_REG_INTERRUPT_NO_CLEAR,
+
+/*=============================================
+  Host Interrupt Status Clear on Read  Register
+  16bit,(Read only)
+  ------------------------------------------
+ The host can read this register to determine
+ which interrupts are active.
+ Reading this register clears it,
+ thus making all interrupts inactive.
+==============================================*/
+        ACX_REG_INTERRUPT_CLEAR,
+
+/*=============================================
+  Host Interrupt Acknowledge Register
+  16bit,(Write only)
+  ------------------------------------------
+ The host can set individual bits in this
+ register to clear (acknowledge) the corresp.
+ interrupt status bits in the HINT_STS_CLR and
+ HINT_STS_ND registers, thus making the
+ assotiated interrupt inactive. (0-no effect)
+==============================================*/
+        ACX_REG_INTERRUPT_ACK,
+
+/*===============================================
+   Host Software Reset - 32bit RW
+ ------------------------------------------
+    [31:1] Reserved
+    0  SOFT_RESET Soft Reset  - When this bit is set,
+    it holds the Wlan hardware in a soft reset state.
+    This reset disables all MAC and baseband processor
+    clocks except the CardBus/PCI interface clock.
+    It also initializes all MAC state machines except
+    the host interface. It does not reload the
+    contents of the EEPROM. When this bit is cleared
+    (not self-clearing), the Wlan hardware
+    exits the software reset state.
+===============================================*/
+        ACX_REG_SLV_SOFT_RESET,
+
+/*===============================================
+ EEPROM Burst Read Start  - 32bit RW
+ ------------------------------------------
+ [31:1] Reserved
+ 0  ACX_EE_START -  EEPROM Burst Read Start 0
+ Setting this bit starts a burst read from
+ the external EEPROM.
+ If this bit is set (after reset) before an EEPROM read/write,
+ the burst read starts at EEPROM address 0.
+ Otherwise, it starts at the address
+ following the address of the previous access.
+ TheWlan hardware hardware clears this bit automatically.
+
+ Default: 0x00000000
+*================================================*/
+        ACX_REG_EE_START,
+
+/* Embedded ARM CPU Control */
+
+/*===============================================
+ Halt eCPU   - 32bit RW
+ ------------------------------------------
+ 0 HALT_ECPU Halt Embedded CPU - This bit is the
+ compliment of bit 1 (MDATA2) in the SOR_CFG register.
+ During a hardware reset, this bit holds
+ the inverse of MDATA2.
+ When downloading firmware from the host,
+ set this bit (pull down MDATA2).
+ The host clears this bit after downloading the firmware into
+ zero-wait-state SSRAM.
+ When loading firmware from Flash, clear this bit (pull up MDATA2)
+ so that the eCPU can run the bootloader code in Flash
+ HALT_ECPU eCPU State
+ --------------------
+ 1 halt eCPU
+ 0 enable eCPU
+ ===============================================*/
+        ACX_REG_ECPU_CONTROL,
+
+        ACX_REG_TABLE_LEN
+};
+
+#define ACX_SLV_SOFT_RESET_BIT   BIT(1)
+#define ACX_REG_EEPROM_START_BIT BIT(1)
+
+/* Command/Information Mailbox Pointers */
+
+/*===============================================
+  Command Mailbox Pointer - 32bit RW
+ ------------------------------------------
+ This register holds the start address of
+ the command mailbox located in the Wlan hardware memory.
+ The host must read this pointer after a reset to
+ find the location of the command mailbox.
+ The Wlan hardware initializes the command mailbox
+ pointer with the default address of the command mailbox.
+ The command mailbox pointer is not valid until after
+ the host receives the Init Complete interrupt from
+ the Wlan hardware.
+ ===============================================*/
+#define REG_COMMAND_MAILBOX_PTR                         (SCR_PAD0)
+
+/*===============================================
+  Information Mailbox Pointer - 32bit RW
+ ------------------------------------------
+ This register holds the start address of
+ the information mailbox located in the Wlan hardware memory.
+ The host must read this pointer after a reset to find
+ the location of the information mailbox.
+ The Wlan hardware initializes the information mailbox pointer
+ with the default address of the information mailbox.
+ The information mailbox pointer is not valid
+ until after the host receives the Init Complete interrupt from
+ the Wlan hardware.
+ ===============================================*/
+#define REG_EVENT_MAILBOX_PTR                           (SCR_PAD1)
+
+
+/* Misc */
+
+#define REG_ENABLE_TX_RX                                (ENABLE)
+/*
+ * Rx configuration (filter) information element
+ * ---------------------------------------------
+ */
+#define REG_RX_CONFIG                           (RX_CFG)
+#define REG_RX_FILTER                           (RX_FILTER_CFG)
+
+
+#define RX_CFG_ENABLE_PHY_HEADER_PLCP    0x0002
+
+/* promiscuous - receives all valid frames */
+#define RX_CFG_PROMISCUOUS               0x0008
+
+/* receives frames from any BSSID */
+#define RX_CFG_BSSID                     0x0020
+
+/* receives frames destined to any MAC address */
+#define RX_CFG_MAC                       0x0010
+
+#define RX_CFG_ENABLE_ONLY_MY_DEST_MAC   0x0010
+#define RX_CFG_ENABLE_ANY_DEST_MAC       0x0000
+#define RX_CFG_ENABLE_ONLY_MY_BSSID      0x0020
+#define RX_CFG_ENABLE_ANY_BSSID          0x0000
+
+/* discards all broadcast frames */
+#define RX_CFG_DISABLE_BCAST             0x0200
+
+#define RX_CFG_ENABLE_ONLY_MY_SSID       0x0400
+#define RX_CFG_ENABLE_RX_CMPLT_FCS_ERROR 0x0800
+#define RX_CFG_COPY_RX_STATUS            0x2000
+#define RX_CFG_TSF                       0x10000
+
+#define RX_CONFIG_OPTION_ANY_DST_MY_BSS  (RX_CFG_ENABLE_ANY_DEST_MAC | \
+                                          RX_CFG_ENABLE_ONLY_MY_BSSID)
+
+#define RX_CONFIG_OPTION_MY_DST_ANY_BSS  (RX_CFG_ENABLE_ONLY_MY_DEST_MAC\
+                                          | RX_CFG_ENABLE_ANY_BSSID)
+
+#define RX_CONFIG_OPTION_ANY_DST_ANY_BSS (RX_CFG_ENABLE_ANY_DEST_MAC | \
+                                          RX_CFG_ENABLE_ANY_BSSID)
+
+#define RX_CONFIG_OPTION_MY_DST_MY_BSS   (RX_CFG_ENABLE_ONLY_MY_DEST_MAC\
+                                          | RX_CFG_ENABLE_ONLY_MY_BSSID)
+
+#define RX_CONFIG_OPTION_FOR_SCAN  (RX_CFG_ENABLE_PHY_HEADER_PLCP \
+                                    | RX_CFG_ENABLE_RX_CMPLT_FCS_ERROR \
+                                    | RX_CFG_COPY_RX_STATUS | RX_CFG_TSF)
+
+#define RX_CONFIG_OPTION_FOR_MEASUREMENT (RX_CFG_ENABLE_ANY_DEST_MAC)
+
+#define RX_CONFIG_OPTION_FOR_JOIN        (RX_CFG_ENABLE_ONLY_MY_BSSID | \
+                                          RX_CFG_ENABLE_ONLY_MY_DEST_MAC)
+
+#define RX_CONFIG_OPTION_FOR_IBSS_JOIN   (RX_CFG_ENABLE_ONLY_MY_SSID | \
+                                          RX_CFG_ENABLE_ONLY_MY_DEST_MAC)
+
+#define RX_FILTER_OPTION_DEF          (CFG_RX_MGMT_EN | CFG_RX_DATA_EN\
+                                       | CFG_RX_CTL_EN | CFG_RX_BCN_EN\
+                                       | CFG_RX_AUTH_EN | CFG_RX_ASSOC_EN)
+
+#define RX_FILTER_OPTION_FILTER_ALL      0
+
+#define RX_FILTER_OPTION_DEF_PRSP_BCN  (CFG_RX_PRSP_EN | CFG_RX_MGMT_EN\
+                                        | CFG_RX_RCTS_ACK | CFG_RX_BCN_EN)
+
+#define RX_FILTER_OPTION_JOIN        (CFG_RX_MGMT_EN | CFG_RX_DATA_EN\
+                                      | CFG_RX_BCN_EN | CFG_RX_AUTH_EN\
+                                      | CFG_RX_ASSOC_EN | CFG_RX_RCTS_ACK\
+                                      | CFG_RX_PRSP_EN)
+
+
+/*===============================================
+ EEPROM Read/Write Request 32bit RW
+ ------------------------------------------
+ 1 EE_READ - EEPROM Read Request 1 - Setting this bit
+ loads a single byte of data into the EE_DATA
+ register from the EEPROM location specified in
+ the EE_ADDR register.
+ The Wlan hardware hardware clears this bit automatically.
+ EE_DATA is valid when this bit is cleared.
+
+ 0 EE_WRITE  - EEPROM Write Request  - Setting this bit
+ writes a single byte of data from the EE_DATA register into the
+ EEPROM location specified in the EE_ADDR register.
+ The Wlan hardware hardware clears this bit automatically.
+*===============================================*/
+#define ACX_EE_CTL_REG                      EE_CTL
+#define EE_WRITE                            0x00000001ul
+#define EE_READ                             0x00000002ul
+
+/*===============================================
+  EEPROM Address  - 32bit RW
+  ------------------------------------------
+  This register specifies the address
+  within the EEPROM from/to which to read/write data.
+  ===============================================*/
+#define ACX_EE_ADDR_REG                     EE_ADDR
+
+/*===============================================
+  EEPROM Data  - 32bit RW
+  ------------------------------------------
+  This register either holds the read 8 bits of
+  data from the EEPROM or the write data
+  to be written to the EEPROM.
+  ===============================================*/
+#define ACX_EE_DATA_REG                     EE_DATA
+
+/*===============================================
+  EEPROM Base Address  - 32bit RW
+  ------------------------------------------
+  This register holds the upper nine bits
+  [23:15] of the 24-bit Wlan hardware memory
+  address for burst reads from EEPROM accesses.
+  The EEPROM provides the lower 15 bits of this address.
+  The MSB of the address from the EEPROM is ignored.
+  ===============================================*/
+#define ACX_EE_CFG                          EE_CFG
+
+/*===============================================
+  GPIO Output Values  -32bit, RW
+  ------------------------------------------
+  [31:16]  Reserved
+  [15: 0]  Specify the output values (at the output driver inputs) for
+  GPIO[15:0], respectively.
+  ===============================================*/
+#define ACX_GPIO_OUT_REG            GPIO_OUT
+#define ACX_MAX_GPIO_LINES          15
+
+/*===============================================
+  Contention window  -32bit, RW
+  ------------------------------------------
+  [31:26]  Reserved
+  [25:16]  Max (0x3ff)
+  [15:07]  Reserved
+  [06:00]  Current contention window value - default is 0x1F
+  ===============================================*/
+#define ACX_CONT_WIND_CFG_REG    CONT_WIND_CFG
+#define ACX_CONT_WIND_MIN_MASK   0x0000007f
+#define ACX_CONT_WIND_MAX        0x03ff0000
+
+/*===============================================
+  HI_CFG Interface Configuration Register Values
+  ------------------------------------------
+  ===============================================*/
+#define HI_CFG_UART_ENABLE          0x00000004
+#define HI_CFG_RST232_ENABLE        0x00000008
+#define HI_CFG_CLOCK_REQ_SELECT     0x00000010
+#define HI_CFG_HOST_INT_ENABLE      0x00000020
+#define HI_CFG_VLYNQ_OUTPUT_ENABLE  0x00000040
+#define HI_CFG_HOST_INT_ACTIVE_LOW  0x00000080
+#define HI_CFG_UART_TX_OUT_GPIO_15  0x00000100
+#define HI_CFG_UART_TX_OUT_GPIO_14  0x00000200
+#define HI_CFG_UART_TX_OUT_GPIO_7   0x00000400
+
+/*
+ * NOTE: USE_ACTIVE_HIGH compilation flag should be defined in makefile
+ *       for platforms using active high interrupt level
+ */
+#ifdef USE_ACTIVE_HIGH
+#define HI_CFG_DEF_VAL              \
+        (HI_CFG_UART_ENABLE |        \
+        HI_CFG_RST232_ENABLE |      \
+        HI_CFG_CLOCK_REQ_SELECT |   \
+        HI_CFG_HOST_INT_ENABLE)
+#else
+#define HI_CFG_DEF_VAL              \
+        (HI_CFG_UART_ENABLE |        \
+        HI_CFG_RST232_ENABLE |      \
+        HI_CFG_CLOCK_REQ_SELECT |   \
+        HI_CFG_HOST_INT_ENABLE)
+
+#endif
+
+#define REF_FREQ_19_2                       0
+#define REF_FREQ_26_0                       1
+#define REF_FREQ_38_4                       2
+#define REF_FREQ_40_0                       3
+#define REF_FREQ_33_6                       4
+#define REF_FREQ_NUM                        5
+
+#define LUT_PARAM_INTEGER_DIVIDER           0
+#define LUT_PARAM_FRACTIONAL_DIVIDER        1
+#define LUT_PARAM_ATTN_BB                   2
+#define LUT_PARAM_ALPHA_BB                  3
+#define LUT_PARAM_STOP_TIME_BB              4
+#define LUT_PARAM_BB_PLL_LOOP_FILTER        5
+#define LUT_PARAM_NUM                       6
+
+#define ACX_EEPROMLESS_IND_REG              (SCR_PAD4)
+#define USE_EEPROM                          0
+#define SOFT_RESET_MAX_TIME                 1000000
+#define SOFT_RESET_STALL_TIME               1000
+#define NVS_DATA_BUNDARY_ALIGNMENT          4
+
+
+/* Firmware image load chunk size */
+#define CHUNK_SIZE          512
+
+/* Firmware image header size */
+#define FW_HDR_SIZE 8
+
+#define ECPU_CONTROL_HALT                                       0x00000101
+
+
+/******************************************************************************
+
+    CHANNELS, BAND & REG DOMAINS definitions
+
+******************************************************************************/
+
+
+enum {
+        RADIO_BAND_2_4GHZ = 0,  /* 2.4 Ghz band */
+        RADIO_BAND_5GHZ = 1,    /* 5 Ghz band */
+        RADIO_BAND_JAPAN_4_9_GHZ = 2,
+        DEFAULT_BAND = RADIO_BAND_2_4GHZ,
+        INVALID_BAND = 0xFE,
+        MAX_RADIO_BANDS = 0xFF
+};
+
+enum {
+        NO_RATE      = 0,
+        RATE_1MBPS   = 0x0A,
+        RATE_2MBPS   = 0x14,
+        RATE_5_5MBPS = 0x37,
+        RATE_6MBPS   = 0x0B,
+        RATE_9MBPS   = 0x0F,
+        RATE_11MBPS  = 0x6E,
+        RATE_12MBPS  = 0x0A,
+        RATE_18MBPS  = 0x0E,
+        RATE_22MBPS  = 0xDC,
+        RATE_24MBPS  = 0x09,
+        RATE_36MBPS  = 0x0D,
+        RATE_48MBPS  = 0x08,
+        RATE_54MBPS  = 0x0C
+};
+
+enum {
+        RATE_INDEX_1MBPS   =  0,
+        RATE_INDEX_2MBPS   =  1,
+        RATE_INDEX_5_5MBPS =  2,
+        RATE_INDEX_6MBPS   =  3,
+        RATE_INDEX_9MBPS   =  4,
+        RATE_INDEX_11MBPS  =  5,
+        RATE_INDEX_12MBPS  =  6,
+        RATE_INDEX_18MBPS  =  7,
+        RATE_INDEX_22MBPS  =  8,
+        RATE_INDEX_24MBPS  =  9,
+        RATE_INDEX_36MBPS  =  10,
+        RATE_INDEX_48MBPS  =  11,
+        RATE_INDEX_54MBPS  =  12,
+        RATE_INDEX_MAX     =  RATE_INDEX_54MBPS,
+        MAX_RATE_INDEX,
+        INVALID_RATE_INDEX = MAX_RATE_INDEX,
+        RATE_INDEX_ENUM_MAX_SIZE = 0x7FFFFFFF
+};
+
+enum {
+        RATE_MASK_1MBPS = 0x1,
+        RATE_MASK_2MBPS = 0x2,
+        RATE_MASK_5_5MBPS = 0x4,
+        RATE_MASK_11MBPS = 0x20,
+};
+
+#define SHORT_PREAMBLE_BIT   BIT(0) /* CCK or Barker depending on the rate */
+#define OFDM_RATE_BIT        BIT(6)
+#define PBCC_RATE_BIT        BIT(7)
+
+enum {
+        CCK_LONG = 0,
+        CCK_SHORT = SHORT_PREAMBLE_BIT,
+        PBCC_LONG = PBCC_RATE_BIT,
+        PBCC_SHORT = PBCC_RATE_BIT | SHORT_PREAMBLE_BIT,
+        OFDM = OFDM_RATE_BIT
+};
+
+/******************************************************************************
+
+Transmit-Descriptor RATE-SET field definitions...
+
+Define a new "Rate-Set" for TX path that incorporates the
+Rate & Modulation info into a single 16-bit field.
+
+TxdRateSet_t:
+b15   - Indicates Preamble type (1=SHORT, 0=LONG).
+        Notes:
+        Must be LONG (0) for 1Mbps rate.
+        Does not apply (set to 0) for RevG-OFDM rates.
+b14   - Indicates PBCC encoding (1=PBCC, 0=not).
+        Notes:
+        Does not apply (set to 0) for rates 1 and 2 Mbps.
+        Does not apply (set to 0) for RevG-OFDM rates.
+b13    - Unused (set to 0).
+b12-b0 - Supported Rate indicator bits as defined below.
+
+******************************************************************************/
+
+
+/*************************************************************************
+
+    Interrupt Trigger Register (Host -> WiLink)
+
+**************************************************************************/
+
+/* Hardware to Embedded CPU Interrupts - first 32-bit register set */
+
+/*
+ * Host Command Interrupt. Setting this bit masks
+ * the interrupt that the host issues to inform
+ * the FW that it has sent a command
+ * to the Wlan hardware Command Mailbox.
+ */
+#define INTR_TRIG_CMD       BIT(0)
+
+/*
+ * Host Event Acknowlegde Interrupt. The host
+ * sets this bit to acknowledge that it received
+ * the unsolicited information from the event
+ * mailbox.
+ */
+#define INTR_TRIG_EVENT_ACK BIT(1)
+
+/*
+ * The host sets this bit to inform the Wlan
+ * FW that a TX packet is in the XFER
+ * Buffer #0.
+ */
+#define INTR_TRIG_TX_PROC0 BIT(2)
+
+/*
+ * The host sets this bit to inform the FW
+ * that it read a packet from RX XFER
+ * Buffer #0.
+ */
+#define INTR_TRIG_RX_PROC0 BIT(3)
+
+#define INTR_TRIG_DEBUG_ACK BIT(4)
+
+#define INTR_TRIG_STATE_CHANGED BIT(5)
+
+
+/* Hardware to Embedded CPU Interrupts - second 32-bit register set */
+
+/*
+ * The host sets this bit to inform the FW
+ * that it read a packet from RX XFER
+ * Buffer #1.
+ */
+#define INTR_TRIG_RX_PROC1 BIT(17)
+
+/*
+ * The host sets this bit to inform the Wlan
+ * hardware that a TX packet is in the XFER
+ * Buffer #1.
+ */
+#define INTR_TRIG_TX_PROC1 BIT(18)
+
+#endif
diff --git a/drivers/net/wireless/wl12xx/wl1251_rx.c b/drivers/net/wireless/wl12xx/wl1251_rx.c
index 0dbb483a0973..17c54b59ef86 100644
--- a/drivers/net/wireless/wl12xx/wl1251_rx.c
+++ b/drivers/net/wireless/wl12xx/wl1251_rx.c
@@ -26,9 +26,10 @@
 #include <net/mac80211.h>
 
 #include "wl1251.h"
-#include "reg.h"
-#include "wl1251_spi.h"
+#include "wl1251_reg.h"
+#include "wl1251_io.h"
 #include "wl1251_rx.h"
+#include "wl1251_cmd.h"
 #include "wl1251_acx.h"
 
 static void wl1251_rx_header(struct wl1251 *wl,
@@ -40,7 +41,7 @@ static void wl1251_rx_header(struct wl1251 *wl,
         if (wl->rx_current_buffer)
                 rx_packet_ring_addr += wl->data_path->rx_packet_ring_chunk_size;
 
-        wl1251_spi_mem_read(wl, rx_packet_ring_addr, desc, sizeof(*desc));
+        wl1251_mem_read(wl, rx_packet_ring_addr, desc, sizeof(*desc));
 }
 
 static void wl1251_rx_status(struct wl1251 *wl,
@@ -136,7 +137,7 @@ static void wl1251_rx_body(struct wl1251 *wl,
         }
 
         rx_buffer = skb_put(skb, length);
-        wl1251_spi_mem_read(wl, rx_packet_ring_addr, rx_buffer, length);
+        wl1251_mem_read(wl, rx_packet_ring_addr, rx_buffer, length);
 
         /* The actual lenght doesn't include the target's alignment */
         skb->len = desc->length  - PLCP_HEADER_LENGTH;
diff --git a/drivers/net/wireless/wl12xx/wl1251_sdio.c b/drivers/net/wireless/wl12xx/wl1251_sdio.c
new file mode 100644
index 000000000000..9423f22bdced
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/wl1251_sdio.c
@@ -0,0 +1,205 @@
+/*
+ * wl12xx SDIO routines
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ * Copyright (C) 2005 Texas Instruments Incorporated
+ * Copyright (C) 2008 Google Inc
+ * Copyright (C) 2009 Bob Copeland (me@bobcopeland.com)
+ */
+#include <linux/module.h>
+#include <linux/crc7.h>
+#include <linux/mod_devicetable.h>
+#include <linux/irq.h>
+#include <linux/mmc/sdio_func.h>
+#include <linux/mmc/sdio_ids.h>
+#include <linux/platform_device.h>
+
+#include "wl1251.h"
+#include "wl12xx_80211.h"
+#include "wl1251_reg.h"
+#include "wl1251_ps.h"
+#include "wl1251_io.h"
+#include "wl1251_tx.h"
+#include "wl1251_debugfs.h"
+
+#ifndef SDIO_VENDOR_ID_TI
+#define SDIO_VENDOR_ID_TI               0x104c
+#endif
+
+#ifndef SDIO_DEVICE_ID_TI_WL1251
+#define SDIO_DEVICE_ID_TI_WL1251        0x9066
+#endif
+
+static struct sdio_func *wl_to_func(struct wl1251 *wl)
+{
+        return wl->if_priv;
+}
+
+static void wl1251_sdio_interrupt(struct sdio_func *func)
+{
+        struct wl1251 *wl = sdio_get_drvdata(func);
+
+        wl1251_debug(DEBUG_IRQ, "IRQ");
+
+        /* FIXME should be synchronous for sdio */
+        ieee80211_queue_work(wl->hw, &wl->irq_work);
+}
+
+static const struct sdio_device_id wl1251_devices[] = {
+        { SDIO_DEVICE(SDIO_VENDOR_ID_TI, SDIO_DEVICE_ID_TI_WL1251) },
+        {}
+};
+MODULE_DEVICE_TABLE(sdio, wl1251_devices);
+
+
+void wl1251_sdio_read(struct wl1251 *wl, int addr, void *buf, size_t len)
+{
+        int ret;
+        struct sdio_func *func = wl_to_func(wl);
+
+        sdio_claim_host(func);
+        ret = sdio_memcpy_fromio(func, buf, addr, len);
+        if (ret)
+                wl1251_error("sdio read failed (%d)", ret);
+        sdio_release_host(func);
+}
+
+void wl1251_sdio_write(struct wl1251 *wl, int addr, void *buf, size_t len)
+{
+        int ret;
+        struct sdio_func *func = wl_to_func(wl);
+
+        sdio_claim_host(func);
+        ret = sdio_memcpy_toio(func, addr, buf, len);
+        if (ret)
+                wl1251_error("sdio write failed (%d)", ret);
+        sdio_release_host(func);
+}
+
+void wl1251_sdio_reset(struct wl1251 *wl)
+{
+}
+
+static void wl1251_sdio_enable_irq(struct wl1251 *wl)
+{
+        struct sdio_func *func = wl_to_func(wl);
+
+        sdio_claim_host(func);
+        sdio_claim_irq(func, wl1251_sdio_interrupt);
+        sdio_release_host(func);
+}
+
+static void wl1251_sdio_disable_irq(struct wl1251 *wl)
+{
+        struct sdio_func *func = wl_to_func(wl);
+
+        sdio_claim_host(func);
+        sdio_release_irq(func);
+        sdio_release_host(func);
+}
+
+void wl1251_sdio_set_power(bool enable)
+{
+}
+
+struct wl1251_if_operations wl1251_sdio_ops = {
+        .read = wl1251_sdio_read,
+        .write = wl1251_sdio_write,
+        .reset = wl1251_sdio_reset,
+        .enable_irq = wl1251_sdio_enable_irq,
+        .disable_irq = wl1251_sdio_disable_irq,
+};
+
+int wl1251_sdio_probe(struct sdio_func *func, const struct sdio_device_id *id)
+{
+        int ret;
+        struct wl1251 *wl;
+        struct ieee80211_hw *hw;
+
+        hw = wl1251_alloc_hw();
+        if (IS_ERR(hw))
+                return PTR_ERR(hw);
+
+        wl = hw->priv;
+
+        sdio_claim_host(func);
+        ret = sdio_enable_func(func);
+        if (ret)
+                goto release;
+
+        sdio_set_block_size(func, 512);
+
+        SET_IEEE80211_DEV(hw, &func->dev);
+        wl->if_priv = func;
+        wl->if_ops = &wl1251_sdio_ops;
+        wl->set_power = wl1251_sdio_set_power;
+
+        sdio_release_host(func);
+        ret = wl1251_init_ieee80211(wl);
+        if (ret)
+                goto disable;
+
+        sdio_set_drvdata(func, wl);
+        return ret;
+
+disable:
+        sdio_claim_host(func);
+        sdio_disable_func(func);
+release:
+        sdio_release_host(func);
+        return ret;
+}
+
+static void __devexit wl1251_sdio_remove(struct sdio_func *func)
+{
+        struct wl1251 *wl = sdio_get_drvdata(func);
+
+        wl1251_free_hw(wl);
+
+        sdio_claim_host(func);
+        sdio_release_irq(func);
+        sdio_disable_func(func);
+        sdio_release_host(func);
+}
+
+static struct sdio_driver wl1251_sdio_driver = {
+        .name           = "wl1251_sdio",
+        .id_table       = wl1251_devices,
+        .probe          = wl1251_sdio_probe,
+        .remove         = __devexit_p(wl1251_sdio_remove),
+};
+
+static int __init wl1251_sdio_init(void)
+{
+        int err;
+
+        err = sdio_register_driver(&wl1251_sdio_driver);
+        if (err)
+                wl1251_error("failed to register sdio driver: %d", err);
+        return err;
+}
+
+static void __exit wl1251_sdio_exit(void)
+{
+        sdio_unregister_driver(&wl1251_sdio_driver);
+        wl1251_notice("unloaded");
+}
+
+module_init(wl1251_sdio_init);
+module_exit(wl1251_sdio_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Kalle Valo <kalle.valo@nokia.com>");
diff --git a/drivers/net/wireless/wl12xx/wl1251_spi.c b/drivers/net/wireless/wl12xx/wl1251_spi.c
index c5da79dbc49c..14eff2b3d4c6 100644
--- a/drivers/net/wireless/wl12xx/wl1251_spi.c
+++ b/drivers/net/wireless/wl12xx/wl1251_spi.c
@@ -21,38 +21,35 @@
  *
  */
 
+#include <linux/irq.h>
 #include <linux/module.h>
 #include <linux/crc7.h>
 #include <linux/spi/spi.h>
+#include <linux/spi/wl12xx.h>
 
 #include "wl1251.h"
-#include "reg.h"
+#include "wl1251_reg.h"
 #include "wl1251_spi.h"
 
-static int wl1251_translate_reg_addr(struct wl1251 *wl, int addr)
+static irqreturn_t wl1251_irq(int irq, void *cookie)
 {
-        /* If the address is lower than REGISTERS_BASE, it means that this is
-         * a chip-specific register address, so look it up in the registers
-         * table */
-        if (addr < REGISTERS_BASE) {
-                /* Make sure we don't go over the table */
-                if (addr >= ACX_REG_TABLE_LEN) {
-                        wl1251_error("address out of range (%d)", addr);
-                        return -EINVAL;
-                }
-                addr = wl->chip.acx_reg_table[addr];
-        }
+        struct wl1251 *wl;
+
+        wl1251_debug(DEBUG_IRQ, "IRQ");
+
+        wl = cookie;
 
-        return addr - wl->physical_reg_addr + wl->virtual_reg_addr;
+        ieee80211_queue_work(wl->hw, &wl->irq_work);
+
+        return IRQ_HANDLED;
 }
 
-static int wl1251_translate_mem_addr(struct wl1251 *wl, int addr)
+static struct spi_device *wl_to_spi(struct wl1251 *wl)
 {
-        return addr - wl->physical_mem_addr + wl->virtual_mem_addr;
+        return wl->if_priv;
 }
 
-
-void wl1251_spi_reset(struct wl1251 *wl)
+static void wl1251_spi_reset(struct wl1251 *wl)
 {
         u8 *cmd;
         struct spi_transfer t;
@@ -73,12 +70,12 @@ void wl1251_spi_reset(struct wl1251 *wl)
         t.len = WSPI_INIT_CMD_LEN;
         spi_message_add_tail(&t, &m);
 
-        spi_sync(wl->spi, &m);
+        spi_sync(wl_to_spi(wl), &m);
 
         wl1251_dump(DEBUG_SPI, "spi reset -> ", cmd, WSPI_INIT_CMD_LEN);
 }
 
-void wl1251_spi_init(struct wl1251 *wl)
+static void wl1251_spi_wake(struct wl1251 *wl)
 {
         u8 crc[WSPI_INIT_CMD_CRC_LEN], *cmd;
         struct spi_transfer t;
@@ -127,136 +124,19 @@ void wl1251_spi_init(struct wl1251 *wl)
         t.len = WSPI_INIT_CMD_LEN;
         spi_message_add_tail(&t, &m);
 
-        spi_sync(wl->spi, &m);
+        spi_sync(wl_to_spi(wl), &m);
 
         wl1251_dump(DEBUG_SPI, "spi init -> ", cmd, WSPI_INIT_CMD_LEN);
 }
 
-/* Set the SPI partitions to access the chip addresses
- *
- * There are two VIRTUAL (SPI) partitions (the memory partition and the
- * registers partition), which are mapped to two different areas of the
- * PHYSICAL (hardware) memory.  This function also makes other checks to
- * ensure that the partitions are not overlapping.  In the diagram below, the
- * memory partition comes before the register partition, but the opposite is
- * also supported.
- *
- *                               PHYSICAL address
- *                                     space
- *
- *                                    |    |
- *                                 ...+----+--> mem_start
- *          VIRTUAL address     ...   |    |
- *               space       ...      |    | [PART_0]
- *                        ...         |    |
- * 0x00000000 <--+----+...         ...+----+--> mem_start + mem_size
- *               |    |         ...   |    |
- *               |MEM |      ...      |    |
- *               |    |   ...         |    |
- *  part_size <--+----+...            |    | {unused area)
- *               |    |   ...         |    |
- *               |REG |      ...      |    |
- *  part_size    |    |         ...   |    |
- *      +     <--+----+...         ...+----+--> reg_start
- *  reg_size              ...         |    |
- *                           ...      |    | [PART_1]
- *                              ...   |    |
- *                                 ...+----+--> reg_start + reg_size
- *                                    |    |
- *
- */
-int wl1251_set_partition(struct wl1251 *wl,
-                          u32 mem_start, u32 mem_size,
-                          u32 reg_start, u32 reg_size)
+static void wl1251_spi_reset_wake(struct wl1251 *wl)
 {
-        struct wl1251_partition *partition;
-        struct spi_transfer t;
-        struct spi_message m;
-        size_t len, cmd_len;
-        u32 *cmd;
-        int addr;
-
-        cmd_len = sizeof(u32) + 2 * sizeof(struct wl1251_partition);
-        cmd = kzalloc(cmd_len, GFP_KERNEL);
-        if (!cmd)
-                return -ENOMEM;
-
-        spi_message_init(&m);
-        memset(&t, 0, sizeof(t));
-
-        partition = (struct wl1251_partition *) (cmd + 1);
-        addr = HW_ACCESS_PART0_SIZE_ADDR;
-        len = 2 * sizeof(struct wl1251_partition);
-
-        *cmd |= WSPI_CMD_WRITE;
-        *cmd |= (len << WSPI_CMD_BYTE_LENGTH_OFFSET) & WSPI_CMD_BYTE_LENGTH;
-        *cmd |= addr & WSPI_CMD_BYTE_ADDR;
-
-        wl1251_debug(DEBUG_SPI, "mem_start %08X mem_size %08X",
-                     mem_start, mem_size);
-        wl1251_debug(DEBUG_SPI, "reg_start %08X reg_size %08X",
-                     reg_start, reg_size);
-
-        /* Make sure that the two partitions together don't exceed the
-         * address range */
-        if ((mem_size + reg_size) > HW_ACCESS_MEMORY_MAX_RANGE) {
-                wl1251_debug(DEBUG_SPI, "Total size exceeds maximum virtual"
-                             " address range.  Truncating partition[0].");
-                mem_size = HW_ACCESS_MEMORY_MAX_RANGE - reg_size;
-                wl1251_debug(DEBUG_SPI, "mem_start %08X mem_size %08X",
-                             mem_start, mem_size);
-                wl1251_debug(DEBUG_SPI, "reg_start %08X reg_size %08X",
-                             reg_start, reg_size);
-        }
-
-        if ((mem_start < reg_start) &&
-            ((mem_start + mem_size) > reg_start)) {
-                /* Guarantee that the memory partition doesn't overlap the
-                 * registers partition */
-                wl1251_debug(DEBUG_SPI, "End of partition[0] is "
-                             "overlapping partition[1].  Adjusted.");
-                mem_size = reg_start - mem_start;
-                wl1251_debug(DEBUG_SPI, "mem_start %08X mem_size %08X",
-                             mem_start, mem_size);
-                wl1251_debug(DEBUG_SPI, "reg_start %08X reg_size %08X",
-                             reg_start, reg_size);
-        } else if ((reg_start < mem_start) &&
-                   ((reg_start + reg_size) > mem_start)) {
-                /* Guarantee that the register partition doesn't overlap the
-                 * memory partition */
-                wl1251_debug(DEBUG_SPI, "End of partition[1] is"
-                             " overlapping partition[0].  Adjusted.");
-                reg_size = mem_start - reg_start;
-                wl1251_debug(DEBUG_SPI, "mem_start %08X mem_size %08X",
-                             mem_start, mem_size);
-                wl1251_debug(DEBUG_SPI, "reg_start %08X reg_size %08X",
-                             reg_start, reg_size);
-        }
-
-        partition[0].start = mem_start;
-        partition[0].size  = mem_size;
-        partition[1].start = reg_start;
-        partition[1].size  = reg_size;
-
-        wl->physical_mem_addr = mem_start;
-        wl->physical_reg_addr = reg_start;
-
-        wl->virtual_mem_addr = 0;
-        wl->virtual_reg_addr = mem_size;
-
-        t.tx_buf = cmd;
-        t.len = cmd_len;
-        spi_message_add_tail(&t, &m);
-
-        spi_sync(wl->spi, &m);
-
-        kfree(cmd);
-
-        return 0;
+        wl1251_spi_reset(wl);
+        wl1251_spi_wake(wl);
 }
 
-void wl1251_spi_read(struct wl1251 *wl, int addr, void *buf,
-                     size_t len, bool fixed)
+static void wl1251_spi_read(struct wl1251 *wl, int addr, void *buf,
+                            size_t len)
 {
         struct spi_transfer t[3];
         struct spi_message m;
@@ -271,9 +151,6 @@ void wl1251_spi_read(struct wl1251 *wl, int addr, void *buf,
         *cmd |= (len << WSPI_CMD_BYTE_LENGTH_OFFSET) & WSPI_CMD_BYTE_LENGTH;
         *cmd |= addr & WSPI_CMD_BYTE_ADDR;
 
-        if (fixed)
-                *cmd |= WSPI_CMD_FIXED;
-
         spi_message_init(&m);
         memset(t, 0, sizeof(t));
 
@@ -290,7 +167,7 @@ void wl1251_spi_read(struct wl1251 *wl, int addr, void *buf,
         t[2].len = len;
         spi_message_add_tail(&t[2], &m);
 
-        spi_sync(wl->spi, &m);
+        spi_sync(wl_to_spi(wl), &m);
 
         /* FIXME: check busy words */
 
@@ -298,8 +175,8 @@ void wl1251_spi_read(struct wl1251 *wl, int addr, void *buf,
         wl1251_dump(DEBUG_SPI, "spi_read buf <- ", buf, len);
 }
 
-void wl1251_spi_write(struct wl1251 *wl, int addr, void *buf,
-                      size_t len, bool fixed)
+static void wl1251_spi_write(struct wl1251 *wl, int addr, void *buf,
+                             size_t len)
 {
         struct spi_transfer t[2];
         struct spi_message m;
@@ -312,9 +189,6 @@ void wl1251_spi_write(struct wl1251 *wl, int addr, void *buf,
         *cmd |= (len << WSPI_CMD_BYTE_LENGTH_OFFSET) & WSPI_CMD_BYTE_LENGTH;
         *cmd |= addr & WSPI_CMD_BYTE_ADDR;
 
-        if (fixed)
-                *cmd |= WSPI_CMD_FIXED;
-
         spi_message_init(&m);
         memset(t, 0, sizeof(t));
 
@@ -326,68 +200,145 @@ void wl1251_spi_write(struct wl1251 *wl, int addr, void *buf,
         t[1].len = len;
         spi_message_add_tail(&t[1], &m);
 
-        spi_sync(wl->spi, &m);
+        spi_sync(wl_to_spi(wl), &m);
 
         wl1251_dump(DEBUG_SPI, "spi_write cmd -> ", cmd, sizeof(*cmd));
         wl1251_dump(DEBUG_SPI, "spi_write buf -> ", buf, len);
 }
 
-void wl1251_spi_mem_read(struct wl1251 *wl, int addr, void *buf,
-                         size_t len)
+static void wl1251_spi_enable_irq(struct wl1251 *wl)
 {
-        int physical;
-
-        physical = wl1251_translate_mem_addr(wl, addr);
+        return enable_irq(wl->irq);
+}
 
-        wl1251_spi_read(wl, physical, buf, len, false);
+static void wl1251_spi_disable_irq(struct wl1251 *wl)
+{
+        return disable_irq(wl->irq);
 }
 
-void wl1251_spi_mem_write(struct wl1251 *wl, int addr, void *buf,
-                          size_t len)
+static const struct wl1251_if_operations wl1251_spi_ops = {
+        .read = wl1251_spi_read,
+        .write = wl1251_spi_write,
+        .reset = wl1251_spi_reset_wake,
+        .enable_irq = wl1251_spi_enable_irq,
+        .disable_irq = wl1251_spi_disable_irq,
+};
+
+static int __devinit wl1251_spi_probe(struct spi_device *spi)
 {
-        int physical;
+        struct wl12xx_platform_data *pdata;
+        struct ieee80211_hw *hw;
+        struct wl1251 *wl;
+        int ret;
+
+        pdata = spi->dev.platform_data;
+        if (!pdata) {
+                wl1251_error("no platform data");
+                return -ENODEV;
+        }
 
-        physical = wl1251_translate_mem_addr(wl, addr);
+        hw = wl1251_alloc_hw();
+        if (IS_ERR(hw))
+                return PTR_ERR(hw);
 
-        wl1251_spi_write(wl, physical, buf, len, false);
-}
+        wl = hw->priv;
 
-void wl1251_spi_reg_read(struct wl1251 *wl, int addr, void *buf, size_t len,
-                         bool fixed)
-{
-        int physical;
+        SET_IEEE80211_DEV(hw, &spi->dev);
+        dev_set_drvdata(&spi->dev, wl);
+        wl->if_priv = spi;
+        wl->if_ops = &wl1251_spi_ops;
 
-        physical = wl1251_translate_reg_addr(wl, addr);
+        /* This is the only SPI value that we need to set here, the rest
+         * comes from the board-peripherals file */
+        spi->bits_per_word = 32;
 
-        wl1251_spi_read(wl, physical, buf, len, fixed);
-}
+        ret = spi_setup(spi);
+        if (ret < 0) {
+                wl1251_error("spi_setup failed");
+                goto out_free;
+        }
 
-void wl1251_spi_reg_write(struct wl1251 *wl, int addr, void *buf, size_t len,
-                          bool fixed)
-{
-        int physical;
+        wl->set_power = pdata->set_power;
+        if (!wl->set_power) {
+                wl1251_error("set power function missing in platform data");
+                return -ENODEV;
+        }
 
-        physical = wl1251_translate_reg_addr(wl, addr);
+        wl->irq = spi->irq;
+        if (wl->irq < 0) {
+                wl1251_error("irq missing in platform data");
+                return -ENODEV;
+        }
 
-        wl1251_spi_write(wl, physical, buf, len, fixed);
-}
+        ret = request_irq(wl->irq, wl1251_irq, 0, DRIVER_NAME, wl);
+        if (ret < 0) {
+                wl1251_error("request_irq() failed: %d", ret);
+                goto out_free;
+        }
 
-u32 wl1251_mem_read32(struct wl1251 *wl, int addr)
-{
-        return wl1251_read32(wl, wl1251_translate_mem_addr(wl, addr));
+        set_irq_type(wl->irq, IRQ_TYPE_EDGE_RISING);
+
+        disable_irq(wl->irq);
+
+        ret = wl1251_init_ieee80211(wl);
+        if (ret)
+                goto out_irq;
+
+        return 0;
+
+ out_irq:
+        free_irq(wl->irq, wl);
+
+ out_free:
+        ieee80211_free_hw(hw);
+
+        return ret;
 }
 
-void wl1251_mem_write32(struct wl1251 *wl, int addr, u32 val)
+static int __devexit wl1251_spi_remove(struct spi_device *spi)
 {
-        wl1251_write32(wl, wl1251_translate_mem_addr(wl, addr), val);
+        struct wl1251 *wl = dev_get_drvdata(&spi->dev);
+
+        free_irq(wl->irq, wl);
+        wl1251_free_hw(wl);
+
+        return 0;
 }
 
-u32 wl1251_reg_read32(struct wl1251 *wl, int addr)
+static struct spi_driver wl1251_spi_driver = {
+        .driver = {
+                .name           = "wl12xx",
+                .bus            = &spi_bus_type,
+                .owner          = THIS_MODULE,
+        },
+
+        .probe          = wl1251_spi_probe,
+        .remove         = __devexit_p(wl1251_spi_remove),
+};
+
+static int __init wl1251_spi_init(void)
 {
-        return wl1251_read32(wl, wl1251_translate_reg_addr(wl, addr));
+        int ret;
+
+        ret = spi_register_driver(&wl1251_spi_driver);
+        if (ret < 0) {
+                wl1251_error("failed to register spi driver: %d", ret);
+                goto out;
+        }
+
+out:
+        return ret;
 }
 
-void wl1251_reg_write32(struct wl1251 *wl, int addr, u32 val)
+static void __exit wl1251_spi_exit(void)
 {
-        wl1251_write32(wl, wl1251_translate_reg_addr(wl, addr), val);
+        spi_unregister_driver(&wl1251_spi_driver);
+
+        wl1251_notice("unloaded");
 }
+
+module_init(wl1251_spi_init);
+module_exit(wl1251_spi_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Kalle Valo <kalle.valo@nokia.com>");
diff --git a/drivers/net/wireless/wl12xx/wl1251_spi.h b/drivers/net/wireless/wl12xx/wl1251_spi.h
index 6e8daf4e1085..2e273a97e7f3 100644
--- a/drivers/net/wireless/wl12xx/wl1251_spi.h
+++ b/drivers/net/wireless/wl12xx/wl1251_spi.h
@@ -27,18 +27,7 @@
 
 #include "wl1251_cmd.h"
 #include "wl1251_acx.h"
-#include "reg.h"
-
-#define HW_ACCESS_MEMORY_MAX_RANGE              0x1FFC0
-
-#define HW_ACCESS_PART0_SIZE_ADDR           0x1FFC0
-#define HW_ACCESS_PART0_START_ADDR          0x1FFC4
-#define HW_ACCESS_PART1_SIZE_ADDR           0x1FFC8
-#define HW_ACCESS_PART1_START_ADDR          0x1FFCC
-
-#define HW_ACCESS_REGISTER_SIZE             4
-
-#define HW_ACCESS_PRAM_MAX_RANGE                0x3c000
+#include "wl1251_reg.h"
 
 #define WSPI_CMD_READ                 0x40000000
 #define WSPI_CMD_WRITE                0x00000000
@@ -69,47 +58,4 @@
                 ((WL1251_BUSY_WORD_LEN - 4) / sizeof(u32))
 #define HW_ACCESS_WSPI_INIT_CMD_MASK  0
 
-
-/* Raw target IO, address is not translated */
-void wl1251_spi_write(struct wl1251 *wl, int addr, void *buf,
-                      size_t len, bool fixed);
-void wl1251_spi_read(struct wl1251 *wl, int addr, void *buf,
-                     size_t len, bool fixed);
-
-/* Memory target IO, address is tranlated to partition 0 */
-void wl1251_spi_mem_read(struct wl1251 *wl, int addr, void *buf, size_t len);
-void wl1251_spi_mem_write(struct wl1251 *wl, int addr, void *buf, size_t len);
-u32 wl1251_mem_read32(struct wl1251 *wl, int addr);
-void wl1251_mem_write32(struct wl1251 *wl, int addr, u32 val);
-
-/* Registers IO */
-void wl1251_spi_reg_read(struct wl1251 *wl, int addr, void *buf, size_t len,
-                         bool fixed);
-void wl1251_spi_reg_write(struct wl1251 *wl, int addr, void *buf, size_t len,
-                          bool fixed);
-u32 wl1251_reg_read32(struct wl1251 *wl, int addr);
-void wl1251_reg_write32(struct wl1251 *wl, int addr, u32 val);
-
-/* INIT and RESET words */
-void wl1251_spi_reset(struct wl1251 *wl);
-void wl1251_spi_init(struct wl1251 *wl);
-int wl1251_set_partition(struct wl1251 *wl,
-                         u32 part_start, u32 part_size,
-                         u32 reg_start,  u32 reg_size);
-
-static inline u32 wl1251_read32(struct wl1251 *wl, int addr)
-{
-        wl1251_spi_read(wl, addr, &wl->buffer_32,
-                        sizeof(wl->buffer_32), false);
-
-        return wl->buffer_32;
-}
-
-static inline void wl1251_write32(struct wl1251 *wl, int addr, u32 val)
-{
-        wl->buffer_32 = val;
-        wl1251_spi_write(wl, addr, &wl->buffer_32,
-                         sizeof(wl->buffer_32), false);
-}
-
 #endif /* __WL1251_SPI_H__ */
diff --git a/drivers/net/wireless/wl12xx/wl1251_tx.c b/drivers/net/wireless/wl12xx/wl1251_tx.c
index 2652a222383a..f85970615849 100644
--- a/drivers/net/wireless/wl12xx/wl1251_tx.c
+++ b/drivers/net/wireless/wl12xx/wl1251_tx.c
@@ -26,10 +26,10 @@
 #include <linux/module.h>
 
 #include "wl1251.h"
-#include "reg.h"
-#include "wl1251_spi.h"
+#include "wl1251_reg.h"
 #include "wl1251_tx.h"
 #include "wl1251_ps.h"
+#include "wl1251_io.h"
 
 static bool wl1251_tx_double_buffer_busy(struct wl1251 *wl, u32 data_out_count)
 {
@@ -235,7 +235,7 @@ static int wl1251_tx_send_packet(struct wl1251 *wl, struct sk_buff *skb,
         else
                 addr = wl->data_path->tx_packet_ring_addr;
 
-        wl1251_spi_mem_write(wl, addr, skb->data, len);
+        wl1251_mem_write(wl, addr, skb->data, len);
 
         wl1251_debug(DEBUG_TX, "tx id %u skb 0x%p payload %u rate 0x%x",
                      tx_hdr->id, skb, tx_hdr->length, tx_hdr->rate);
@@ -451,7 +451,7 @@ void wl1251_tx_complete(struct wl1251 *wl)
                 return;
 
         /* First we read the result */
-        wl1251_spi_mem_read(wl, wl->data_path->tx_complete_addr,
+        wl1251_mem_read(wl, wl->data_path->tx_complete_addr,
                             result, sizeof(result));
 
         result_index = wl->next_tx_complete;
@@ -482,41 +482,41 @@ void wl1251_tx_complete(struct wl1251 *wl)
                  */
                 if (result_index > wl->next_tx_complete) {
                         /* Only 1 write is needed */
-                        wl1251_spi_mem_write(wl,
-                                             wl->data_path->tx_complete_addr +
-                                             (wl->next_tx_complete *
-                                              sizeof(struct tx_result)),
-                                             &result[wl->next_tx_complete],
-                                             num_complete *
-                                             sizeof(struct tx_result));
+                        wl1251_mem_write(wl,
+                                         wl->data_path->tx_complete_addr +
+                                         (wl->next_tx_complete *
+                                          sizeof(struct tx_result)),
+                                         &result[wl->next_tx_complete],
+                                         num_complete *
+                                         sizeof(struct tx_result));
 
 
                 } else if (result_index < wl->next_tx_complete) {
                         /* 2 writes are needed */
-                        wl1251_spi_mem_write(wl,
-                                             wl->data_path->tx_complete_addr +
-                                             (wl->next_tx_complete *
-                                              sizeof(struct tx_result)),
-                                             &result[wl->next_tx_complete],
-                                             (FW_TX_CMPLT_BLOCK_SIZE -
-                                              wl->next_tx_complete) *
-                                             sizeof(struct tx_result));
-
-                        wl1251_spi_mem_write(wl,
-                                             wl->data_path->tx_complete_addr,
-                                             result,
-                                             (num_complete -
-                                              FW_TX_CMPLT_BLOCK_SIZE +
-                                              wl->next_tx_complete) *
-                                             sizeof(struct tx_result));
+                        wl1251_mem_write(wl,
+                                         wl->data_path->tx_complete_addr +
+                                         (wl->next_tx_complete *
+                                          sizeof(struct tx_result)),
+                                         &result[wl->next_tx_complete],
+                                         (FW_TX_CMPLT_BLOCK_SIZE -
+                                          wl->next_tx_complete) *
+                                         sizeof(struct tx_result));
+
+                        wl1251_mem_write(wl,
+                                         wl->data_path->tx_complete_addr,
+                                         result,
+                                         (num_complete -
+                                          FW_TX_CMPLT_BLOCK_SIZE +
+                                          wl->next_tx_complete) *
+                                         sizeof(struct tx_result));
 
                 } else {
                         /* We have to write the whole array */
-                        wl1251_spi_mem_write(wl,
-                                             wl->data_path->tx_complete_addr,
-                                             result,
-                                             FW_TX_CMPLT_BLOCK_SIZE *
-                                             sizeof(struct tx_result));
+                        wl1251_mem_write(wl,
+                                         wl->data_path->tx_complete_addr,
+                                         result,
+                                         FW_TX_CMPLT_BLOCK_SIZE *
+                                         sizeof(struct tx_result));
                 }
 
         }
diff --git a/drivers/net/wireless/wl12xx/wl1271.h b/drivers/net/wireless/wl12xx/wl1271.h
new file mode 100644
index 000000000000..55818f94017b
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/wl1271.h
@@ -0,0 +1,407 @@
+/*
+ * This file is part of wl1271
+ *
+ * Copyright (C) 1998-2009 Texas Instruments. All rights reserved.
+ * Copyright (C) 2008-2009 Nokia Corporation
+ *
+ * Contact: Luciano Coelho <luciano.coelho@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#ifndef __WL1271_H__
+#define __WL1271_H__
+
+#include <linux/mutex.h>
+#include <linux/completion.h>
+#include <linux/spinlock.h>
+#include <linux/list.h>
+#include <linux/bitops.h>
+#include <net/mac80211.h>
+
+#define DRIVER_NAME "wl1271"
+#define DRIVER_PREFIX DRIVER_NAME ": "
+
+enum {
+        DEBUG_NONE      = 0,
+        DEBUG_IRQ       = BIT(0),
+        DEBUG_SPI       = BIT(1),
+        DEBUG_BOOT      = BIT(2),
+        DEBUG_MAILBOX   = BIT(3),
+        DEBUG_NETLINK   = BIT(4),
+        DEBUG_EVENT     = BIT(5),
+        DEBUG_TX        = BIT(6),
+        DEBUG_RX        = BIT(7),
+        DEBUG_SCAN      = BIT(8),
+        DEBUG_CRYPT     = BIT(9),
+        DEBUG_PSM       = BIT(10),
+        DEBUG_MAC80211  = BIT(11),
+        DEBUG_CMD       = BIT(12),
+        DEBUG_ACX       = BIT(13),
+        DEBUG_ALL       = ~0,
+};
+
+#define DEBUG_LEVEL (DEBUG_NONE)
+
+#define DEBUG_DUMP_LIMIT 1024
+
+#define wl1271_error(fmt, arg...) \
+        printk(KERN_ERR DRIVER_PREFIX "ERROR " fmt "\n", ##arg)
+
+#define wl1271_warning(fmt, arg...) \
+        printk(KERN_WARNING DRIVER_PREFIX "WARNING " fmt "\n", ##arg)
+
+#define wl1271_notice(fmt, arg...) \
+        printk(KERN_INFO DRIVER_PREFIX fmt "\n", ##arg)
+
+#define wl1271_info(fmt, arg...) \
+        printk(KERN_DEBUG DRIVER_PREFIX fmt "\n", ##arg)
+
+#define wl1271_debug(level, fmt, arg...) \
+        do { \
+                if (level & DEBUG_LEVEL) \
+                        printk(KERN_DEBUG DRIVER_PREFIX fmt "\n", ##arg); \
+        } while (0)
+
+#define wl1271_dump(level, prefix, buf, len)    \
+        do { \
+                if (level & DEBUG_LEVEL) \
+                        print_hex_dump(KERN_DEBUG, DRIVER_PREFIX prefix, \
+                                       DUMP_PREFIX_OFFSET, 16, 1,       \
+                                       buf,                             \
+                                       min_t(size_t, len, DEBUG_DUMP_LIMIT), \
+                                       0);                              \
+        } while (0)
+
+#define wl1271_dump_ascii(level, prefix, buf, len)      \
+        do { \
+                if (level & DEBUG_LEVEL) \
+                        print_hex_dump(KERN_DEBUG, DRIVER_PREFIX prefix, \
+                                       DUMP_PREFIX_OFFSET, 16, 1,       \
+                                       buf,                             \
+                                       min_t(size_t, len, DEBUG_DUMP_LIMIT), \
+                                       true);                           \
+        } while (0)
+
+#define WL1271_DEFAULT_RX_CONFIG (CFG_UNI_FILTER_EN |   \
+                                  CFG_BSSID_FILTER_EN)
+
+#define WL1271_DEFAULT_RX_FILTER (CFG_RX_RCTS_ACK | CFG_RX_PRSP_EN |  \
+                                  CFG_RX_MGMT_EN | CFG_RX_DATA_EN |   \
+                                  CFG_RX_CTL_EN | CFG_RX_BCN_EN |     \
+                                  CFG_RX_AUTH_EN | CFG_RX_ASSOC_EN)
+
+#define WL1271_FW_NAME "wl1271-fw.bin"
+#define WL1271_NVS_NAME "wl1271-nvs.bin"
+
+#define WL1271_BUSY_WORD_LEN 8
+
+#define WL1271_ELP_HW_STATE_ASLEEP 0
+#define WL1271_ELP_HW_STATE_IRQ    1
+
+enum wl1271_state {
+        WL1271_STATE_OFF,
+        WL1271_STATE_ON,
+        WL1271_STATE_PLT,
+};
+
+enum wl1271_partition_type {
+        PART_DOWN,
+        PART_WORK,
+        PART_DRPW,
+
+        PART_TABLE_LEN
+};
+
+struct wl1271_partition {
+        u32 size;
+        u32 start;
+};
+
+struct wl1271_partition_set {
+        struct wl1271_partition mem;
+        struct wl1271_partition reg;
+};
+
+struct wl1271;
+
+/* FIXME: I'm not sure about this structure name */
+struct wl1271_chip {
+        u32 id;
+        char fw_ver[21];
+};
+
+struct wl1271_stats {
+        struct acx_statistics *fw_stats;
+        unsigned long fw_stats_update;
+
+        unsigned int retry_count;
+        unsigned int excessive_retries;
+};
+
+struct wl1271_debugfs {
+        struct dentry *rootdir;
+        struct dentry *fw_statistics;
+
+        struct dentry *tx_internal_desc_overflow;
+
+        struct dentry *rx_out_of_mem;
+        struct dentry *rx_hdr_overflow;
+        struct dentry *rx_hw_stuck;
+        struct dentry *rx_dropped;
+        struct dentry *rx_fcs_err;
+        struct dentry *rx_xfr_hint_trig;
+        struct dentry *rx_path_reset;
+        struct dentry *rx_reset_counter;
+
+        struct dentry *dma_rx_requested;
+        struct dentry *dma_rx_errors;
+        struct dentry *dma_tx_requested;
+        struct dentry *dma_tx_errors;
+
+        struct dentry *isr_cmd_cmplt;
+        struct dentry *isr_fiqs;
+        struct dentry *isr_rx_headers;
+        struct dentry *isr_rx_mem_overflow;
+        struct dentry *isr_rx_rdys;
+        struct dentry *isr_irqs;
+        struct dentry *isr_tx_procs;
+        struct dentry *isr_decrypt_done;
+        struct dentry *isr_dma0_done;
+        struct dentry *isr_dma1_done;
+        struct dentry *isr_tx_exch_complete;
+        struct dentry *isr_commands;
+        struct dentry *isr_rx_procs;
+        struct dentry *isr_hw_pm_mode_changes;
+        struct dentry *isr_host_acknowledges;
+        struct dentry *isr_pci_pm;
+        struct dentry *isr_wakeups;
+        struct dentry *isr_low_rssi;
+
+        struct dentry *wep_addr_key_count;
+        struct dentry *wep_default_key_count;
+        /* skipping wep.reserved */
+        struct dentry *wep_key_not_found;
+        struct dentry *wep_decrypt_fail;
+        struct dentry *wep_packets;
+        struct dentry *wep_interrupt;
+
+        struct dentry *pwr_ps_enter;
+        struct dentry *pwr_elp_enter;
+        struct dentry *pwr_missing_bcns;
+        struct dentry *pwr_wake_on_host;
+        struct dentry *pwr_wake_on_timer_exp;
+        struct dentry *pwr_tx_with_ps;
+        struct dentry *pwr_tx_without_ps;
+        struct dentry *pwr_rcvd_beacons;
+        struct dentry *pwr_power_save_off;
+        struct dentry *pwr_enable_ps;
+        struct dentry *pwr_disable_ps;
+        struct dentry *pwr_fix_tsf_ps;
+        /* skipping cont_miss_bcns_spread for now */
+        struct dentry *pwr_rcvd_awake_beacons;
+
+        struct dentry *mic_rx_pkts;
+        struct dentry *mic_calc_failure;
+
+        struct dentry *aes_encrypt_fail;
+        struct dentry *aes_decrypt_fail;
+        struct dentry *aes_encrypt_packets;
+        struct dentry *aes_decrypt_packets;
+        struct dentry *aes_encrypt_interrupt;
+        struct dentry *aes_decrypt_interrupt;
+
+        struct dentry *event_heart_beat;
+        struct dentry *event_calibration;
+        struct dentry *event_rx_mismatch;
+        struct dentry *event_rx_mem_empty;
+        struct dentry *event_rx_pool;
+        struct dentry *event_oom_late;
+        struct dentry *event_phy_transmit_error;
+        struct dentry *event_tx_stuck;
+
+        struct dentry *ps_pspoll_timeouts;
+        struct dentry *ps_upsd_timeouts;
+        struct dentry *ps_upsd_max_sptime;
+        struct dentry *ps_upsd_max_apturn;
+        struct dentry *ps_pspoll_max_apturn;
+        struct dentry *ps_pspoll_utilization;
+        struct dentry *ps_upsd_utilization;
+
+        struct dentry *rxpipe_rx_prep_beacon_drop;
+        struct dentry *rxpipe_descr_host_int_trig_rx_data;
+        struct dentry *rxpipe_beacon_buffer_thres_host_int_trig_rx_data;
+        struct dentry *rxpipe_missed_beacon_host_int_trig_rx_data;
+        struct dentry *rxpipe_tx_xfr_host_int_trig_rx_data;
+
+        struct dentry *tx_queue_len;
+
+        struct dentry *retry_count;
+        struct dentry *excessive_retries;
+};
+
+#define NUM_TX_QUEUES              4
+#define NUM_RX_PKT_DESC            8
+
+/* FW status registers */
+struct wl1271_fw_status {
+        u32 intr;
+        u8  fw_rx_counter;
+        u8  drv_rx_counter;
+        u8  reserved;
+        u8  tx_results_counter;
+        u32 rx_pkt_descs[NUM_RX_PKT_DESC];
+        u32 tx_released_blks[NUM_TX_QUEUES];
+        u32 fw_localtime;
+        u32 padding[2];
+} __attribute__ ((packed));
+
+struct wl1271_rx_mem_pool_addr {
+        u32 addr;
+        u32 addr_extra;
+};
+
+struct wl1271 {
+        struct ieee80211_hw *hw;
+        bool mac80211_registered;
+
+        struct spi_device *spi;
+
+        void (*set_power)(bool enable);
+        int irq;
+
+        spinlock_t wl_lock;
+
+        enum wl1271_state state;
+        struct mutex mutex;
+
+        int physical_mem_addr;
+        int physical_reg_addr;
+        int virtual_mem_addr;
+        int virtual_reg_addr;
+
+        struct wl1271_chip chip;
+
+        int cmd_box_addr;
+        int event_box_addr;
+
+        u8 *fw;
+        size_t fw_len;
+        u8 *nvs;
+        size_t nvs_len;
+
+        u8 bssid[ETH_ALEN];
+        u8 mac_addr[ETH_ALEN];
+        u8 bss_type;
+        u8 ssid[IW_ESSID_MAX_SIZE + 1];
+        u8 ssid_len;
+        u8 listen_int;
+        int channel;
+
+        struct wl1271_acx_mem_map *target_mem_map;
+
+        /* Accounting for allocated / available TX blocks on HW */
+        u32 tx_blocks_freed[NUM_TX_QUEUES];
+        u32 tx_blocks_available;
+        u8 tx_results_count;
+
+        /* Transmitted TX packets counter for chipset interface */
+        int tx_packets_count;
+
+        /* Time-offset between host and chipset clocks */
+        int time_offset;
+
+        /* Session counter for the chipset */
+        int session_counter;
+
+        /* Frames scheduled for transmission, not handled yet */
+        struct sk_buff_head tx_queue;
+        bool tx_queue_stopped;
+
+        struct work_struct tx_work;
+        struct work_struct filter_work;
+
+        /* Pending TX frames */
+        struct sk_buff *tx_frames[16];
+
+        /* FW Rx counter */
+        u32 rx_counter;
+
+        /* Rx memory pool address */
+        struct wl1271_rx_mem_pool_addr rx_mem_pool_addr;
+
+        /* The target interrupt mask */
+        struct work_struct irq_work;
+
+        /* The mbox event mask */
+        u32 event_mask;
+
+        /* Mailbox pointers */
+        u32 mbox_ptr[2];
+
+        /* Are we currently scanning */
+        bool scanning;
+
+        /* Our association ID */
+        u16 aid;
+
+        /* Default key (for WEP) */
+        u32 default_key;
+
+        unsigned int rx_config;
+        unsigned int rx_filter;
+
+        /* is firmware in elp mode */
+        bool elp;
+
+        struct completion *elp_compl;
+
+        /* we can be in psm, but not in elp, we have to differentiate */
+        bool psm;
+
+        /* PSM mode requested */
+        bool psm_requested;
+
+        /* in dBm */
+        int power_level;
+
+        struct wl1271_stats stats;
+        struct wl1271_debugfs debugfs;
+
+        u32 buffer_32;
+        u32 buffer_cmd;
+        u8 buffer_busyword[WL1271_BUSY_WORD_LEN];
+        struct wl1271_rx_descriptor *rx_descriptor;
+
+        struct wl1271_fw_status *fw_status;
+        struct wl1271_tx_hw_res_if *tx_res_if;
+};
+
+int wl1271_plt_start(struct wl1271 *wl);
+int wl1271_plt_stop(struct wl1271 *wl);
+
+#define JOIN_TIMEOUT 5000 /* 5000 milliseconds to join */
+
+#define SESSION_COUNTER_MAX 7 /* maximum value for the session counter */
+
+#define WL1271_DEFAULT_POWER_LEVEL 0
+
+#define WL1271_TX_QUEUE_MAX_LENGTH 20
+
+/* WL1271 needs a 200ms sleep after power on */
+#define WL1271_POWER_ON_SLEEP 200 /* in miliseconds */
+
+#endif
diff --git a/drivers/net/wireless/wl12xx/wl1271_acx.c b/drivers/net/wireless/wl12xx/wl1271_acx.c
new file mode 100644
index 000000000000..f622a4092615
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/wl1271_acx.c
@@ -0,0 +1,961 @@
+/*
+ * This file is part of wl1271
+ *
+ * Copyright (C) 2008-2009 Nokia Corporation
+ *
+ * Contact: Luciano Coelho <luciano.coelho@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#include "wl1271_acx.h"
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/crc7.h>
+#include <linux/spi/spi.h>
+
+#include "wl1271.h"
+#include "wl12xx_80211.h"
+#include "wl1271_reg.h"
+#include "wl1271_spi.h"
+#include "wl1271_ps.h"
+
+int wl1271_acx_wake_up_conditions(struct wl1271 *wl, u8 wake_up_event,
+                                  u8 listen_interval)
+{
+        struct acx_wake_up_condition *wake_up;
+        int ret;
+
+        wl1271_debug(DEBUG_ACX, "acx wake up conditions");
+
+        wake_up = kzalloc(sizeof(*wake_up), GFP_KERNEL);
+        if (!wake_up) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        wake_up->wake_up_event = wake_up_event;
+        wake_up->listen_interval = listen_interval;
+
+        ret = wl1271_cmd_configure(wl, ACX_WAKE_UP_CONDITIONS,
+                                   wake_up, sizeof(*wake_up));
+        if (ret < 0) {
+                wl1271_warning("could not set wake up conditions: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(wake_up);
+        return ret;
+}
+
+int wl1271_acx_sleep_auth(struct wl1271 *wl, u8 sleep_auth)
+{
+        struct acx_sleep_auth *auth;
+        int ret;
+
+        wl1271_debug(DEBUG_ACX, "acx sleep auth");
+
+        auth = kzalloc(sizeof(*auth), GFP_KERNEL);
+        if (!auth) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        auth->sleep_auth = sleep_auth;
+
+        ret = wl1271_cmd_configure(wl, ACX_SLEEP_AUTH, auth, sizeof(*auth));
+        if (ret < 0)
+                return ret;
+
+out:
+        kfree(auth);
+        return ret;
+}
+
+int wl1271_acx_fw_version(struct wl1271 *wl, char *buf, size_t len)
+{
+        struct acx_revision *rev;
+        int ret;
+
+        wl1271_debug(DEBUG_ACX, "acx fw rev");
+
+        rev = kzalloc(sizeof(*rev), GFP_KERNEL);
+        if (!rev) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        ret = wl1271_cmd_interrogate(wl, ACX_FW_REV, rev, sizeof(*rev));
+        if (ret < 0) {
+                wl1271_warning("ACX_FW_REV interrogate failed");
+                goto out;
+        }
+
+        /* be careful with the buffer sizes */
+        strncpy(buf, rev->fw_version, min(len, sizeof(rev->fw_version)));
+
+        /*
+         * if the firmware version string is exactly
+         * sizeof(rev->fw_version) long or fw_len is less than
+         * sizeof(rev->fw_version) it won't be null terminated
+         */
+        buf[min(len, sizeof(rev->fw_version)) - 1] = '\0';
+
+out:
+        kfree(rev);
+        return ret;
+}
+
+int wl1271_acx_tx_power(struct wl1271 *wl, int power)
+{
+        struct acx_current_tx_power *acx;
+        int ret;
+
+        wl1271_debug(DEBUG_ACX, "acx dot11_cur_tx_pwr");
+
+        if (power < 0 || power > 25)
+                return -EINVAL;
+
+        acx = kzalloc(sizeof(*acx), GFP_KERNEL);
+        if (!acx) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        acx->current_tx_power = power * 10;
+
+        ret = wl1271_cmd_configure(wl, DOT11_CUR_TX_PWR, acx, sizeof(*acx));
+        if (ret < 0) {
+                wl1271_warning("configure of tx power failed: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(acx);
+        return ret;
+}
+
+int wl1271_acx_feature_cfg(struct wl1271 *wl)
+{
+        struct acx_feature_config *feature;
+        int ret;
+
+        wl1271_debug(DEBUG_ACX, "acx feature cfg");
+
+        feature = kzalloc(sizeof(*feature), GFP_KERNEL);
+        if (!feature) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        /* DF_ENCRYPTION_DISABLE and DF_SNIFF_MODE_ENABLE are disabled */
+        feature->data_flow_options = 0;
+        feature->options = 0;
+
+        ret = wl1271_cmd_configure(wl, ACX_FEATURE_CFG,
+                                   feature, sizeof(*feature));
+        if (ret < 0) {
+                wl1271_error("Couldnt set HW encryption");
+                goto out;
+        }
+
+out:
+        kfree(feature);
+        return ret;
+}
+
+int wl1271_acx_mem_map(struct wl1271 *wl, struct acx_header *mem_map,
+                       size_t len)
+{
+        int ret;
+
+        wl1271_debug(DEBUG_ACX, "acx mem map");
+
+        ret = wl1271_cmd_interrogate(wl, ACX_MEM_MAP, mem_map, len);
+        if (ret < 0)
+                return ret;
+
+        return 0;
+}
+
+int wl1271_acx_rx_msdu_life_time(struct wl1271 *wl, u32 life_time)
+{
+        struct acx_rx_msdu_lifetime *acx;
+        int ret;
+
+        wl1271_debug(DEBUG_ACX, "acx rx msdu life time");
+
+        acx = kzalloc(sizeof(*acx), GFP_KERNEL);
+        if (!acx) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        acx->lifetime = life_time;
+        ret = wl1271_cmd_configure(wl, DOT11_RX_MSDU_LIFE_TIME,
+                                   acx, sizeof(*acx));
+        if (ret < 0) {
+                wl1271_warning("failed to set rx msdu life time: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(acx);
+        return ret;
+}
+
+int wl1271_acx_rx_config(struct wl1271 *wl, u32 config, u32 filter)
+{
+        struct acx_rx_config *rx_config;
+        int ret;
+
+        wl1271_debug(DEBUG_ACX, "acx rx config");
+
+        rx_config = kzalloc(sizeof(*rx_config), GFP_KERNEL);
+        if (!rx_config) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        rx_config->config_options = config;
+        rx_config->filter_options = filter;
+
+        ret = wl1271_cmd_configure(wl, ACX_RX_CFG,
+                                   rx_config, sizeof(*rx_config));
+        if (ret < 0) {
+                wl1271_warning("failed to set rx config: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(rx_config);
+        return ret;
+}
+
+int wl1271_acx_pd_threshold(struct wl1271 *wl)
+{
+        struct acx_packet_detection *pd;
+        int ret;
+
+        wl1271_debug(DEBUG_ACX, "acx data pd threshold");
+
+        pd = kzalloc(sizeof(*pd), GFP_KERNEL);
+        if (!pd) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        /* FIXME: threshold value not set */
+
+        ret = wl1271_cmd_configure(wl, ACX_PD_THRESHOLD, pd, sizeof(*pd));
+        if (ret < 0) {
+                wl1271_warning("failed to set pd threshold: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(pd);
+        return 0;
+}
+
+int wl1271_acx_slot(struct wl1271 *wl, enum acx_slot_type slot_time)
+{
+        struct acx_slot *slot;
+        int ret;
+
+        wl1271_debug(DEBUG_ACX, "acx slot");
+
+        slot = kzalloc(sizeof(*slot), GFP_KERNEL);
+        if (!slot) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        slot->wone_index = STATION_WONE_INDEX;
+        slot->slot_time = slot_time;
+
+        ret = wl1271_cmd_configure(wl, ACX_SLOT, slot, sizeof(*slot));
+        if (ret < 0) {
+                wl1271_warning("failed to set slot time: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(slot);
+        return ret;
+}
+
+int wl1271_acx_group_address_tbl(struct wl1271 *wl)
+{
+        struct acx_dot11_grp_addr_tbl *acx;
+        int ret;
+
+        wl1271_debug(DEBUG_ACX, "acx group address tbl");
+
+        acx = kzalloc(sizeof(*acx), GFP_KERNEL);
+        if (!acx) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        /* MAC filtering */
+        acx->enabled = 0;
+        acx->num_groups = 0;
+        memset(acx->mac_table, 0, ADDRESS_GROUP_MAX_LEN);
+
+        ret = wl1271_cmd_configure(wl, DOT11_GROUP_ADDRESS_TBL,
+                                   acx, sizeof(*acx));
+        if (ret < 0) {
+                wl1271_warning("failed to set group addr table: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(acx);
+        return ret;
+}
+
+int wl1271_acx_service_period_timeout(struct wl1271 *wl)
+{
+        struct acx_rx_timeout *rx_timeout;
+        int ret;
+
+        rx_timeout = kzalloc(sizeof(*rx_timeout), GFP_KERNEL);
+        if (!rx_timeout) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        wl1271_debug(DEBUG_ACX, "acx service period timeout");
+
+        rx_timeout->ps_poll_timeout = RX_TIMEOUT_PS_POLL_DEF;
+        rx_timeout->upsd_timeout = RX_TIMEOUT_UPSD_DEF;
+
+        ret = wl1271_cmd_configure(wl, ACX_SERVICE_PERIOD_TIMEOUT,
+                                   rx_timeout, sizeof(*rx_timeout));
+        if (ret < 0) {
+                wl1271_warning("failed to set service period timeout: %d",
+                               ret);
+                goto out;
+        }
+
+out:
+        kfree(rx_timeout);
+        return ret;
+}
+
+int wl1271_acx_rts_threshold(struct wl1271 *wl, u16 rts_threshold)
+{
+        struct acx_rts_threshold *rts;
+        int ret;
+
+        wl1271_debug(DEBUG_ACX, "acx rts threshold");
+
+        rts = kzalloc(sizeof(*rts), GFP_KERNEL);
+        if (!rts) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        rts->threshold = rts_threshold;
+
+        ret = wl1271_cmd_configure(wl, DOT11_RTS_THRESHOLD, rts, sizeof(*rts));
+        if (ret < 0) {
+                wl1271_warning("failed to set rts threshold: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(rts);
+        return ret;
+}
+
+int wl1271_acx_beacon_filter_opt(struct wl1271 *wl)
+{
+        struct acx_beacon_filter_option *beacon_filter;
+        int ret;
+
+        wl1271_debug(DEBUG_ACX, "acx beacon filter opt");
+
+        beacon_filter = kzalloc(sizeof(*beacon_filter), GFP_KERNEL);
+        if (!beacon_filter) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        beacon_filter->enable = 0;
+        beacon_filter->max_num_beacons = 0;
+
+        ret = wl1271_cmd_configure(wl, ACX_BEACON_FILTER_OPT,
+                                   beacon_filter, sizeof(*beacon_filter));
+        if (ret < 0) {
+                wl1271_warning("failed to set beacon filter opt: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(beacon_filter);
+        return ret;
+}
+
+int wl1271_acx_beacon_filter_table(struct wl1271 *wl)
+{
+        struct acx_beacon_filter_ie_table *ie_table;
+        int ret;
+
+        wl1271_debug(DEBUG_ACX, "acx beacon filter table");
+
+        ie_table = kzalloc(sizeof(*ie_table), GFP_KERNEL);
+        if (!ie_table) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        ie_table->num_ie = 0;
+        memset(ie_table->table, 0, BEACON_FILTER_TABLE_MAX_SIZE);
+
+        ret = wl1271_cmd_configure(wl, ACX_BEACON_FILTER_TABLE,
+                                   ie_table, sizeof(*ie_table));
+        if (ret < 0) {
+                wl1271_warning("failed to set beacon filter table: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(ie_table);
+        return ret;
+}
+
+int wl1271_acx_sg_enable(struct wl1271 *wl)
+{
+        struct acx_bt_wlan_coex *pta;
+        int ret;
+
+        wl1271_debug(DEBUG_ACX, "acx sg enable");
+
+        pta = kzalloc(sizeof(*pta), GFP_KERNEL);
+        if (!pta) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        pta->enable = SG_ENABLE;
+
+        ret = wl1271_cmd_configure(wl, ACX_SG_ENABLE, pta, sizeof(*pta));
+        if (ret < 0) {
+                wl1271_warning("failed to set softgemini enable: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(pta);
+        return ret;
+}
+
+int wl1271_acx_sg_cfg(struct wl1271 *wl)
+{
+        struct acx_bt_wlan_coex_param *param;
+        int ret;
+
+        wl1271_debug(DEBUG_ACX, "acx sg cfg");
+
+        param = kzalloc(sizeof(*param), GFP_KERNEL);
+        if (!param) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        /* BT-WLAN coext parameters */
+        param->min_rate = RATE_INDEX_24MBPS;
+        param->bt_hp_max_time = PTA_BT_HP_MAXTIME_DEF;
+        param->wlan_hp_max_time = PTA_WLAN_HP_MAX_TIME_DEF;
+        param->sense_disable_timer = PTA_SENSE_DISABLE_TIMER_DEF;
+        param->rx_time_bt_hp = PTA_PROTECTIVE_RX_TIME_DEF;
+        param->tx_time_bt_hp = PTA_PROTECTIVE_TX_TIME_DEF;
+        param->rx_time_bt_hp_fast = PTA_PROTECTIVE_RX_TIME_FAST_DEF;
+        param->tx_time_bt_hp_fast = PTA_PROTECTIVE_TX_TIME_FAST_DEF;
+        param->wlan_cycle_fast = PTA_CYCLE_TIME_FAST_DEF;
+        param->bt_anti_starvation_period = PTA_ANTI_STARVE_PERIOD_DEF;
+        param->next_bt_lp_packet = PTA_TIMEOUT_NEXT_BT_LP_PACKET_DEF;
+        param->wake_up_beacon = PTA_TIME_BEFORE_BEACON_DEF;
+        param->hp_dm_max_guard_time = PTA_HPDM_MAX_TIME_DEF;
+        param->next_wlan_packet = PTA_TIME_OUT_NEXT_WLAN_DEF;
+        param->antenna_type = PTA_ANTENNA_TYPE_DEF;
+        param->signal_type = PTA_SIGNALING_TYPE_DEF;
+        param->afh_leverage_on = PTA_AFH_LEVERAGE_ON_DEF;
+        param->quiet_cycle_num = PTA_NUMBER_QUIET_CYCLE_DEF;
+        param->max_cts = PTA_MAX_NUM_CTS_DEF;
+        param->wlan_packets_num = PTA_NUMBER_OF_WLAN_PACKETS_DEF;
+        param->bt_packets_num = PTA_NUMBER_OF_BT_PACKETS_DEF;
+        param->missed_rx_avalanche = PTA_RX_FOR_AVALANCHE_DEF;
+        param->wlan_elp_hp = PTA_ELP_HP_DEF;
+        param->bt_anti_starvation_cycles = PTA_ANTI_STARVE_NUM_CYCLE_DEF;
+        param->ack_mode_dual_ant = PTA_ACK_MODE_DEF;
+        param->pa_sd_enable = PTA_ALLOW_PA_SD_DEF;
+        param->pta_auto_mode_enable = PTA_AUTO_MODE_NO_CTS_DEF;
+        param->bt_hp_respected_num = PTA_BT_HP_RESPECTED_DEF;
+
+        ret = wl1271_cmd_configure(wl, ACX_SG_CFG, param, sizeof(*param));
+        if (ret < 0) {
+                wl1271_warning("failed to set sg config: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(param);
+        return ret;
+}
+
+int wl1271_acx_cca_threshold(struct wl1271 *wl)
+{
+        struct acx_energy_detection *detection;
+        int ret;
+
+        wl1271_debug(DEBUG_ACX, "acx cca threshold");
+
+        detection = kzalloc(sizeof(*detection), GFP_KERNEL);
+        if (!detection) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        detection->rx_cca_threshold = CCA_THRSH_DISABLE_ENERGY_D;
+        detection->tx_energy_detection = 0;
+
+        ret = wl1271_cmd_configure(wl, ACX_CCA_THRESHOLD,
+                                   detection, sizeof(*detection));
+        if (ret < 0) {
+                wl1271_warning("failed to set cca threshold: %d", ret);
+                return ret;
+        }
+
+out:
+        kfree(detection);
+        return ret;
+}
+
+int wl1271_acx_bcn_dtim_options(struct wl1271 *wl)
+{
+        struct acx_beacon_broadcast *bb;
+        int ret;
+
+        wl1271_debug(DEBUG_ACX, "acx bcn dtim options");
+
+        bb = kzalloc(sizeof(*bb), GFP_KERNEL);
+        if (!bb) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        bb->beacon_rx_timeout = BCN_RX_TIMEOUT_DEF_VALUE;
+        bb->broadcast_timeout = BROADCAST_RX_TIMEOUT_DEF_VALUE;
+        bb->rx_broadcast_in_ps = RX_BROADCAST_IN_PS_DEF_VALUE;
+        bb->ps_poll_threshold = CONSECUTIVE_PS_POLL_FAILURE_DEF;
+
+        ret = wl1271_cmd_configure(wl, ACX_BCN_DTIM_OPTIONS, bb, sizeof(*bb));
+        if (ret < 0) {
+                wl1271_warning("failed to set rx config: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(bb);
+        return ret;
+}
+
+int wl1271_acx_aid(struct wl1271 *wl, u16 aid)
+{
+        struct acx_aid *acx_aid;
+        int ret;
+
+        wl1271_debug(DEBUG_ACX, "acx aid");
+
+        acx_aid = kzalloc(sizeof(*acx_aid), GFP_KERNEL);
+        if (!acx_aid) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        acx_aid->aid = aid;
+
+        ret = wl1271_cmd_configure(wl, ACX_AID, acx_aid, sizeof(*acx_aid));
+        if (ret < 0) {
+                wl1271_warning("failed to set aid: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(acx_aid);
+        return ret;
+}
+
+int wl1271_acx_event_mbox_mask(struct wl1271 *wl, u32 event_mask)
+{
+        struct acx_event_mask *mask;
+        int ret;
+
+        wl1271_debug(DEBUG_ACX, "acx event mbox mask");
+
+        mask = kzalloc(sizeof(*mask), GFP_KERNEL);
+        if (!mask) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        /* high event mask is unused */
+        mask->high_event_mask = 0xffffffff;
+
+        mask->event_mask = event_mask;
+
+        ret = wl1271_cmd_configure(wl, ACX_EVENT_MBOX_MASK,
+                                   mask, sizeof(*mask));
+        if (ret < 0) {
+                wl1271_warning("failed to set acx_event_mbox_mask: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(mask);
+        return ret;
+}
+
+int wl1271_acx_set_preamble(struct wl1271 *wl, enum acx_preamble_type preamble)
+{
+        struct acx_preamble *acx;
+        int ret;
+
+        wl1271_debug(DEBUG_ACX, "acx_set_preamble");
+
+        acx = kzalloc(sizeof(*acx), GFP_KERNEL);
+        if (!acx) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        acx->preamble = preamble;
+
+        ret = wl1271_cmd_configure(wl, ACX_PREAMBLE_TYPE, acx, sizeof(*acx));
+        if (ret < 0) {
+                wl1271_warning("Setting of preamble failed: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(acx);
+        return ret;
+}
+
+int wl1271_acx_cts_protect(struct wl1271 *wl,
+                           enum acx_ctsprotect_type ctsprotect)
+{
+        struct acx_ctsprotect *acx;
+        int ret;
+
+        wl1271_debug(DEBUG_ACX, "acx_set_ctsprotect");
+
+        acx = kzalloc(sizeof(*acx), GFP_KERNEL);
+        if (!acx) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        acx->ctsprotect = ctsprotect;
+
+        ret = wl1271_cmd_configure(wl, ACX_CTS_PROTECTION, acx, sizeof(*acx));
+        if (ret < 0) {
+                wl1271_warning("Setting of ctsprotect failed: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(acx);
+        return ret;
+}
+
+int wl1271_acx_statistics(struct wl1271 *wl, struct acx_statistics *stats)
+{
+        int ret;
+
+        wl1271_debug(DEBUG_ACX, "acx statistics");
+
+        ret = wl1271_cmd_interrogate(wl, ACX_STATISTICS, stats,
+                                     sizeof(*stats));
+        if (ret < 0) {
+                wl1271_warning("acx statistics failed: %d", ret);
+                return -ENOMEM;
+        }
+
+        return 0;
+}
+
+int wl1271_acx_rate_policies(struct wl1271 *wl)
+{
+        struct acx_rate_policy *acx;
+        int ret = 0;
+
+        wl1271_debug(DEBUG_ACX, "acx rate policies");
+
+        acx = kzalloc(sizeof(*acx), GFP_KERNEL);
+
+        if (!acx) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        /* configure one default (one-size-fits-all) rate class */
+        acx->rate_class_cnt = 1;
+        acx->rate_class[0].enabled_rates = ACX_RATE_MASK_ALL;
+        acx->rate_class[0].short_retry_limit = ACX_RATE_RETRY_LIMIT;
+        acx->rate_class[0].long_retry_limit = ACX_RATE_RETRY_LIMIT;
+        acx->rate_class[0].aflags = 0;
+
+        ret = wl1271_cmd_configure(wl, ACX_RATE_POLICY, acx, sizeof(*acx));
+        if (ret < 0) {
+                wl1271_warning("Setting of rate policies failed: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(acx);
+        return ret;
+}
+
+int wl1271_acx_ac_cfg(struct wl1271 *wl)
+{
+        struct acx_ac_cfg *acx;
+        int i, ret = 0;
+
+        wl1271_debug(DEBUG_ACX, "acx access category config");
+
+        acx = kzalloc(sizeof(*acx), GFP_KERNEL);
+
+        if (!acx) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        /*
+         * FIXME: Configure each AC with appropriate values (most suitable
+         * values will probably be different for each AC.
+         */
+        for (i = 0; i < WL1271_ACX_AC_COUNT; i++) {
+                acx->ac = i;
+
+                /*
+                 * FIXME: The following default values originate from
+                 * the TI reference driver. What do they mean?
+                 */
+                acx->cw_min = 15;
+                acx->cw_max = 63;
+                acx->aifsn = 3;
+                acx->reserved = 0;
+                acx->tx_op_limit = 0;
+
+                ret = wl1271_cmd_configure(wl, ACX_AC_CFG, acx, sizeof(*acx));
+                if (ret < 0) {
+                        wl1271_warning("Setting of access category "
+                                       "config: %d", ret);
+                        goto out;
+                }
+        }
+
+out:
+        kfree(acx);
+        return ret;
+}
+
+int wl1271_acx_tid_cfg(struct wl1271 *wl)
+{
+        struct acx_tid_config *acx;
+        int i, ret = 0;
+
+        wl1271_debug(DEBUG_ACX, "acx tid config");
+
+        acx = kzalloc(sizeof(*acx), GFP_KERNEL);
+
+        if (!acx) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        /* FIXME: configure each TID with a different AC reference */
+        for (i = 0; i < WL1271_ACX_TID_COUNT; i++) {
+                acx->queue_id = i;
+                acx->tsid = WL1271_ACX_AC_BE;
+                acx->ps_scheme = WL1271_ACX_PS_SCHEME_LEGACY;
+                acx->ack_policy = WL1271_ACX_ACK_POLICY_LEGACY;
+
+                ret = wl1271_cmd_configure(wl, ACX_TID_CFG, acx, sizeof(*acx));
+                if (ret < 0) {
+                        wl1271_warning("Setting of tid config failed: %d", ret);
+                        goto out;
+                }
+        }
+
+out:
+        kfree(acx);
+        return ret;
+}
+
+int wl1271_acx_frag_threshold(struct wl1271 *wl)
+{
+        struct acx_frag_threshold *acx;
+        int ret = 0;
+
+        wl1271_debug(DEBUG_ACX, "acx frag threshold");
+
+        acx = kzalloc(sizeof(*acx), GFP_KERNEL);
+
+        if (!acx) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        acx->frag_threshold = IEEE80211_MAX_FRAG_THRESHOLD;
+        ret = wl1271_cmd_configure(wl, ACX_FRAG_CFG, acx, sizeof(*acx));
+        if (ret < 0) {
+                wl1271_warning("Setting of frag threshold failed: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(acx);
+        return ret;
+}
+
+int wl1271_acx_tx_config_options(struct wl1271 *wl)
+{
+        struct acx_tx_config_options *acx;
+        int ret = 0;
+
+        wl1271_debug(DEBUG_ACX, "acx tx config options");
+
+        acx = kzalloc(sizeof(*acx), GFP_KERNEL);
+
+        if (!acx) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        acx->tx_compl_timeout = WL1271_ACX_TX_COMPL_TIMEOUT;
+        acx->tx_compl_threshold = WL1271_ACX_TX_COMPL_THRESHOLD;
+        ret = wl1271_cmd_configure(wl, ACX_TX_CONFIG_OPT, acx, sizeof(*acx));
+        if (ret < 0) {
+                wl1271_warning("Setting of tx options failed: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(acx);
+        return ret;
+}
+
+int wl1271_acx_mem_cfg(struct wl1271 *wl)
+{
+        struct wl1271_acx_config_memory *mem_conf;
+        int ret;
+
+        wl1271_debug(DEBUG_ACX, "wl1271 mem cfg");
+
+        mem_conf = kzalloc(sizeof(*mem_conf), GFP_KERNEL);
+        if (!mem_conf) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        /* memory config */
+        mem_conf->num_stations = cpu_to_le16(DEFAULT_NUM_STATIONS);
+        mem_conf->rx_mem_block_num = ACX_RX_MEM_BLOCKS;
+        mem_conf->tx_min_mem_block_num = ACX_TX_MIN_MEM_BLOCKS;
+        mem_conf->num_ssid_profiles = ACX_NUM_SSID_PROFILES;
+        mem_conf->total_tx_descriptors = ACX_TX_DESCRIPTORS;
+
+        ret = wl1271_cmd_configure(wl, ACX_MEM_CFG, mem_conf,
+                                   sizeof(*mem_conf));
+        if (ret < 0) {
+                wl1271_warning("wl1271 mem config failed: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(mem_conf);
+        return ret;
+}
+
+int wl1271_acx_init_mem_config(struct wl1271 *wl)
+{
+        int ret;
+
+        ret = wl1271_acx_mem_cfg(wl);
+        if (ret < 0)
+                return ret;
+
+        wl->target_mem_map = kzalloc(sizeof(struct wl1271_acx_mem_map),
+                                          GFP_KERNEL);
+        if (!wl->target_mem_map) {
+                wl1271_error("couldn't allocate target memory map");
+                return -ENOMEM;
+        }
+
+        /* we now ask for the firmware built memory map */
+        ret = wl1271_acx_mem_map(wl, (void *)wl->target_mem_map,
+                                 sizeof(struct wl1271_acx_mem_map));
+        if (ret < 0) {
+                wl1271_error("couldn't retrieve firmware memory map");
+                kfree(wl->target_mem_map);
+                wl->target_mem_map = NULL;
+                return ret;
+        }
+
+        /* initialize TX block book keeping */
+        wl->tx_blocks_available = wl->target_mem_map->num_tx_mem_blocks;
+        wl1271_debug(DEBUG_TX, "available tx blocks: %d",
+                     wl->tx_blocks_available);
+
+        return 0;
+}
+
+int wl1271_acx_init_rx_interrupt(struct wl1271 *wl)
+{
+        struct wl1271_acx_rx_config_opt *rx_conf;
+        int ret;
+
+        wl1271_debug(DEBUG_ACX, "wl1271 rx interrupt config");
+
+        rx_conf = kzalloc(sizeof(*rx_conf), GFP_KERNEL);
+        if (!rx_conf) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        rx_conf->threshold = WL1271_RX_INTR_THRESHOLD_DEF;
+        rx_conf->timeout = WL1271_RX_INTR_TIMEOUT_DEF;
+        rx_conf->mblk_threshold = USHORT_MAX; /* Disabled */
+        rx_conf->queue_type = RX_QUEUE_TYPE_RX_LOW_PRIORITY;
+
+        ret = wl1271_cmd_configure(wl, ACX_RX_CONFIG_OPT, rx_conf,
+                                   sizeof(*rx_conf));
+        if (ret < 0) {
+                wl1271_warning("wl1271 rx config opt failed: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(rx_conf);
+        return ret;
+}
diff --git a/drivers/net/wireless/wl12xx/wl1271_acx.h b/drivers/net/wireless/wl12xx/wl1271_acx.h
new file mode 100644
index 000000000000..9068daaf0ddf
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/wl1271_acx.h
@@ -0,0 +1,1221 @@
+/*
+ * This file is part of wl1271
+ *
+ * Copyright (C) 1998-2009 Texas Instruments. All rights reserved.
+ * Copyright (C) 2008-2009 Nokia Corporation
+ *
+ * Contact: Luciano Coelho <luciano.coelho@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#ifndef __WL1271_ACX_H__
+#define __WL1271_ACX_H__
+
+#include "wl1271.h"
+#include "wl1271_cmd.h"
+
+/*************************************************************************
+
+    Host Interrupt Register (WiLink -> Host)
+
+**************************************************************************/
+/* HW Initiated interrupt Watchdog timer expiration */
+#define WL1271_ACX_INTR_WATCHDOG           BIT(0)
+/* Init sequence is done (masked interrupt, detection through polling only ) */
+#define WL1271_ACX_INTR_INIT_COMPLETE      BIT(1)
+/* Event was entered to Event MBOX #A*/
+#define WL1271_ACX_INTR_EVENT_A            BIT(2)
+/* Event was entered to Event MBOX #B*/
+#define WL1271_ACX_INTR_EVENT_B            BIT(3)
+/* Command processing completion*/
+#define WL1271_ACX_INTR_CMD_COMPLETE       BIT(4)
+/* Signaling the host on HW wakeup */
+#define WL1271_ACX_INTR_HW_AVAILABLE       BIT(5)
+/* The MISC bit is used for aggregation of RX, TxComplete and TX rate update */
+#define WL1271_ACX_INTR_DATA               BIT(6)
+/* Trace meassge on MBOX #A */
+#define WL1271_ACX_INTR_TRACE_A            BIT(7)
+/* Trace meassge on MBOX #B */
+#define WL1271_ACX_INTR_TRACE_B            BIT(8)
+
+#define WL1271_ACX_INTR_ALL                0xFFFFFFFF
+#define WL1271_ACX_ALL_EVENTS_VECTOR       (WL1271_ACX_INTR_WATCHDOG      | \
+                                            WL1271_ACX_INTR_INIT_COMPLETE | \
+                                            WL1271_ACX_INTR_EVENT_A       | \
+                                            WL1271_ACX_INTR_EVENT_B       | \
+                                            WL1271_ACX_INTR_CMD_COMPLETE  | \
+                                            WL1271_ACX_INTR_HW_AVAILABLE  | \
+                                            WL1271_ACX_INTR_DATA)
+
+#define WL1271_INTR_MASK                   (WL1271_ACX_INTR_EVENT_A |   \
+                                            WL1271_ACX_INTR_EVENT_B | \
+                                            WL1271_ACX_INTR_DATA)
+
+/* Target's information element */
+struct acx_header {
+        struct wl1271_cmd_header cmd;
+
+        /* acx (or information element) header */
+        u16 id;
+
+        /* payload length (not including headers */
+        u16 len;
+};
+
+struct acx_error_counter {
+        struct acx_header header;
+
+        /* The number of PLCP errors since the last time this */
+        /* information element was interrogated. This field is */
+        /* automatically cleared when it is interrogated.*/
+        u32 PLCP_error;
+
+        /* The number of FCS errors since the last time this */
+        /* information element was interrogated. This field is */
+        /* automatically cleared when it is interrogated.*/
+        u32 FCS_error;
+
+        /* The number of MPDUs without PLCP header errors received*/
+        /* since the last time this information element was interrogated. */
+        /* This field is automatically cleared when it is interrogated.*/
+        u32 valid_frame;
+
+        /* the number of missed sequence numbers in the squentially */
+        /* values of frames seq numbers */
+        u32 seq_num_miss;
+} __attribute__ ((packed));
+
+struct acx_revision {
+        struct acx_header header;
+
+        /*
+         * The WiLink firmware version, an ASCII string x.x.x.x,
+         * that uniquely identifies the current firmware.
+         * The left most digit is incremented each time a
+         * significant change is made to the firmware, such as
+         * code redesign or new platform support.
+         * The second digit is incremented when major enhancements
+         * are added or major fixes are made.
+         * The third digit is incremented for each GA release.
+         * The fourth digit is incremented for each build.
+         * The first two digits identify a firmware release version,
+         * in other words, a unique set of features.
+         * The first three digits identify a GA release.
+         */
+        char fw_version[20];
+
+        /*
+         * This 4 byte field specifies the WiLink hardware version.
+         * bits 0  - 15: Reserved.
+         * bits 16 - 23: Version ID - The WiLink version ID
+         *              (1 = first spin, 2 = second spin, and so on).
+         * bits 24 - 31: Chip ID - The WiLink chip ID.
+         */
+        u32 hw_version;
+} __attribute__ ((packed));
+
+enum wl1271_psm_mode {
+        /* Active mode */
+        WL1271_PSM_CAM = 0,
+
+        /* Power save mode */
+        WL1271_PSM_PS = 1,
+
+        /* Extreme low power */
+        WL1271_PSM_ELP = 2,
+};
+
+struct acx_sleep_auth {
+        struct acx_header header;
+
+        /* The sleep level authorization of the device. */
+        /* 0 - Always active*/
+        /* 1 - Power down mode: light / fast sleep*/
+        /* 2 - ELP mode: Deep / Max sleep*/
+        u8  sleep_auth;
+        u8  padding[3];
+} __attribute__ ((packed));
+
+enum {
+        HOSTIF_PCI_MASTER_HOST_INDIRECT,
+        HOSTIF_PCI_MASTER_HOST_DIRECT,
+        HOSTIF_SLAVE,
+        HOSTIF_PKT_RING,
+        HOSTIF_DONTCARE = 0xFF
+};
+
+#define DEFAULT_UCAST_PRIORITY          0
+#define DEFAULT_RX_Q_PRIORITY           0
+#define DEFAULT_NUM_STATIONS            1
+#define DEFAULT_RXQ_PRIORITY            0 /* low 0 .. 15 high  */
+#define DEFAULT_RXQ_TYPE                0x07    /* All frames, Data/Ctrl/Mgmt */
+#define TRACE_BUFFER_MAX_SIZE           256
+
+#define  DP_RX_PACKET_RING_CHUNK_SIZE 1600
+#define  DP_TX_PACKET_RING_CHUNK_SIZE 1600
+#define  DP_RX_PACKET_RING_CHUNK_NUM 2
+#define  DP_TX_PACKET_RING_CHUNK_NUM 2
+#define  DP_TX_COMPLETE_TIME_OUT 20
+#define  FW_TX_CMPLT_BLOCK_SIZE 16
+
+#define TX_MSDU_LIFETIME_MIN       0
+#define TX_MSDU_LIFETIME_MAX       3000
+#define TX_MSDU_LIFETIME_DEF       512
+#define RX_MSDU_LIFETIME_MIN       0
+#define RX_MSDU_LIFETIME_MAX       0xFFFFFFFF
+#define RX_MSDU_LIFETIME_DEF       512000
+
+struct acx_rx_msdu_lifetime {
+        struct acx_header header;
+
+        /*
+         * The maximum amount of time, in TU, before the
+         * firmware discards the MSDU.
+         */
+        u32 lifetime;
+} __attribute__ ((packed));
+
+/*
+ * RX Config Options Table
+ * Bit          Definition
+ * ===          ==========
+ * 31:14                Reserved
+ * 13           Copy RX Status - when set, write three receive status words
+ *              to top of rx'd MPDUs.
+ *              When cleared, do not write three status words (added rev 1.5)
+ * 12           Reserved
+ * 11           RX Complete upon FCS error - when set, give rx complete
+ *              interrupt for FCS errors, after the rx filtering, e.g. unicast
+ *              frames not to us with FCS error will not generate an interrupt.
+ * 10           SSID Filter Enable - When set, the WiLink discards all beacon,
+ *              probe request, and probe response frames with an SSID that does
+ *              not match the SSID specified by the host in the START/JOIN
+ *              command.
+ *              When clear, the WiLink receives frames with any SSID.
+ * 9            Broadcast Filter Enable - When set, the WiLink discards all
+ *              broadcast frames. When clear, the WiLink receives all received
+ *              broadcast frames.
+ * 8:6          Reserved
+ * 5            BSSID Filter Enable - When set, the WiLink discards any frames
+ *              with a BSSID that does not match the BSSID specified by the
+ *              host.
+ *              When clear, the WiLink receives frames from any BSSID.
+ * 4            MAC Addr Filter - When set, the WiLink discards any frames
+ *              with a destination address that does not match the MAC address
+ *              of the adaptor.
+ *              When clear, the WiLink receives frames destined to any MAC
+ *              address.
+ * 3            Promiscuous - When set, the WiLink receives all valid frames
+ *              (i.e., all frames that pass the FCS check).
+ *              When clear, only frames that pass the other filters specified
+ *              are received.
+ * 2            FCS - When set, the WiLink includes the FCS with the received
+ *              frame.
+ *              When cleared, the FCS is discarded.
+ * 1            PLCP header - When set, write all data from baseband to frame
+ *              buffer including PHY header.
+ * 0            Reserved - Always equal to 0.
+ *
+ * RX Filter Options Table
+ * Bit          Definition
+ * ===          ==========
+ * 31:12                Reserved - Always equal to 0.
+ * 11           Association - When set, the WiLink receives all association
+ *              related frames (association request/response, reassocation
+ *              request/response, and disassociation). When clear, these frames
+ *              are discarded.
+ * 10           Auth/De auth - When set, the WiLink receives all authentication
+ *              and de-authentication frames. When clear, these frames are
+ *              discarded.
+ * 9            Beacon - When set, the WiLink receives all beacon frames.
+ *              When clear, these frames are discarded.
+ * 8            Contention Free - When set, the WiLink receives all contention
+ *              free frames.
+ *              When clear, these frames are discarded.
+ * 7            Control - When set, the WiLink receives all control frames.
+ *              When clear, these frames are discarded.
+ * 6            Data - When set, the WiLink receives all data frames.
+ *              When clear, these frames are discarded.
+ * 5            FCS Error - When set, the WiLink receives frames that have FCS
+ *              errors.
+ *              When clear, these frames are discarded.
+ * 4            Management - When set, the WiLink receives all management
+ *              frames.
+ *              When clear, these frames are discarded.
+ * 3            Probe Request - When set, the WiLink receives all probe request
+ *              frames.
+ *              When clear, these frames are discarded.
+ * 2            Probe Response - When set, the WiLink receives all probe
+ *              response frames.
+ *              When clear, these frames are discarded.
+ * 1            RTS/CTS/ACK - When set, the WiLink receives all RTS, CTS and ACK
+ *              frames.
+ *              When clear, these frames are discarded.
+ * 0            Rsvd Type/Sub Type - When set, the WiLink receives all frames
+ *              that have reserved frame types and sub types as defined by the
+ *              802.11 specification.
+ *              When clear, these frames are discarded.
+ */
+struct acx_rx_config {
+        struct acx_header header;
+
+        u32 config_options;
+        u32 filter_options;
+} __attribute__ ((packed));
+
+struct acx_packet_detection {
+        struct acx_header header;
+
+        u32 threshold;
+} __attribute__ ((packed));
+
+
+enum acx_slot_type {
+        SLOT_TIME_LONG = 0,
+        SLOT_TIME_SHORT = 1,
+        DEFAULT_SLOT_TIME = SLOT_TIME_SHORT,
+        MAX_SLOT_TIMES = 0xFF
+};
+
+#define STATION_WONE_INDEX 0
+
+struct acx_slot {
+        struct acx_header header;
+
+        u8 wone_index; /* Reserved */
+        u8 slot_time;
+        u8 reserved[6];
+} __attribute__ ((packed));
+
+
+#define ADDRESS_GROUP_MAX       (8)
+#define ADDRESS_GROUP_MAX_LEN   (ETH_ALEN * ADDRESS_GROUP_MAX)
+
+struct acx_dot11_grp_addr_tbl {
+        struct acx_header header;
+
+        u8 enabled;
+        u8 num_groups;
+        u8 pad[2];
+        u8 mac_table[ADDRESS_GROUP_MAX_LEN];
+} __attribute__ ((packed));
+
+
+#define  RX_TIMEOUT_PS_POLL_MIN    0
+#define  RX_TIMEOUT_PS_POLL_MAX    (200000)
+#define  RX_TIMEOUT_PS_POLL_DEF    (15)
+#define  RX_TIMEOUT_UPSD_MIN       0
+#define  RX_TIMEOUT_UPSD_MAX       (200000)
+#define  RX_TIMEOUT_UPSD_DEF       (15)
+
+struct acx_rx_timeout {
+        struct acx_header header;
+
+        /*
+         * The longest time the STA will wait to receive
+         * traffic from the AP after a PS-poll has been
+         * transmitted.
+         */
+        u16 ps_poll_timeout;
+
+        /*
+         * The longest time the STA will wait to receive
+         * traffic from the AP after a frame has been sent
+         * from an UPSD enabled queue.
+         */
+        u16 upsd_timeout;
+} __attribute__ ((packed));
+
+#define RTS_THRESHOLD_MIN              0
+#define RTS_THRESHOLD_MAX              4096
+#define RTS_THRESHOLD_DEF              2347
+
+struct acx_rts_threshold {
+        struct acx_header header;
+
+        u16 threshold;
+        u8 pad[2];
+} __attribute__ ((packed));
+
+struct acx_beacon_filter_option {
+        struct acx_header header;
+
+        u8 enable;
+
+        /*
+         * The number of beacons without the unicast TIM
+         * bit set that the firmware buffers before
+         * signaling the host about ready frames.
+         * When set to 0 and the filter is enabled, beacons
+         * without the unicast TIM bit set are dropped.
+         */
+        u8 max_num_beacons;
+        u8 pad[2];
+} __attribute__ ((packed));
+
+/*
+ * ACXBeaconFilterEntry (not 221)
+ * Byte Offset     Size (Bytes)    Definition
+ * ===========     ============    ==========
+ * 0                            1               IE identifier
+ * 1               1               Treatment bit mask
+ *
+ * ACXBeaconFilterEntry (221)
+ * Byte Offset     Size (Bytes)    Definition
+ * ===========     ============    ==========
+ * 0               1               IE identifier
+ * 1               1               Treatment bit mask
+ * 2               3               OUI
+ * 5               1               Type
+ * 6               2               Version
+ *
+ *
+ * Treatment bit mask - The information element handling:
+ * bit 0 - The information element is compared and transferred
+ * in case of change.
+ * bit 1 - The information element is transferred to the host
+ * with each appearance or disappearance.
+ * Note that both bits can be set at the same time.
+ */
+#define BEACON_FILTER_TABLE_MAX_IE_NUM                 (32)
+#define BEACON_FILTER_TABLE_MAX_VENDOR_SPECIFIC_IE_NUM (6)
+#define BEACON_FILTER_TABLE_IE_ENTRY_SIZE              (2)
+#define BEACON_FILTER_TABLE_EXTRA_VENDOR_SPECIFIC_IE_SIZE (6)
+#define BEACON_FILTER_TABLE_MAX_SIZE ((BEACON_FILTER_TABLE_MAX_IE_NUM * \
+                            BEACON_FILTER_TABLE_IE_ENTRY_SIZE) + \
+                           (BEACON_FILTER_TABLE_MAX_VENDOR_SPECIFIC_IE_NUM * \
+                            BEACON_FILTER_TABLE_EXTRA_VENDOR_SPECIFIC_IE_SIZE))
+
+struct acx_beacon_filter_ie_table {
+        struct acx_header header;
+
+        u8 num_ie;
+        u8 table[BEACON_FILTER_TABLE_MAX_SIZE];
+        u8 pad[3];
+} __attribute__ ((packed));
+
+enum {
+        SG_ENABLE = 0,
+        SG_DISABLE,
+        SG_SENSE_NO_ACTIVITY,
+        SG_SENSE_ACTIVE
+};
+
+struct acx_bt_wlan_coex {
+        struct acx_header header;
+
+        /*
+         * 0 -> PTA enabled
+         * 1 -> PTA disabled
+         * 2 -> sense no active mode, i.e.
+         *      an interrupt is sent upon
+         *      BT activity.
+         * 3 -> PTA is switched on in response
+         *      to the interrupt sending.
+         */
+        u8 enable;
+        u8 pad[3];
+} __attribute__ ((packed));
+
+#define PTA_ANTENNA_TYPE_DEF              (0)
+#define PTA_BT_HP_MAXTIME_DEF             (2000)
+#define PTA_WLAN_HP_MAX_TIME_DEF          (5000)
+#define PTA_SENSE_DISABLE_TIMER_DEF       (1350)
+#define PTA_PROTECTIVE_RX_TIME_DEF        (1500)
+#define PTA_PROTECTIVE_TX_TIME_DEF        (1500)
+#define PTA_TIMEOUT_NEXT_BT_LP_PACKET_DEF (3000)
+#define PTA_SIGNALING_TYPE_DEF            (1)
+#define PTA_AFH_LEVERAGE_ON_DEF           (0)
+#define PTA_NUMBER_QUIET_CYCLE_DEF        (0)
+#define PTA_MAX_NUM_CTS_DEF               (3)
+#define PTA_NUMBER_OF_WLAN_PACKETS_DEF    (2)
+#define PTA_NUMBER_OF_BT_PACKETS_DEF      (2)
+#define PTA_PROTECTIVE_RX_TIME_FAST_DEF   (1500)
+#define PTA_PROTECTIVE_TX_TIME_FAST_DEF   (3000)
+#define PTA_CYCLE_TIME_FAST_DEF           (8700)
+#define PTA_RX_FOR_AVALANCHE_DEF          (5)
+#define PTA_ELP_HP_DEF                    (0)
+#define PTA_ANTI_STARVE_PERIOD_DEF        (500)
+#define PTA_ANTI_STARVE_NUM_CYCLE_DEF     (4)
+#define PTA_ALLOW_PA_SD_DEF               (1)
+#define PTA_TIME_BEFORE_BEACON_DEF        (6300)
+#define PTA_HPDM_MAX_TIME_DEF             (1600)
+#define PTA_TIME_OUT_NEXT_WLAN_DEF        (2550)
+#define PTA_AUTO_MODE_NO_CTS_DEF          (0)
+#define PTA_BT_HP_RESPECTED_DEF           (3)
+#define PTA_WLAN_RX_MIN_RATE_DEF          (24)
+#define PTA_ACK_MODE_DEF                  (1)
+
+struct acx_bt_wlan_coex_param {
+        struct acx_header header;
+
+        /*
+         * The minimum rate of a received WLAN packet in the STA,
+         * during protective mode, of which a new BT-HP request
+         * during this Rx will always be respected and gain the antenna.
+         */
+        u32 min_rate;
+
+        /* Max time the BT HP will be respected. */
+        u16 bt_hp_max_time;
+
+        /* Max time the WLAN HP will be respected. */
+        u16 wlan_hp_max_time;
+
+        /*
+         * The time between the last BT activity
+         * and the moment when the sense mode returns
+         * to SENSE_INACTIVE.
+         */
+        u16 sense_disable_timer;
+
+        /* Time before the next BT HP instance */
+        u16 rx_time_bt_hp;
+        u16 tx_time_bt_hp;
+
+        /* range: 10-20000    default: 1500 */
+        u16 rx_time_bt_hp_fast;
+        u16 tx_time_bt_hp_fast;
+
+        /* range: 2000-65535  default: 8700 */
+        u16 wlan_cycle_fast;
+
+        /* range: 0 - 15000 (Msec) default: 1000 */
+        u16 bt_anti_starvation_period;
+
+        /* range 400-10000(Usec) default: 3000 */
+        u16 next_bt_lp_packet;
+
+        /* Deafult: worst case for BT DH5 traffic */
+        u16 wake_up_beacon;
+
+        /* range: 0-50000(Usec) default: 1050 */
+        u16 hp_dm_max_guard_time;
+
+        /*
+         * This is to prevent both BT & WLAN antenna
+         * starvation.
+         * Range: 100-50000(Usec) default:2550
+         */
+        u16 next_wlan_packet;
+
+        /* 0 -> shared antenna */
+        u8 antenna_type;
+
+        /*
+         * 0 -> TI legacy
+         * 1 -> Palau
+         */
+        u8 signal_type;
+
+        /*
+         * BT AFH status
+         * 0 -> no AFH
+         * 1 -> from dedicated GPIO
+         * 2 -> AFH on (from host)
+         */
+        u8 afh_leverage_on;
+
+        /*
+         * The number of cycles during which no
+         * TX will be sent after 1 cycle of RX
+         * transaction in protective mode
+         */
+        u8 quiet_cycle_num;
+
+        /*
+         * The maximum number of CTSs that will
+         * be sent for receiving RX packet in
+         * protective mode
+         */
+        u8 max_cts;
+
+        /*
+         * The number of WLAN packets
+         * transferred in common mode before
+         * switching to BT.
+         */
+        u8 wlan_packets_num;
+
+        /*
+         * The number of BT packets
+         * transferred in common mode before
+         * switching to WLAN.
+         */
+        u8 bt_packets_num;
+
+        /* range: 1-255  default: 5 */
+        u8 missed_rx_avalanche;
+
+        /* range: 0-1    default: 1 */
+        u8 wlan_elp_hp;
+
+        /* range: 0 - 15  default: 4 */
+        u8 bt_anti_starvation_cycles;
+
+        u8 ack_mode_dual_ant;
+
+        /*
+         * Allow PA_SD assertion/de-assertion
+         * during enabled BT activity.
+         */
+        u8 pa_sd_enable;
+
+        /*
+         * Enable/Disable PTA in auto mode:
+         * Support Both Active & P.S modes
+         */
+        u8 pta_auto_mode_enable;
+
+        /* range: 0 - 20  default: 1 */
+        u8 bt_hp_respected_num;
+} __attribute__ ((packed));
+
+#define CCA_THRSH_ENABLE_ENERGY_D       0x140A
+#define CCA_THRSH_DISABLE_ENERGY_D      0xFFEF
+
+struct acx_energy_detection {
+        struct acx_header header;
+
+        /* The RX Clear Channel Assessment threshold in the PHY */
+        u16 rx_cca_threshold;
+        u8 tx_energy_detection;
+        u8 pad;
+} __attribute__ ((packed));
+
+#define BCN_RX_TIMEOUT_DEF_VALUE        10000
+#define BROADCAST_RX_TIMEOUT_DEF_VALUE  20000
+#define RX_BROADCAST_IN_PS_DEF_VALUE    1
+#define CONSECUTIVE_PS_POLL_FAILURE_DEF 4
+
+struct acx_beacon_broadcast {
+        struct acx_header header;
+
+        u16 beacon_rx_timeout;
+        u16 broadcast_timeout;
+
+        /* Enables receiving of broadcast packets in PS mode */
+        u8 rx_broadcast_in_ps;
+
+        /* Consecutive PS Poll failures before updating the host */
+        u8 ps_poll_threshold;
+        u8 pad[2];
+} __attribute__ ((packed));
+
+struct acx_event_mask {
+        struct acx_header header;
+
+        u32 event_mask;
+        u32 high_event_mask; /* Unused */
+} __attribute__ ((packed));
+
+#define CFG_RX_FCS              BIT(2)
+#define CFG_RX_ALL_GOOD         BIT(3)
+#define CFG_UNI_FILTER_EN       BIT(4)
+#define CFG_BSSID_FILTER_EN     BIT(5)
+#define CFG_MC_FILTER_EN        BIT(6)
+#define CFG_MC_ADDR0_EN         BIT(7)
+#define CFG_MC_ADDR1_EN         BIT(8)
+#define CFG_BC_REJECT_EN        BIT(9)
+#define CFG_SSID_FILTER_EN      BIT(10)
+#define CFG_RX_INT_FCS_ERROR    BIT(11)
+#define CFG_RX_INT_ENCRYPTED    BIT(12)
+#define CFG_RX_WR_RX_STATUS     BIT(13)
+#define CFG_RX_FILTER_NULTI     BIT(14)
+#define CFG_RX_RESERVE          BIT(15)
+#define CFG_RX_TIMESTAMP_TSF    BIT(16)
+
+#define CFG_RX_RSV_EN           BIT(0)
+#define CFG_RX_RCTS_ACK         BIT(1)
+#define CFG_RX_PRSP_EN          BIT(2)
+#define CFG_RX_PREQ_EN          BIT(3)
+#define CFG_RX_MGMT_EN          BIT(4)
+#define CFG_RX_FCS_ERROR        BIT(5)
+#define CFG_RX_DATA_EN          BIT(6)
+#define CFG_RX_CTL_EN           BIT(7)
+#define CFG_RX_CF_EN            BIT(8)
+#define CFG_RX_BCN_EN           BIT(9)
+#define CFG_RX_AUTH_EN          BIT(10)
+#define CFG_RX_ASSOC_EN         BIT(11)
+
+#define SCAN_PASSIVE            BIT(0)
+#define SCAN_5GHZ_BAND          BIT(1)
+#define SCAN_TRIGGERED          BIT(2)
+#define SCAN_PRIORITY_HIGH      BIT(3)
+
+struct acx_feature_config {
+        struct acx_header header;
+
+        u32 options;
+        u32 data_flow_options;
+} __attribute__ ((packed));
+
+struct acx_current_tx_power {
+        struct acx_header header;
+
+        u8  current_tx_power;
+        u8  padding[3];
+} __attribute__ ((packed));
+
+enum acx_wake_up_event {
+        WAKE_UP_EVENT_BEACON_BITMAP     = 0x01, /* Wake on every Beacon*/
+        WAKE_UP_EVENT_DTIM_BITMAP       = 0x02, /* Wake on every DTIM*/
+        WAKE_UP_EVENT_N_DTIM_BITMAP     = 0x04, /* Wake on every Nth DTIM */
+        WAKE_UP_EVENT_N_BEACONS_BITMAP  = 0x08, /* Wake on every Nth Beacon */
+        WAKE_UP_EVENT_BITS_MASK         = 0x0F
+};
+
+struct acx_wake_up_condition {
+        struct acx_header header;
+
+        u8 wake_up_event; /* Only one bit can be set */
+        u8 listen_interval;
+        u8 pad[2];
+} __attribute__ ((packed));
+
+struct acx_aid {
+        struct acx_header header;
+
+        /*
+         * To be set when associated with an AP.
+         */
+        u16 aid;
+        u8 pad[2];
+} __attribute__ ((packed));
+
+enum acx_preamble_type {
+        ACX_PREAMBLE_LONG = 0,
+        ACX_PREAMBLE_SHORT = 1
+};
+
+struct acx_preamble {
+        struct acx_header header;
+
+        /*
+         * When set, the WiLink transmits the frames with a short preamble and
+         * when cleared, the WiLink transmits the frames with a long preamble.
+         */
+        u8 preamble;
+        u8 padding[3];
+} __attribute__ ((packed));
+
+enum acx_ctsprotect_type {
+        CTSPROTECT_DISABLE = 0,
+        CTSPROTECT_ENABLE = 1
+};
+
+struct acx_ctsprotect {
+        struct acx_header header;
+        u8 ctsprotect;
+        u8 padding[3];
+} __attribute__ ((packed));
+
+struct acx_tx_statistics {
+        u32 internal_desc_overflow;
+}  __attribute__ ((packed));
+
+struct acx_rx_statistics {
+        u32 out_of_mem;
+        u32 hdr_overflow;
+        u32 hw_stuck;
+        u32 dropped;
+        u32 fcs_err;
+        u32 xfr_hint_trig;
+        u32 path_reset;
+        u32 reset_counter;
+} __attribute__ ((packed));
+
+struct acx_dma_statistics {
+        u32 rx_requested;
+        u32 rx_errors;
+        u32 tx_requested;
+        u32 tx_errors;
+}  __attribute__ ((packed));
+
+struct acx_isr_statistics {
+        /* host command complete */
+        u32 cmd_cmplt;
+
+        /* fiqisr() */
+        u32 fiqs;
+
+        /* (INT_STS_ND & INT_TRIG_RX_HEADER) */
+        u32 rx_headers;
+
+        /* (INT_STS_ND & INT_TRIG_RX_CMPLT) */
+        u32 rx_completes;
+
+        /* (INT_STS_ND & INT_TRIG_NO_RX_BUF) */
+        u32 rx_mem_overflow;
+
+        /* (INT_STS_ND & INT_TRIG_S_RX_RDY) */
+        u32 rx_rdys;
+
+        /* irqisr() */
+        u32 irqs;
+
+        /* (INT_STS_ND & INT_TRIG_TX_PROC) */
+        u32 tx_procs;
+
+        /* (INT_STS_ND & INT_TRIG_DECRYPT_DONE) */
+        u32 decrypt_done;
+
+        /* (INT_STS_ND & INT_TRIG_DMA0) */
+        u32 dma0_done;
+
+        /* (INT_STS_ND & INT_TRIG_DMA1) */
+        u32 dma1_done;
+
+        /* (INT_STS_ND & INT_TRIG_TX_EXC_CMPLT) */
+        u32 tx_exch_complete;
+
+        /* (INT_STS_ND & INT_TRIG_COMMAND) */
+        u32 commands;
+
+        /* (INT_STS_ND & INT_TRIG_RX_PROC) */
+        u32 rx_procs;
+
+        /* (INT_STS_ND & INT_TRIG_PM_802) */
+        u32 hw_pm_mode_changes;
+
+        /* (INT_STS_ND & INT_TRIG_ACKNOWLEDGE) */
+        u32 host_acknowledges;
+
+        /* (INT_STS_ND & INT_TRIG_PM_PCI) */
+        u32 pci_pm;
+
+        /* (INT_STS_ND & INT_TRIG_ACM_WAKEUP) */
+        u32 wakeups;
+
+        /* (INT_STS_ND & INT_TRIG_LOW_RSSI) */
+        u32 low_rssi;
+} __attribute__ ((packed));
+
+struct acx_wep_statistics {
+        /* WEP address keys configured */
+        u32 addr_key_count;
+
+        /* default keys configured */
+        u32 default_key_count;
+
+        u32 reserved;
+
+        /* number of times that WEP key not found on lookup */
+        u32 key_not_found;
+
+        /* number of times that WEP key decryption failed */
+        u32 decrypt_fail;
+
+        /* WEP packets decrypted */
+        u32 packets;
+
+        /* WEP decrypt interrupts */
+        u32 interrupt;
+} __attribute__ ((packed));
+
+#define ACX_MISSED_BEACONS_SPREAD 10
+
+struct acx_pwr_statistics {
+        /* the amount of enters into power save mode (both PD & ELP) */
+        u32 ps_enter;
+
+        /* the amount of enters into ELP mode */
+        u32 elp_enter;
+
+        /* the amount of missing beacon interrupts to the host */
+        u32 missing_bcns;
+
+        /* the amount of wake on host-access times */
+        u32 wake_on_host;
+
+        /* the amount of wake on timer-expire */
+        u32 wake_on_timer_exp;
+
+        /* the number of packets that were transmitted with PS bit set */
+        u32 tx_with_ps;
+
+        /* the number of packets that were transmitted with PS bit clear */
+        u32 tx_without_ps;
+
+        /* the number of received beacons */
+        u32 rcvd_beacons;
+
+        /* the number of entering into PowerOn (power save off) */
+        u32 power_save_off;
+
+        /* the number of entries into power save mode */
+        u16 enable_ps;
+
+        /*
+         * the number of exits from power save, not including failed PS
+         * transitions
+         */
+        u16 disable_ps;
+
+        /*
+         * the number of times the TSF counter was adjusted because
+         * of drift
+         */
+        u32 fix_tsf_ps;
+
+        /* Gives statistics about the spread continuous missed beacons.
+         * The 16 LSB are dedicated for the PS mode.
+         * The 16 MSB are dedicated for the PS mode.
+         * cont_miss_bcns_spread[0] - single missed beacon.
+         * cont_miss_bcns_spread[1] - two continuous missed beacons.
+         * cont_miss_bcns_spread[2] - three continuous missed beacons.
+         * ...
+         * cont_miss_bcns_spread[9] - ten and more continuous missed beacons.
+        */
+        u32 cont_miss_bcns_spread[ACX_MISSED_BEACONS_SPREAD];
+
+        /* the number of beacons in awake mode */
+        u32 rcvd_awake_beacons;
+} __attribute__ ((packed));
+
+struct acx_mic_statistics {
+        u32 rx_pkts;
+        u32 calc_failure;
+} __attribute__ ((packed));
+
+struct acx_aes_statistics {
+        u32 encrypt_fail;
+        u32 decrypt_fail;
+        u32 encrypt_packets;
+        u32 decrypt_packets;
+        u32 encrypt_interrupt;
+        u32 decrypt_interrupt;
+} __attribute__ ((packed));
+
+struct acx_event_statistics {
+        u32 heart_beat;
+        u32 calibration;
+        u32 rx_mismatch;
+        u32 rx_mem_empty;
+        u32 rx_pool;
+        u32 oom_late;
+        u32 phy_transmit_error;
+        u32 tx_stuck;
+} __attribute__ ((packed));
+
+struct acx_ps_statistics {
+        u32 pspoll_timeouts;
+        u32 upsd_timeouts;
+        u32 upsd_max_sptime;
+        u32 upsd_max_apturn;
+        u32 pspoll_max_apturn;
+        u32 pspoll_utilization;
+        u32 upsd_utilization;
+} __attribute__ ((packed));
+
+struct acx_rxpipe_statistics {
+        u32 rx_prep_beacon_drop;
+        u32 descr_host_int_trig_rx_data;
+        u32 beacon_buffer_thres_host_int_trig_rx_data;
+        u32 missed_beacon_host_int_trig_rx_data;
+        u32 tx_xfr_host_int_trig_rx_data;
+} __attribute__ ((packed));
+
+struct acx_statistics {
+        struct acx_header header;
+
+        struct acx_tx_statistics tx;
+        struct acx_rx_statistics rx;
+        struct acx_dma_statistics dma;
+        struct acx_isr_statistics isr;
+        struct acx_wep_statistics wep;
+        struct acx_pwr_statistics pwr;
+        struct acx_aes_statistics aes;
+        struct acx_mic_statistics mic;
+        struct acx_event_statistics event;
+        struct acx_ps_statistics ps;
+        struct acx_rxpipe_statistics rxpipe;
+} __attribute__ ((packed));
+
+#define ACX_MAX_RATE_CLASSES       8
+#define ACX_RATE_MASK_UNSPECIFIED  0
+#define ACX_RATE_MASK_ALL          0x1eff
+#define ACX_RATE_RETRY_LIMIT       10
+
+struct acx_rate_class {
+        u32 enabled_rates;
+        u8 short_retry_limit;
+        u8 long_retry_limit;
+        u8 aflags;
+        u8 reserved;
+};
+
+struct acx_rate_policy {
+        struct acx_header header;
+
+        u32 rate_class_cnt;
+        struct acx_rate_class rate_class[ACX_MAX_RATE_CLASSES];
+} __attribute__ ((packed));
+
+#define WL1271_ACX_AC_COUNT 4
+
+struct acx_ac_cfg {
+        struct acx_header header;
+        u8 ac;
+        u8 cw_min;
+        u16 cw_max;
+        u8 aifsn;
+        u8 reserved;
+        u16 tx_op_limit;
+} __attribute__ ((packed));
+
+enum wl1271_acx_ac {
+        WL1271_ACX_AC_BE = 0,
+        WL1271_ACX_AC_BK = 1,
+        WL1271_ACX_AC_VI = 2,
+        WL1271_ACX_AC_VO = 3,
+        WL1271_ACX_AC_CTS2SELF = 4,
+        WL1271_ACX_AC_ANY_TID = 0x1F,
+        WL1271_ACX_AC_INVALID = 0xFF,
+};
+
+enum wl1271_acx_ps_scheme {
+        WL1271_ACX_PS_SCHEME_LEGACY = 0,
+        WL1271_ACX_PS_SCHEME_UPSD_TRIGGER = 1,
+        WL1271_ACX_PS_SCHEME_LEGACY_PSPOLL = 2,
+        WL1271_ACX_PS_SCHEME_SAPSD = 3,
+};
+
+enum wl1271_acx_ack_policy {
+        WL1271_ACX_ACK_POLICY_LEGACY = 0,
+        WL1271_ACX_ACK_POLICY_NO_ACK = 1,
+        WL1271_ACX_ACK_POLICY_BLOCK = 2,
+};
+
+#define WL1271_ACX_TID_COUNT 7
+
+struct acx_tid_config {
+        struct acx_header header;
+        u8 queue_id;
+        u8 channel_type;
+        u8 tsid;
+        u8 ps_scheme;
+        u8 ack_policy;
+        u8 padding[3];
+        u32 apsd_conf[2];
+} __attribute__ ((packed));
+
+struct acx_frag_threshold {
+        struct acx_header header;
+        u16 frag_threshold;
+        u8 padding[2];
+} __attribute__ ((packed));
+
+#define WL1271_ACX_TX_COMPL_TIMEOUT   5
+#define WL1271_ACX_TX_COMPL_THRESHOLD 5
+
+struct acx_tx_config_options {
+        struct acx_header header;
+        u16 tx_compl_timeout;     /* msec */
+        u16 tx_compl_threshold;   /* number of packets */
+} __attribute__ ((packed));
+
+#define ACX_RX_MEM_BLOCKS     64
+#define ACX_TX_MIN_MEM_BLOCKS 64
+#define ACX_TX_DESCRIPTORS    32
+#define ACX_NUM_SSID_PROFILES 1
+
+struct wl1271_acx_config_memory {
+        struct acx_header header;
+
+        u8 rx_mem_block_num;
+        u8 tx_min_mem_block_num;
+        u8 num_stations;
+        u8 num_ssid_profiles;
+        u32 total_tx_descriptors;
+} __attribute__ ((packed));
+
+struct wl1271_acx_mem_map {
+        struct acx_header header;
+
+        void *code_start;
+        void *code_end;
+
+        void *wep_defkey_start;
+        void *wep_defkey_end;
+
+        void *sta_table_start;
+        void *sta_table_end;
+
+        void *packet_template_start;
+        void *packet_template_end;
+
+        /* Address of the TX result interface (control block) */
+        u32 tx_result;
+        u32 tx_result_queue_start;
+
+        void *queue_memory_start;
+        void *queue_memory_end;
+
+        u32 packet_memory_pool_start;
+        u32 packet_memory_pool_end;
+
+        void *debug_buffer1_start;
+        void *debug_buffer1_end;
+
+        void *debug_buffer2_start;
+        void *debug_buffer2_end;
+
+        /* Number of blocks FW allocated for TX packets */
+        u32 num_tx_mem_blocks;
+
+        /* Number of blocks FW allocated for RX packets */
+        u32 num_rx_mem_blocks;
+
+        /* the following 4 fields are valid in SLAVE mode only */
+        u8 *tx_cbuf;
+        u8 *rx_cbuf;
+        void *rx_ctrl;
+        void *tx_ctrl;
+} __attribute__ ((packed));
+
+enum wl1271_acx_rx_queue_type {
+        RX_QUEUE_TYPE_RX_LOW_PRIORITY,    /* All except the high priority */
+        RX_QUEUE_TYPE_RX_HIGH_PRIORITY,   /* Management and voice packets */
+        RX_QUEUE_TYPE_NUM,
+        RX_QUEUE_TYPE_MAX = USHORT_MAX
+};
+
+#define WL1271_RX_INTR_THRESHOLD_DEF  0       /* no pacing, send interrupt on
+                                               * every event */
+#define WL1271_RX_INTR_THRESHOLD_MIN  0
+#define WL1271_RX_INTR_THRESHOLD_MAX  15
+
+#define WL1271_RX_INTR_TIMEOUT_DEF    5
+#define WL1271_RX_INTR_TIMEOUT_MIN    1
+#define WL1271_RX_INTR_TIMEOUT_MAX    100
+
+struct wl1271_acx_rx_config_opt {
+        struct acx_header header;
+
+        u16 mblk_threshold;
+        u16 threshold;
+        u16 timeout;
+        u8 queue_type;
+        u8 reserved;
+} __attribute__ ((packed));
+
+enum {
+        ACX_WAKE_UP_CONDITIONS      = 0x0002,
+        ACX_MEM_CFG                 = 0x0003,
+        ACX_SLOT                    = 0x0004,
+        ACX_AC_CFG                  = 0x0007,
+        ACX_MEM_MAP                 = 0x0008,
+        ACX_AID                     = 0x000A,
+        /* ACX_FW_REV is missing in the ref driver, but seems to work */
+        ACX_FW_REV                  = 0x000D,
+        ACX_MEDIUM_USAGE            = 0x000F,
+        ACX_RX_CFG                  = 0x0010,
+        ACX_TX_QUEUE_CFG            = 0x0011, /* FIXME: only used by wl1251 */
+        ACX_STATISTICS              = 0x0013, /* Debug API */
+        ACX_PWR_CONSUMPTION_STATISTICS = 0x0014,
+        ACX_FEATURE_CFG             = 0x0015,
+        ACX_TID_CFG                 = 0x001A,
+        ACX_PS_RX_STREAMING         = 0x001B,
+        ACX_BEACON_FILTER_OPT       = 0x001F,
+        ACX_NOISE_HIST              = 0x0021,
+        ACX_HDK_VERSION             = 0x0022, /* ??? */
+        ACX_PD_THRESHOLD            = 0x0023,
+        ACX_TX_CONFIG_OPT           = 0x0024,
+        ACX_CCA_THRESHOLD           = 0x0025,
+        ACX_EVENT_MBOX_MASK         = 0x0026,
+        ACX_CONN_MONIT_PARAMS       = 0x002D,
+        ACX_CONS_TX_FAILURE         = 0x002F,
+        ACX_BCN_DTIM_OPTIONS        = 0x0031,
+        ACX_SG_ENABLE               = 0x0032,
+        ACX_SG_CFG                  = 0x0033,
+        ACX_BEACON_FILTER_TABLE     = 0x0038,
+        ACX_ARP_IP_FILTER           = 0x0039,
+        ACX_ROAMING_STATISTICS_TBL  = 0x003B,
+        ACX_RATE_POLICY             = 0x003D,
+        ACX_CTS_PROTECTION          = 0x003E,
+        ACX_SLEEP_AUTH              = 0x003F,
+        ACX_PREAMBLE_TYPE           = 0x0040,
+        ACX_ERROR_CNT               = 0x0041,
+        ACX_IBSS_FILTER             = 0x0044,
+        ACX_SERVICE_PERIOD_TIMEOUT  = 0x0045,
+        ACX_TSF_INFO                = 0x0046,
+        ACX_CONFIG_PS_WMM           = 0x0049,
+        ACX_ENABLE_RX_DATA_FILTER   = 0x004A,
+        ACX_SET_RX_DATA_FILTER      = 0x004B,
+        ACX_GET_DATA_FILTER_STATISTICS = 0x004C,
+        ACX_RX_CONFIG_OPT           = 0x004E,
+        ACX_FRAG_CFG                = 0x004F,
+        ACX_BET_ENABLE              = 0x0050,
+        ACX_RSSI_SNR_TRIGGER        = 0x0051,
+        ACX_RSSI_SNR_WEIGHTS        = 0x0051,
+        ACX_KEEP_ALIVE_MODE         = 0x0052,
+        ACX_SET_KEEP_ALIVE_CONFIG   = 0x0054,
+        ACX_BA_SESSION_RESPONDER_POLICY = 0x0055,
+        ACX_BA_SESSION_INITIATOR_POLICY = 0x0056,
+        ACX_PEER_HT_CAP             = 0x0057,
+        ACX_HT_BSS_OPERATION        = 0x0058,
+        ACX_COEX_ACTIVITY           = 0x0059,
+        DOT11_RX_MSDU_LIFE_TIME     = 0x1004,
+        DOT11_CUR_TX_PWR            = 0x100D,
+        DOT11_RX_DOT11_MODE         = 0x1012,
+        DOT11_RTS_THRESHOLD         = 0x1013,
+        DOT11_GROUP_ADDRESS_TBL     = 0x1014,
+
+        MAX_DOT11_IE = DOT11_GROUP_ADDRESS_TBL,
+
+        MAX_IE = 0xFFFF
+};
+
+
+int wl1271_acx_wake_up_conditions(struct wl1271 *wl, u8 wake_up_event,
+                                  u8 listen_interval);
+int wl1271_acx_sleep_auth(struct wl1271 *wl, u8 sleep_auth);
+int wl1271_acx_fw_version(struct wl1271 *wl, char *buf, size_t len);
+int wl1271_acx_tx_power(struct wl1271 *wl, int power);
+int wl1271_acx_feature_cfg(struct wl1271 *wl);
+int wl1271_acx_mem_map(struct wl1271 *wl,
+                       struct acx_header *mem_map, size_t len);
+int wl1271_acx_rx_msdu_life_time(struct wl1271 *wl, u32 life_time);
+int wl1271_acx_rx_config(struct wl1271 *wl, u32 config, u32 filter);
+int wl1271_acx_pd_threshold(struct wl1271 *wl);
+int wl1271_acx_slot(struct wl1271 *wl, enum acx_slot_type slot_time);
+int wl1271_acx_group_address_tbl(struct wl1271 *wl);
+int wl1271_acx_service_period_timeout(struct wl1271 *wl);
+int wl1271_acx_rts_threshold(struct wl1271 *wl, u16 rts_threshold);
+int wl1271_acx_beacon_filter_opt(struct wl1271 *wl);
+int wl1271_acx_beacon_filter_table(struct wl1271 *wl);
+int wl1271_acx_sg_enable(struct wl1271 *wl);
+int wl1271_acx_sg_cfg(struct wl1271 *wl);
+int wl1271_acx_cca_threshold(struct wl1271 *wl);
+int wl1271_acx_bcn_dtim_options(struct wl1271 *wl);
+int wl1271_acx_aid(struct wl1271 *wl, u16 aid);
+int wl1271_acx_event_mbox_mask(struct wl1271 *wl, u32 event_mask);
+int wl1271_acx_set_preamble(struct wl1271 *wl, enum acx_preamble_type preamble);
+int wl1271_acx_cts_protect(struct wl1271 *wl,
+                            enum acx_ctsprotect_type ctsprotect);
+int wl1271_acx_statistics(struct wl1271 *wl, struct acx_statistics *stats);
+int wl1271_acx_rate_policies(struct wl1271 *wl);
+int wl1271_acx_ac_cfg(struct wl1271 *wl);
+int wl1271_acx_tid_cfg(struct wl1271 *wl);
+int wl1271_acx_frag_threshold(struct wl1271 *wl);
+int wl1271_acx_tx_config_options(struct wl1271 *wl);
+int wl1271_acx_mem_cfg(struct wl1271 *wl);
+int wl1271_acx_init_mem_config(struct wl1271 *wl);
+int wl1271_acx_init_rx_interrupt(struct wl1271 *wl);
+
+#endif /* __WL1271_ACX_H__ */
diff --git a/drivers/net/wireless/wl12xx/wl1271_boot.c b/drivers/net/wireless/wl12xx/wl1271_boot.c
new file mode 100644
index 000000000000..8228ef474a7e
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/wl1271_boot.c
@@ -0,0 +1,541 @@
+/*
+ * This file is part of wl1271
+ *
+ * Copyright (C) 2008-2009 Nokia Corporation
+ *
+ * Contact: Luciano Coelho <luciano.coelho@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#include <linux/gpio.h>
+
+#include "wl1271_acx.h"
+#include "wl1271_reg.h"
+#include "wl1271_boot.h"
+#include "wl1271_spi.h"
+#include "wl1271_event.h"
+
+static struct wl1271_partition_set part_table[PART_TABLE_LEN] = {
+        [PART_DOWN] = {
+                .mem = {
+                        .start = 0x00000000,
+                        .size  = 0x000177c0
+                },
+                .reg = {
+                        .start = REGISTERS_BASE,
+                        .size  = 0x00008800
+                },
+        },
+
+        [PART_WORK] = {
+                .mem = {
+                        .start = 0x00040000,
+                        .size  = 0x00014fc0
+                },
+                .reg = {
+                        .start = REGISTERS_BASE,
+                        .size  = 0x0000b000
+                },
+        },
+
+        [PART_DRPW] = {
+                .mem = {
+                        .start = 0x00040000,
+                        .size  = 0x00014fc0
+                },
+                .reg = {
+                        .start = DRPW_BASE,
+                        .size  = 0x00006000
+                }
+        }
+};
+
+static void wl1271_boot_set_ecpu_ctrl(struct wl1271 *wl, u32 flag)
+{
+        u32 cpu_ctrl;
+
+        /* 10.5.0 run the firmware (I) */
+        cpu_ctrl = wl1271_reg_read32(wl, ACX_REG_ECPU_CONTROL);
+
+        /* 10.5.1 run the firmware (II) */
+        cpu_ctrl |= flag;
+        wl1271_reg_write32(wl, ACX_REG_ECPU_CONTROL, cpu_ctrl);
+}
+
+static void wl1271_boot_fw_version(struct wl1271 *wl)
+{
+        struct wl1271_static_data static_data;
+
+        wl1271_spi_mem_read(wl, wl->cmd_box_addr,
+                            &static_data, sizeof(static_data));
+
+        strncpy(wl->chip.fw_ver, static_data.fw_version,
+                sizeof(wl->chip.fw_ver));
+
+        /* make sure the string is NULL-terminated */
+        wl->chip.fw_ver[sizeof(wl->chip.fw_ver) - 1] = '\0';
+}
+
+static int wl1271_boot_upload_firmware_chunk(struct wl1271 *wl, void *buf,
+                                             size_t fw_data_len, u32 dest)
+{
+        int addr, chunk_num, partition_limit;
+        u8 *p;
+
+        /* whal_FwCtrl_LoadFwImageSm() */
+
+        wl1271_debug(DEBUG_BOOT, "starting firmware upload");
+
+        wl1271_debug(DEBUG_BOOT, "fw_data_len %zd chunk_size %d",
+                     fw_data_len, CHUNK_SIZE);
+
+
+        if ((fw_data_len % 4) != 0) {
+                wl1271_error("firmware length not multiple of four");
+                return -EIO;
+        }
+
+        wl1271_set_partition(wl, dest,
+                             part_table[PART_DOWN].mem.size,
+                             part_table[PART_DOWN].reg.start,
+                             part_table[PART_DOWN].reg.size);
+
+        /* 10.1 set partition limit and chunk num */
+        chunk_num = 0;
+        partition_limit = part_table[PART_DOWN].mem.size;
+
+        while (chunk_num < fw_data_len / CHUNK_SIZE) {
+                /* 10.2 update partition, if needed */
+                addr = dest + (chunk_num + 2) * CHUNK_SIZE;
+                if (addr > partition_limit) {
+                        addr = dest + chunk_num * CHUNK_SIZE;
+                        partition_limit = chunk_num * CHUNK_SIZE +
+                                part_table[PART_DOWN].mem.size;
+
+                        /* FIXME: Over 80 chars! */
+                        wl1271_set_partition(wl,
+                                             addr,
+                                             part_table[PART_DOWN].mem.size,
+                                             part_table[PART_DOWN].reg.start,
+                                             part_table[PART_DOWN].reg.size);
+                }
+
+                /* 10.3 upload the chunk */
+                addr = dest + chunk_num * CHUNK_SIZE;
+                p = buf + chunk_num * CHUNK_SIZE;
+                wl1271_debug(DEBUG_BOOT, "uploading fw chunk 0x%p to 0x%x",
+                             p, addr);
+                wl1271_spi_mem_write(wl, addr, p, CHUNK_SIZE);
+
+                chunk_num++;
+        }
+
+        /* 10.4 upload the last chunk */
+        addr = dest + chunk_num * CHUNK_SIZE;
+        p = buf + chunk_num * CHUNK_SIZE;
+        wl1271_debug(DEBUG_BOOT, "uploading fw last chunk (%zd B) 0x%p to 0x%x",
+                     fw_data_len % CHUNK_SIZE, p, addr);
+        wl1271_spi_mem_write(wl, addr, p, fw_data_len % CHUNK_SIZE);
+
+        return 0;
+}
+
+static int wl1271_boot_upload_firmware(struct wl1271 *wl)
+{
+        u32 chunks, addr, len;
+        u8 *fw;
+
+        fw = wl->fw;
+        chunks = be32_to_cpup((u32 *) fw);
+        fw += sizeof(u32);
+
+        wl1271_debug(DEBUG_BOOT, "firmware chunks to be uploaded: %u", chunks);
+
+        while (chunks--) {
+                addr = be32_to_cpup((u32 *) fw);
+                fw += sizeof(u32);
+                len = be32_to_cpup((u32 *) fw);
+                fw += sizeof(u32);
+
+                if (len > 300000) {
+                        wl1271_info("firmware chunk too long: %u", len);
+                        return -EINVAL;
+                }
+                wl1271_debug(DEBUG_BOOT, "chunk %d addr 0x%x len %u",
+                             chunks, addr, len);
+                wl1271_boot_upload_firmware_chunk(wl, fw, len, addr);
+                fw += len;
+        }
+
+        return 0;
+}
+
+static int wl1271_boot_upload_nvs(struct wl1271 *wl)
+{
+        size_t nvs_len, burst_len;
+        int i;
+        u32 dest_addr, val;
+        u8 *nvs_ptr, *nvs, *nvs_aligned;
+
+        nvs = wl->nvs;
+        if (nvs == NULL)
+                return -ENODEV;
+
+        nvs_ptr = nvs;
+
+        nvs_len = wl->nvs_len;
+
+        /* Update the device MAC address into the nvs */
+        nvs[11] = wl->mac_addr[0];
+        nvs[10] = wl->mac_addr[1];
+        nvs[6] = wl->mac_addr[2];
+        nvs[5] = wl->mac_addr[3];
+        nvs[4] = wl->mac_addr[4];
+        nvs[3] = wl->mac_addr[5];
+
+        /*
+         * Layout before the actual NVS tables:
+         * 1 byte : burst length.
+         * 2 bytes: destination address.
+         * n bytes: data to burst copy.
+         *
+         * This is ended by a 0 length, then the NVS tables.
+         */
+
+        /* FIXME: Do we need to check here whether the LSB is 1? */
+        while (nvs_ptr[0]) {
+                burst_len = nvs_ptr[0];
+                dest_addr = (nvs_ptr[1] & 0xfe) | ((u32)(nvs_ptr[2] << 8));
+
+                /* FIXME: Due to our new wl1271_translate_reg_addr function,
+                   we need to add the REGISTER_BASE to the destination */
+                dest_addr += REGISTERS_BASE;
+
+                /* We move our pointer to the data */
+                nvs_ptr += 3;
+
+                for (i = 0; i < burst_len; i++) {
+                        val = (nvs_ptr[0] | (nvs_ptr[1] << 8)
+                               | (nvs_ptr[2] << 16) | (nvs_ptr[3] << 24));
+
+                        wl1271_debug(DEBUG_BOOT,
+                                     "nvs burst write 0x%x: 0x%x",
+                                     dest_addr, val);
+                        wl1271_reg_write32(wl, dest_addr, val);
+
+                        nvs_ptr += 4;
+                        dest_addr += 4;
+                }
+        }
+
+        /*
+         * We've reached the first zero length, the first NVS table
+         * is 7 bytes further.
+         */
+        nvs_ptr += 7;
+        nvs_len -= nvs_ptr - nvs;
+        nvs_len = ALIGN(nvs_len, 4);
+
+        /* FIXME: The driver sets the partition here, but this is not needed,
+           since it sets to the same one as currently in use */
+        /* Now we must set the partition correctly */
+        wl1271_set_partition(wl,
+                             part_table[PART_WORK].mem.start,
+                             part_table[PART_WORK].mem.size,
+                             part_table[PART_WORK].reg.start,
+                             part_table[PART_WORK].reg.size);
+
+        /* Copy the NVS tables to a new block to ensure alignment */
+        nvs_aligned = kmemdup(nvs_ptr, nvs_len, GFP_KERNEL);
+
+        /* And finally we upload the NVS tables */
+        /* FIXME: In wl1271, we upload everything at once.
+           No endianness handling needed here?! The ref driver doesn't do
+           anything about it at this point */
+        wl1271_spi_mem_write(wl, CMD_MBOX_ADDRESS, nvs_aligned, nvs_len);
+
+        kfree(nvs_aligned);
+        return 0;
+}
+
+static void wl1271_boot_enable_interrupts(struct wl1271 *wl)
+{
+        enable_irq(wl->irq);
+        wl1271_reg_write32(wl, ACX_REG_INTERRUPT_MASK,
+                           WL1271_ACX_INTR_ALL & ~(WL1271_INTR_MASK));
+        wl1271_reg_write32(wl, HI_CFG, HI_CFG_DEF_VAL);
+}
+
+static int wl1271_boot_soft_reset(struct wl1271 *wl)
+{
+        unsigned long timeout;
+        u32 boot_data;
+
+        /* perform soft reset */
+        wl1271_reg_write32(wl, ACX_REG_SLV_SOFT_RESET, ACX_SLV_SOFT_RESET_BIT);
+
+        /* SOFT_RESET is self clearing */
+        timeout = jiffies + usecs_to_jiffies(SOFT_RESET_MAX_TIME);
+        while (1) {
+                boot_data = wl1271_reg_read32(wl, ACX_REG_SLV_SOFT_RESET);
+                wl1271_debug(DEBUG_BOOT, "soft reset bootdata 0x%x", boot_data);
+                if ((boot_data & ACX_SLV_SOFT_RESET_BIT) == 0)
+                        break;
+
+                if (time_after(jiffies, timeout)) {
+                        /* 1.2 check pWhalBus->uSelfClearTime if the
+                         * timeout was reached */
+                        wl1271_error("soft reset timeout");
+                        return -1;
+                }
+
+                udelay(SOFT_RESET_STALL_TIME);
+        }
+
+        /* disable Rx/Tx */
+        wl1271_reg_write32(wl, ENABLE, 0x0);
+
+        /* disable auto calibration on start*/
+        wl1271_reg_write32(wl, SPARE_A2, 0xffff);
+
+        return 0;
+}
+
+static int wl1271_boot_run_firmware(struct wl1271 *wl)
+{
+        int loop, ret;
+        u32 chip_id, interrupt;
+
+        wl1271_boot_set_ecpu_ctrl(wl, ECPU_CONTROL_HALT);
+
+        chip_id = wl1271_reg_read32(wl, CHIP_ID_B);
+
+        wl1271_debug(DEBUG_BOOT, "chip id after firmware boot: 0x%x", chip_id);
+
+        if (chip_id != wl->chip.id) {
+                wl1271_error("chip id doesn't match after firmware boot");
+                return -EIO;
+        }
+
+        /* wait for init to complete */
+        loop = 0;
+        while (loop++ < INIT_LOOP) {
+                udelay(INIT_LOOP_DELAY);
+                interrupt = wl1271_reg_read32(wl, ACX_REG_INTERRUPT_NO_CLEAR);
+
+                if (interrupt == 0xffffffff) {
+                        wl1271_error("error reading hardware complete "
+                                     "init indication");
+                        return -EIO;
+                }
+                /* check that ACX_INTR_INIT_COMPLETE is enabled */
+                else if (interrupt & WL1271_ACX_INTR_INIT_COMPLETE) {
+                        wl1271_reg_write32(wl, ACX_REG_INTERRUPT_ACK,
+                                           WL1271_ACX_INTR_INIT_COMPLETE);
+                        break;
+                }
+        }
+
+        if (loop >= INIT_LOOP) {
+                wl1271_error("timeout waiting for the hardware to "
+                             "complete initialization");
+                return -EIO;
+        }
+
+        /* get hardware config command mail box */
+        wl->cmd_box_addr = wl1271_reg_read32(wl, REG_COMMAND_MAILBOX_PTR);
+
+        /* get hardware config event mail box */
+        wl->event_box_addr = wl1271_reg_read32(wl, REG_EVENT_MAILBOX_PTR);
+
+        /* set the working partition to its "running" mode offset */
+        wl1271_set_partition(wl,
+                             part_table[PART_WORK].mem.start,
+                             part_table[PART_WORK].mem.size,
+                             part_table[PART_WORK].reg.start,
+                             part_table[PART_WORK].reg.size);
+
+        wl1271_debug(DEBUG_MAILBOX, "cmd_box_addr 0x%x event_box_addr 0x%x",
+                     wl->cmd_box_addr, wl->event_box_addr);
+
+        wl1271_boot_fw_version(wl);
+
+        /*
+         * in case of full asynchronous mode the firmware event must be
+         * ready to receive event from the command mailbox
+         */
+
+        /* enable gpio interrupts */
+        wl1271_boot_enable_interrupts(wl);
+
+        /* unmask all mbox events  */
+        wl->event_mask = 0xffffffff;
+
+        ret = wl1271_event_unmask(wl);
+        if (ret < 0) {
+                wl1271_error("EVENT mask setting failed");
+                return ret;
+        }
+
+        wl1271_event_mbox_config(wl);
+
+        /* firmware startup completed */
+        return 0;
+}
+
+static int wl1271_boot_write_irq_polarity(struct wl1271 *wl)
+{
+        u32 polarity, status, i;
+
+        wl1271_reg_write32(wl, OCP_POR_CTR, OCP_REG_POLARITY);
+        wl1271_reg_write32(wl, OCP_CMD, OCP_CMD_READ);
+
+        /* Wait until the command is complete (ie. bit 18 is set) */
+        for (i = 0; i < OCP_CMD_LOOP; i++) {
+                polarity = wl1271_reg_read32(wl, OCP_DATA_READ);
+                if (polarity & OCP_READY_MASK)
+                        break;
+        }
+        if (i == OCP_CMD_LOOP) {
+                wl1271_error("OCP command timeout!");
+                return -EIO;
+        }
+
+        status = polarity & OCP_STATUS_MASK;
+        if (status != OCP_STATUS_OK) {
+                wl1271_error("OCP command failed (%d)", status);
+                return -EIO;
+        }
+
+        /* We use HIGH polarity, so unset the LOW bit */
+        polarity &= ~POLARITY_LOW;
+
+        wl1271_reg_write32(wl, OCP_POR_CTR, OCP_REG_POLARITY);
+        wl1271_reg_write32(wl, OCP_DATA_WRITE, polarity);
+        wl1271_reg_write32(wl, OCP_CMD, OCP_CMD_WRITE);
+
+        return 0;
+}
+
+int wl1271_boot(struct wl1271 *wl)
+{
+        int ret = 0;
+        u32 tmp, clk, pause;
+
+        if (REF_CLOCK == 0 || REF_CLOCK == 2)
+                /* ref clk: 19.2/38.4 */
+                clk = 0x3;
+        else if (REF_CLOCK == 1 || REF_CLOCK == 3)
+                /* ref clk: 26/52 */
+                clk = 0x5;
+
+        wl1271_reg_write32(wl, PLL_PARAMETERS, clk);
+
+        pause = wl1271_reg_read32(wl, PLL_PARAMETERS);
+
+        wl1271_debug(DEBUG_BOOT, "pause1 0x%x", pause);
+
+        pause &= ~(WU_COUNTER_PAUSE_VAL); /* FIXME: This should probably be
+                                           * WU_COUNTER_PAUSE_VAL instead of
+                                           * 0x3ff (magic number ).  How does
+                                           * this work?! */
+        pause |= WU_COUNTER_PAUSE_VAL;
+        wl1271_reg_write32(wl, WU_COUNTER_PAUSE, pause);
+
+        /* Continue the ELP wake up sequence */
+        wl1271_reg_write32(wl, WELP_ARM_COMMAND, WELP_ARM_COMMAND_VAL);
+        udelay(500);
+
+        wl1271_set_partition(wl,
+                             part_table[PART_DRPW].mem.start,
+                             part_table[PART_DRPW].mem.size,
+                             part_table[PART_DRPW].reg.start,
+                             part_table[PART_DRPW].reg.size);
+
+        /* Read-modify-write DRPW_SCRATCH_START register (see next state)
+           to be used by DRPw FW. The RTRIM value will be added by the FW
+           before taking DRPw out of reset */
+
+        wl1271_debug(DEBUG_BOOT, "DRPW_SCRATCH_START %08x", DRPW_SCRATCH_START);
+        clk = wl1271_reg_read32(wl, DRPW_SCRATCH_START);
+
+        wl1271_debug(DEBUG_BOOT, "clk2 0x%x", clk);
+
+        /* 2 */
+        clk |= (REF_CLOCK << 1) << 4;
+        wl1271_reg_write32(wl, DRPW_SCRATCH_START, clk);
+
+        wl1271_set_partition(wl,
+                             part_table[PART_WORK].mem.start,
+                             part_table[PART_WORK].mem.size,
+                             part_table[PART_WORK].reg.start,
+                             part_table[PART_WORK].reg.size);
+
+        /* Disable interrupts */
+        wl1271_reg_write32(wl, ACX_REG_INTERRUPT_MASK, WL1271_ACX_INTR_ALL);
+
+        ret = wl1271_boot_soft_reset(wl);
+        if (ret < 0)
+                goto out;
+
+        /* 2. start processing NVS file */
+        ret = wl1271_boot_upload_nvs(wl);
+        if (ret < 0)
+                goto out;
+
+        /* write firmware's last address (ie. it's length) to
+         * ACX_EEPROMLESS_IND_REG */
+        wl1271_debug(DEBUG_BOOT, "ACX_EEPROMLESS_IND_REG");
+
+        wl1271_reg_write32(wl, ACX_EEPROMLESS_IND_REG, ACX_EEPROMLESS_IND_REG);
+
+        tmp = wl1271_reg_read32(wl, CHIP_ID_B);
+
+        wl1271_debug(DEBUG_BOOT, "chip id 0x%x", tmp);
+
+        /* 6. read the EEPROM parameters */
+        tmp = wl1271_reg_read32(wl, SCR_PAD2);
+
+        ret = wl1271_boot_write_irq_polarity(wl);
+        if (ret < 0)
+                goto out;
+
+        /* FIXME: Need to check whether this is really what we want */
+        wl1271_reg_write32(wl, ACX_REG_INTERRUPT_MASK,
+                           WL1271_ACX_ALL_EVENTS_VECTOR);
+
+        /* WL1271: The reference driver skips steps 7 to 10 (jumps directly
+         * to upload_fw) */
+
+        ret = wl1271_boot_upload_firmware(wl);
+        if (ret < 0)
+                goto out;
+
+        /* 10.5 start firmware */
+        ret = wl1271_boot_run_firmware(wl);
+        if (ret < 0)
+                goto out;
+
+        /* set the wl1271 default filters */
+        wl->rx_config = WL1271_DEFAULT_RX_CONFIG;
+        wl->rx_filter = WL1271_DEFAULT_RX_FILTER;
+
+        wl1271_event_mbox_config(wl);
+
+out:
+        return ret;
+}
diff --git a/drivers/net/wireless/wl12xx/wl1271_boot.h b/drivers/net/wireless/wl12xx/wl1271_boot.h
new file mode 100644
index 000000000000..b0d8fb46a439
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/wl1271_boot.h
@@ -0,0 +1,72 @@
+/*
+ * This file is part of wl1271
+ *
+ * Copyright (C) 2008-2009 Nokia Corporation
+ *
+ * Contact: Luciano Coelho <luciano.coelho@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#ifndef __BOOT_H__
+#define __BOOT_H__
+
+#include "wl1271.h"
+
+int wl1271_boot(struct wl1271 *wl);
+
+#define WL1271_NO_SUBBANDS 8
+#define WL1271_NO_POWER_LEVELS 4
+#define WL1271_FW_VERSION_MAX_LEN 20
+
+struct wl1271_static_data {
+        u8 mac_address[ETH_ALEN];
+        u8 padding[2];
+        u8 fw_version[WL1271_FW_VERSION_MAX_LEN];
+        u32 hw_version;
+        u8 tx_power_table[WL1271_NO_SUBBANDS][WL1271_NO_POWER_LEVELS];
+};
+
+/* number of times we try to read the INIT interrupt */
+#define INIT_LOOP 20000
+
+/* delay between retries */
+#define INIT_LOOP_DELAY 50
+
+#define REF_CLOCK            2
+#define WU_COUNTER_PAUSE_VAL 0x3FF
+#define WELP_ARM_COMMAND_VAL 0x4
+
+#define OCP_CMD_LOOP  32
+
+#define OCP_CMD_WRITE 0x1
+#define OCP_CMD_READ  0x2
+
+#define OCP_READY_MASK  BIT(18)
+#define OCP_STATUS_MASK (BIT(16) | BIT(17))
+
+#define OCP_STATUS_NO_RESP    0x00000
+#define OCP_STATUS_OK         0x10000
+#define OCP_STATUS_REQ_FAILED 0x20000
+#define OCP_STATUS_RESP_ERROR 0x30000
+
+#define OCP_REG_POLARITY 0x30032
+
+#define CMD_MBOX_ADDRESS 0x407B4
+
+#define POLARITY_LOW BIT(1)
+
+#endif
diff --git a/drivers/net/wireless/wl12xx/wl1271_cmd.c b/drivers/net/wireless/wl12xx/wl1271_cmd.c
new file mode 100644
index 000000000000..2a4351ff54dc
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/wl1271_cmd.c
@@ -0,0 +1,813 @@
+/*
+ * This file is part of wl1271
+ *
+ * Copyright (C) 2009 Nokia Corporation
+ *
+ * Contact: Luciano Coelho <luciano.coelho@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/crc7.h>
+#include <linux/spi/spi.h>
+#include <linux/etherdevice.h>
+
+#include "wl1271.h"
+#include "wl1271_reg.h"
+#include "wl1271_spi.h"
+#include "wl1271_acx.h"
+#include "wl12xx_80211.h"
+#include "wl1271_cmd.h"
+
+/*
+ * send command to firmware
+ *
+ * @wl: wl struct
+ * @id: command id
+ * @buf: buffer containing the command, must work with dma
+ * @len: length of the buffer
+ */
+int wl1271_cmd_send(struct wl1271 *wl, u16 id, void *buf, size_t len)
+{
+        struct wl1271_cmd_header *cmd;
+        unsigned long timeout;
+        u32 intr;
+        int ret = 0;
+
+        cmd = buf;
+        cmd->id = id;
+        cmd->status = 0;
+
+        WARN_ON(len % 4 != 0);
+
+        wl1271_spi_mem_write(wl, wl->cmd_box_addr, buf, len);
+
+        wl1271_reg_write32(wl, ACX_REG_INTERRUPT_TRIG, INTR_TRIG_CMD);
+
+        timeout = jiffies + msecs_to_jiffies(WL1271_COMMAND_TIMEOUT);
+
+        intr = wl1271_reg_read32(wl, ACX_REG_INTERRUPT_NO_CLEAR);
+        while (!(intr & WL1271_ACX_INTR_CMD_COMPLETE)) {
+                if (time_after(jiffies, timeout)) {
+                        wl1271_error("command complete timeout");
+                        ret = -ETIMEDOUT;
+                        goto out;
+                }
+
+                msleep(1);
+
+                intr = wl1271_reg_read32(wl, ACX_REG_INTERRUPT_NO_CLEAR);
+        }
+
+        wl1271_reg_write32(wl, ACX_REG_INTERRUPT_ACK,
+                           WL1271_ACX_INTR_CMD_COMPLETE);
+
+out:
+        return ret;
+}
+
+int wl1271_cmd_cal_channel_tune(struct wl1271 *wl)
+{
+        struct wl1271_cmd_cal_channel_tune *cmd;
+        int ret = 0;
+
+        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+        if (!cmd)
+                return -ENOMEM;
+
+        cmd->test.id = TEST_CMD_CHANNEL_TUNE;
+
+        cmd->band = WL1271_CHANNEL_TUNE_BAND_2_4;
+        /* set up any channel, 7 is in the middle of the range */
+        cmd->channel = 7;
+
+        ret = wl1271_cmd_test(wl, cmd, sizeof(*cmd), 0);
+        if (ret < 0)
+                wl1271_warning("TEST_CMD_CHANNEL_TUNE failed");
+
+        kfree(cmd);
+        return ret;
+}
+
+int wl1271_cmd_cal_update_ref_point(struct wl1271 *wl)
+{
+        struct wl1271_cmd_cal_update_ref_point *cmd;
+        int ret = 0;
+
+        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+        if (!cmd)
+                return -ENOMEM;
+
+        cmd->test.id = TEST_CMD_UPDATE_PD_REFERENCE_POINT;
+
+        /* FIXME: still waiting for the correct values */
+        cmd->ref_power    = 0;
+        cmd->ref_detector = 0;
+
+        cmd->sub_band     = WL1271_PD_REFERENCE_POINT_BAND_B_G;
+
+        ret = wl1271_cmd_test(wl, cmd, sizeof(*cmd), 0);
+        if (ret < 0)
+                wl1271_warning("TEST_CMD_UPDATE_PD_REFERENCE_POINT failed");
+
+        kfree(cmd);
+        return ret;
+}
+
+int wl1271_cmd_cal_p2g(struct wl1271 *wl)
+{
+        struct wl1271_cmd_cal_p2g *cmd;
+        int ret = 0;
+
+        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+        if (!cmd)
+                return -ENOMEM;
+
+        cmd->test.id = TEST_CMD_P2G_CAL;
+
+        cmd->sub_band_mask = WL1271_CAL_P2G_BAND_B_G;
+
+        ret = wl1271_cmd_test(wl, cmd, sizeof(*cmd), 0);
+        if (ret < 0)
+                wl1271_warning("TEST_CMD_P2G_CAL failed");
+
+        kfree(cmd);
+        return ret;
+}
+
+int wl1271_cmd_cal(struct wl1271 *wl)
+{
+        /*
+         * FIXME: we must make sure that we're not sleeping when calibration
+         * is done
+         */
+        int ret;
+
+        wl1271_notice("performing tx calibration");
+
+        ret = wl1271_cmd_cal_channel_tune(wl);
+        if (ret < 0)
+                return ret;
+
+        ret = wl1271_cmd_cal_update_ref_point(wl);
+        if (ret < 0)
+                return ret;
+
+        ret = wl1271_cmd_cal_p2g(wl);
+        if (ret < 0)
+                return ret;
+
+        return ret;
+}
+
+int wl1271_cmd_join(struct wl1271 *wl, u8 bss_type, u8 dtim_interval,
+                    u16 beacon_interval, u8 wait)
+{
+        static bool do_cal = true;
+        unsigned long timeout;
+        struct wl1271_cmd_join *join;
+        int ret, i;
+        u8 *bssid;
+
+        /* FIXME: remove when we get calibration from the factory */
+        if (do_cal) {
+                ret = wl1271_cmd_cal(wl);
+                if (ret < 0)
+                        wl1271_warning("couldn't calibrate");
+                else
+                        do_cal = false;
+        }
+
+
+        join = kzalloc(sizeof(*join), GFP_KERNEL);
+        if (!join) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        wl1271_debug(DEBUG_CMD, "cmd join");
+
+        /* Reverse order BSSID */
+        bssid = (u8 *) &join->bssid_lsb;
+        for (i = 0; i < ETH_ALEN; i++)
+                bssid[i] = wl->bssid[ETH_ALEN - i - 1];
+
+        join->rx_config_options = wl->rx_config;
+        join->rx_filter_options = wl->rx_filter;
+
+        join->basic_rate_set = RATE_MASK_1MBPS | RATE_MASK_2MBPS |
+                RATE_MASK_5_5MBPS | RATE_MASK_11MBPS;
+
+        join->beacon_interval = beacon_interval;
+        join->dtim_interval = dtim_interval;
+        join->bss_type = bss_type;
+        join->channel = wl->channel;
+        join->ssid_len = wl->ssid_len;
+        memcpy(join->ssid, wl->ssid, wl->ssid_len);
+        join->ctrl = WL1271_JOIN_CMD_CTRL_TX_FLUSH;
+
+        /* increment the session counter */
+        wl->session_counter++;
+        if (wl->session_counter >= SESSION_COUNTER_MAX)
+                wl->session_counter = 0;
+
+        join->ctrl |= wl->session_counter << WL1271_JOIN_CMD_TX_SESSION_OFFSET;
+
+
+        ret = wl1271_cmd_send(wl, CMD_START_JOIN, join, sizeof(*join));
+        if (ret < 0) {
+                wl1271_error("failed to initiate cmd join");
+                goto out_free;
+        }
+
+        timeout = msecs_to_jiffies(JOIN_TIMEOUT);
+
+        /*
+         * ugly hack: we should wait for JOIN_EVENT_COMPLETE_ID but to
+         * simplify locking we just sleep instead, for now
+         */
+        if (wait)
+                msleep(10);
+
+out_free:
+        kfree(join);
+
+out:
+        return ret;
+}
+
+/**
+ * send test command to firmware
+ *
+ * @wl: wl struct
+ * @buf: buffer containing the command, with all headers, must work with dma
+ * @len: length of the buffer
+ * @answer: is answer needed
+ */
+int wl1271_cmd_test(struct wl1271 *wl, void *buf, size_t buf_len, u8 answer)
+{
+        int ret;
+
+        wl1271_debug(DEBUG_CMD, "cmd test");
+
+        ret = wl1271_cmd_send(wl, CMD_TEST, buf, buf_len);
+
+        if (ret < 0) {
+                wl1271_warning("TEST command failed");
+                return ret;
+        }
+
+        if (answer) {
+                struct wl1271_command *cmd_answer;
+
+                /*
+                 * The test command got in, we can read the answer.
+                 * The answer would be a wl1271_command, where the
+                 * parameter array contains the actual answer.
+                 */
+                wl1271_spi_mem_read(wl, wl->cmd_box_addr, buf, buf_len);
+
+                cmd_answer = buf;
+
+                if (cmd_answer->header.status != CMD_STATUS_SUCCESS)
+                        wl1271_error("TEST command answer error: %d",
+                                     cmd_answer->header.status);
+        }
+
+        return 0;
+}
+
+/**
+ * read acx from firmware
+ *
+ * @wl: wl struct
+ * @id: acx id
+ * @buf: buffer for the response, including all headers, must work with dma
+ * @len: lenght of buf
+ */
+int wl1271_cmd_interrogate(struct wl1271 *wl, u16 id, void *buf, size_t len)
+{
+        struct acx_header *acx = buf;
+        int ret;
+
+        wl1271_debug(DEBUG_CMD, "cmd interrogate");
+
+        acx->id = id;
+
+        /* payload length, does not include any headers */
+        acx->len = len - sizeof(*acx);
+
+        ret = wl1271_cmd_send(wl, CMD_INTERROGATE, acx, sizeof(*acx));
+        if (ret < 0) {
+                wl1271_error("INTERROGATE command failed");
+                goto out;
+        }
+
+        /* the interrogate command got in, we can read the answer */
+        wl1271_spi_mem_read(wl, wl->cmd_box_addr, buf, len);
+
+        acx = buf;
+        if (acx->cmd.status != CMD_STATUS_SUCCESS)
+                wl1271_error("INTERROGATE command error: %d",
+                             acx->cmd.status);
+
+out:
+        return ret;
+}
+
+/**
+ * write acx value to firmware
+ *
+ * @wl: wl struct
+ * @id: acx id
+ * @buf: buffer containing acx, including all headers, must work with dma
+ * @len: length of buf
+ */
+int wl1271_cmd_configure(struct wl1271 *wl, u16 id, void *buf, size_t len)
+{
+        struct acx_header *acx = buf;
+        int ret;
+
+        wl1271_debug(DEBUG_CMD, "cmd configure");
+
+        acx->id = id;
+
+        /* payload length, does not include any headers */
+        acx->len = len - sizeof(*acx);
+
+        ret = wl1271_cmd_send(wl, CMD_CONFIGURE, acx, len);
+        if (ret < 0) {
+                wl1271_warning("CONFIGURE command NOK");
+                return ret;
+        }
+
+        return 0;
+}
+
+int wl1271_cmd_data_path(struct wl1271 *wl, u8 channel, bool enable)
+{
+        struct cmd_enabledisable_path *cmd;
+        int ret;
+        u16 cmd_rx, cmd_tx;
+
+        wl1271_debug(DEBUG_CMD, "cmd data path");
+
+        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+        if (!cmd) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        cmd->channel = channel;
+
+        if (enable) {
+                cmd_rx = CMD_ENABLE_RX;
+                cmd_tx = CMD_ENABLE_TX;
+        } else {
+                cmd_rx = CMD_DISABLE_RX;
+                cmd_tx = CMD_DISABLE_TX;
+        }
+
+        ret = wl1271_cmd_send(wl, cmd_rx, cmd, sizeof(*cmd));
+        if (ret < 0) {
+                wl1271_error("rx %s cmd for channel %d failed",
+                             enable ? "start" : "stop", channel);
+                goto out;
+        }
+
+        wl1271_debug(DEBUG_BOOT, "rx %s cmd channel %d",
+                     enable ? "start" : "stop", channel);
+
+        ret = wl1271_cmd_send(wl, cmd_tx, cmd, sizeof(*cmd));
+        if (ret < 0) {
+                wl1271_error("tx %s cmd for channel %d failed",
+                             enable ? "start" : "stop", channel);
+                return ret;
+        }
+
+        wl1271_debug(DEBUG_BOOT, "tx %s cmd channel %d",
+                     enable ? "start" : "stop", channel);
+
+out:
+        kfree(cmd);
+        return ret;
+}
+
+int wl1271_cmd_ps_mode(struct wl1271 *wl, u8 ps_mode)
+{
+        struct wl1271_cmd_ps_params *ps_params = NULL;
+        int ret = 0;
+
+        /* FIXME: this should be in ps.c */
+        ret = wl1271_acx_wake_up_conditions(wl, WAKE_UP_EVENT_DTIM_BITMAP,
+                                            wl->listen_int);
+        if (ret < 0) {
+                wl1271_error("couldn't set wake up conditions");
+                goto out;
+        }
+
+        wl1271_debug(DEBUG_CMD, "cmd set ps mode");
+
+        ps_params = kzalloc(sizeof(*ps_params), GFP_KERNEL);
+        if (!ps_params) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        ps_params->ps_mode = ps_mode;
+        ps_params->send_null_data = 1;
+        ps_params->retries = 5;
+        ps_params->hang_over_period = 128;
+        ps_params->null_data_rate = 1; /* 1 Mbps */
+
+        ret = wl1271_cmd_send(wl, CMD_SET_PS_MODE, ps_params,
+                              sizeof(*ps_params));
+        if (ret < 0) {
+                wl1271_error("cmd set_ps_mode failed");
+                goto out;
+        }
+
+out:
+        kfree(ps_params);
+        return ret;
+}
+
+int wl1271_cmd_read_memory(struct wl1271 *wl, u32 addr, void *answer,
+                           size_t len)
+{
+        struct cmd_read_write_memory *cmd;
+        int ret = 0;
+
+        wl1271_debug(DEBUG_CMD, "cmd read memory");
+
+        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+        if (!cmd) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        WARN_ON(len > MAX_READ_SIZE);
+        len = min_t(size_t, len, MAX_READ_SIZE);
+
+        cmd->addr = addr;
+        cmd->size = len;
+
+        ret = wl1271_cmd_send(wl, CMD_READ_MEMORY, cmd, sizeof(*cmd));
+        if (ret < 0) {
+                wl1271_error("read memory command failed: %d", ret);
+                goto out;
+        }
+
+        /* the read command got in, we can now read the answer */
+        wl1271_spi_mem_read(wl, wl->cmd_box_addr, cmd, sizeof(*cmd));
+
+        if (cmd->header.status != CMD_STATUS_SUCCESS)
+                wl1271_error("error in read command result: %d",
+                             cmd->header.status);
+
+        memcpy(answer, cmd->value, len);
+
+out:
+        kfree(cmd);
+        return ret;
+}
+
+int wl1271_cmd_scan(struct wl1271 *wl, u8 *ssid, size_t len,
+                    u8 active_scan, u8 high_prio, u8 num_channels,
+                    u8 probe_requests)
+{
+
+        struct wl1271_cmd_trigger_scan_to *trigger = NULL;
+        struct wl1271_cmd_scan *params = NULL;
+        int i, ret;
+        u16 scan_options = 0;
+
+        if (wl->scanning)
+                return -EINVAL;
+
+        params = kzalloc(sizeof(*params), GFP_KERNEL);
+        if (!params)
+                return -ENOMEM;
+
+        params->params.rx_config_options = cpu_to_le32(CFG_RX_ALL_GOOD);
+        params->params.rx_filter_options =
+                cpu_to_le32(CFG_RX_PRSP_EN | CFG_RX_MGMT_EN | CFG_RX_BCN_EN);
+
+        if (!active_scan)
+                scan_options |= WL1271_SCAN_OPT_PASSIVE;
+        if (high_prio)
+                scan_options |= WL1271_SCAN_OPT_PRIORITY_HIGH;
+        params->params.scan_options = scan_options;
+
+        params->params.num_channels = num_channels;
+        params->params.num_probe_requests = probe_requests;
+        params->params.tx_rate = cpu_to_le32(RATE_MASK_2MBPS);
+        params->params.tid_trigger = 0;
+        params->params.scan_tag = WL1271_SCAN_DEFAULT_TAG;
+
+        for (i = 0; i < num_channels; i++) {
+                params->channels[i].min_duration =
+                        cpu_to_le32(WL1271_SCAN_CHAN_MIN_DURATION);
+                params->channels[i].max_duration =
+                        cpu_to_le32(WL1271_SCAN_CHAN_MAX_DURATION);
+                memset(&params->channels[i].bssid_lsb, 0xff, 4);
+                memset(&params->channels[i].bssid_msb, 0xff, 2);
+                params->channels[i].early_termination = 0;
+                params->channels[i].tx_power_att = WL1271_SCAN_CURRENT_TX_PWR;
+                params->channels[i].channel = i + 1;
+        }
+
+        if (len && ssid) {
+                params->params.ssid_len = len;
+                memcpy(params->params.ssid, ssid, len);
+        }
+
+        ret = wl1271_cmd_build_probe_req(wl, ssid, len);
+        if (ret < 0) {
+                wl1271_error("PROBE request template failed");
+                goto out;
+        }
+
+        trigger = kzalloc(sizeof(*trigger), GFP_KERNEL);
+        if (!trigger) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        /* disable the timeout */
+        trigger->timeout = 0;
+
+        ret = wl1271_cmd_send(wl, CMD_TRIGGER_SCAN_TO, trigger,
+                              sizeof(*trigger));
+        if (ret < 0) {
+                wl1271_error("trigger scan to failed for hw scan");
+                goto out;
+        }
+
+        wl1271_dump(DEBUG_SCAN, "SCAN: ", params, sizeof(*params));
+
+        wl->scanning = true;
+
+        ret = wl1271_cmd_send(wl, CMD_SCAN, params, sizeof(*params));
+        if (ret < 0) {
+                wl1271_error("SCAN failed");
+                goto out;
+        }
+
+        wl1271_spi_mem_read(wl, wl->cmd_box_addr, params, sizeof(*params));
+
+        if (params->header.status != CMD_STATUS_SUCCESS) {
+                wl1271_error("Scan command error: %d",
+                             params->header.status);
+                wl->scanning = false;
+                ret = -EIO;
+                goto out;
+        }
+
+out:
+        kfree(params);
+        return ret;
+}
+
+int wl1271_cmd_template_set(struct wl1271 *wl, u16 template_id,
+                            void *buf, size_t buf_len)
+{
+        struct wl1271_cmd_template_set *cmd;
+        int ret = 0;
+
+        wl1271_debug(DEBUG_CMD, "cmd template_set %d", template_id);
+
+        WARN_ON(buf_len > WL1271_CMD_TEMPL_MAX_SIZE);
+        buf_len = min_t(size_t, buf_len, WL1271_CMD_TEMPL_MAX_SIZE);
+
+        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+        if (!cmd) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        cmd->len = cpu_to_le16(buf_len);
+        cmd->template_type = template_id;
+        cmd->enabled_rates = ACX_RATE_MASK_UNSPECIFIED;
+        cmd->short_retry_limit = ACX_RATE_RETRY_LIMIT;
+        cmd->long_retry_limit = ACX_RATE_RETRY_LIMIT;
+
+        if (buf)
+                memcpy(cmd->template_data, buf, buf_len);
+
+        ret = wl1271_cmd_send(wl, CMD_SET_TEMPLATE, cmd, sizeof(*cmd));
+        if (ret < 0) {
+                wl1271_warning("cmd set_template failed: %d", ret);
+                goto out_free;
+        }
+
+out_free:
+        kfree(cmd);
+
+out:
+        return ret;
+}
+
+static int wl1271_build_basic_rates(char *rates)
+{
+        u8 index = 0;
+
+        rates[index++] = IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_1MB;
+        rates[index++] = IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_2MB;
+        rates[index++] = IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_5MB;
+        rates[index++] = IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_11MB;
+
+        return index;
+}
+
+static int wl1271_build_extended_rates(char *rates)
+{
+        u8 index = 0;
+
+        rates[index++] = IEEE80211_OFDM_RATE_6MB;
+        rates[index++] = IEEE80211_OFDM_RATE_9MB;
+        rates[index++] = IEEE80211_OFDM_RATE_12MB;
+        rates[index++] = IEEE80211_OFDM_RATE_18MB;
+        rates[index++] = IEEE80211_OFDM_RATE_24MB;
+        rates[index++] = IEEE80211_OFDM_RATE_36MB;
+        rates[index++] = IEEE80211_OFDM_RATE_48MB;
+        rates[index++] = IEEE80211_OFDM_RATE_54MB;
+
+        return index;
+}
+
+int wl1271_cmd_build_null_data(struct wl1271 *wl)
+{
+        struct wl12xx_null_data_template template;
+
+        if (!is_zero_ether_addr(wl->bssid)) {
+                memcpy(template.header.da, wl->bssid, ETH_ALEN);
+                memcpy(template.header.bssid, wl->bssid, ETH_ALEN);
+        } else {
+                memset(template.header.da, 0xff, ETH_ALEN);
+                memset(template.header.bssid, 0xff, ETH_ALEN);
+        }
+
+        memcpy(template.header.sa, wl->mac_addr, ETH_ALEN);
+        template.header.frame_ctl = cpu_to_le16(IEEE80211_FTYPE_DATA |
+                                                IEEE80211_STYPE_NULLFUNC);
+
+        return wl1271_cmd_template_set(wl, CMD_TEMPL_NULL_DATA, &template,
+                                       sizeof(template));
+
+}
+
+int wl1271_cmd_build_ps_poll(struct wl1271 *wl, u16 aid)
+{
+        struct wl12xx_ps_poll_template template;
+
+        memcpy(template.bssid, wl->bssid, ETH_ALEN);
+        memcpy(template.ta, wl->mac_addr, ETH_ALEN);
+        template.aid = aid;
+        template.fc = cpu_to_le16(IEEE80211_FTYPE_CTL | IEEE80211_STYPE_PSPOLL);
+
+        return wl1271_cmd_template_set(wl, CMD_TEMPL_PS_POLL, &template,
+                                       sizeof(template));
+
+}
+
+int wl1271_cmd_build_probe_req(struct wl1271 *wl, u8 *ssid, size_t ssid_len)
+{
+        struct wl12xx_probe_req_template template;
+        struct wl12xx_ie_rates *rates;
+        char *ptr;
+        u16 size;
+
+        ptr = (char *)&template;
+        size = sizeof(struct ieee80211_header);
+
+        memset(template.header.da, 0xff, ETH_ALEN);
+        memset(template.header.bssid, 0xff, ETH_ALEN);
+        memcpy(template.header.sa, wl->mac_addr, ETH_ALEN);
+        template.header.frame_ctl = cpu_to_le16(IEEE80211_STYPE_PROBE_REQ);
+
+        /* IEs */
+        /* SSID */
+        template.ssid.header.id = WLAN_EID_SSID;
+        template.ssid.header.len = ssid_len;
+        if (ssid_len && ssid)
+                memcpy(template.ssid.ssid, ssid, ssid_len);
+        size += sizeof(struct wl12xx_ie_header) + ssid_len;
+        ptr += size;
+
+        /* Basic Rates */
+        rates = (struct wl12xx_ie_rates *)ptr;
+        rates->header.id = WLAN_EID_SUPP_RATES;
+        rates->header.len = wl1271_build_basic_rates(rates->rates);
+        size += sizeof(struct wl12xx_ie_header) + rates->header.len;
+        ptr += sizeof(struct wl12xx_ie_header) + rates->header.len;
+
+        /* Extended rates */
+        rates = (struct wl12xx_ie_rates *)ptr;
+        rates->header.id = WLAN_EID_EXT_SUPP_RATES;
+        rates->header.len = wl1271_build_extended_rates(rates->rates);
+        size += sizeof(struct wl12xx_ie_header) + rates->header.len;
+
+        wl1271_dump(DEBUG_SCAN, "PROBE REQ: ", &template, size);
+
+        return wl1271_cmd_template_set(wl, CMD_TEMPL_CFG_PROBE_REQ_2_4,
+                                       &template, size);
+}
+
+int wl1271_cmd_set_default_wep_key(struct wl1271 *wl, u8 id)
+{
+        struct wl1271_cmd_set_keys *cmd;
+        int ret = 0;
+
+        wl1271_debug(DEBUG_CMD, "cmd set_default_wep_key %d", id);
+
+        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+        if (!cmd) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        cmd->id = id;
+        cmd->key_action = KEY_SET_ID;
+        cmd->key_type = KEY_WEP;
+
+        ret = wl1271_cmd_send(wl, CMD_SET_KEYS, cmd, sizeof(*cmd));
+        if (ret < 0) {
+                wl1271_warning("cmd set_default_wep_key failed: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(cmd);
+
+        return ret;
+}
+
+int wl1271_cmd_set_key(struct wl1271 *wl, u16 action, u8 id, u8 key_type,
+                       u8 key_size, const u8 *key, const u8 *addr)
+{
+        struct wl1271_cmd_set_keys *cmd;
+        int ret = 0;
+
+        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+        if (!cmd) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        if (key_type != KEY_WEP)
+                memcpy(cmd->addr, addr, ETH_ALEN);
+
+        cmd->key_action = action;
+        cmd->key_size = key_size;
+        cmd->key_type = key_type;
+
+        /* we have only one SSID profile */
+        cmd->ssid_profile = 0;
+
+        cmd->id = id;
+
+        /* FIXME: this is from wl1251, needs to be checked */
+        if (key_type == KEY_TKIP) {
+                /*
+                 * We get the key in the following form:
+                 * TKIP (16 bytes) - TX MIC (8 bytes) - RX MIC (8 bytes)
+                 * but the target is expecting:
+                 * TKIP - RX MIC - TX MIC
+                 */
+                memcpy(cmd->key, key, 16);
+                memcpy(cmd->key + 16, key + 24, 8);
+                memcpy(cmd->key + 24, key + 16, 8);
+
+        } else {
+                memcpy(cmd->key, key, key_size);
+        }
+
+        wl1271_dump(DEBUG_CRYPT, "TARGET KEY: ", cmd, sizeof(*cmd));
+
+        ret = wl1271_cmd_send(wl, CMD_SET_KEYS, cmd, sizeof(*cmd));
+        if (ret < 0) {
+                wl1271_warning("could not set keys");
+                goto out;
+        }
+
+out:
+        kfree(cmd);
+
+        return ret;
+}
diff --git a/drivers/net/wireless/wl12xx/wl1271_cmd.h b/drivers/net/wireless/wl12xx/wl1271_cmd.h
new file mode 100644
index 000000000000..951a8447a516
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/wl1271_cmd.h
@@ -0,0 +1,464 @@
+/*
+ * This file is part of wl1271
+ *
+ * Copyright (C) 1998-2009 Texas Instruments. All rights reserved.
+ * Copyright (C) 2009 Nokia Corporation
+ *
+ * Contact: Luciano Coelho <luciano.coelho@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#ifndef __WL1271_CMD_H__
+#define __WL1271_CMD_H__
+
+#include "wl1271.h"
+
+struct acx_header;
+
+int wl1271_cmd_send(struct wl1271 *wl, u16 type, void *buf, size_t buf_len);
+int wl1271_cmd_join(struct wl1271 *wl, u8 bss_type, u8 dtim_interval,
+                    u16 beacon_interval, u8 wait);
+int wl1271_cmd_test(struct wl1271 *wl, void *buf, size_t buf_len, u8 answer);
+int wl1271_cmd_interrogate(struct wl1271 *wl, u16 id, void *buf, size_t len);
+int wl1271_cmd_configure(struct wl1271 *wl, u16 id, void *buf, size_t len);
+int wl1271_cmd_data_path(struct wl1271 *wl, u8 channel, bool enable);
+int wl1271_cmd_ps_mode(struct wl1271 *wl, u8 ps_mode);
+int wl1271_cmd_read_memory(struct wl1271 *wl, u32 addr, void *answer,
+                           size_t len);
+int wl1271_cmd_scan(struct wl1271 *wl, u8 *ssid, size_t len,
+                    u8 active_scan, u8 high_prio, u8 num_channels,
+                    u8 probe_requests);
+int wl1271_cmd_template_set(struct wl1271 *wl, u16 template_id,
+                            void *buf, size_t buf_len);
+int wl1271_cmd_build_null_data(struct wl1271 *wl);
+int wl1271_cmd_build_ps_poll(struct wl1271 *wl, u16 aid);
+int wl1271_cmd_build_probe_req(struct wl1271 *wl, u8 *ssid, size_t ssid_len);
+int wl1271_cmd_set_default_wep_key(struct wl1271 *wl, u8 id);
+int wl1271_cmd_set_key(struct wl1271 *wl, u16 action, u8 id, u8 key_type,
+                       u8 key_size, const u8 *key, const u8 *addr);
+
+enum wl1271_commands {
+        CMD_INTERROGATE     = 1,    /*use this to read information elements*/
+        CMD_CONFIGURE       = 2,    /*use this to write information elements*/
+        CMD_ENABLE_RX       = 3,
+        CMD_ENABLE_TX       = 4,
+        CMD_DISABLE_RX      = 5,
+        CMD_DISABLE_TX      = 6,
+        CMD_SCAN            = 8,
+        CMD_STOP_SCAN       = 9,
+        CMD_START_JOIN      = 11,
+        CMD_SET_KEYS        = 12,
+        CMD_READ_MEMORY     = 13,
+        CMD_WRITE_MEMORY    = 14,
+        CMD_SET_TEMPLATE    = 19,
+        CMD_TEST            = 23,
+        CMD_NOISE_HIST      = 28,
+        CMD_LNA_CONTROL     = 32,
+        CMD_SET_BCN_MODE    = 33,
+        CMD_MEASUREMENT      = 34,
+        CMD_STOP_MEASUREMENT = 35,
+        CMD_DISCONNECT       = 36,
+        CMD_SET_PS_MODE      = 37,
+        CMD_CHANNEL_SWITCH   = 38,
+        CMD_STOP_CHANNEL_SWICTH = 39,
+        CMD_AP_DISCOVERY     = 40,
+        CMD_STOP_AP_DISCOVERY = 41,
+        CMD_SPS_SCAN = 42,
+        CMD_STOP_SPS_SCAN = 43,
+        CMD_HEALTH_CHECK     = 45,
+        CMD_DEBUG            = 46,
+        CMD_TRIGGER_SCAN_TO  = 47,
+        CMD_CONNECTION_SCAN_CFG      = 48,
+        CMD_CONNECTION_SCAN_SSID_CFG = 49,
+        CMD_START_PERIODIC_SCAN      = 50,
+        CMD_STOP_PERIODIC_SCAN       = 51,
+        CMD_SET_STA_STATE            = 52,
+
+        NUM_COMMANDS,
+        MAX_COMMAND_ID = 0xFFFF,
+};
+
+#define MAX_CMD_PARAMS 572
+
+enum cmd_templ {
+        CMD_TEMPL_NULL_DATA = 0,
+        CMD_TEMPL_BEACON,
+        CMD_TEMPL_CFG_PROBE_REQ_2_4,
+        CMD_TEMPL_CFG_PROBE_REQ_5,
+        CMD_TEMPL_PROBE_RESPONSE,
+        CMD_TEMPL_QOS_NULL_DATA,
+        CMD_TEMPL_PS_POLL,
+        CMD_TEMPL_KLV,
+        CMD_TEMPL_DISCONNECT,
+        CMD_TEMPL_PROBE_REQ_2_4, /* for firmware internal use only */
+        CMD_TEMPL_PROBE_REQ_5,   /* for firmware internal use only */
+        CMD_TEMPL_BAR,           /* for firmware internal use only */
+        CMD_TEMPL_CTS,           /*
+                                  * For CTS-to-self (FastCTS) mechanism
+                                  * for BT/WLAN coexistence (SoftGemini). */
+        CMD_TEMPL_MAX = 0xff
+};
+
+/* unit ms */
+#define WL1271_COMMAND_TIMEOUT     2000
+#define WL1271_CMD_TEMPL_MAX_SIZE  252
+
+struct wl1271_cmd_header {
+        u16 id;
+        u16 status;
+        /* payload */
+        u8 data[0];
+} __attribute__ ((packed));
+
+#define WL1271_CMD_MAX_PARAMS 572
+
+struct wl1271_command {
+        struct wl1271_cmd_header header;
+        u8  parameters[WL1271_CMD_MAX_PARAMS];
+} __attribute__ ((packed));
+
+enum {
+        CMD_MAILBOX_IDLE                =  0,
+        CMD_STATUS_SUCCESS              =  1,
+        CMD_STATUS_UNKNOWN_CMD          =  2,
+        CMD_STATUS_UNKNOWN_IE           =  3,
+        CMD_STATUS_REJECT_MEAS_SG_ACTIVE        = 11,
+        CMD_STATUS_RX_BUSY              = 13,
+        CMD_STATUS_INVALID_PARAM                = 14,
+        CMD_STATUS_TEMPLATE_TOO_LARGE           = 15,
+        CMD_STATUS_OUT_OF_MEMORY                = 16,
+        CMD_STATUS_STA_TABLE_FULL               = 17,
+        CMD_STATUS_RADIO_ERROR          = 18,
+        CMD_STATUS_WRONG_NESTING                = 19,
+        CMD_STATUS_TIMEOUT              = 21, /* Driver internal use.*/
+        CMD_STATUS_FW_RESET             = 22, /* Driver internal use.*/
+        MAX_COMMAND_STATUS              = 0xff
+};
+
+
+/*
+ * CMD_READ_MEMORY
+ *
+ * The host issues this command to read the WiLink device memory/registers.
+ *
+ * Note: The Base Band address has special handling (16 bits registers and
+ * addresses). For more information, see the hardware specification.
+ */
+/*
+ * CMD_WRITE_MEMORY
+ *
+ * The host issues this command to write the WiLink device memory/registers.
+ *
+ * The Base Band address has special handling (16 bits registers and
+ * addresses). For more information, see the hardware specification.
+ */
+#define MAX_READ_SIZE 256
+
+struct cmd_read_write_memory {
+        struct wl1271_cmd_header header;
+
+        /* The address of the memory to read from or write to.*/
+        u32 addr;
+
+        /* The amount of data in bytes to read from or write to the WiLink
+         * device.*/
+        u32 size;
+
+        /* The actual value read from or written to the Wilink. The source
+           of this field is the Host in WRITE command or the Wilink in READ
+           command. */
+        u8 value[MAX_READ_SIZE];
+};
+
+#define CMDMBOX_HEADER_LEN 4
+#define CMDMBOX_INFO_ELEM_HEADER_LEN 4
+
+enum {
+        BSS_TYPE_IBSS = 0,
+        BSS_TYPE_STA_BSS = 2,
+        BSS_TYPE_AP_BSS = 3,
+        MAX_BSS_TYPE = 0xFF
+};
+
+#define WL1271_JOIN_CMD_CTRL_TX_FLUSH     0x80 /* Firmware flushes all Tx */
+#define WL1271_JOIN_CMD_TX_SESSION_OFFSET 1
+
+struct wl1271_cmd_join {
+        struct wl1271_cmd_header header;
+
+        u32 bssid_lsb;
+        u16 bssid_msb;
+        u16 beacon_interval; /* in TBTTs */
+        u32 rx_config_options;
+        u32 rx_filter_options;
+
+        /*
+         * The target uses this field to determine the rate at
+         * which to transmit control frame responses (such as
+         * ACK or CTS frames).
+         */
+        u32 basic_rate_set;
+        u8 dtim_interval;
+        /*
+         * bits 0-2: This bitwise field specifies the type
+         * of BSS to start or join (BSS_TYPE_*).
+         * bit 4: Band - The radio band in which to join
+         * or start.
+         *  0 - 2.4GHz band
+         *  1 - 5GHz band
+         * bits 3, 5-7: Reserved
+         */
+        u8 bss_type;
+        u8 channel;
+        u8 ssid_len;
+        u8 ssid[IW_ESSID_MAX_SIZE];
+        u8 ctrl; /* JOIN_CMD_CTRL_* */
+        u8 reserved[3];
+} __attribute__ ((packed));
+
+struct cmd_enabledisable_path {
+        struct wl1271_cmd_header header;
+
+        u8 channel;
+        u8 padding[3];
+} __attribute__ ((packed));
+
+struct wl1271_cmd_template_set {
+        struct wl1271_cmd_header header;
+
+        u16 len;
+        u8 template_type;
+        u8 index;  /* relevant only for KLV_TEMPLATE type */
+        u32 enabled_rates;
+        u8 short_retry_limit;
+        u8 long_retry_limit;
+        u8 aflags;
+        u8 reserved;
+        u8 template_data[WL1271_CMD_TEMPL_MAX_SIZE];
+} __attribute__ ((packed));
+
+#define TIM_ELE_ID    5
+#define PARTIAL_VBM_MAX    251
+
+struct wl1271_tim {
+        u8 identity;
+        u8 length;
+        u8 dtim_count;
+        u8 dtim_period;
+        u8 bitmap_ctrl;
+        u8 pvb_field[PARTIAL_VBM_MAX]; /* Partial Virtual Bitmap */
+} __attribute__ ((packed));
+
+enum wl1271_cmd_ps_mode {
+        STATION_ACTIVE_MODE,
+        STATION_POWER_SAVE_MODE
+};
+
+struct wl1271_cmd_ps_params {
+        struct wl1271_cmd_header header;
+
+        u8 ps_mode; /* STATION_* */
+        u8 send_null_data; /* Do we have to send NULL data packet ? */
+        u8 retries; /* Number of retires for the initial NULL data packet */
+
+         /*
+          * TUs during which the target stays awake after switching
+          * to power save mode.
+          */
+        u8 hang_over_period;
+        u32 null_data_rate;
+} __attribute__ ((packed));
+
+/* HW encryption keys */
+#define NUM_ACCESS_CATEGORIES_COPY 4
+#define MAX_KEY_SIZE 32
+
+/* When set, disable HW encryption */
+#define DF_ENCRYPTION_DISABLE      0x01
+/* When set, disable HW decryption */
+#define DF_SNIFF_MODE_ENABLE       0x80
+
+enum wl1271_cmd_key_action {
+        KEY_ADD_OR_REPLACE = 1,
+        KEY_REMOVE         = 2,
+        KEY_SET_ID         = 3,
+        MAX_KEY_ACTION     = 0xffff,
+};
+
+enum wl1271_cmd_key_type {
+        KEY_NONE = 0,
+        KEY_WEP  = 1,
+        KEY_TKIP = 2,
+        KEY_AES  = 3,
+        KEY_GEM  = 4
+};
+
+/* FIXME: Add description for key-types */
+
+struct wl1271_cmd_set_keys {
+        struct wl1271_cmd_header header;
+
+        /* Ignored for default WEP key */
+        u8 addr[ETH_ALEN];
+
+        /* key_action_e */
+        u16 key_action;
+
+        u16 reserved_1;
+
+        /* key size in bytes */
+        u8 key_size;
+
+        /* key_type_e */
+        u8 key_type;
+        u8 ssid_profile;
+
+        /*
+         * TKIP, AES: frame's key id field.
+         * For WEP default key: key id;
+         */
+        u8 id;
+        u8 reserved_2[6];
+        u8 key[MAX_KEY_SIZE];
+        u16 ac_seq_num16[NUM_ACCESS_CATEGORIES_COPY];
+        u32 ac_seq_num32[NUM_ACCESS_CATEGORIES_COPY];
+} __attribute__ ((packed));
+
+
+#define WL1271_SCAN_MAX_CHANNELS       24
+#define WL1271_SCAN_DEFAULT_TAG        1
+#define WL1271_SCAN_CURRENT_TX_PWR     0
+#define WL1271_SCAN_OPT_ACTIVE         0
+#define WL1271_SCAN_OPT_PASSIVE        1
+#define WL1271_SCAN_OPT_PRIORITY_HIGH  4
+#define WL1271_SCAN_CHAN_MIN_DURATION  30000  /* TU */
+#define WL1271_SCAN_CHAN_MAX_DURATION  60000  /* TU */
+
+struct basic_scan_params {
+        u32 rx_config_options;
+        u32 rx_filter_options;
+        /* Scan option flags (WL1271_SCAN_OPT_*) */
+        u16 scan_options;
+        /* Number of scan channels in the list (maximum 30) */
+        u8 num_channels;
+        /* This field indicates the number of probe requests to send
+           per channel for an active scan */
+        u8 num_probe_requests;
+        /* Rate bit field for sending the probes */
+        u32 tx_rate;
+        u8 tid_trigger;
+        u8 ssid_len;
+        /* in order to align */
+        u8 padding1[2];
+        u8 ssid[IW_ESSID_MAX_SIZE];
+        /* Band to scan */
+        u8 band;
+        u8 use_ssid_list;
+        u8 scan_tag;
+        u8 padding2;
+} __attribute__ ((packed));
+
+struct basic_scan_channel_params {
+        /* Duration in TU to wait for frames on a channel for active scan */
+        u32 min_duration;
+        u32 max_duration;
+        u32 bssid_lsb;
+        u16 bssid_msb;
+        u8 early_termination;
+        u8 tx_power_att;
+        u8 channel;
+        /* FW internal use only! */
+        u8 dfs_candidate;
+        u8 activity_detected;
+        u8 pad;
+} __attribute__ ((packed));
+
+struct wl1271_cmd_scan {
+        struct wl1271_cmd_header header;
+
+        struct basic_scan_params params;
+        struct basic_scan_channel_params channels[WL1271_SCAN_MAX_CHANNELS];
+} __attribute__ ((packed));
+
+struct wl1271_cmd_trigger_scan_to {
+        struct wl1271_cmd_header header;
+
+        u32 timeout;
+};
+
+struct wl1271_cmd_test_header {
+        u8 id;
+        u8 padding[3];
+};
+
+enum wl1271_channel_tune_bands {
+        WL1271_CHANNEL_TUNE_BAND_2_4,
+        WL1271_CHANNEL_TUNE_BAND_5,
+        WL1271_CHANNEL_TUNE_BAND_4_9
+};
+
+#define WL1271_PD_REFERENCE_POINT_BAND_B_G 0
+
+#define TEST_CMD_P2G_CAL                   0x02
+#define TEST_CMD_CHANNEL_TUNE              0x0d
+#define TEST_CMD_UPDATE_PD_REFERENCE_POINT 0x1d
+
+struct wl1271_cmd_cal_channel_tune {
+        struct wl1271_cmd_header header;
+
+        struct wl1271_cmd_test_header test;
+
+        u8 band;
+        u8 channel;
+
+        u16 radio_status;
+} __attribute__ ((packed));
+
+struct wl1271_cmd_cal_update_ref_point {
+        struct wl1271_cmd_header header;
+
+        struct wl1271_cmd_test_header test;
+
+        s32 ref_power;
+        s32 ref_detector;
+        u8  sub_band;
+        u8  padding[3];
+} __attribute__ ((packed));
+
+#define MAX_TLV_LENGTH         400
+#define MAX_NVS_VERSION_LENGTH 12
+
+#define WL1271_CAL_P2G_BAND_B_G BIT(0)
+
+struct wl1271_cmd_cal_p2g {
+        struct wl1271_cmd_header header;
+
+        struct wl1271_cmd_test_header test;
+
+        u16 len;
+        u8  buf[MAX_TLV_LENGTH];
+        u8  type;
+        u8  padding;
+
+        s16 radio_status;
+        u8  nvs_version[MAX_NVS_VERSION_LENGTH];
+
+        u8  sub_band_mask;
+        u8  padding2;
+} __attribute__ ((packed));
+
+#endif /* __WL1271_CMD_H__ */
diff --git a/drivers/net/wireless/wl12xx/wl1271_debugfs.c b/drivers/net/wireless/wl12xx/wl1271_debugfs.c
new file mode 100644
index 000000000000..c1805e5f8964
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/wl1271_debugfs.c
@@ -0,0 +1,518 @@
+/*
+ * This file is part of wl1271
+ *
+ * Copyright (C) 2009 Nokia Corporation
+ *
+ * Contact: Luciano Coelho <luciano.coelho@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#include "wl1271_debugfs.h"
+
+#include <linux/skbuff.h>
+
+#include "wl1271.h"
+#include "wl1271_acx.h"
+#include "wl1271_ps.h"
+
+/* ms */
+#define WL1271_DEBUGFS_STATS_LIFETIME 1000
+
+/* debugfs macros idea from mac80211 */
+
+#define DEBUGFS_READONLY_FILE(name, buflen, fmt, value...)              \
+static ssize_t name## _read(struct file *file, char __user *userbuf,    \
+                            size_t count, loff_t *ppos)                 \
+{                                                                       \
+        struct wl1271 *wl = file->private_data;                         \
+        char buf[buflen];                                               \
+        int res;                                                        \
+                                                                        \
+        res = scnprintf(buf, buflen, fmt "\n", ##value);                \
+        return simple_read_from_buffer(userbuf, count, ppos, buf, res); \
+}                                                                       \
+                                                                        \
+static const struct file_operations name## _ops = {                     \
+        .read = name## _read,                                           \
+        .open = wl1271_open_file_generic,                               \
+};
+
+#define DEBUGFS_ADD(name, parent)                                       \
+        wl->debugfs.name = debugfs_create_file(#name, 0400, parent,     \
+                                               wl, &name## _ops);       \
+        if (IS_ERR(wl->debugfs.name)) {                                 \
+                ret = PTR_ERR(wl->debugfs.name);                        \
+                wl->debugfs.name = NULL;                                \
+                goto out;                                               \
+        }
+
+#define DEBUGFS_DEL(name)                                               \
+        do {                                                            \
+                debugfs_remove(wl->debugfs.name);                       \
+                wl->debugfs.name = NULL;                                \
+        } while (0)
+
+#define DEBUGFS_FWSTATS_FILE(sub, name, buflen, fmt)                    \
+static ssize_t sub## _ ##name## _read(struct file *file,                \
+                                      char __user *userbuf,             \
+                                      size_t count, loff_t *ppos)       \
+{                                                                       \
+        struct wl1271 *wl = file->private_data;                         \
+        char buf[buflen];                                               \
+        int res;                                                        \
+                                                                        \
+        wl1271_debugfs_update_stats(wl);                                \
+                                                                        \
+        res = scnprintf(buf, buflen, fmt "\n",                          \
+                        wl->stats.fw_stats->sub.name);                  \
+        return simple_read_from_buffer(userbuf, count, ppos, buf, res); \
+}                                                                       \
+                                                                        \
+static const struct file_operations sub## _ ##name## _ops = {           \
+        .read = sub## _ ##name## _read,                                 \
+        .open = wl1271_open_file_generic,                               \
+};
+
+#define DEBUGFS_FWSTATS_ADD(sub, name)                          \
+        DEBUGFS_ADD(sub## _ ##name, wl->debugfs.fw_statistics)
+
+#define DEBUGFS_FWSTATS_DEL(sub, name)                          \
+        DEBUGFS_DEL(sub## _ ##name)
+
+static void wl1271_debugfs_update_stats(struct wl1271 *wl)
+{
+        int ret;
+
+        mutex_lock(&wl->mutex);
+
+        ret = wl1271_ps_elp_wakeup(wl, false);
+        if (ret < 0)
+                goto out;
+
+        if (wl->state == WL1271_STATE_ON &&
+            time_after(jiffies, wl->stats.fw_stats_update +
+                       msecs_to_jiffies(WL1271_DEBUGFS_STATS_LIFETIME))) {
+                wl1271_acx_statistics(wl, wl->stats.fw_stats);
+                wl->stats.fw_stats_update = jiffies;
+        }
+
+        wl1271_ps_elp_sleep(wl);
+
+out:
+        mutex_unlock(&wl->mutex);
+}
+
+static int wl1271_open_file_generic(struct inode *inode, struct file *file)
+{
+        file->private_data = inode->i_private;
+        return 0;
+}
+
+DEBUGFS_FWSTATS_FILE(tx, internal_desc_overflow, 20, "%u");
+
+DEBUGFS_FWSTATS_FILE(rx, out_of_mem, 20, "%u");
+DEBUGFS_FWSTATS_FILE(rx, hdr_overflow, 20, "%u");
+DEBUGFS_FWSTATS_FILE(rx, hw_stuck, 20, "%u");
+DEBUGFS_FWSTATS_FILE(rx, dropped, 20, "%u");
+DEBUGFS_FWSTATS_FILE(rx, fcs_err, 20, "%u");
+DEBUGFS_FWSTATS_FILE(rx, xfr_hint_trig, 20, "%u");
+DEBUGFS_FWSTATS_FILE(rx, path_reset, 20, "%u");
+DEBUGFS_FWSTATS_FILE(rx, reset_counter, 20, "%u");
+
+DEBUGFS_FWSTATS_FILE(dma, rx_requested, 20, "%u");
+DEBUGFS_FWSTATS_FILE(dma, rx_errors, 20, "%u");
+DEBUGFS_FWSTATS_FILE(dma, tx_requested, 20, "%u");
+DEBUGFS_FWSTATS_FILE(dma, tx_errors, 20, "%u");
+
+DEBUGFS_FWSTATS_FILE(isr, cmd_cmplt, 20, "%u");
+DEBUGFS_FWSTATS_FILE(isr, fiqs, 20, "%u");
+DEBUGFS_FWSTATS_FILE(isr, rx_headers, 20, "%u");
+DEBUGFS_FWSTATS_FILE(isr, rx_mem_overflow, 20, "%u");
+DEBUGFS_FWSTATS_FILE(isr, rx_rdys, 20, "%u");
+DEBUGFS_FWSTATS_FILE(isr, irqs, 20, "%u");
+DEBUGFS_FWSTATS_FILE(isr, tx_procs, 20, "%u");
+DEBUGFS_FWSTATS_FILE(isr, decrypt_done, 20, "%u");
+DEBUGFS_FWSTATS_FILE(isr, dma0_done, 20, "%u");
+DEBUGFS_FWSTATS_FILE(isr, dma1_done, 20, "%u");
+DEBUGFS_FWSTATS_FILE(isr, tx_exch_complete, 20, "%u");
+DEBUGFS_FWSTATS_FILE(isr, commands, 20, "%u");
+DEBUGFS_FWSTATS_FILE(isr, rx_procs, 20, "%u");
+DEBUGFS_FWSTATS_FILE(isr, hw_pm_mode_changes, 20, "%u");
+DEBUGFS_FWSTATS_FILE(isr, host_acknowledges, 20, "%u");
+DEBUGFS_FWSTATS_FILE(isr, pci_pm, 20, "%u");
+DEBUGFS_FWSTATS_FILE(isr, wakeups, 20, "%u");
+DEBUGFS_FWSTATS_FILE(isr, low_rssi, 20, "%u");
+
+DEBUGFS_FWSTATS_FILE(wep, addr_key_count, 20, "%u");
+DEBUGFS_FWSTATS_FILE(wep, default_key_count, 20, "%u");
+/* skipping wep.reserved */
+DEBUGFS_FWSTATS_FILE(wep, key_not_found, 20, "%u");
+DEBUGFS_FWSTATS_FILE(wep, decrypt_fail, 20, "%u");
+DEBUGFS_FWSTATS_FILE(wep, packets, 20, "%u");
+DEBUGFS_FWSTATS_FILE(wep, interrupt, 20, "%u");
+
+DEBUGFS_FWSTATS_FILE(pwr, ps_enter, 20, "%u");
+DEBUGFS_FWSTATS_FILE(pwr, elp_enter, 20, "%u");
+DEBUGFS_FWSTATS_FILE(pwr, missing_bcns, 20, "%u");
+DEBUGFS_FWSTATS_FILE(pwr, wake_on_host, 20, "%u");
+DEBUGFS_FWSTATS_FILE(pwr, wake_on_timer_exp, 20, "%u");
+DEBUGFS_FWSTATS_FILE(pwr, tx_with_ps, 20, "%u");
+DEBUGFS_FWSTATS_FILE(pwr, tx_without_ps, 20, "%u");
+DEBUGFS_FWSTATS_FILE(pwr, rcvd_beacons, 20, "%u");
+DEBUGFS_FWSTATS_FILE(pwr, power_save_off, 20, "%u");
+DEBUGFS_FWSTATS_FILE(pwr, enable_ps, 20, "%u");
+DEBUGFS_FWSTATS_FILE(pwr, disable_ps, 20, "%u");
+DEBUGFS_FWSTATS_FILE(pwr, fix_tsf_ps, 20, "%u");
+/* skipping cont_miss_bcns_spread for now */
+DEBUGFS_FWSTATS_FILE(pwr, rcvd_awake_beacons, 20, "%u");
+
+DEBUGFS_FWSTATS_FILE(mic, rx_pkts, 20, "%u");
+DEBUGFS_FWSTATS_FILE(mic, calc_failure, 20, "%u");
+
+DEBUGFS_FWSTATS_FILE(aes, encrypt_fail, 20, "%u");
+DEBUGFS_FWSTATS_FILE(aes, decrypt_fail, 20, "%u");
+DEBUGFS_FWSTATS_FILE(aes, encrypt_packets, 20, "%u");
+DEBUGFS_FWSTATS_FILE(aes, decrypt_packets, 20, "%u");
+DEBUGFS_FWSTATS_FILE(aes, encrypt_interrupt, 20, "%u");
+DEBUGFS_FWSTATS_FILE(aes, decrypt_interrupt, 20, "%u");
+
+DEBUGFS_FWSTATS_FILE(event, heart_beat, 20, "%u");
+DEBUGFS_FWSTATS_FILE(event, calibration, 20, "%u");
+DEBUGFS_FWSTATS_FILE(event, rx_mismatch, 20, "%u");
+DEBUGFS_FWSTATS_FILE(event, rx_mem_empty, 20, "%u");
+DEBUGFS_FWSTATS_FILE(event, rx_pool, 20, "%u");
+DEBUGFS_FWSTATS_FILE(event, oom_late, 20, "%u");
+DEBUGFS_FWSTATS_FILE(event, phy_transmit_error, 20, "%u");
+DEBUGFS_FWSTATS_FILE(event, tx_stuck, 20, "%u");
+
+DEBUGFS_FWSTATS_FILE(ps, pspoll_timeouts, 20, "%u");
+DEBUGFS_FWSTATS_FILE(ps, upsd_timeouts, 20, "%u");
+DEBUGFS_FWSTATS_FILE(ps, upsd_max_sptime, 20, "%u");
+DEBUGFS_FWSTATS_FILE(ps, upsd_max_apturn, 20, "%u");
+DEBUGFS_FWSTATS_FILE(ps, pspoll_max_apturn, 20, "%u");
+DEBUGFS_FWSTATS_FILE(ps, pspoll_utilization, 20, "%u");
+DEBUGFS_FWSTATS_FILE(ps, upsd_utilization, 20, "%u");
+
+DEBUGFS_FWSTATS_FILE(rxpipe, rx_prep_beacon_drop, 20, "%u");
+DEBUGFS_FWSTATS_FILE(rxpipe, descr_host_int_trig_rx_data, 20, "%u");
+DEBUGFS_FWSTATS_FILE(rxpipe, beacon_buffer_thres_host_int_trig_rx_data,
+                     20, "%u");
+DEBUGFS_FWSTATS_FILE(rxpipe, missed_beacon_host_int_trig_rx_data, 20, "%u");
+DEBUGFS_FWSTATS_FILE(rxpipe, tx_xfr_host_int_trig_rx_data, 20, "%u");
+
+DEBUGFS_READONLY_FILE(retry_count, 20, "%u", wl->stats.retry_count);
+DEBUGFS_READONLY_FILE(excessive_retries, 20, "%u",
+                      wl->stats.excessive_retries);
+
+static ssize_t tx_queue_len_read(struct file *file, char __user *userbuf,
+                                 size_t count, loff_t *ppos)
+{
+        struct wl1271 *wl = file->private_data;
+        u32 queue_len;
+        char buf[20];
+        int res;
+
+        queue_len = skb_queue_len(&wl->tx_queue);
+
+        res = scnprintf(buf, sizeof(buf), "%u\n", queue_len);
+        return simple_read_from_buffer(userbuf, count, ppos, buf, res);
+}
+
+static const struct file_operations tx_queue_len_ops = {
+        .read = tx_queue_len_read,
+        .open = wl1271_open_file_generic,
+};
+
+static void wl1271_debugfs_delete_files(struct wl1271 *wl)
+{
+        DEBUGFS_FWSTATS_DEL(tx, internal_desc_overflow);
+
+        DEBUGFS_FWSTATS_DEL(rx, out_of_mem);
+        DEBUGFS_FWSTATS_DEL(rx, hdr_overflow);
+        DEBUGFS_FWSTATS_DEL(rx, hw_stuck);
+        DEBUGFS_FWSTATS_DEL(rx, dropped);
+        DEBUGFS_FWSTATS_DEL(rx, fcs_err);
+        DEBUGFS_FWSTATS_DEL(rx, xfr_hint_trig);
+        DEBUGFS_FWSTATS_DEL(rx, path_reset);
+        DEBUGFS_FWSTATS_DEL(rx, reset_counter);
+
+        DEBUGFS_FWSTATS_DEL(dma, rx_requested);
+        DEBUGFS_FWSTATS_DEL(dma, rx_errors);
+        DEBUGFS_FWSTATS_DEL(dma, tx_requested);
+        DEBUGFS_FWSTATS_DEL(dma, tx_errors);
+
+        DEBUGFS_FWSTATS_DEL(isr, cmd_cmplt);
+        DEBUGFS_FWSTATS_DEL(isr, fiqs);
+        DEBUGFS_FWSTATS_DEL(isr, rx_headers);
+        DEBUGFS_FWSTATS_DEL(isr, rx_mem_overflow);
+        DEBUGFS_FWSTATS_DEL(isr, rx_rdys);
+        DEBUGFS_FWSTATS_DEL(isr, irqs);
+        DEBUGFS_FWSTATS_DEL(isr, tx_procs);
+        DEBUGFS_FWSTATS_DEL(isr, decrypt_done);
+        DEBUGFS_FWSTATS_DEL(isr, dma0_done);
+        DEBUGFS_FWSTATS_DEL(isr, dma1_done);
+        DEBUGFS_FWSTATS_DEL(isr, tx_exch_complete);
+        DEBUGFS_FWSTATS_DEL(isr, commands);
+        DEBUGFS_FWSTATS_DEL(isr, rx_procs);
+        DEBUGFS_FWSTATS_DEL(isr, hw_pm_mode_changes);
+        DEBUGFS_FWSTATS_DEL(isr, host_acknowledges);
+        DEBUGFS_FWSTATS_DEL(isr, pci_pm);
+        DEBUGFS_FWSTATS_DEL(isr, wakeups);
+        DEBUGFS_FWSTATS_DEL(isr, low_rssi);
+
+        DEBUGFS_FWSTATS_DEL(wep, addr_key_count);
+        DEBUGFS_FWSTATS_DEL(wep, default_key_count);
+        /* skipping wep.reserved */
+        DEBUGFS_FWSTATS_DEL(wep, key_not_found);
+        DEBUGFS_FWSTATS_DEL(wep, decrypt_fail);
+        DEBUGFS_FWSTATS_DEL(wep, packets);
+        DEBUGFS_FWSTATS_DEL(wep, interrupt);
+
+        DEBUGFS_FWSTATS_DEL(pwr, ps_enter);
+        DEBUGFS_FWSTATS_DEL(pwr, elp_enter);
+        DEBUGFS_FWSTATS_DEL(pwr, missing_bcns);
+        DEBUGFS_FWSTATS_DEL(pwr, wake_on_host);
+        DEBUGFS_FWSTATS_DEL(pwr, wake_on_timer_exp);
+        DEBUGFS_FWSTATS_DEL(pwr, tx_with_ps);
+        DEBUGFS_FWSTATS_DEL(pwr, tx_without_ps);
+        DEBUGFS_FWSTATS_DEL(pwr, rcvd_beacons);
+        DEBUGFS_FWSTATS_DEL(pwr, power_save_off);
+        DEBUGFS_FWSTATS_DEL(pwr, enable_ps);
+        DEBUGFS_FWSTATS_DEL(pwr, disable_ps);
+        DEBUGFS_FWSTATS_DEL(pwr, fix_tsf_ps);
+        /* skipping cont_miss_bcns_spread for now */
+        DEBUGFS_FWSTATS_DEL(pwr, rcvd_awake_beacons);
+
+        DEBUGFS_FWSTATS_DEL(mic, rx_pkts);
+        DEBUGFS_FWSTATS_DEL(mic, calc_failure);
+
+        DEBUGFS_FWSTATS_DEL(aes, encrypt_fail);
+        DEBUGFS_FWSTATS_DEL(aes, decrypt_fail);
+        DEBUGFS_FWSTATS_DEL(aes, encrypt_packets);
+        DEBUGFS_FWSTATS_DEL(aes, decrypt_packets);
+        DEBUGFS_FWSTATS_DEL(aes, encrypt_interrupt);
+        DEBUGFS_FWSTATS_DEL(aes, decrypt_interrupt);
+
+        DEBUGFS_FWSTATS_DEL(event, heart_beat);
+        DEBUGFS_FWSTATS_DEL(event, calibration);
+        DEBUGFS_FWSTATS_DEL(event, rx_mismatch);
+        DEBUGFS_FWSTATS_DEL(event, rx_mem_empty);
+        DEBUGFS_FWSTATS_DEL(event, rx_pool);
+        DEBUGFS_FWSTATS_DEL(event, oom_late);
+        DEBUGFS_FWSTATS_DEL(event, phy_transmit_error);
+        DEBUGFS_FWSTATS_DEL(event, tx_stuck);
+
+        DEBUGFS_FWSTATS_DEL(ps, pspoll_timeouts);
+        DEBUGFS_FWSTATS_DEL(ps, upsd_timeouts);
+        DEBUGFS_FWSTATS_DEL(ps, upsd_max_sptime);
+        DEBUGFS_FWSTATS_DEL(ps, upsd_max_apturn);
+        DEBUGFS_FWSTATS_DEL(ps, pspoll_max_apturn);
+        DEBUGFS_FWSTATS_DEL(ps, pspoll_utilization);
+        DEBUGFS_FWSTATS_DEL(ps, upsd_utilization);
+
+        DEBUGFS_FWSTATS_DEL(rxpipe, rx_prep_beacon_drop);
+        DEBUGFS_FWSTATS_DEL(rxpipe, descr_host_int_trig_rx_data);
+        DEBUGFS_FWSTATS_DEL(rxpipe, beacon_buffer_thres_host_int_trig_rx_data);
+        DEBUGFS_FWSTATS_DEL(rxpipe, missed_beacon_host_int_trig_rx_data);
+        DEBUGFS_FWSTATS_DEL(rxpipe, tx_xfr_host_int_trig_rx_data);
+
+        DEBUGFS_DEL(tx_queue_len);
+        DEBUGFS_DEL(retry_count);
+        DEBUGFS_DEL(excessive_retries);
+}
+
+static int wl1271_debugfs_add_files(struct wl1271 *wl)
+{
+        int ret = 0;
+
+        DEBUGFS_FWSTATS_ADD(tx, internal_desc_overflow);
+
+        DEBUGFS_FWSTATS_ADD(rx, out_of_mem);
+        DEBUGFS_FWSTATS_ADD(rx, hdr_overflow);
+        DEBUGFS_FWSTATS_ADD(rx, hw_stuck);
+        DEBUGFS_FWSTATS_ADD(rx, dropped);
+        DEBUGFS_FWSTATS_ADD(rx, fcs_err);
+        DEBUGFS_FWSTATS_ADD(rx, xfr_hint_trig);
+        DEBUGFS_FWSTATS_ADD(rx, path_reset);
+        DEBUGFS_FWSTATS_ADD(rx, reset_counter);
+
+        DEBUGFS_FWSTATS_ADD(dma, rx_requested);
+        DEBUGFS_FWSTATS_ADD(dma, rx_errors);
+        DEBUGFS_FWSTATS_ADD(dma, tx_requested);
+        DEBUGFS_FWSTATS_ADD(dma, tx_errors);
+
+        DEBUGFS_FWSTATS_ADD(isr, cmd_cmplt);
+        DEBUGFS_FWSTATS_ADD(isr, fiqs);
+        DEBUGFS_FWSTATS_ADD(isr, rx_headers);
+        DEBUGFS_FWSTATS_ADD(isr, rx_mem_overflow);
+        DEBUGFS_FWSTATS_ADD(isr, rx_rdys);
+        DEBUGFS_FWSTATS_ADD(isr, irqs);
+        DEBUGFS_FWSTATS_ADD(isr, tx_procs);
+        DEBUGFS_FWSTATS_ADD(isr, decrypt_done);
+        DEBUGFS_FWSTATS_ADD(isr, dma0_done);
+        DEBUGFS_FWSTATS_ADD(isr, dma1_done);
+        DEBUGFS_FWSTATS_ADD(isr, tx_exch_complete);
+        DEBUGFS_FWSTATS_ADD(isr, commands);
+        DEBUGFS_FWSTATS_ADD(isr, rx_procs);
+        DEBUGFS_FWSTATS_ADD(isr, hw_pm_mode_changes);
+        DEBUGFS_FWSTATS_ADD(isr, host_acknowledges);
+        DEBUGFS_FWSTATS_ADD(isr, pci_pm);
+        DEBUGFS_FWSTATS_ADD(isr, wakeups);
+        DEBUGFS_FWSTATS_ADD(isr, low_rssi);
+
+        DEBUGFS_FWSTATS_ADD(wep, addr_key_count);
+        DEBUGFS_FWSTATS_ADD(wep, default_key_count);
+        /* skipping wep.reserved */
+        DEBUGFS_FWSTATS_ADD(wep, key_not_found);
+        DEBUGFS_FWSTATS_ADD(wep, decrypt_fail);
+        DEBUGFS_FWSTATS_ADD(wep, packets);
+        DEBUGFS_FWSTATS_ADD(wep, interrupt);
+
+        DEBUGFS_FWSTATS_ADD(pwr, ps_enter);
+        DEBUGFS_FWSTATS_ADD(pwr, elp_enter);
+        DEBUGFS_FWSTATS_ADD(pwr, missing_bcns);
+        DEBUGFS_FWSTATS_ADD(pwr, wake_on_host);
+        DEBUGFS_FWSTATS_ADD(pwr, wake_on_timer_exp);
+        DEBUGFS_FWSTATS_ADD(pwr, tx_with_ps);
+        DEBUGFS_FWSTATS_ADD(pwr, tx_without_ps);
+        DEBUGFS_FWSTATS_ADD(pwr, rcvd_beacons);
+        DEBUGFS_FWSTATS_ADD(pwr, power_save_off);
+        DEBUGFS_FWSTATS_ADD(pwr, enable_ps);
+        DEBUGFS_FWSTATS_ADD(pwr, disable_ps);
+        DEBUGFS_FWSTATS_ADD(pwr, fix_tsf_ps);
+        /* skipping cont_miss_bcns_spread for now */
+        DEBUGFS_FWSTATS_ADD(pwr, rcvd_awake_beacons);
+
+        DEBUGFS_FWSTATS_ADD(mic, rx_pkts);
+        DEBUGFS_FWSTATS_ADD(mic, calc_failure);
+
+        DEBUGFS_FWSTATS_ADD(aes, encrypt_fail);
+        DEBUGFS_FWSTATS_ADD(aes, decrypt_fail);
+        DEBUGFS_FWSTATS_ADD(aes, encrypt_packets);
+        DEBUGFS_FWSTATS_ADD(aes, decrypt_packets);
+        DEBUGFS_FWSTATS_ADD(aes, encrypt_interrupt);
+        DEBUGFS_FWSTATS_ADD(aes, decrypt_interrupt);
+
+        DEBUGFS_FWSTATS_ADD(event, heart_beat);
+        DEBUGFS_FWSTATS_ADD(event, calibration);
+        DEBUGFS_FWSTATS_ADD(event, rx_mismatch);
+        DEBUGFS_FWSTATS_ADD(event, rx_mem_empty);
+        DEBUGFS_FWSTATS_ADD(event, rx_pool);
+        DEBUGFS_FWSTATS_ADD(event, oom_late);
+        DEBUGFS_FWSTATS_ADD(event, phy_transmit_error);
+        DEBUGFS_FWSTATS_ADD(event, tx_stuck);
+
+        DEBUGFS_FWSTATS_ADD(ps, pspoll_timeouts);
+        DEBUGFS_FWSTATS_ADD(ps, upsd_timeouts);
+        DEBUGFS_FWSTATS_ADD(ps, upsd_max_sptime);
+        DEBUGFS_FWSTATS_ADD(ps, upsd_max_apturn);
+        DEBUGFS_FWSTATS_ADD(ps, pspoll_max_apturn);
+        DEBUGFS_FWSTATS_ADD(ps, pspoll_utilization);
+        DEBUGFS_FWSTATS_ADD(ps, upsd_utilization);
+
+        DEBUGFS_FWSTATS_ADD(rxpipe, rx_prep_beacon_drop);
+        DEBUGFS_FWSTATS_ADD(rxpipe, descr_host_int_trig_rx_data);
+        DEBUGFS_FWSTATS_ADD(rxpipe, beacon_buffer_thres_host_int_trig_rx_data);
+        DEBUGFS_FWSTATS_ADD(rxpipe, missed_beacon_host_int_trig_rx_data);
+        DEBUGFS_FWSTATS_ADD(rxpipe, tx_xfr_host_int_trig_rx_data);
+
+        DEBUGFS_ADD(tx_queue_len, wl->debugfs.rootdir);
+        DEBUGFS_ADD(retry_count, wl->debugfs.rootdir);
+        DEBUGFS_ADD(excessive_retries, wl->debugfs.rootdir);
+
+out:
+        if (ret < 0)
+                wl1271_debugfs_delete_files(wl);
+
+        return ret;
+}
+
+void wl1271_debugfs_reset(struct wl1271 *wl)
+{
+        memset(wl->stats.fw_stats, 0, sizeof(*wl->stats.fw_stats));
+        wl->stats.retry_count = 0;
+        wl->stats.excessive_retries = 0;
+}
+
+int wl1271_debugfs_init(struct wl1271 *wl)
+{
+        int ret;
+
+        wl->debugfs.rootdir = debugfs_create_dir(KBUILD_MODNAME, NULL);
+
+        if (IS_ERR(wl->debugfs.rootdir)) {
+                ret = PTR_ERR(wl->debugfs.rootdir);
+                wl->debugfs.rootdir = NULL;
+                goto err;
+        }
+
+        wl->debugfs.fw_statistics = debugfs_create_dir("fw-statistics",
+                                                       wl->debugfs.rootdir);
+
+        if (IS_ERR(wl->debugfs.fw_statistics)) {
+                ret = PTR_ERR(wl->debugfs.fw_statistics);
+                wl->debugfs.fw_statistics = NULL;
+                goto err_root;
+        }
+
+        wl->stats.fw_stats = kzalloc(sizeof(*wl->stats.fw_stats),
+                                      GFP_KERNEL);
+
+        if (!wl->stats.fw_stats) {
+                ret = -ENOMEM;
+                goto err_fw;
+        }
+
+        wl->stats.fw_stats_update = jiffies;
+
+        ret = wl1271_debugfs_add_files(wl);
+
+        if (ret < 0)
+                goto err_file;
+
+        return 0;
+
+err_file:
+        kfree(wl->stats.fw_stats);
+        wl->stats.fw_stats = NULL;
+
+err_fw:
+        debugfs_remove(wl->debugfs.fw_statistics);
+        wl->debugfs.fw_statistics = NULL;
+
+err_root:
+        debugfs_remove(wl->debugfs.rootdir);
+        wl->debugfs.rootdir = NULL;
+
+err:
+        return ret;
+}
+
+void wl1271_debugfs_exit(struct wl1271 *wl)
+{
+        wl1271_debugfs_delete_files(wl);
+
+        kfree(wl->stats.fw_stats);
+        wl->stats.fw_stats = NULL;
+
+        debugfs_remove(wl->debugfs.fw_statistics);
+        wl->debugfs.fw_statistics = NULL;
+
+        debugfs_remove(wl->debugfs.rootdir);
+        wl->debugfs.rootdir = NULL;
+
+}
diff --git a/drivers/net/wireless/wl12xx/wl1271_debugfs.h b/drivers/net/wireless/wl12xx/wl1271_debugfs.h
new file mode 100644
index 000000000000..00a45b2669ad
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/wl1271_debugfs.h
@@ -0,0 +1,33 @@
+/*
+ * This file is part of wl1271
+ *
+ * Copyright (C) 2009 Nokia Corporation
+ *
+ * Contact: Luciano Coelho <luciano.coelho@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#ifndef WL1271_DEBUGFS_H
+#define WL1271_DEBUGFS_H
+
+#include "wl1271.h"
+
+int wl1271_debugfs_init(struct wl1271 *wl);
+void wl1271_debugfs_exit(struct wl1271 *wl);
+void wl1271_debugfs_reset(struct wl1271 *wl);
+
+#endif /* WL1271_DEBUGFS_H */
diff --git a/drivers/net/wireless/wl12xx/wl1271_event.c b/drivers/net/wireless/wl12xx/wl1271_event.c
new file mode 100644
index 000000000000..f3afd4a6ff33
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/wl1271_event.c
@@ -0,0 +1,125 @@
+/*
+ * This file is part of wl1271
+ *
+ * Copyright (C) 2008-2009 Nokia Corporation
+ *
+ * Contact: Luciano Coelho <luciano.coelho@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#include "wl1271.h"
+#include "wl1271_reg.h"
+#include "wl1271_spi.h"
+#include "wl1271_event.h"
+#include "wl1271_ps.h"
+
+static int wl1271_event_scan_complete(struct wl1271 *wl,
+                                      struct event_mailbox *mbox)
+{
+        wl1271_debug(DEBUG_EVENT, "status: 0x%x",
+                     mbox->scheduled_scan_status);
+
+        if (wl->scanning) {
+                mutex_unlock(&wl->mutex);
+                ieee80211_scan_completed(wl->hw, false);
+                mutex_lock(&wl->mutex);
+                wl->scanning = false;
+        }
+
+        return 0;
+}
+
+static void wl1271_event_mbox_dump(struct event_mailbox *mbox)
+{
+        wl1271_debug(DEBUG_EVENT, "MBOX DUMP:");
+        wl1271_debug(DEBUG_EVENT, "\tvector: 0x%x", mbox->events_vector);
+        wl1271_debug(DEBUG_EVENT, "\tmask: 0x%x", mbox->events_mask);
+}
+
+static int wl1271_event_process(struct wl1271 *wl, struct event_mailbox *mbox)
+{
+        int ret;
+        u32 vector;
+
+        wl1271_event_mbox_dump(mbox);
+
+        vector = mbox->events_vector & ~(mbox->events_mask);
+        wl1271_debug(DEBUG_EVENT, "vector: 0x%x", vector);
+
+        if (vector & SCAN_COMPLETE_EVENT_ID) {
+                ret = wl1271_event_scan_complete(wl, mbox);
+                if (ret < 0)
+                        return ret;
+        }
+
+        if (vector & BSS_LOSE_EVENT_ID) {
+                wl1271_debug(DEBUG_EVENT, "BSS_LOSE_EVENT");
+
+                if (wl->psm_requested && wl->psm) {
+                        ret = wl1271_ps_set_mode(wl, STATION_ACTIVE_MODE);
+                        if (ret < 0)
+                                return ret;
+                }
+        }
+
+        return 0;
+}
+
+int wl1271_event_unmask(struct wl1271 *wl)
+{
+        int ret;
+
+        ret = wl1271_acx_event_mbox_mask(wl, ~(wl->event_mask));
+        if (ret < 0)
+                return ret;
+
+        return 0;
+}
+
+void wl1271_event_mbox_config(struct wl1271 *wl)
+{
+        wl->mbox_ptr[0] = wl1271_reg_read32(wl, REG_EVENT_MAILBOX_PTR);
+        wl->mbox_ptr[1] = wl->mbox_ptr[0] + sizeof(struct event_mailbox);
+
+        wl1271_debug(DEBUG_EVENT, "MBOX ptrs: 0x%x 0x%x",
+                     wl->mbox_ptr[0], wl->mbox_ptr[1]);
+}
+
+int wl1271_event_handle(struct wl1271 *wl, u8 mbox_num)
+{
+        struct event_mailbox mbox;
+        int ret;
+
+        wl1271_debug(DEBUG_EVENT, "EVENT on mbox %d", mbox_num);
+
+        if (mbox_num > 1)
+                return -EINVAL;
+
+        /* first we read the mbox descriptor */
+        wl1271_spi_mem_read(wl, wl->mbox_ptr[mbox_num], &mbox,
+                            sizeof(struct event_mailbox));
+
+        /* process the descriptor */
+        ret = wl1271_event_process(wl, &mbox);
+        if (ret < 0)
+                return ret;
+
+        /* then we let the firmware know it can go on...*/
+        wl1271_reg_write32(wl, ACX_REG_INTERRUPT_TRIG, INTR_TRIG_EVENT_ACK);
+
+        return 0;
+}
diff --git a/drivers/net/wireless/wl12xx/wl1271_event.h b/drivers/net/wireless/wl12xx/wl1271_event.h
new file mode 100644
index 000000000000..2cdce7c34bf0
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/wl1271_event.h
@@ -0,0 +1,110 @@
+/*
+ * This file is part of wl1271
+ *
+ * Copyright (C) 1998-2009 Texas Instruments. All rights reserved.
+ * Copyright (C) 2008-2009 Nokia Corporation
+ *
+ * Contact: Luciano Coelho <luciano.coelho@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#ifndef __WL1271_EVENT_H__
+#define __WL1271_EVENT_H__
+
+/*
+ * Mbox events
+ *
+ * The event mechanism is based on a pair of event buffers (buffers A and
+ * B) at fixed locations in the target's memory. The host processes one
+ * buffer while the other buffer continues to collect events. If the host
+ * is not processing events, an interrupt is issued to signal that a buffer
+ * is ready. Once the host is done with processing events from one buffer,
+ * it signals the target (with an ACK interrupt) that the event buffer is
+ * free.
+ */
+
+enum {
+        MEASUREMENT_START_EVENT_ID               = BIT(8),
+        MEASUREMENT_COMPLETE_EVENT_ID            = BIT(9),
+        SCAN_COMPLETE_EVENT_ID                   = BIT(10),
+        SCHEDULED_SCAN_COMPLETE_EVENT_ID         = BIT(11),
+        AP_DISCOVERY_COMPLETE_EVENT_ID           = BIT(12),
+        PS_REPORT_EVENT_ID                       = BIT(13),
+        PSPOLL_DELIVERY_FAILURE_EVENT_ID         = BIT(14),
+        DISCONNECT_EVENT_COMPLETE_ID             = BIT(15),
+        JOIN_EVENT_COMPLETE_ID                   = BIT(16),
+        CHANNEL_SWITCH_COMPLETE_EVENT_ID         = BIT(17),
+        BSS_LOSE_EVENT_ID                        = BIT(18),
+        REGAINED_BSS_EVENT_ID                    = BIT(19),
+        ROAMING_TRIGGER_MAX_TX_RETRY_EVENT_ID    = BIT(20),
+        SOFT_GEMINI_SENSE_EVENT_ID               = BIT(22),
+        SOFT_GEMINI_PREDICTION_EVENT_ID          = BIT(23),
+        SOFT_GEMINI_AVALANCHE_EVENT_ID           = BIT(24),
+        PLT_RX_CALIBRATION_COMPLETE_EVENT_ID     = BIT(25),
+        DBG_EVENT_ID                             = BIT(26),
+        HEALTH_CHECK_REPLY_EVENT_ID              = BIT(27),
+        PERIODIC_SCAN_COMPLETE_EVENT_ID          = BIT(28),
+        PERIODIC_SCAN_REPORT_EVENT_ID            = BIT(29),
+        BA_SESSION_TEAR_DOWN_EVENT_ID            = BIT(30),
+        EVENT_MBOX_ALL_EVENT_ID                  = 0x7fffffff,
+};
+
+struct event_debug_report {
+        u8 debug_event_id;
+        u8 num_params;
+        u16 pad;
+        u32 report_1;
+        u32 report_2;
+        u32 report_3;
+} __attribute__ ((packed));
+
+#define NUM_OF_RSSI_SNR_TRIGGERS 8
+
+struct event_mailbox {
+        u32 events_vector;
+        u32 events_mask;
+        u32 reserved_1;
+        u32 reserved_2;
+
+        u8 dbg_event_id;
+        u8 num_relevant_params;
+        u16 reserved_3;
+        u32 event_report_p1;
+        u32 event_report_p2;
+        u32 event_report_p3;
+
+        u8 number_of_scan_results;
+        u8 scan_tag;
+        u8 reserved_4[2];
+        u32 compl_scheduled_scan_status;
+
+        u16 scheduled_scan_attended_channels;
+        u8 soft_gemini_sense_info;
+        u8 soft_gemini_protective_info;
+        s8 rssi_snr_trigger_metric[NUM_OF_RSSI_SNR_TRIGGERS];
+        u8 channel_switch_status;
+        u8 scheduled_scan_status;
+        u8 ps_status;
+
+        u8 reserved_5[29];
+} __attribute__ ((packed));
+
+int wl1271_event_unmask(struct wl1271 *wl);
+void wl1271_event_mbox_config(struct wl1271 *wl);
+int wl1271_event_handle(struct wl1271 *wl, u8 mbox);
+
+#endif
diff --git a/drivers/net/wireless/wl12xx/wl1271_init.c b/drivers/net/wireless/wl12xx/wl1271_init.c
new file mode 100644
index 000000000000..490df217605a
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/wl1271_init.c
@@ -0,0 +1,397 @@
+/*
+ * This file is part of wl1271
+ *
+ * Copyright (C) 2009 Nokia Corporation
+ *
+ * Contact: Luciano Coelho <luciano.coelho@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+
+#include "wl1271_init.h"
+#include "wl12xx_80211.h"
+#include "wl1271_acx.h"
+#include "wl1271_cmd.h"
+#include "wl1271_reg.h"
+
+static int wl1271_init_hwenc_config(struct wl1271 *wl)
+{
+        int ret;
+
+        ret = wl1271_acx_feature_cfg(wl);
+        if (ret < 0) {
+                wl1271_warning("couldn't set feature config");
+                return ret;
+        }
+
+        ret = wl1271_cmd_set_default_wep_key(wl, wl->default_key);
+        if (ret < 0) {
+                wl1271_warning("couldn't set default key");
+                return ret;
+        }
+
+        return 0;
+}
+
+static int wl1271_init_templates_config(struct wl1271 *wl)
+{
+        int ret;
+
+        /* send empty templates for fw memory reservation */
+        ret = wl1271_cmd_template_set(wl, CMD_TEMPL_CFG_PROBE_REQ_2_4, NULL,
+                                      sizeof(struct wl12xx_probe_req_template));
+        if (ret < 0)
+                return ret;
+
+        ret = wl1271_cmd_template_set(wl, CMD_TEMPL_NULL_DATA, NULL,
+                                      sizeof(struct wl12xx_null_data_template));
+        if (ret < 0)
+                return ret;
+
+        ret = wl1271_cmd_template_set(wl, CMD_TEMPL_PS_POLL, NULL,
+                                      sizeof(struct wl12xx_ps_poll_template));
+        if (ret < 0)
+                return ret;
+
+        ret = wl1271_cmd_template_set(wl, CMD_TEMPL_QOS_NULL_DATA, NULL,
+                                      sizeof
+                                      (struct wl12xx_qos_null_data_template));
+        if (ret < 0)
+                return ret;
+
+        ret = wl1271_cmd_template_set(wl, CMD_TEMPL_PROBE_RESPONSE, NULL,
+                                      sizeof
+                                      (struct wl12xx_probe_resp_template));
+        if (ret < 0)
+                return ret;
+
+        ret = wl1271_cmd_template_set(wl, CMD_TEMPL_BEACON, NULL,
+                                      sizeof
+                                      (struct wl12xx_beacon_template));
+        if (ret < 0)
+                return ret;
+
+        return 0;
+}
+
+static int wl1271_init_rx_config(struct wl1271 *wl, u32 config, u32 filter)
+{
+        int ret;
+
+        ret = wl1271_acx_rx_msdu_life_time(wl, RX_MSDU_LIFETIME_DEF);
+        if (ret < 0)
+                return ret;
+
+        ret = wl1271_acx_rx_config(wl, config, filter);
+        if (ret < 0)
+                return ret;
+
+        return 0;
+}
+
+static int wl1271_init_phy_config(struct wl1271 *wl)
+{
+        int ret;
+
+        ret = wl1271_acx_pd_threshold(wl);
+        if (ret < 0)
+                return ret;
+
+        ret = wl1271_acx_slot(wl, DEFAULT_SLOT_TIME);
+        if (ret < 0)
+                return ret;
+
+        ret = wl1271_acx_group_address_tbl(wl);
+        if (ret < 0)
+                return ret;
+
+        ret = wl1271_acx_service_period_timeout(wl);
+        if (ret < 0)
+                return ret;
+
+        ret = wl1271_acx_rts_threshold(wl, RTS_THRESHOLD_DEF);
+        if (ret < 0)
+                return ret;
+
+        return 0;
+}
+
+static int wl1271_init_beacon_filter(struct wl1271 *wl)
+{
+        int ret;
+
+        ret = wl1271_acx_beacon_filter_opt(wl);
+        if (ret < 0)
+                return ret;
+
+        ret = wl1271_acx_beacon_filter_table(wl);
+        if (ret < 0)
+                return ret;
+
+        return 0;
+}
+
+static int wl1271_init_pta(struct wl1271 *wl)
+{
+        int ret;
+
+        ret = wl1271_acx_sg_enable(wl);
+        if (ret < 0)
+                return ret;
+
+        ret = wl1271_acx_sg_cfg(wl);
+        if (ret < 0)
+                return ret;
+
+        return 0;
+}
+
+static int wl1271_init_energy_detection(struct wl1271 *wl)
+{
+        int ret;
+
+        ret = wl1271_acx_cca_threshold(wl);
+        if (ret < 0)
+                return ret;
+
+        return 0;
+}
+
+static int wl1271_init_beacon_broadcast(struct wl1271 *wl)
+{
+        int ret;
+
+        ret = wl1271_acx_bcn_dtim_options(wl);
+        if (ret < 0)
+                return ret;
+
+        return 0;
+}
+
+static int wl1271_init_general_parms(struct wl1271 *wl)
+{
+        struct wl1271_general_parms *gen_parms;
+        int ret;
+
+        gen_parms = kzalloc(sizeof(*gen_parms), GFP_KERNEL);
+        if (!gen_parms)
+                return -ENOMEM;
+
+        gen_parms->id = TEST_CMD_INI_FILE_GENERAL_PARAM;
+
+        gen_parms->ref_clk = REF_CLK_38_4_E;
+        /* FIXME: magic numbers */
+        gen_parms->settling_time = 5;
+        gen_parms->clk_valid_on_wakeup = 0;
+        gen_parms->dc2dcmode = 0;
+        gen_parms->single_dual_band = 0;
+        gen_parms->tx_bip_fem_autodetect = 1;
+        gen_parms->tx_bip_fem_manufacturer = 1;
+        gen_parms->settings = 1;
+
+        ret = wl1271_cmd_test(wl, gen_parms, sizeof(*gen_parms), 0);
+        if (ret < 0) {
+                wl1271_warning("CMD_INI_FILE_GENERAL_PARAM failed");
+                return ret;
+        }
+
+        kfree(gen_parms);
+        return 0;
+}
+
+static int wl1271_init_radio_parms(struct wl1271 *wl)
+{
+        /*
+         * FIXME: All these magic numbers should be moved to some place where
+         * they can be configured (separate file?)
+         */
+
+        struct wl1271_radio_parms *radio_parms;
+        int ret;
+        u8 compensation[] = { 0xec, 0xf6, 0x00, 0x0c, 0x18, 0xf8, 0xfc, 0x00,
+                              0x08, 0x10, 0xf0, 0xf8, 0x00, 0x0a, 0x14 };
+
+        u8 tx_rate_limits_normal[]   = { 0x1e, 0x1f, 0x22, 0x24, 0x28, 0x29 };
+        u8 tx_rate_limits_degraded[] = { 0x1b, 0x1c, 0x1e, 0x20, 0x24, 0x25 };
+
+        u8 tx_channel_limits_11b[] = { 0x22, 0x50, 0x50, 0x50,
+                                       0x50, 0x50, 0x50, 0x50,
+                                       0x50, 0x50, 0x22, 0x50,
+                                       0x22, 0x50 };
+
+        u8 tx_channel_limits_ofdm[] = { 0x20, 0x50, 0x50, 0x50,
+                                        0x50, 0x50, 0x50, 0x50,
+                                        0x50, 0x50, 0x20, 0x50,
+                                        0x20, 0x50 };
+
+        u8 tx_pdv_rate_offsets[] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
+
+        u8 tx_ibias[] = { 0x1a, 0x1a, 0x1a, 0x1a, 0x1a, 0x27 };
+
+        radio_parms = kzalloc(sizeof(*radio_parms), GFP_KERNEL);
+        if (!radio_parms)
+                return -ENOMEM;
+
+        radio_parms->id = TEST_CMD_INI_FILE_RADIO_PARAM;
+
+        /* Static radio parameters */
+        radio_parms->rx_trace_loss = 10;
+        radio_parms->tx_trace_loss = 10;
+        memcpy(radio_parms->rx_rssi_and_proc_compens, compensation,
+               sizeof(compensation));
+
+        /* We don't set the 5GHz -- N/A */
+
+        /* Dynamic radio parameters */
+        radio_parms->tx_ref_pd_voltage = cpu_to_le16(0x24e);
+        radio_parms->tx_ref_power = 0x78;
+        radio_parms->tx_offset_db = 0x0;
+
+        memcpy(radio_parms->tx_rate_limits_normal, tx_rate_limits_normal,
+               sizeof(tx_rate_limits_normal));
+        memcpy(radio_parms->tx_rate_limits_degraded, tx_rate_limits_degraded,
+               sizeof(tx_rate_limits_degraded));
+
+        memcpy(radio_parms->tx_channel_limits_11b, tx_channel_limits_11b,
+               sizeof(tx_channel_limits_11b));
+        memcpy(radio_parms->tx_channel_limits_ofdm, tx_channel_limits_ofdm,
+               sizeof(tx_channel_limits_ofdm));
+        memcpy(radio_parms->tx_pdv_rate_offsets, tx_pdv_rate_offsets,
+               sizeof(tx_pdv_rate_offsets));
+        memcpy(radio_parms->tx_ibias, tx_ibias,
+               sizeof(tx_ibias));
+
+        radio_parms->rx_fem_insertion_loss = 0x14;
+
+        ret = wl1271_cmd_test(wl, radio_parms, sizeof(*radio_parms), 0);
+        if (ret < 0)
+                wl1271_warning("CMD_INI_FILE_RADIO_PARAM failed");
+
+        kfree(radio_parms);
+        return ret;
+}
+
+int wl1271_hw_init(struct wl1271 *wl)
+{
+        int ret;
+
+        ret = wl1271_init_general_parms(wl);
+        if (ret < 0)
+                return ret;
+
+        ret = wl1271_init_radio_parms(wl);
+        if (ret < 0)
+                return ret;
+
+        /* Template settings */
+        ret = wl1271_init_templates_config(wl);
+        if (ret < 0)
+                return ret;
+
+        /* Default memory configuration */
+        ret = wl1271_acx_init_mem_config(wl);
+        if (ret < 0)
+                return ret;
+
+        /* RX config */
+        ret = wl1271_init_rx_config(wl,
+                                       RX_CFG_PROMISCUOUS | RX_CFG_TSF,
+                                       RX_FILTER_OPTION_DEF);
+        /* RX_CONFIG_OPTION_ANY_DST_ANY_BSS,
+           RX_FILTER_OPTION_FILTER_ALL); */
+        if (ret < 0)
+                goto out_free_memmap;
+
+        /* PHY layer config */
+        ret = wl1271_init_phy_config(wl);
+        if (ret < 0)
+                goto out_free_memmap;
+
+        /* Beacon filtering */
+        ret = wl1271_init_beacon_filter(wl);
+        if (ret < 0)
+                goto out_free_memmap;
+
+        /* Configure TX patch complete interrupt behavior */
+        ret = wl1271_acx_tx_config_options(wl);
+        if (ret < 0)
+                goto out_free_memmap;
+
+        /* RX complete interrupt pacing */
+        ret = wl1271_acx_init_rx_interrupt(wl);
+        if (ret < 0)
+                goto out_free_memmap;
+
+        /* Bluetooth WLAN coexistence */
+        ret = wl1271_init_pta(wl);
+        if (ret < 0)
+                goto out_free_memmap;
+
+        /* Energy detection */
+        ret = wl1271_init_energy_detection(wl);
+        if (ret < 0)
+                goto out_free_memmap;
+
+        /* Beacons and boradcast settings */
+        ret = wl1271_init_beacon_broadcast(wl);
+        if (ret < 0)
+                goto out_free_memmap;
+
+        /* Default fragmentation threshold */
+        ret = wl1271_acx_frag_threshold(wl);
+        if (ret < 0)
+                goto out_free_memmap;
+
+        /* Default TID configuration */
+        ret = wl1271_acx_tid_cfg(wl);
+        if (ret < 0)
+                goto out_free_memmap;
+
+        /* Default AC configuration */
+        ret = wl1271_acx_ac_cfg(wl);
+        if (ret < 0)
+                goto out_free_memmap;
+
+        /* Configure TX rate classes */
+        ret = wl1271_acx_rate_policies(wl);
+        if (ret < 0)
+                goto out_free_memmap;
+
+        /* Enable data path */
+        ret = wl1271_cmd_data_path(wl, wl->channel, 1);
+        if (ret < 0)
+                goto out_free_memmap;
+
+        /* Configure for ELP power saving */
+        ret = wl1271_acx_sleep_auth(wl, WL1271_PSM_ELP);
+        if (ret < 0)
+                goto out_free_memmap;
+
+        /* Configure HW encryption */
+        ret = wl1271_init_hwenc_config(wl);
+        if (ret < 0)
+                goto out_free_memmap;
+
+        return 0;
+
+ out_free_memmap:
+        kfree(wl->target_mem_map);
+
+        return ret;
+}
diff --git a/drivers/net/wireless/wl12xx/wl1271_init.h b/drivers/net/wireless/wl12xx/wl1271_init.h
new file mode 100644
index 000000000000..bd8ff0fa2272
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/wl1271_init.h
@@ -0,0 +1,115 @@
+/*
+ * This file is part of wl1271
+ *
+ * Copyright (C) 2009 Nokia Corporation
+ *
+ * Contact: Luciano Coelho <luciano.coelho@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#ifndef __WL1271_INIT_H__
+#define __WL1271_INIT_H__
+
+#include "wl1271.h"
+
+int wl1271_hw_init_power_auth(struct wl1271 *wl);
+int wl1271_hw_init(struct wl1271 *wl);
+
+/* These are not really a TEST_CMD, but the ref driver uses them as such */
+#define TEST_CMD_INI_FILE_RADIO_PARAM   0x19
+#define TEST_CMD_INI_FILE_GENERAL_PARAM 0x1E
+
+struct wl1271_general_parms {
+        u8 id;
+        u8 padding[3];
+
+        u8 ref_clk;
+        u8 settling_time;
+        u8 clk_valid_on_wakeup;
+        u8 dc2dcmode;
+        u8 single_dual_band;
+
+        u8 tx_bip_fem_autodetect;
+        u8 tx_bip_fem_manufacturer;
+        u8 settings;
+} __attribute__ ((packed));
+
+enum ref_clk_enum {
+        REF_CLK_19_2_E,
+        REF_CLK_26_E,
+        REF_CLK_38_4_E,
+        REF_CLK_52_E
+};
+
+#define RSSI_AND_PROCESS_COMPENSATION_SIZE 15
+#define NUMBER_OF_SUB_BANDS_5  7
+#define NUMBER_OF_RATE_GROUPS  6
+#define NUMBER_OF_CHANNELS_2_4 14
+#define NUMBER_OF_CHANNELS_5   35
+
+struct wl1271_radio_parms {
+        u8 id;
+        u8 padding[3];
+
+        /* Static radio parameters */
+        /* 2.4GHz */
+        u8 rx_trace_loss;
+        u8 tx_trace_loss;
+        s8 rx_rssi_and_proc_compens[RSSI_AND_PROCESS_COMPENSATION_SIZE];
+
+        /* 5GHz */
+        u8 rx_trace_loss_5[NUMBER_OF_SUB_BANDS_5];
+        u8 tx_trace_loss_5[NUMBER_OF_SUB_BANDS_5];
+        s8 rx_rssi_and_proc_compens_5[RSSI_AND_PROCESS_COMPENSATION_SIZE];
+
+        /* Dynamic radio parameters */
+        /* 2.4GHz */
+        s16 tx_ref_pd_voltage;
+        s8  tx_ref_power;
+        s8  tx_offset_db;
+
+        s8  tx_rate_limits_normal[NUMBER_OF_RATE_GROUPS];
+        s8  tx_rate_limits_degraded[NUMBER_OF_RATE_GROUPS];
+
+        s8  tx_channel_limits_11b[NUMBER_OF_CHANNELS_2_4];
+        s8  tx_channel_limits_ofdm[NUMBER_OF_CHANNELS_2_4];
+        s8  tx_pdv_rate_offsets[NUMBER_OF_RATE_GROUPS];
+
+        u8  tx_ibias[NUMBER_OF_RATE_GROUPS];
+        u8  rx_fem_insertion_loss;
+
+        u8 padding2;
+
+        /* 5GHz */
+        s16 tx_ref_pd_voltage_5[NUMBER_OF_SUB_BANDS_5];
+        s8  tx_ref_power_5[NUMBER_OF_SUB_BANDS_5];
+        s8  tx_offset_db_5[NUMBER_OF_SUB_BANDS_5];
+
+        s8  tx_rate_limits_normal_5[NUMBER_OF_RATE_GROUPS];
+        s8  tx_rate_limits_degraded_5[NUMBER_OF_RATE_GROUPS];
+
+        s8  tx_channel_limits_ofdm_5[NUMBER_OF_CHANNELS_5];
+        s8  tx_pdv_rate_offsets_5[NUMBER_OF_RATE_GROUPS];
+
+        /* FIXME: this is inconsistent with the types for 2.4GHz */
+        s8  tx_ibias_5[NUMBER_OF_RATE_GROUPS];
+        s8  rx_fem_insertion_loss_5[NUMBER_OF_SUB_BANDS_5];
+
+        u8 padding3[2];
+} __attribute__ ((packed));
+
+#endif
diff --git a/drivers/net/wireless/wl12xx/wl1271_main.c b/drivers/net/wireless/wl12xx/wl1271_main.c
new file mode 100644
index 000000000000..4102d590b798
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/wl1271_main.c
@@ -0,0 +1,1397 @@
+/*
+ * This file is part of wl1271
+ *
+ * Copyright (C) 2008-2009 Nokia Corporation
+ *
+ * Contact: Luciano Coelho <luciano.coelho@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/interrupt.h>
+#include <linux/firmware.h>
+#include <linux/delay.h>
+#include <linux/irq.h>
+#include <linux/spi/spi.h>
+#include <linux/crc32.h>
+#include <linux/etherdevice.h>
+#include <linux/spi/wl12xx.h>
+
+#include "wl1271.h"
+#include "wl12xx_80211.h"
+#include "wl1271_reg.h"
+#include "wl1271_spi.h"
+#include "wl1271_event.h"
+#include "wl1271_tx.h"
+#include "wl1271_rx.h"
+#include "wl1271_ps.h"
+#include "wl1271_init.h"
+#include "wl1271_debugfs.h"
+#include "wl1271_cmd.h"
+#include "wl1271_boot.h"
+
+static int wl1271_plt_init(struct wl1271 *wl)
+{
+        int ret;
+
+        ret = wl1271_acx_init_mem_config(wl);
+        if (ret < 0)
+                return ret;
+
+        ret = wl1271_cmd_data_path(wl, wl->channel, 1);
+        if (ret < 0)
+                return ret;
+
+        return 0;
+}
+
+static void wl1271_disable_interrupts(struct wl1271 *wl)
+{
+        disable_irq(wl->irq);
+}
+
+static void wl1271_power_off(struct wl1271 *wl)
+{
+        wl->set_power(false);
+}
+
+static void wl1271_power_on(struct wl1271 *wl)
+{
+        wl->set_power(true);
+}
+
+static void wl1271_fw_status(struct wl1271 *wl, struct wl1271_fw_status *status)
+{
+        u32 total = 0;
+        int i;
+
+        /*
+         * FIXME: Reading the FW status directly from the registers seems to
+         * be the right thing to do, but it doesn't work.  And in the
+         * reference driver, there is a workaround called
+         * USE_SDIO_24M_WORKAROUND, which reads the status from memory
+         * instead, so we do the same here.
+         */
+
+        wl1271_spi_mem_read(wl, STATUS_MEM_ADDRESS, status, sizeof(*status));
+
+        wl1271_debug(DEBUG_IRQ, "intr: 0x%x (fw_rx_counter = %d, "
+                     "drv_rx_counter = %d, tx_results_counter = %d)",
+                     status->intr,
+                     status->fw_rx_counter,
+                     status->drv_rx_counter,
+                     status->tx_results_counter);
+
+        /* update number of available TX blocks */
+        for (i = 0; i < NUM_TX_QUEUES; i++) {
+                u32 cnt = status->tx_released_blks[i] - wl->tx_blocks_freed[i];
+                wl->tx_blocks_freed[i] = status->tx_released_blks[i];
+                wl->tx_blocks_available += cnt;
+                total += cnt;
+        }
+
+        /* if more blocks are available now, schedule some tx work */
+        if (total && !skb_queue_empty(&wl->tx_queue))
+                schedule_work(&wl->tx_work);
+
+        /* update the host-chipset time offset */
+        wl->time_offset = jiffies_to_usecs(jiffies) - status->fw_localtime;
+}
+
+#define WL1271_IRQ_MAX_LOOPS 10
+static void wl1271_irq_work(struct work_struct *work)
+{
+        u32 intr, ctr = WL1271_IRQ_MAX_LOOPS;
+        int ret;
+        struct wl1271 *wl =
+                container_of(work, struct wl1271, irq_work);
+
+        mutex_lock(&wl->mutex);
+
+        wl1271_debug(DEBUG_IRQ, "IRQ work");
+
+        if (wl->state == WL1271_STATE_OFF)
+                goto out;
+
+        ret = wl1271_ps_elp_wakeup(wl, true);
+        if (ret < 0)
+                goto out;
+
+        wl1271_reg_write32(wl, ACX_REG_INTERRUPT_MASK, WL1271_ACX_INTR_ALL);
+
+        intr = wl1271_reg_read32(wl, ACX_REG_INTERRUPT_CLEAR);
+        if (!intr) {
+                wl1271_debug(DEBUG_IRQ, "Zero interrupt received.");
+                goto out_sleep;
+        }
+
+        intr &= WL1271_INTR_MASK;
+
+        do {
+                wl1271_fw_status(wl, wl->fw_status);
+
+
+                if (intr & (WL1271_ACX_INTR_EVENT_A |
+                            WL1271_ACX_INTR_EVENT_B)) {
+                        wl1271_debug(DEBUG_IRQ,
+                                     "WL1271_ACX_INTR_EVENT (0x%x)", intr);
+                        if (intr & WL1271_ACX_INTR_EVENT_A)
+                                wl1271_event_handle(wl, 0);
+                        else
+                                wl1271_event_handle(wl, 1);
+                }
+
+                if (intr & WL1271_ACX_INTR_INIT_COMPLETE)
+                        wl1271_debug(DEBUG_IRQ,
+                                     "WL1271_ACX_INTR_INIT_COMPLETE");
+
+                if (intr & WL1271_ACX_INTR_HW_AVAILABLE)
+                        wl1271_debug(DEBUG_IRQ, "WL1271_ACX_INTR_HW_AVAILABLE");
+
+                if (intr & WL1271_ACX_INTR_DATA) {
+                        u8 tx_res_cnt = wl->fw_status->tx_results_counter -
+                                wl->tx_results_count;
+
+                        wl1271_debug(DEBUG_IRQ, "WL1271_ACX_INTR_DATA");
+
+                        /* check for tx results */
+                        if (tx_res_cnt)
+                                wl1271_tx_complete(wl, tx_res_cnt);
+
+                        wl1271_rx(wl, wl->fw_status);
+                }
+
+                intr = wl1271_reg_read32(wl, ACX_REG_INTERRUPT_CLEAR);
+                intr &= WL1271_INTR_MASK;
+        } while (intr && --ctr);
+
+out_sleep:
+        wl1271_reg_write32(wl, ACX_REG_INTERRUPT_MASK,
+                           WL1271_ACX_INTR_ALL & ~(WL1271_INTR_MASK));
+        wl1271_ps_elp_sleep(wl);
+
+out:
+        mutex_unlock(&wl->mutex);
+}
+
+static irqreturn_t wl1271_irq(int irq, void *cookie)
+{
+        struct wl1271 *wl;
+        unsigned long flags;
+
+        wl1271_debug(DEBUG_IRQ, "IRQ");
+
+        wl = cookie;
+
+        /* complete the ELP completion */
+        spin_lock_irqsave(&wl->wl_lock, flags);
+        if (wl->elp_compl) {
+                complete(wl->elp_compl);
+                wl->elp_compl = NULL;
+        }
+
+        schedule_work(&wl->irq_work);
+        spin_unlock_irqrestore(&wl->wl_lock, flags);
+
+        return IRQ_HANDLED;
+}
+
+static int wl1271_fetch_firmware(struct wl1271 *wl)
+{
+        const struct firmware *fw;
+        int ret;
+
+        ret = request_firmware(&fw, WL1271_FW_NAME, &wl->spi->dev);
+
+        if (ret < 0) {
+                wl1271_error("could not get firmware: %d", ret);
+                return ret;
+        }
+
+        if (fw->size % 4) {
+                wl1271_error("firmware size is not multiple of 32 bits: %zu",
+                             fw->size);
+                ret = -EILSEQ;
+                goto out;
+        }
+
+        wl->fw_len = fw->size;
+        wl->fw = kmalloc(wl->fw_len, GFP_KERNEL);
+
+        if (!wl->fw) {
+                wl1271_error("could not allocate memory for the firmware");
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        memcpy(wl->fw, fw->data, wl->fw_len);
+
+        ret = 0;
+
+out:
+        release_firmware(fw);
+
+        return ret;
+}
+
+static int wl1271_fetch_nvs(struct wl1271 *wl)
+{
+        const struct firmware *fw;
+        int ret;
+
+        ret = request_firmware(&fw, WL1271_NVS_NAME, &wl->spi->dev);
+
+        if (ret < 0) {
+                wl1271_error("could not get nvs file: %d", ret);
+                return ret;
+        }
+
+        if (fw->size % 4) {
+                wl1271_error("nvs size is not multiple of 32 bits: %zu",
+                             fw->size);
+                ret = -EILSEQ;
+                goto out;
+        }
+
+        wl->nvs_len = fw->size;
+        wl->nvs = kmalloc(wl->nvs_len, GFP_KERNEL);
+
+        if (!wl->nvs) {
+                wl1271_error("could not allocate memory for the nvs file");
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        memcpy(wl->nvs, fw->data, wl->nvs_len);
+
+        ret = 0;
+
+out:
+        release_firmware(fw);
+
+        return ret;
+}
+
+static void wl1271_fw_wakeup(struct wl1271 *wl)
+{
+        u32 elp_reg;
+
+        elp_reg = ELPCTRL_WAKE_UP;
+        wl1271_write32(wl, HW_ACCESS_ELP_CTRL_REG_ADDR, elp_reg);
+}
+
+static int wl1271_setup(struct wl1271 *wl)
+{
+        wl->fw_status = kmalloc(sizeof(*wl->fw_status), GFP_KERNEL);
+        if (!wl->fw_status)
+                return -ENOMEM;
+
+        wl->tx_res_if = kmalloc(sizeof(*wl->tx_res_if), GFP_KERNEL);
+        if (!wl->tx_res_if) {
+                kfree(wl->fw_status);
+                return -ENOMEM;
+        }
+
+        INIT_WORK(&wl->irq_work, wl1271_irq_work);
+        INIT_WORK(&wl->tx_work, wl1271_tx_work);
+        return 0;
+}
+
+static int wl1271_chip_wakeup(struct wl1271 *wl)
+{
+        int ret = 0;
+
+        wl1271_power_on(wl);
+        msleep(WL1271_POWER_ON_SLEEP);
+        wl1271_spi_reset(wl);
+        wl1271_spi_init(wl);
+
+        /* We don't need a real memory partition here, because we only want
+         * to use the registers at this point. */
+        wl1271_set_partition(wl,
+                             0x00000000,
+                             0x00000000,
+                             REGISTERS_BASE,
+                             REGISTERS_DOWN_SIZE);
+
+        /* ELP module wake up */
+        wl1271_fw_wakeup(wl);
+
+        /* whal_FwCtrl_BootSm() */
+
+        /* 0. read chip id from CHIP_ID */
+        wl->chip.id = wl1271_reg_read32(wl, CHIP_ID_B);
+
+        /* 1. check if chip id is valid */
+
+        switch (wl->chip.id) {
+        case CHIP_ID_1271_PG10:
+                wl1271_warning("chip id 0x%x (1271 PG10) support is obsolete",
+                               wl->chip.id);
+
+                ret = wl1271_setup(wl);
+                if (ret < 0)
+                        goto out;
+                break;
+        case CHIP_ID_1271_PG20:
+                wl1271_debug(DEBUG_BOOT, "chip id 0x%x (1271 PG20)",
+                             wl->chip.id);
+
+                ret = wl1271_setup(wl);
+                if (ret < 0)
+                        goto out;
+                break;
+        default:
+                wl1271_error("unsupported chip id: 0x%x", wl->chip.id);
+                ret = -ENODEV;
+                goto out;
+        }
+
+        if (wl->fw == NULL) {
+                ret = wl1271_fetch_firmware(wl);
+                if (ret < 0)
+                        goto out;
+        }
+
+        /* No NVS from netlink, try to get it from the filesystem */
+        if (wl->nvs == NULL) {
+                ret = wl1271_fetch_nvs(wl);
+                if (ret < 0)
+                        goto out;
+        }
+
+out:
+        return ret;
+}
+
+static void wl1271_filter_work(struct work_struct *work)
+{
+        struct wl1271 *wl =
+                container_of(work, struct wl1271, filter_work);
+        int ret;
+
+        mutex_lock(&wl->mutex);
+
+        if (wl->state == WL1271_STATE_OFF)
+                goto out;
+
+        ret = wl1271_ps_elp_wakeup(wl, false);
+        if (ret < 0)
+                goto out;
+
+        /* FIXME: replace the magic numbers with proper definitions */
+        ret = wl1271_cmd_join(wl, wl->bss_type, 1, 100, 0);
+        if (ret < 0)
+                goto out_sleep;
+
+out_sleep:
+        wl1271_ps_elp_sleep(wl);
+
+out:
+        mutex_unlock(&wl->mutex);
+}
+
+int wl1271_plt_start(struct wl1271 *wl)
+{
+        int ret;
+
+        mutex_lock(&wl->mutex);
+
+        wl1271_notice("power up");
+
+        if (wl->state != WL1271_STATE_OFF) {
+                wl1271_error("cannot go into PLT state because not "
+                             "in off state: %d", wl->state);
+                ret = -EBUSY;
+                goto out;
+        }
+
+        wl->state = WL1271_STATE_PLT;
+
+        ret = wl1271_chip_wakeup(wl);
+        if (ret < 0)
+                goto out;
+
+        ret = wl1271_boot(wl);
+        if (ret < 0)
+                goto out;
+
+        wl1271_notice("firmware booted in PLT mode (%s)", wl->chip.fw_ver);
+
+        ret = wl1271_plt_init(wl);
+        if (ret < 0)
+                goto out;
+
+out:
+        mutex_unlock(&wl->mutex);
+
+        return ret;
+}
+
+int wl1271_plt_stop(struct wl1271 *wl)
+{
+        int ret = 0;
+
+        mutex_lock(&wl->mutex);
+
+        wl1271_notice("power down");
+
+        if (wl->state != WL1271_STATE_PLT) {
+                wl1271_error("cannot power down because not in PLT "
+                             "state: %d", wl->state);
+                ret = -EBUSY;
+                goto out;
+        }
+
+        wl1271_disable_interrupts(wl);
+        wl1271_power_off(wl);
+
+        wl->state = WL1271_STATE_OFF;
+
+out:
+        mutex_unlock(&wl->mutex);
+
+        return ret;
+}
+
+
+static int wl1271_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
+{
+        struct wl1271 *wl = hw->priv;
+
+        skb_queue_tail(&wl->tx_queue, skb);
+
+        /*
+         * The chip specific setup must run before the first TX packet -
+         * before that, the tx_work will not be initialized!
+         */
+
+        schedule_work(&wl->tx_work);
+
+        /*
+         * The workqueue is slow to process the tx_queue and we need stop
+         * the queue here, otherwise the queue will get too long.
+         */
+        if (skb_queue_len(&wl->tx_queue) >= WL1271_TX_QUEUE_MAX_LENGTH) {
+                ieee80211_stop_queues(wl->hw);
+
+                /*
+                 * FIXME: this is racy, the variable is not properly
+                 * protected. Maybe fix this by removing the stupid
+                 * variable altogether and checking the real queue state?
+                 */
+                wl->tx_queue_stopped = true;
+        }
+
+        return NETDEV_TX_OK;
+}
+
+static int wl1271_op_start(struct ieee80211_hw *hw)
+{
+        struct wl1271 *wl = hw->priv;
+        int ret = 0;
+
+        wl1271_debug(DEBUG_MAC80211, "mac80211 start");
+
+        mutex_lock(&wl->mutex);
+
+        if (wl->state != WL1271_STATE_OFF) {
+                wl1271_error("cannot start because not in off state: %d",
+                             wl->state);
+                ret = -EBUSY;
+                goto out;
+        }
+
+        ret = wl1271_chip_wakeup(wl);
+        if (ret < 0)
+                goto out;
+
+        ret = wl1271_boot(wl);
+        if (ret < 0)
+                goto out;
+
+        ret = wl1271_hw_init(wl);
+        if (ret < 0)
+                goto out;
+
+        wl->state = WL1271_STATE_ON;
+
+        wl1271_info("firmware booted (%s)", wl->chip.fw_ver);
+
+out:
+        if (ret < 0)
+                wl1271_power_off(wl);
+
+        mutex_unlock(&wl->mutex);
+
+        return ret;
+}
+
+static void wl1271_op_stop(struct ieee80211_hw *hw)
+{
+        struct wl1271 *wl = hw->priv;
+        int i;
+
+        wl1271_info("down");
+
+        wl1271_debug(DEBUG_MAC80211, "mac80211 stop");
+
+        mutex_lock(&wl->mutex);
+
+        WARN_ON(wl->state != WL1271_STATE_ON);
+
+        if (wl->scanning) {
+                mutex_unlock(&wl->mutex);
+                ieee80211_scan_completed(wl->hw, true);
+                mutex_lock(&wl->mutex);
+                wl->scanning = false;
+        }
+
+        wl->state = WL1271_STATE_OFF;
+
+        wl1271_disable_interrupts(wl);
+
+        mutex_unlock(&wl->mutex);
+
+        cancel_work_sync(&wl->irq_work);
+        cancel_work_sync(&wl->tx_work);
+        cancel_work_sync(&wl->filter_work);
+
+        mutex_lock(&wl->mutex);
+
+        /* let's notify MAC80211 about the remaining pending TX frames */
+        wl1271_tx_flush(wl);
+        wl1271_power_off(wl);
+
+        memset(wl->bssid, 0, ETH_ALEN);
+        memset(wl->ssid, 0, IW_ESSID_MAX_SIZE + 1);
+        wl->ssid_len = 0;
+        wl->listen_int = 1;
+        wl->bss_type = MAX_BSS_TYPE;
+
+        wl->rx_counter = 0;
+        wl->elp = false;
+        wl->psm = 0;
+        wl->tx_queue_stopped = false;
+        wl->power_level = WL1271_DEFAULT_POWER_LEVEL;
+        wl->tx_blocks_available = 0;
+        wl->tx_results_count = 0;
+        wl->tx_packets_count = 0;
+        wl->time_offset = 0;
+        wl->session_counter = 0;
+        for (i = 0; i < NUM_TX_QUEUES; i++)
+                wl->tx_blocks_freed[i] = 0;
+
+        wl1271_debugfs_reset(wl);
+        mutex_unlock(&wl->mutex);
+}
+
+static int wl1271_op_add_interface(struct ieee80211_hw *hw,
+                                   struct ieee80211_if_init_conf *conf)
+{
+        struct wl1271 *wl = hw->priv;
+        DECLARE_MAC_BUF(mac);
+        int ret = 0;
+
+        wl1271_debug(DEBUG_MAC80211, "mac80211 add interface type %d mac %s",
+                     conf->type, print_mac(mac, conf->mac_addr));
+
+        mutex_lock(&wl->mutex);
+
+        switch (conf->type) {
+        case NL80211_IFTYPE_STATION:
+                wl->bss_type = BSS_TYPE_STA_BSS;
+                break;
+        case NL80211_IFTYPE_ADHOC:
+                wl->bss_type = BSS_TYPE_IBSS;
+                break;
+        default:
+                ret = -EOPNOTSUPP;
+                goto out;
+        }
+
+        /* FIXME: what if conf->mac_addr changes? */
+
+out:
+        mutex_unlock(&wl->mutex);
+        return ret;
+}
+
+static void wl1271_op_remove_interface(struct ieee80211_hw *hw,
+                                         struct ieee80211_if_init_conf *conf)
+{
+        wl1271_debug(DEBUG_MAC80211, "mac80211 remove interface");
+}
+
+#if 0
+static int wl1271_op_config_interface(struct ieee80211_hw *hw,
+                                      struct ieee80211_vif *vif,
+                                      struct ieee80211_if_conf *conf)
+{
+        struct wl1271 *wl = hw->priv;
+        struct sk_buff *beacon;
+        DECLARE_MAC_BUF(mac);
+        int ret;
+
+        wl1271_debug(DEBUG_MAC80211, "mac80211 config_interface bssid %s",
+                     print_mac(mac, conf->bssid));
+        wl1271_dump_ascii(DEBUG_MAC80211, "ssid: ", conf->ssid,
+                          conf->ssid_len);
+
+        mutex_lock(&wl->mutex);
+
+        ret = wl1271_ps_elp_wakeup(wl, false);
+        if (ret < 0)
+                goto out;
+
+        memcpy(wl->bssid, conf->bssid, ETH_ALEN);
+
+        ret = wl1271_cmd_build_null_data(wl);
+        if (ret < 0)
+                goto out_sleep;
+
+        wl->ssid_len = conf->ssid_len;
+        if (wl->ssid_len)
+                memcpy(wl->ssid, conf->ssid, wl->ssid_len);
+
+        if (wl->bss_type != BSS_TYPE_IBSS) {
+                /* FIXME: replace the magic numbers with proper definitions */
+                ret = wl1271_cmd_join(wl, wl->bss_type, 5, 100, 1);
+                if (ret < 0)
+                        goto out_sleep;
+        }
+
+        if (conf->changed & IEEE80211_IFCC_BEACON) {
+                beacon = ieee80211_beacon_get(hw, vif);
+                ret = wl1271_cmd_template_set(wl, CMD_TEMPL_BEACON,
+                                              beacon->data, beacon->len);
+
+                if (ret < 0) {
+                        dev_kfree_skb(beacon);
+                        goto out_sleep;
+                }
+
+                ret = wl1271_cmd_template_set(wl, CMD_TEMPL_PROBE_RESPONSE,
+                                              beacon->data, beacon->len);
+
+                dev_kfree_skb(beacon);
+
+                if (ret < 0)
+                        goto out_sleep;
+
+                /* FIXME: replace the magic numbers with proper definitions */
+                ret = wl1271_cmd_join(wl, wl->bss_type, 1, 100, 0);
+
+                if (ret < 0)
+                        goto out_sleep;
+        }
+
+out_sleep:
+        wl1271_ps_elp_sleep(wl);
+
+out:
+        mutex_unlock(&wl->mutex);
+
+        return ret;
+}
+#endif
+
+static int wl1271_op_config(struct ieee80211_hw *hw, u32 changed)
+{
+        struct wl1271 *wl = hw->priv;
+        struct ieee80211_conf *conf = &hw->conf;
+        int channel, ret = 0;
+
+        channel = ieee80211_frequency_to_channel(conf->channel->center_freq);
+
+        wl1271_debug(DEBUG_MAC80211, "mac80211 config ch %d psm %s power %d",
+                     channel,
+                     conf->flags & IEEE80211_CONF_PS ? "on" : "off",
+                     conf->power_level);
+
+        mutex_lock(&wl->mutex);
+
+        ret = wl1271_ps_elp_wakeup(wl, false);
+        if (ret < 0)
+                goto out;
+
+        if (channel != wl->channel) {
+                u8 old_channel = wl->channel;
+                wl->channel = channel;
+
+                /* FIXME: use beacon interval provided by mac80211 */
+                ret = wl1271_cmd_join(wl, wl->bss_type, 1, 100, 0);
+                if (ret < 0) {
+                        wl->channel = old_channel;
+                        goto out_sleep;
+                }
+        }
+
+        ret = wl1271_cmd_build_null_data(wl);
+        if (ret < 0)
+                goto out_sleep;
+
+        if (conf->flags & IEEE80211_CONF_PS && !wl->psm_requested) {
+                wl1271_info("psm enabled");
+
+                wl->psm_requested = true;
+
+                /*
+                 * We enter PSM only if we're already associated.
+                 * If we're not, we'll enter it when joining an SSID,
+                 * through the bss_info_changed() hook.
+                 */
+                ret = wl1271_ps_set_mode(wl, STATION_POWER_SAVE_MODE);
+        } else if (!(conf->flags & IEEE80211_CONF_PS) &&
+                   wl->psm_requested) {
+                wl1271_info("psm disabled");
+
+                wl->psm_requested = false;
+
+                if (wl->psm)
+                        ret = wl1271_ps_set_mode(wl, STATION_ACTIVE_MODE);
+        }
+
+        if (conf->power_level != wl->power_level) {
+                ret = wl1271_acx_tx_power(wl, conf->power_level);
+                if (ret < 0)
+                        goto out;
+
+                wl->power_level = conf->power_level;
+        }
+
+out_sleep:
+        wl1271_ps_elp_sleep(wl);
+
+out:
+        mutex_unlock(&wl->mutex);
+
+        return ret;
+}
+
+#define WL1271_SUPPORTED_FILTERS (FIF_PROMISC_IN_BSS | \
+                                  FIF_ALLMULTI | \
+                                  FIF_FCSFAIL | \
+                                  FIF_BCN_PRBRESP_PROMISC | \
+                                  FIF_CONTROL | \
+                                  FIF_OTHER_BSS)
+
+static void wl1271_op_configure_filter(struct ieee80211_hw *hw,
+                                       unsigned int changed,
+                                       unsigned int *total,
+                                       int mc_count,
+                                       struct dev_addr_list *mc_list)
+{
+        struct wl1271 *wl = hw->priv;
+
+        wl1271_debug(DEBUG_MAC80211, "mac80211 configure filter");
+
+        *total &= WL1271_SUPPORTED_FILTERS;
+        changed &= WL1271_SUPPORTED_FILTERS;
+
+        if (changed == 0)
+                return;
+
+        /* FIXME: wl->rx_config and wl->rx_filter are not protected */
+        wl->rx_config = WL1271_DEFAULT_RX_CONFIG;
+        wl->rx_filter = WL1271_DEFAULT_RX_FILTER;
+
+        /*
+         * FIXME: workqueues need to be properly cancelled on stop(), for
+         * now let's just disable changing the filter settings. They will
+         * be updated any on config().
+         */
+        /* schedule_work(&wl->filter_work); */
+}
+
+static int wl1271_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+                             struct ieee80211_vif *vif,
+                             struct ieee80211_sta *sta,
+                             struct ieee80211_key_conf *key_conf)
+{
+        struct wl1271 *wl = hw->priv;
+        const u8 *addr;
+        int ret;
+        u8 key_type;
+
+        static const u8 bcast_addr[ETH_ALEN] =
+                { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
+
+        wl1271_debug(DEBUG_MAC80211, "mac80211 set key");
+
+        addr = sta ? sta->addr : bcast_addr;
+
+        wl1271_debug(DEBUG_CRYPT, "CMD: 0x%x", cmd);
+        wl1271_dump(DEBUG_CRYPT, "ADDR: ", addr, ETH_ALEN);
+        wl1271_debug(DEBUG_CRYPT, "Key: algo:0x%x, id:%d, len:%d flags 0x%x",
+                     key_conf->alg, key_conf->keyidx,
+                     key_conf->keylen, key_conf->flags);
+        wl1271_dump(DEBUG_CRYPT, "KEY: ", key_conf->key, key_conf->keylen);
+
+        if (is_zero_ether_addr(addr)) {
+                /* We dont support TX only encryption */
+                ret = -EOPNOTSUPP;
+                goto out;
+        }
+
+        mutex_lock(&wl->mutex);
+
+        ret = wl1271_ps_elp_wakeup(wl, false);
+        if (ret < 0)
+                goto out_unlock;
+
+        switch (key_conf->alg) {
+        case ALG_WEP:
+                key_type = KEY_WEP;
+
+                key_conf->hw_key_idx = key_conf->keyidx;
+                break;
+        case ALG_TKIP:
+                key_type = KEY_TKIP;
+
+                key_conf->hw_key_idx = key_conf->keyidx;
+                break;
+        case ALG_CCMP:
+                key_type = KEY_AES;
+
+                key_conf->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
+                break;
+        default:
+                wl1271_error("Unknown key algo 0x%x", key_conf->alg);
+
+                ret = -EOPNOTSUPP;
+                goto out_sleep;
+        }
+
+        switch (cmd) {
+        case SET_KEY:
+                ret = wl1271_cmd_set_key(wl, KEY_ADD_OR_REPLACE,
+                                         key_conf->keyidx, key_type,
+                                         key_conf->keylen, key_conf->key,
+                                         addr);
+                if (ret < 0) {
+                        wl1271_error("Could not add or replace key");
+                        goto out_sleep;
+                }
+                break;
+
+        case DISABLE_KEY:
+                ret = wl1271_cmd_set_key(wl, KEY_REMOVE,
+                                         key_conf->keyidx, key_type,
+                                         key_conf->keylen, key_conf->key,
+                                         addr);
+                if (ret < 0) {
+                        wl1271_error("Could not remove key");
+                        goto out_sleep;
+                }
+                break;
+
+        default:
+                wl1271_error("Unsupported key cmd 0x%x", cmd);
+                ret = -EOPNOTSUPP;
+                goto out_sleep;
+
+                break;
+        }
+
+out_sleep:
+        wl1271_ps_elp_sleep(wl);
+
+out_unlock:
+        mutex_unlock(&wl->mutex);
+
+out:
+        return ret;
+}
+
+static int wl1271_op_hw_scan(struct ieee80211_hw *hw,
+                             struct cfg80211_scan_request *req)
+{
+        struct wl1271 *wl = hw->priv;
+        int ret;
+        u8 *ssid = NULL;
+        size_t ssid_len = 0;
+
+        wl1271_debug(DEBUG_MAC80211, "mac80211 hw scan");
+
+        if (req->n_ssids) {
+                ssid = req->ssids[0].ssid;
+                ssid_len = req->ssids[0].ssid_len;
+        }
+
+        mutex_lock(&wl->mutex);
+
+        ret = wl1271_ps_elp_wakeup(wl, false);
+        if (ret < 0)
+                goto out;
+
+        ret = wl1271_cmd_scan(hw->priv, ssid, ssid_len, 1, 0, 13, 3);
+
+        wl1271_ps_elp_sleep(wl);
+
+out:
+        mutex_unlock(&wl->mutex);
+
+        return ret;
+}
+
+static int wl1271_op_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
+{
+        struct wl1271 *wl = hw->priv;
+        int ret;
+
+        mutex_lock(&wl->mutex);
+
+        ret = wl1271_ps_elp_wakeup(wl, false);
+        if (ret < 0)
+                goto out;
+
+        ret = wl1271_acx_rts_threshold(wl, (u16) value);
+        if (ret < 0)
+                wl1271_warning("wl1271_op_set_rts_threshold failed: %d", ret);
+
+        wl1271_ps_elp_sleep(wl);
+
+out:
+        mutex_unlock(&wl->mutex);
+
+        return ret;
+}
+
+static void wl1271_op_bss_info_changed(struct ieee80211_hw *hw,
+                                       struct ieee80211_vif *vif,
+                                       struct ieee80211_bss_conf *bss_conf,
+                                       u32 changed)
+{
+        enum wl1271_cmd_ps_mode mode;
+        struct wl1271 *wl = hw->priv;
+        int ret;
+
+        wl1271_debug(DEBUG_MAC80211, "mac80211 bss info changed");
+
+        mutex_lock(&wl->mutex);
+
+        ret = wl1271_ps_elp_wakeup(wl, false);
+        if (ret < 0)
+                goto out;
+
+        if (changed & BSS_CHANGED_ASSOC) {
+                if (bss_conf->assoc) {
+                        wl->aid = bss_conf->aid;
+
+                        ret = wl1271_cmd_build_ps_poll(wl, wl->aid);
+                        if (ret < 0)
+                                goto out_sleep;
+
+                        ret = wl1271_acx_aid(wl, wl->aid);
+                        if (ret < 0)
+                                goto out_sleep;
+
+                        /* If we want to go in PSM but we're not there yet */
+                        if (wl->psm_requested && !wl->psm) {
+                                mode = STATION_POWER_SAVE_MODE;
+                                ret = wl1271_ps_set_mode(wl, mode);
+                                if (ret < 0)
+                                        goto out_sleep;
+                        }
+                }
+        }
+        if (changed & BSS_CHANGED_ERP_SLOT) {
+                if (bss_conf->use_short_slot)
+                        ret = wl1271_acx_slot(wl, SLOT_TIME_SHORT);
+                else
+                        ret = wl1271_acx_slot(wl, SLOT_TIME_LONG);
+                if (ret < 0) {
+                        wl1271_warning("Set slot time failed %d", ret);
+                        goto out_sleep;
+                }
+        }
+
+        if (changed & BSS_CHANGED_ERP_PREAMBLE) {
+                if (bss_conf->use_short_preamble)
+                        wl1271_acx_set_preamble(wl, ACX_PREAMBLE_SHORT);
+                else
+                        wl1271_acx_set_preamble(wl, ACX_PREAMBLE_LONG);
+        }
+
+        if (changed & BSS_CHANGED_ERP_CTS_PROT) {
+                if (bss_conf->use_cts_prot)
+                        ret = wl1271_acx_cts_protect(wl, CTSPROTECT_ENABLE);
+                else
+                        ret = wl1271_acx_cts_protect(wl, CTSPROTECT_DISABLE);
+                if (ret < 0) {
+                        wl1271_warning("Set ctsprotect failed %d", ret);
+                        goto out_sleep;
+                }
+        }
+
+out_sleep:
+        wl1271_ps_elp_sleep(wl);
+
+out:
+        mutex_unlock(&wl->mutex);
+}
+
+
+/* can't be const, mac80211 writes to this */
+static struct ieee80211_rate wl1271_rates[] = {
+        { .bitrate = 10,
+          .hw_value = 0x1,
+          .hw_value_short = 0x1, },
+        { .bitrate = 20,
+          .hw_value = 0x2,
+          .hw_value_short = 0x2,
+          .flags = IEEE80211_RATE_SHORT_PREAMBLE },
+        { .bitrate = 55,
+          .hw_value = 0x4,
+          .hw_value_short = 0x4,
+          .flags = IEEE80211_RATE_SHORT_PREAMBLE },
+        { .bitrate = 110,
+          .hw_value = 0x20,
+          .hw_value_short = 0x20,
+          .flags = IEEE80211_RATE_SHORT_PREAMBLE },
+        { .bitrate = 60,
+          .hw_value = 0x8,
+          .hw_value_short = 0x8, },
+        { .bitrate = 90,
+          .hw_value = 0x10,
+          .hw_value_short = 0x10, },
+        { .bitrate = 120,
+          .hw_value = 0x40,
+          .hw_value_short = 0x40, },
+        { .bitrate = 180,
+          .hw_value = 0x80,
+          .hw_value_short = 0x80, },
+        { .bitrate = 240,
+          .hw_value = 0x200,
+          .hw_value_short = 0x200, },
+        { .bitrate = 360,
+         .hw_value = 0x400,
+         .hw_value_short = 0x400, },
+        { .bitrate = 480,
+          .hw_value = 0x800,
+          .hw_value_short = 0x800, },
+        { .bitrate = 540,
+          .hw_value = 0x1000,
+          .hw_value_short = 0x1000, },
+};
+
+/* can't be const, mac80211 writes to this */
+static struct ieee80211_channel wl1271_channels[] = {
+        { .hw_value = 1, .center_freq = 2412},
+        { .hw_value = 2, .center_freq = 2417},
+        { .hw_value = 3, .center_freq = 2422},
+        { .hw_value = 4, .center_freq = 2427},
+        { .hw_value = 5, .center_freq = 2432},
+        { .hw_value = 6, .center_freq = 2437},
+        { .hw_value = 7, .center_freq = 2442},
+        { .hw_value = 8, .center_freq = 2447},
+        { .hw_value = 9, .center_freq = 2452},
+        { .hw_value = 10, .center_freq = 2457},
+        { .hw_value = 11, .center_freq = 2462},
+        { .hw_value = 12, .center_freq = 2467},
+        { .hw_value = 13, .center_freq = 2472},
+};
+
+/* can't be const, mac80211 writes to this */
+static struct ieee80211_supported_band wl1271_band_2ghz = {
+        .channels = wl1271_channels,
+        .n_channels = ARRAY_SIZE(wl1271_channels),
+        .bitrates = wl1271_rates,
+        .n_bitrates = ARRAY_SIZE(wl1271_rates),
+};
+
+static const struct ieee80211_ops wl1271_ops = {
+        .start = wl1271_op_start,
+        .stop = wl1271_op_stop,
+        .add_interface = wl1271_op_add_interface,
+        .remove_interface = wl1271_op_remove_interface,
+        .config = wl1271_op_config,
+/*      .config_interface = wl1271_op_config_interface, */
+        .configure_filter = wl1271_op_configure_filter,
+        .tx = wl1271_op_tx,
+        .set_key = wl1271_op_set_key,
+        .hw_scan = wl1271_op_hw_scan,
+        .bss_info_changed = wl1271_op_bss_info_changed,
+        .set_rts_threshold = wl1271_op_set_rts_threshold,
+};
+
+static int wl1271_register_hw(struct wl1271 *wl)
+{
+        int ret;
+
+        if (wl->mac80211_registered)
+                return 0;
+
+        SET_IEEE80211_PERM_ADDR(wl->hw, wl->mac_addr);
+
+        ret = ieee80211_register_hw(wl->hw);
+        if (ret < 0) {
+                wl1271_error("unable to register mac80211 hw: %d", ret);
+                return ret;
+        }
+
+        wl->mac80211_registered = true;
+
+        wl1271_notice("loaded");
+
+        return 0;
+}
+
+static int wl1271_init_ieee80211(struct wl1271 *wl)
+{
+        /*
+         * The tx descriptor buffer and the TKIP space.
+         *
+         * FIXME: add correct 1271 descriptor size
+         */
+        wl->hw->extra_tx_headroom = WL1271_TKIP_IV_SPACE;
+
+        /* unit us */
+        /* FIXME: find a proper value */
+        wl->hw->channel_change_time = 10000;
+
+        wl->hw->flags = IEEE80211_HW_SIGNAL_DBM |
+                IEEE80211_HW_NOISE_DBM;
+
+        wl->hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION);
+        wl->hw->wiphy->max_scan_ssids = 1;
+        wl->hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &wl1271_band_2ghz;
+
+        SET_IEEE80211_DEV(wl->hw, &wl->spi->dev);
+
+        return 0;
+}
+
+static void wl1271_device_release(struct device *dev)
+{
+
+}
+
+static struct platform_device wl1271_device = {
+        .name           = "wl1271",
+        .id             = -1,
+
+        /* device model insists to have a release function */
+        .dev            = {
+                .release = wl1271_device_release,
+        },
+};
+
+#define WL1271_DEFAULT_CHANNEL 0
+static int __devinit wl1271_probe(struct spi_device *spi)
+{
+        struct wl12xx_platform_data *pdata;
+        struct ieee80211_hw *hw;
+        struct wl1271 *wl;
+        int ret, i;
+        static const u8 nokia_oui[3] = {0x00, 0x1f, 0xdf};
+
+        pdata = spi->dev.platform_data;
+        if (!pdata) {
+                wl1271_error("no platform data");
+                return -ENODEV;
+        }
+
+        hw = ieee80211_alloc_hw(sizeof(*wl), &wl1271_ops);
+        if (!hw) {
+                wl1271_error("could not alloc ieee80211_hw");
+                return -ENOMEM;
+        }
+
+        wl = hw->priv;
+        memset(wl, 0, sizeof(*wl));
+
+        wl->hw = hw;
+        dev_set_drvdata(&spi->dev, wl);
+        wl->spi = spi;
+
+        skb_queue_head_init(&wl->tx_queue);
+
+        INIT_WORK(&wl->filter_work, wl1271_filter_work);
+        wl->channel = WL1271_DEFAULT_CHANNEL;
+        wl->scanning = false;
+        wl->default_key = 0;
+        wl->listen_int = 1;
+        wl->rx_counter = 0;
+        wl->rx_config = WL1271_DEFAULT_RX_CONFIG;
+        wl->rx_filter = WL1271_DEFAULT_RX_FILTER;
+        wl->elp = false;
+        wl->psm = 0;
+        wl->psm_requested = false;
+        wl->tx_queue_stopped = false;
+        wl->power_level = WL1271_DEFAULT_POWER_LEVEL;
+
+        /* We use the default power on sleep time until we know which chip
+         * we're using */
+        for (i = 0; i < FW_TX_CMPLT_BLOCK_SIZE; i++)
+                wl->tx_frames[i] = NULL;
+
+        spin_lock_init(&wl->wl_lock);
+
+        /*
+         * In case our MAC address is not correctly set,
+         * we use a random but Nokia MAC.
+         */
+        memcpy(wl->mac_addr, nokia_oui, 3);
+        get_random_bytes(wl->mac_addr + 3, 3);
+
+        wl->state = WL1271_STATE_OFF;
+        mutex_init(&wl->mutex);
+
+        wl->rx_descriptor = kmalloc(sizeof(*wl->rx_descriptor), GFP_KERNEL);
+        if (!wl->rx_descriptor) {
+                wl1271_error("could not allocate memory for rx descriptor");
+                ret = -ENOMEM;
+                goto out_free;
+        }
+
+        /* This is the only SPI value that we need to set here, the rest
+         * comes from the board-peripherals file */
+        spi->bits_per_word = 32;
+
+        ret = spi_setup(spi);
+        if (ret < 0) {
+                wl1271_error("spi_setup failed");
+                goto out_free;
+        }
+
+        wl->set_power = pdata->set_power;
+        if (!wl->set_power) {
+                wl1271_error("set power function missing in platform data");
+                ret = -ENODEV;
+                goto out_free;
+        }
+
+        wl->irq = spi->irq;
+        if (wl->irq < 0) {
+                wl1271_error("irq missing in platform data");
+                ret = -ENODEV;
+                goto out_free;
+        }
+
+        ret = request_irq(wl->irq, wl1271_irq, 0, DRIVER_NAME, wl);
+        if (ret < 0) {
+                wl1271_error("request_irq() failed: %d", ret);
+                goto out_free;
+        }
+
+        set_irq_type(wl->irq, IRQ_TYPE_EDGE_RISING);
+
+        disable_irq(wl->irq);
+
+        ret = platform_device_register(&wl1271_device);
+        if (ret) {
+                wl1271_error("couldn't register platform device");
+                goto out_irq;
+        }
+        dev_set_drvdata(&wl1271_device.dev, wl);
+
+        ret = wl1271_init_ieee80211(wl);
+        if (ret)
+                goto out_platform;
+
+        ret = wl1271_register_hw(wl);
+        if (ret)
+                goto out_platform;
+
+        wl1271_debugfs_init(wl);
+
+        wl1271_notice("initialized");
+
+        return 0;
+
+ out_platform:
+        platform_device_unregister(&wl1271_device);
+
+ out_irq:
+        free_irq(wl->irq, wl);
+
+ out_free:
+        kfree(wl->rx_descriptor);
+        wl->rx_descriptor = NULL;
+
+        ieee80211_free_hw(hw);
+
+        return ret;
+}
+
+static int __devexit wl1271_remove(struct spi_device *spi)
+{
+        struct wl1271 *wl = dev_get_drvdata(&spi->dev);
+
+        ieee80211_unregister_hw(wl->hw);
+
+        wl1271_debugfs_exit(wl);
+        platform_device_unregister(&wl1271_device);
+        free_irq(wl->irq, wl);
+        kfree(wl->target_mem_map);
+        kfree(wl->fw);
+        wl->fw = NULL;
+        kfree(wl->nvs);
+        wl->nvs = NULL;
+
+        kfree(wl->rx_descriptor);
+        wl->rx_descriptor = NULL;
+
+        kfree(wl->fw_status);
+        kfree(wl->tx_res_if);
+
+        ieee80211_free_hw(wl->hw);
+
+        return 0;
+}
+
+
+static struct spi_driver wl1271_spi_driver = {
+        .driver = {
+                .name           = "wl1271",
+                .bus            = &spi_bus_type,
+                .owner          = THIS_MODULE,
+        },
+
+        .probe          = wl1271_probe,
+        .remove         = __devexit_p(wl1271_remove),
+};
+
+static int __init wl1271_init(void)
+{
+        int ret;
+
+        ret = spi_register_driver(&wl1271_spi_driver);
+        if (ret < 0) {
+                wl1271_error("failed to register spi driver: %d", ret);
+                goto out;
+        }
+
+out:
+        return ret;
+}
+
+static void __exit wl1271_exit(void)
+{
+        spi_unregister_driver(&wl1271_spi_driver);
+
+        wl1271_notice("unloaded");
+}
+
+module_init(wl1271_init);
+module_exit(wl1271_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Luciano Coelho <luciano.coelho@nokia.com>");
diff --git a/drivers/net/wireless/wl12xx/wl1271_ps.c b/drivers/net/wireless/wl12xx/wl1271_ps.c
new file mode 100644
index 000000000000..1dc74b0c7736
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/wl1271_ps.c
@@ -0,0 +1,142 @@
+/*
+ * This file is part of wl1271
+ *
+ * Copyright (C) 2008-2009 Nokia Corporation
+ *
+ * Contact: Luciano Coelho <luciano.coelho@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#include "wl1271_reg.h"
+#include "wl1271_ps.h"
+#include "wl1271_spi.h"
+
+#define WL1271_WAKEUP_TIMEOUT 500
+
+/* Routines to toggle sleep mode while in ELP */
+void wl1271_ps_elp_sleep(struct wl1271 *wl)
+{
+        /*
+         * FIXME: due to a problem in the firmware (causing a firmware
+         * crash), ELP entry is prevented below. Remove the "true" to
+         * re-enable ELP entry.
+         */
+        if (true || wl->elp || !wl->psm)
+                return;
+
+        /*
+         * Go to ELP unless there is work already pending - pending work
+         * will immediately wakeup the chipset anyway.
+         */
+        if (!work_pending(&wl->irq_work) && !work_pending(&wl->tx_work)) {
+                wl1271_debug(DEBUG_PSM, "chip to elp");
+                wl1271_write32(wl, HW_ACCESS_ELP_CTRL_REG_ADDR, ELPCTRL_SLEEP);
+                wl->elp = true;
+        }
+}
+
+int wl1271_ps_elp_wakeup(struct wl1271 *wl, bool chip_awake)
+{
+        DECLARE_COMPLETION_ONSTACK(compl);
+        unsigned long flags;
+        int ret;
+        u32 start_time = jiffies;
+        bool pending = false;
+
+        if (!wl->elp)
+                return 0;
+
+        wl1271_debug(DEBUG_PSM, "waking up chip from elp");
+
+        /*
+         * The spinlock is required here to synchronize both the work and
+         * the completion variable in one entity.
+         */
+        spin_lock_irqsave(&wl->wl_lock, flags);
+        if (work_pending(&wl->irq_work) || chip_awake)
+                pending = true;
+        else
+                wl->elp_compl = &compl;
+        spin_unlock_irqrestore(&wl->wl_lock, flags);
+
+        wl1271_write32(wl, HW_ACCESS_ELP_CTRL_REG_ADDR, ELPCTRL_WAKE_UP);
+
+        if (!pending) {
+                ret = wait_for_completion_timeout(
+                        &compl, msecs_to_jiffies(WL1271_WAKEUP_TIMEOUT));
+                if (ret == 0) {
+                        wl1271_error("ELP wakeup timeout!");
+                        ret = -ETIMEDOUT;
+                        goto err;
+                } else if (ret < 0) {
+                        wl1271_error("ELP wakeup completion error.");
+                        goto err;
+                }
+        }
+
+        wl->elp = false;
+
+        wl1271_debug(DEBUG_PSM, "wakeup time: %u ms",
+                     jiffies_to_msecs(jiffies - start_time));
+        goto out;
+
+err:
+        spin_lock_irqsave(&wl->wl_lock, flags);
+        wl->elp_compl = NULL;
+        spin_unlock_irqrestore(&wl->wl_lock, flags);
+        return ret;
+
+out:
+        return 0;
+}
+
+int wl1271_ps_set_mode(struct wl1271 *wl, enum wl1271_cmd_ps_mode mode)
+{
+        int ret;
+
+        switch (mode) {
+        case STATION_POWER_SAVE_MODE:
+                wl1271_debug(DEBUG_PSM, "entering psm");
+                ret = wl1271_cmd_ps_mode(wl, STATION_POWER_SAVE_MODE);
+                if (ret < 0)
+                        return ret;
+
+                wl1271_ps_elp_sleep(wl);
+                if (ret < 0)
+                        return ret;
+
+                wl->psm = 1;
+                break;
+        case STATION_ACTIVE_MODE:
+        default:
+                wl1271_debug(DEBUG_PSM, "leaving psm");
+                ret = wl1271_ps_elp_wakeup(wl, false);
+                if (ret < 0)
+                        return ret;
+
+                ret = wl1271_cmd_ps_mode(wl, STATION_ACTIVE_MODE);
+                if (ret < 0)
+                        return ret;
+
+                wl->psm = 0;
+                break;
+        }
+
+        return ret;
+}
+
+
diff --git a/drivers/net/wireless/wl12xx/wl1271_ps.h b/drivers/net/wireless/wl12xx/wl1271_ps.h
new file mode 100644
index 000000000000..de2bd3c7dc9c
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/wl1271_ps.h
@@ -0,0 +1,35 @@
+/*
+ * This file is part of wl1271
+ *
+ * Copyright (C) 2008-2009 Nokia Corporation
+ *
+ * Contact: Luciano Coelho <luciano.coelho@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#ifndef __WL1271_PS_H__
+#define __WL1271_PS_H__
+
+#include "wl1271.h"
+#include "wl1271_acx.h"
+
+int wl1271_ps_set_mode(struct wl1271 *wl, enum wl1271_cmd_ps_mode mode);
+void wl1271_ps_elp_sleep(struct wl1271 *wl);
+int wl1271_ps_elp_wakeup(struct wl1271 *wl, bool chip_awake);
+
+
+#endif /* __WL1271_PS_H__ */
diff --git a/drivers/net/wireless/wl12xx/reg.h b/drivers/net/wireless/wl12xx/wl1271_reg.h
index 2de47cc32b8b..f8ed4a4fc691 100644
--- a/drivers/net/wireless/wl12xx/reg.h
+++ b/drivers/net/wireless/wl12xx/wl1271_reg.h
@@ -1,10 +1,10 @@
 /*
  * This file is part of wl12xx
  *
- * Copyright (c) 1998-2007 Texas Instruments Incorporated
- * Copyright (C) 2008 Nokia Corporation
+ * Copyright (C) 1998-2009 Texas Instruments. All rights reserved.
+ * Copyright (C) 2009 Nokia Corporation
  *
- * Contact: Kalle Valo <kalle.valo@nokia.com>
+ * Contact: Luciano Coelho <luciano.coelho@nokia.com>
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
@@ -34,6 +34,7 @@
 #define REGISTERS_WORK_SIZE 0x0000b000
 
 #define HW_ACCESS_ELP_CTRL_REG_ADDR         0x1FFFC
+#define STATUS_MEM_ADDRESS                  0x40400
 
 /* ELP register commands */
 #define ELPCTRL_WAKE_UP             0x1
@@ -42,6 +43,25 @@
 /* ELP WLAN_READY bit */
 #define ELPCTRL_WLAN_READY          0x2
 
+/*===============================================
+   Host Software Reset - 32bit RW
+ ------------------------------------------
+    [31:1] Reserved
+    0  SOFT_RESET Soft Reset  - When this bit is set,
+    it holds the Wlan hardware in a soft reset state.
+    This reset disables all MAC and baseband processor
+    clocks except the CardBus/PCI interface clock.
+    It also initializes all MAC state machines except
+    the host interface. It does not reload the
+    contents of the EEPROM. When this bit is cleared
+    (not self-clearing), the Wlan hardware
+    exits the software reset state.
+===============================================*/
+#define ACX_REG_SLV_SOFT_RESET         (REGISTERS_BASE + 0x0000)
+
+#define WL1271_SLV_REG_DATA            (REGISTERS_BASE + 0x0008)
+#define WL1271_SLV_REG_ADATA           (REGISTERS_BASE + 0x000c)
+#define WL1271_SLV_MEM_DATA            (REGISTERS_BASE + 0x0018)
 /*
  * Interrupt registers.
  * 64 bit interrupt sources registers ws ced.
@@ -95,6 +115,9 @@
 #define HOST_MASK_CLR_L                (REGISTERS_BASE + 0x0440)
 #define HOST_MASK_CLR_H                (REGISTERS_BASE + 0x0444)
 
+#define ACX_REG_INTERRUPT_TRIG         (REGISTERS_BASE + 0x0474)
+#define ACX_REG_INTERRUPT_TRIG_H       (REGISTERS_BASE + 0x0478)
+
 /* Host Interrupts*/
 #define HINT_MASK                      (REGISTERS_BASE + 0x0494)
 #define HINT_MASK_SET                  (REGISTERS_BASE + 0x0498)
@@ -106,67 +129,6 @@
 #define HINT_ACK                       (REGISTERS_BASE + 0x04A8)
 #define HINT_TRIG                      (REGISTERS_BASE + 0x04AC)
 
-/* Device Configuration registers*/
-#define SOR_CFG                        (REGISTERS_BASE + 0x0800)
-#define ECPU_CTRL                      (REGISTERS_BASE + 0x0804)
-#define HI_CFG                         (REGISTERS_BASE + 0x0808)
-#define EE_START                       (REGISTERS_BASE + 0x080C)
-
-#define CHIP_ID_B                      (REGISTERS_BASE + 0x5674)
-
-#define CHIP_ID_1251_PG10                  (0x7010101)
-#define CHIP_ID_1251_PG11                  (0x7020101)
-#define CHIP_ID_1251_PG12                  (0x7030101)
-
-#define ENABLE                         (REGISTERS_BASE + 0x5450)
-
-/* Power Management registers */
-#define ELP_CFG_MODE                   (REGISTERS_BASE + 0x5804)
-#define ELP_CMD                        (REGISTERS_BASE + 0x5808)
-#define PLL_CAL_TIME                   (REGISTERS_BASE + 0x5810)
-#define CLK_REQ_TIME                   (REGISTERS_BASE + 0x5814)
-#define CLK_BUF_TIME                   (REGISTERS_BASE + 0x5818)
-
-#define CFG_PLL_SYNC_CNT               (REGISTERS_BASE + 0x5820)
-
-/* Scratch Pad registers*/
-#define SCR_PAD0                       (REGISTERS_BASE + 0x5608)
-#define SCR_PAD1                       (REGISTERS_BASE + 0x560C)
-#define SCR_PAD2                       (REGISTERS_BASE + 0x5610)
-#define SCR_PAD3                       (REGISTERS_BASE + 0x5614)
-#define SCR_PAD4                       (REGISTERS_BASE + 0x5618)
-#define SCR_PAD4_SET                   (REGISTERS_BASE + 0x561C)
-#define SCR_PAD4_CLR                   (REGISTERS_BASE + 0x5620)
-#define SCR_PAD5                       (REGISTERS_BASE + 0x5624)
-#define SCR_PAD5_SET                   (REGISTERS_BASE + 0x5628)
-#define SCR_PAD5_CLR                   (REGISTERS_BASE + 0x562C)
-#define SCR_PAD6                       (REGISTERS_BASE + 0x5630)
-#define SCR_PAD7                       (REGISTERS_BASE + 0x5634)
-#define SCR_PAD8                       (REGISTERS_BASE + 0x5638)
-#define SCR_PAD9                       (REGISTERS_BASE + 0x563C)
-
-/* Spare registers*/
-#define SPARE_A1                       (REGISTERS_BASE + 0x0994)
-#define SPARE_A2                       (REGISTERS_BASE + 0x0998)
-#define SPARE_A3                       (REGISTERS_BASE + 0x099C)
-#define SPARE_A4                       (REGISTERS_BASE + 0x09A0)
-#define SPARE_A5                       (REGISTERS_BASE + 0x09A4)
-#define SPARE_A6                       (REGISTERS_BASE + 0x09A8)
-#define SPARE_A7                       (REGISTERS_BASE + 0x09AC)
-#define SPARE_A8                       (REGISTERS_BASE + 0x09B0)
-#define SPARE_B1                       (REGISTERS_BASE + 0x5420)
-#define SPARE_B2                       (REGISTERS_BASE + 0x5424)
-#define SPARE_B3                       (REGISTERS_BASE + 0x5428)
-#define SPARE_B4                       (REGISTERS_BASE + 0x542C)
-#define SPARE_B5                       (REGISTERS_BASE + 0x5430)
-#define SPARE_B6                       (REGISTERS_BASE + 0x5434)
-#define SPARE_B7                       (REGISTERS_BASE + 0x5438)
-#define SPARE_B8                       (REGISTERS_BASE + 0x543C)
-
-enum wl12xx_acx_int_reg {
-        ACX_REG_INTERRUPT_TRIG,
-        ACX_REG_INTERRUPT_TRIG_H,
-
 /*=============================================
   Host Interrupt Mask Register - 32bit (RW)
   ------------------------------------------
@@ -195,7 +157,7 @@ enum wl12xx_acx_int_reg {
  21-                    -
  Default: 0x0001
 *==============================================*/
-        ACX_REG_INTERRUPT_MASK,
+#define ACX_REG_INTERRUPT_MASK         (REGISTERS_BASE + 0x04DC)
 
 /*=============================================
   Host Interrupt Mask Set 16bit, (Write only)
@@ -205,7 +167,7 @@ enum wl12xx_acx_int_reg {
  without effecting the mask
  state of other bits (0 = no effect).
 ==============================================*/
-        ACX_REG_HINT_MASK_SET,
+#define ACX_REG_HINT_MASK_SET          (REGISTERS_BASE + 0x04E0)
 
 /*=============================================
   Host Interrupt Mask Clear 16bit,(Write only)
@@ -215,7 +177,7 @@ enum wl12xx_acx_int_reg {
  without effecting the mask
  state of other bits (0 = no effect).
 =============================================*/
-        ACX_REG_HINT_MASK_CLR,
+#define ACX_REG_HINT_MASK_CLR          (REGISTERS_BASE + 0x04E4)
 
 /*=============================================
   Host Interrupt Status Nondestructive Read
@@ -226,7 +188,7 @@ enum wl12xx_acx_int_reg {
  Reading this register doesn't
  effect its content.
 =============================================*/
-        ACX_REG_INTERRUPT_NO_CLEAR,
+#define ACX_REG_INTERRUPT_NO_CLEAR     (REGISTERS_BASE + 0x04E8)
 
 /*=============================================
   Host Interrupt Status Clear on Read  Register
@@ -237,7 +199,7 @@ enum wl12xx_acx_int_reg {
  Reading this register clears it,
  thus making all interrupts inactive.
 ==============================================*/
-        ACX_REG_INTERRUPT_CLEAR,
+#define ACX_REG_INTERRUPT_CLEAR        (REGISTERS_BASE + 0x04F8)
 
 /*=============================================
   Host Interrupt Acknowledge Register
@@ -249,40 +211,13 @@ enum wl12xx_acx_int_reg {
  HINT_STS_ND registers, thus making the
  assotiated interrupt inactive. (0-no effect)
 ==============================================*/
-        ACX_REG_INTERRUPT_ACK,
+#define ACX_REG_INTERRUPT_ACK          (REGISTERS_BASE + 0x04F0)
 
-/*===============================================
-   Host Software Reset - 32bit RW
- ------------------------------------------
-    [31:1] Reserved
-    0  SOFT_RESET Soft Reset  - When this bit is set,
-    it holds the Wlan hardware in a soft reset state.
-    This reset disables all MAC and baseband processor
-    clocks except the CardBus/PCI interface clock.
-    It also initializes all MAC state machines except
-    the host interface. It does not reload the
-    contents of the EEPROM. When this bit is cleared
-    (not self-clearing), the Wlan hardware
-    exits the software reset state.
-===============================================*/
-        ACX_REG_SLV_SOFT_RESET,
-
-/*===============================================
- EEPROM Burst Read Start  - 32bit RW
- ------------------------------------------
- [31:1] Reserved
- 0  ACX_EE_START -  EEPROM Burst Read Start 0
- Setting this bit starts a burst read from
- the external EEPROM.
- If this bit is set (after reset) before an EEPROM read/write,
- the burst read starts at EEPROM address 0.
- Otherwise, it starts at the address
- following the address of the previous access.
- TheWlan hardware hardware clears this bit automatically.
+#define RX_DRIVER_DUMMY_WRITE_ADDRESS  (REGISTERS_BASE + 0x0534)
+#define RX_DRIVER_COUNTER_ADDRESS      (REGISTERS_BASE + 0x0538)
 
- Default: 0x00000000
-*================================================*/
-        ACX_REG_EE_START,
+/* Device Configuration registers*/
+#define SOR_CFG                        (REGISTERS_BASE + 0x0800)
 
 /* Embedded ARM CPU Control */
 
@@ -304,10 +239,89 @@ enum wl12xx_acx_int_reg {
  1 halt eCPU
  0 enable eCPU
  ===============================================*/
-        ACX_REG_ECPU_CONTROL,
+#define ACX_REG_ECPU_CONTROL           (REGISTERS_BASE + 0x0804)
+
+#define HI_CFG                         (REGISTERS_BASE + 0x0808)
+
+/*===============================================
+ EEPROM Burst Read Start  - 32bit RW
+ ------------------------------------------
+ [31:1] Reserved
+ 0  ACX_EE_START -  EEPROM Burst Read Start 0
+ Setting this bit starts a burst read from
+ the external EEPROM.
+ If this bit is set (after reset) before an EEPROM read/write,
+ the burst read starts at EEPROM address 0.
+ Otherwise, it starts at the address
+ following the address of the previous access.
+ TheWlan hardware hardware clears this bit automatically.
+
+ Default: 0x00000000
+*================================================*/
+#define ACX_REG_EE_START               (REGISTERS_BASE + 0x080C)
+
+#define OCP_POR_CTR                    (REGISTERS_BASE + 0x09B4)
+#define OCP_DATA_WRITE                 (REGISTERS_BASE + 0x09B8)
+#define OCP_DATA_READ                  (REGISTERS_BASE + 0x09BC)
+#define OCP_CMD                        (REGISTERS_BASE + 0x09C0)
+
+#define WL1271_HOST_WR_ACCESS          (REGISTERS_BASE + 0x09F8)
+
+#define CHIP_ID_B                      (REGISTERS_BASE + 0x5674)
+
+#define CHIP_ID_1271_PG10              (0x4030101)
+#define CHIP_ID_1271_PG20              (0x4030111)
+
+#define ENABLE                         (REGISTERS_BASE + 0x5450)
+
+/* Power Management registers */
+#define ELP_CFG_MODE                   (REGISTERS_BASE + 0x5804)
+#define ELP_CMD                        (REGISTERS_BASE + 0x5808)
+#define PLL_CAL_TIME                   (REGISTERS_BASE + 0x5810)
+#define CLK_REQ_TIME                   (REGISTERS_BASE + 0x5814)
+#define CLK_BUF_TIME                   (REGISTERS_BASE + 0x5818)
+
+#define CFG_PLL_SYNC_CNT               (REGISTERS_BASE + 0x5820)
+
+/* Scratch Pad registers*/
+#define SCR_PAD0                       (REGISTERS_BASE + 0x5608)
+#define SCR_PAD1                       (REGISTERS_BASE + 0x560C)
+#define SCR_PAD2                       (REGISTERS_BASE + 0x5610)
+#define SCR_PAD3                       (REGISTERS_BASE + 0x5614)
+#define SCR_PAD4                       (REGISTERS_BASE + 0x5618)
+#define SCR_PAD4_SET                   (REGISTERS_BASE + 0x561C)
+#define SCR_PAD4_CLR                   (REGISTERS_BASE + 0x5620)
+#define SCR_PAD5                       (REGISTERS_BASE + 0x5624)
+#define SCR_PAD5_SET                   (REGISTERS_BASE + 0x5628)
+#define SCR_PAD5_CLR                   (REGISTERS_BASE + 0x562C)
+#define SCR_PAD6                       (REGISTERS_BASE + 0x5630)
+#define SCR_PAD7                       (REGISTERS_BASE + 0x5634)
+#define SCR_PAD8                       (REGISTERS_BASE + 0x5638)
+#define SCR_PAD9                       (REGISTERS_BASE + 0x563C)
+
+/* Spare registers*/
+#define SPARE_A1                       (REGISTERS_BASE + 0x0994)
+#define SPARE_A2                       (REGISTERS_BASE + 0x0998)
+#define SPARE_A3                       (REGISTERS_BASE + 0x099C)
+#define SPARE_A4                       (REGISTERS_BASE + 0x09A0)
+#define SPARE_A5                       (REGISTERS_BASE + 0x09A4)
+#define SPARE_A6                       (REGISTERS_BASE + 0x09A8)
+#define SPARE_A7                       (REGISTERS_BASE + 0x09AC)
+#define SPARE_A8                       (REGISTERS_BASE + 0x09B0)
+#define SPARE_B1                       (REGISTERS_BASE + 0x5420)
+#define SPARE_B2                       (REGISTERS_BASE + 0x5424)
+#define SPARE_B3                       (REGISTERS_BASE + 0x5428)
+#define SPARE_B4                       (REGISTERS_BASE + 0x542C)
+#define SPARE_B5                       (REGISTERS_BASE + 0x5430)
+#define SPARE_B6                       (REGISTERS_BASE + 0x5434)
+#define SPARE_B7                       (REGISTERS_BASE + 0x5438)
+#define SPARE_B8                       (REGISTERS_BASE + 0x543C)
+
+#define PLL_PARAMETERS                 (REGISTERS_BASE + 0x6040)
+#define WU_COUNTER_PAUSE               (REGISTERS_BASE + 0x6008)
+#define WELP_ARM_COMMAND               (REGISTERS_BASE + 0x6100)
+#define DRPW_SCRATCH_START             (DRPW_BASE + 0x002C)
 
-        ACX_REG_TABLE_LEN
-};
 
 #define ACX_SLV_SOFT_RESET_BIT   BIT(1)
 #define ACX_REG_EEPROM_START_BIT BIT(1)
diff --git a/drivers/net/wireless/wl12xx/wl1271_rx.c b/drivers/net/wireless/wl12xx/wl1271_rx.c
new file mode 100644
index 000000000000..ad8b6904c5eb
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/wl1271_rx.c
@@ -0,0 +1,200 @@
+/*
+ * This file is part of wl1271
+ *
+ * Copyright (C) 2009 Nokia Corporation
+ *
+ * Contact: Luciano Coelho <luciano.coelho@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#include "wl1271.h"
+#include "wl1271_acx.h"
+#include "wl1271_reg.h"
+#include "wl1271_rx.h"
+#include "wl1271_spi.h"
+
+static u8 wl1271_rx_get_mem_block(struct wl1271_fw_status *status,
+                                  u32 drv_rx_counter)
+{
+        return status->rx_pkt_descs[drv_rx_counter] & RX_MEM_BLOCK_MASK;
+}
+
+static u32 wl1271_rx_get_buf_size(struct wl1271_fw_status *status,
+                                 u32 drv_rx_counter)
+{
+        return (status->rx_pkt_descs[drv_rx_counter] & RX_BUF_SIZE_MASK) >>
+                RX_BUF_SIZE_SHIFT_DIV;
+}
+
+/* The values of this table must match the wl1271_rates[] array */
+static u8 wl1271_rx_rate_to_idx[] = {
+        /* MCS rates are used only with 11n */
+        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS7 */
+        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS6 */
+        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS5 */
+        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS4 */
+        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS3 */
+        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS2 */
+        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS1 */
+        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS0 */
+
+        11,                         /* WL1271_RATE_54   */
+        10,                         /* WL1271_RATE_48   */
+        9,                          /* WL1271_RATE_36   */
+        8,                          /* WL1271_RATE_24   */
+
+        /* TI-specific rate */
+        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_22   */
+
+        7,                          /* WL1271_RATE_18   */
+        6,                          /* WL1271_RATE_12   */
+        3,                          /* WL1271_RATE_11   */
+        5,                          /* WL1271_RATE_9    */
+        4,                          /* WL1271_RATE_6    */
+        2,                          /* WL1271_RATE_5_5  */
+        1,                          /* WL1271_RATE_2    */
+        0                           /* WL1271_RATE_1    */
+};
+
+static void wl1271_rx_status(struct wl1271 *wl,
+                             struct wl1271_rx_descriptor *desc,
+                             struct ieee80211_rx_status *status,
+                             u8 beacon)
+{
+        memset(status, 0, sizeof(struct ieee80211_rx_status));
+
+        if ((desc->flags & WL1271_RX_DESC_BAND_MASK) == WL1271_RX_DESC_BAND_BG)
+                status->band = IEEE80211_BAND_2GHZ;
+        else
+                wl1271_warning("unsupported band 0x%x",
+                               desc->flags & WL1271_RX_DESC_BAND_MASK);
+
+        /*
+         * FIXME: Add mactime handling.  For IBSS (ad-hoc) we need to get the
+         * timestamp from the beacon (acx_tsf_info).  In BSS mode (infra) we
+         * only need the mactime for monitor mode.  For now the mactime is
+         * not valid, so RX_FLAG_TSFT should not be set
+         */
+        status->signal = desc->rssi;
+
+        /* FIXME: Should this be optimized? */
+        status->qual = (desc->rssi - WL1271_RX_MIN_RSSI) * 100 /
+                (WL1271_RX_MAX_RSSI - WL1271_RX_MIN_RSSI);
+        status->qual = min(status->qual, 100);
+        status->qual = max(status->qual, 0);
+
+        /*
+         * FIXME: In wl1251, the SNR should be divided by two.  In wl1271 we
+         * need to divide by two for now, but TI has been discussing about
+         * changing it.  This needs to be rechecked.
+         */
+        status->noise = desc->rssi - (desc->snr >> 1);
+
+        status->freq = ieee80211_channel_to_frequency(desc->channel);
+
+        if (desc->flags & WL1271_RX_DESC_ENCRYPT_MASK) {
+                status->flag |= RX_FLAG_IV_STRIPPED | RX_FLAG_MMIC_STRIPPED;
+
+                if (likely(!(desc->flags & WL1271_RX_DESC_DECRYPT_FAIL)))
+                        status->flag |= RX_FLAG_DECRYPTED;
+
+                if (unlikely(desc->flags & WL1271_RX_DESC_MIC_FAIL))
+                        status->flag |= RX_FLAG_MMIC_ERROR;
+        }
+
+        status->rate_idx = wl1271_rx_rate_to_idx[desc->rate];
+
+        if (status->rate_idx == WL1271_RX_RATE_UNSUPPORTED)
+                wl1271_warning("unsupported rate");
+}
+
+static void wl1271_rx_handle_data(struct wl1271 *wl, u32 length)
+{
+        struct ieee80211_rx_status rx_status;
+        struct wl1271_rx_descriptor *desc;
+        struct sk_buff *skb;
+        u16 *fc;
+        u8 *buf;
+        u8 beacon = 0;
+
+        skb = dev_alloc_skb(length);
+        if (!skb) {
+                wl1271_error("Couldn't allocate RX frame");
+                return;
+        }
+
+        buf = skb_put(skb, length);
+        wl1271_spi_reg_read(wl, WL1271_SLV_MEM_DATA, buf, length, true);
+
+        /* the data read starts with the descriptor */
+        desc = (struct wl1271_rx_descriptor *) buf;
+
+        /* now we pull the descriptor out of the buffer */
+        skb_pull(skb, sizeof(*desc));
+
+        fc = (u16 *)skb->data;
+        if ((*fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_BEACON)
+                beacon = 1;
+
+        wl1271_rx_status(wl, desc, &rx_status, beacon);
+
+        wl1271_debug(DEBUG_RX, "rx skb 0x%p: %d B %s", skb, skb->len,
+                     beacon ? "beacon" : "");
+
+        memcpy(IEEE80211_SKB_RXCB(skb), &rx_status, sizeof(rx_status));
+        ieee80211_rx(wl->hw, skb);
+}
+
+void wl1271_rx(struct wl1271 *wl, struct wl1271_fw_status *status)
+{
+        struct wl1271_acx_mem_map *wl_mem_map = wl->target_mem_map;
+        u32 buf_size;
+        u32 fw_rx_counter  = status->fw_rx_counter & NUM_RX_PKT_DESC_MOD_MASK;
+        u32 drv_rx_counter = wl->rx_counter & NUM_RX_PKT_DESC_MOD_MASK;
+        u32 mem_block;
+
+        while (drv_rx_counter != fw_rx_counter) {
+                mem_block = wl1271_rx_get_mem_block(status, drv_rx_counter);
+                buf_size = wl1271_rx_get_buf_size(status, drv_rx_counter);
+
+                if (buf_size == 0) {
+                        wl1271_warning("received empty data");
+                        break;
+                }
+
+                wl->rx_mem_pool_addr.addr =
+                        (mem_block << 8) + wl_mem_map->packet_memory_pool_start;
+                wl->rx_mem_pool_addr.addr_extra =
+                        wl->rx_mem_pool_addr.addr + 4;
+
+                /* Choose the block we want to read */
+                wl1271_spi_reg_write(wl, WL1271_SLV_REG_DATA,
+                                     &wl->rx_mem_pool_addr,
+                                     sizeof(wl->rx_mem_pool_addr), false);
+
+                wl1271_rx_handle_data(wl, buf_size);
+
+                wl->rx_counter++;
+                drv_rx_counter = wl->rx_counter & NUM_RX_PKT_DESC_MOD_MASK;
+        }
+
+        wl1271_reg_write32(wl, RX_DRIVER_COUNTER_ADDRESS, wl->rx_counter);
+
+        /* This is a workaround for some problems in the chip */
+        wl1271_reg_write32(wl, RX_DRIVER_DUMMY_WRITE_ADDRESS, 0x1);
+
+}
diff --git a/drivers/net/wireless/wl12xx/wl1271_rx.h b/drivers/net/wireless/wl12xx/wl1271_rx.h
new file mode 100644
index 000000000000..d1ca60e43a25
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/wl1271_rx.h
@@ -0,0 +1,121 @@
+/*
+ * This file is part of wl1271
+ *
+ * Copyright (C) 1998-2009 Texas Instruments. All rights reserved.
+ * Copyright (C) 2008-2009 Nokia Corporation
+ *
+ * Contact: Luciano Coelho <luciano.coelho@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#ifndef __WL1271_RX_H__
+#define __WL1271_RX_H__
+
+#include <linux/bitops.h>
+
+#define WL1271_RX_MAX_RSSI -30
+#define WL1271_RX_MIN_RSSI -95
+
+#define WL1271_RX_ALIGN_TO 4
+#define WL1271_RX_ALIGN(len) (((len) + WL1271_RX_ALIGN_TO - 1) & \
+                             ~(WL1271_RX_ALIGN_TO - 1))
+
+#define SHORT_PREAMBLE_BIT   BIT(0)
+#define OFDM_RATE_BIT        BIT(6)
+#define PBCC_RATE_BIT        BIT(7)
+
+#define PLCP_HEADER_LENGTH 8
+#define RX_DESC_PACKETID_SHIFT 11
+#define RX_MAX_PACKET_ID 3
+
+#define NUM_RX_PKT_DESC_MOD_MASK   7
+#define WL1271_RX_RATE_UNSUPPORTED 0xFF
+
+#define RX_DESC_VALID_FCS         0x0001
+#define RX_DESC_MATCH_RXADDR1     0x0002
+#define RX_DESC_MCAST             0x0004
+#define RX_DESC_STAINTIM          0x0008
+#define RX_DESC_VIRTUAL_BM        0x0010
+#define RX_DESC_BCAST             0x0020
+#define RX_DESC_MATCH_SSID        0x0040
+#define RX_DESC_MATCH_BSSID       0x0080
+#define RX_DESC_ENCRYPTION_MASK   0x0300
+#define RX_DESC_MEASURMENT        0x0400
+#define RX_DESC_SEQNUM_MASK       0x1800
+#define RX_DESC_MIC_FAIL          0x2000
+#define RX_DESC_DECRYPT_FAIL      0x4000
+
+/*
+ * RX Descriptor flags:
+ *
+ * Bits 0-1 - band
+ * Bit  2   - STBC
+ * Bit  3   - A-MPDU
+ * Bit  4   - HT
+ * Bits 5-7 - encryption
+ */
+#define WL1271_RX_DESC_BAND_MASK    0x03
+#define WL1271_RX_DESC_ENCRYPT_MASK 0xE0
+
+#define WL1271_RX_DESC_BAND_BG      0x00
+#define WL1271_RX_DESC_BAND_J       0x01
+#define WL1271_RX_DESC_BAND_A       0x02
+
+#define WL1271_RX_DESC_STBC         BIT(2)
+#define WL1271_RX_DESC_A_MPDU       BIT(3)
+#define WL1271_RX_DESC_HT           BIT(4)
+
+#define WL1271_RX_DESC_ENCRYPT_WEP  0x20
+#define WL1271_RX_DESC_ENCRYPT_TKIP 0x40
+#define WL1271_RX_DESC_ENCRYPT_AES  0x60
+#define WL1271_RX_DESC_ENCRYPT_GEM  0x80
+
+/*
+ * RX Descriptor status
+ *
+ * Bits 0-2 - status
+ * Bits 3-7 - reserved
+ */
+#define WL1271_RX_DESC_STATUS_MASK      0x07
+
+#define WL1271_RX_DESC_SUCCESS          0x00
+#define WL1271_RX_DESC_DECRYPT_FAIL     0x01
+#define WL1271_RX_DESC_MIC_FAIL         0x02
+#define WL1271_RX_DESC_DRIVER_RX_Q_FAIL 0x03
+
+#define RX_MEM_BLOCK_MASK     0xFF
+#define RX_BUF_SIZE_MASK      0xFFF00
+#define RX_BUF_SIZE_SHIFT_DIV 6
+
+struct wl1271_rx_descriptor {
+        u16 length;
+        u8  status;
+        u8  flags;
+        u8  rate;
+        u8  channel;
+        s8  rssi;
+        u8  snr;
+        u32 timestamp;
+        u8  packet_class;
+        u8  process_id;
+        u8  pad_len;
+        u8  reserved;
+} __attribute__ ((packed));
+
+void wl1271_rx(struct wl1271 *wl, struct wl1271_fw_status *status);
+
+#endif
diff --git a/drivers/net/wireless/wl12xx/wl1271_spi.c b/drivers/net/wireless/wl12xx/wl1271_spi.c
new file mode 100644
index 000000000000..4a12880c16a8
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/wl1271_spi.c
@@ -0,0 +1,382 @@
+/*
+ * This file is part of wl1271
+ *
+ * Copyright (C) 2008-2009 Nokia Corporation
+ *
+ * Contact: Luciano Coelho <luciano.coelho@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/crc7.h>
+#include <linux/spi/spi.h>
+
+#include "wl1271.h"
+#include "wl12xx_80211.h"
+#include "wl1271_spi.h"
+
+static int wl1271_translate_reg_addr(struct wl1271 *wl, int addr)
+{
+        return addr - wl->physical_reg_addr + wl->virtual_reg_addr;
+}
+
+static int wl1271_translate_mem_addr(struct wl1271 *wl, int addr)
+{
+        return addr - wl->physical_mem_addr + wl->virtual_mem_addr;
+}
+
+
+void wl1271_spi_reset(struct wl1271 *wl)
+{
+        u8 *cmd;
+        struct spi_transfer t;
+        struct spi_message m;
+
+        cmd = kzalloc(WSPI_INIT_CMD_LEN, GFP_KERNEL);
+        if (!cmd) {
+                wl1271_error("could not allocate cmd for spi reset");
+                return;
+        }
+
+        memset(&t, 0, sizeof(t));
+        spi_message_init(&m);
+
+        memset(cmd, 0xff, WSPI_INIT_CMD_LEN);
+
+        t.tx_buf = cmd;
+        t.len = WSPI_INIT_CMD_LEN;
+        spi_message_add_tail(&t, &m);
+
+        spi_sync(wl->spi, &m);
+
+        wl1271_dump(DEBUG_SPI, "spi reset -> ", cmd, WSPI_INIT_CMD_LEN);
+}
+
+void wl1271_spi_init(struct wl1271 *wl)
+{
+        u8 crc[WSPI_INIT_CMD_CRC_LEN], *cmd;
+        struct spi_transfer t;
+        struct spi_message m;
+
+        cmd = kzalloc(WSPI_INIT_CMD_LEN, GFP_KERNEL);
+        if (!cmd) {
+                wl1271_error("could not allocate cmd for spi init");
+                return;
+        }
+
+        memset(crc, 0, sizeof(crc));
+        memset(&t, 0, sizeof(t));
+        spi_message_init(&m);
+
+        /*
+         * Set WSPI_INIT_COMMAND
+         * the data is being send from the MSB to LSB
+         */
+        cmd[2] = 0xff;
+        cmd[3] = 0xff;
+        cmd[1] = WSPI_INIT_CMD_START | WSPI_INIT_CMD_TX;
+        cmd[0] = 0;
+        cmd[7] = 0;
+        cmd[6] |= HW_ACCESS_WSPI_INIT_CMD_MASK << 3;
+        cmd[6] |= HW_ACCESS_WSPI_FIXED_BUSY_LEN & WSPI_INIT_CMD_FIXEDBUSY_LEN;
+
+        if (HW_ACCESS_WSPI_FIXED_BUSY_LEN == 0)
+                cmd[5] |=  WSPI_INIT_CMD_DIS_FIXEDBUSY;
+        else
+                cmd[5] |= WSPI_INIT_CMD_EN_FIXEDBUSY;
+
+        cmd[5] |= WSPI_INIT_CMD_IOD | WSPI_INIT_CMD_IP | WSPI_INIT_CMD_CS
+                | WSPI_INIT_CMD_WSPI | WSPI_INIT_CMD_WS;
+
+        crc[0] = cmd[1];
+        crc[1] = cmd[0];
+        crc[2] = cmd[7];
+        crc[3] = cmd[6];
+        crc[4] = cmd[5];
+
+        cmd[4] |= crc7(0, crc, WSPI_INIT_CMD_CRC_LEN) << 1;
+        cmd[4] |= WSPI_INIT_CMD_END;
+
+        t.tx_buf = cmd;
+        t.len = WSPI_INIT_CMD_LEN;
+        spi_message_add_tail(&t, &m);
+
+        spi_sync(wl->spi, &m);
+
+        wl1271_dump(DEBUG_SPI, "spi init -> ", cmd, WSPI_INIT_CMD_LEN);
+}
+
+/* Set the SPI partitions to access the chip addresses
+ *
+ * There are two VIRTUAL (SPI) partitions (the memory partition and the
+ * registers partition), which are mapped to two different areas of the
+ * PHYSICAL (hardware) memory.  This function also makes other checks to
+ * ensure that the partitions are not overlapping.  In the diagram below, the
+ * memory partition comes before the register partition, but the opposite is
+ * also supported.
+ *
+ *                               PHYSICAL address
+ *                                     space
+ *
+ *                                    |    |
+ *                                 ...+----+--> mem_start
+ *          VIRTUAL address     ...   |    |
+ *               space       ...      |    | [PART_0]
+ *                        ...         |    |
+ * 0x00000000 <--+----+...         ...+----+--> mem_start + mem_size
+ *               |    |         ...   |    |
+ *               |MEM |      ...      |    |
+ *               |    |   ...         |    |
+ *  part_size <--+----+...            |    | {unused area)
+ *               |    |   ...         |    |
+ *               |REG |      ...      |    |
+ *  part_size    |    |         ...   |    |
+ *      +     <--+----+...         ...+----+--> reg_start
+ *  reg_size              ...         |    |
+ *                           ...      |    | [PART_1]
+ *                              ...   |    |
+ *                                 ...+----+--> reg_start + reg_size
+ *                                    |    |
+ *
+ */
+int wl1271_set_partition(struct wl1271 *wl,
+                          u32 mem_start, u32 mem_size,
+                          u32 reg_start, u32 reg_size)
+{
+        struct wl1271_partition *partition;
+        struct spi_transfer t;
+        struct spi_message m;
+        size_t len, cmd_len;
+        u32 *cmd;
+        int addr;
+
+        cmd_len = sizeof(u32) + 2 * sizeof(struct wl1271_partition);
+        cmd = kzalloc(cmd_len, GFP_KERNEL);
+        if (!cmd)
+                return -ENOMEM;
+
+        spi_message_init(&m);
+        memset(&t, 0, sizeof(t));
+
+        partition = (struct wl1271_partition *) (cmd + 1);
+        addr = HW_ACCESS_PART0_SIZE_ADDR;
+        len = 2 * sizeof(struct wl1271_partition);
+
+        *cmd |= WSPI_CMD_WRITE;
+        *cmd |= (len << WSPI_CMD_BYTE_LENGTH_OFFSET) & WSPI_CMD_BYTE_LENGTH;
+        *cmd |= addr & WSPI_CMD_BYTE_ADDR;
+
+        wl1271_debug(DEBUG_SPI, "mem_start %08X mem_size %08X",
+                     mem_start, mem_size);
+        wl1271_debug(DEBUG_SPI, "reg_start %08X reg_size %08X",
+                     reg_start, reg_size);
+
+        /* Make sure that the two partitions together don't exceed the
+         * address range */
+        if ((mem_size + reg_size) > HW_ACCESS_MEMORY_MAX_RANGE) {
+                wl1271_debug(DEBUG_SPI, "Total size exceeds maximum virtual"
+                             " address range.  Truncating partition[0].");
+                mem_size = HW_ACCESS_MEMORY_MAX_RANGE - reg_size;
+                wl1271_debug(DEBUG_SPI, "mem_start %08X mem_size %08X",
+                             mem_start, mem_size);
+                wl1271_debug(DEBUG_SPI, "reg_start %08X reg_size %08X",
+                             reg_start, reg_size);
+        }
+
+        if ((mem_start < reg_start) &&
+            ((mem_start + mem_size) > reg_start)) {
+                /* Guarantee that the memory partition doesn't overlap the
+                 * registers partition */
+                wl1271_debug(DEBUG_SPI, "End of partition[0] is "
+                             "overlapping partition[1].  Adjusted.");
+                mem_size = reg_start - mem_start;
+                wl1271_debug(DEBUG_SPI, "mem_start %08X mem_size %08X",
+                             mem_start, mem_size);
+                wl1271_debug(DEBUG_SPI, "reg_start %08X reg_size %08X",
+                             reg_start, reg_size);
+        } else if ((reg_start < mem_start) &&
+                   ((reg_start + reg_size) > mem_start)) {
+                /* Guarantee that the register partition doesn't overlap the
+                 * memory partition */
+                wl1271_debug(DEBUG_SPI, "End of partition[1] is"
+                             " overlapping partition[0].  Adjusted.");
+                reg_size = mem_start - reg_start;
+                wl1271_debug(DEBUG_SPI, "mem_start %08X mem_size %08X",
+                             mem_start, mem_size);
+                wl1271_debug(DEBUG_SPI, "reg_start %08X reg_size %08X",
+                             reg_start, reg_size);
+        }
+
+        partition[0].start = mem_start;
+        partition[0].size  = mem_size;
+        partition[1].start = reg_start;
+        partition[1].size  = reg_size;
+
+        wl->physical_mem_addr = mem_start;
+        wl->physical_reg_addr = reg_start;
+
+        wl->virtual_mem_addr = 0;
+        wl->virtual_reg_addr = mem_size;
+
+        t.tx_buf = cmd;
+        t.len = cmd_len;
+        spi_message_add_tail(&t, &m);
+
+        spi_sync(wl->spi, &m);
+
+        kfree(cmd);
+
+        return 0;
+}
+
+void wl1271_spi_read(struct wl1271 *wl, int addr, void *buf,
+                     size_t len, bool fixed)
+{
+        struct spi_transfer t[3];
+        struct spi_message m;
+        u8 *busy_buf;
+        u32 *cmd;
+
+        cmd = &wl->buffer_cmd;
+        busy_buf = wl->buffer_busyword;
+
+        *cmd = 0;
+        *cmd |= WSPI_CMD_READ;
+        *cmd |= (len << WSPI_CMD_BYTE_LENGTH_OFFSET) & WSPI_CMD_BYTE_LENGTH;
+        *cmd |= addr & WSPI_CMD_BYTE_ADDR;
+
+        if (fixed)
+                *cmd |= WSPI_CMD_FIXED;
+
+        spi_message_init(&m);
+        memset(t, 0, sizeof(t));
+
+        t[0].tx_buf = cmd;
+        t[0].len = 4;
+        spi_message_add_tail(&t[0], &m);
+
+        /* Busy and non busy words read */
+        t[1].rx_buf = busy_buf;
+        t[1].len = WL1271_BUSY_WORD_LEN;
+        spi_message_add_tail(&t[1], &m);
+
+        t[2].rx_buf = buf;
+        t[2].len = len;
+        spi_message_add_tail(&t[2], &m);
+
+        spi_sync(wl->spi, &m);
+
+        /* FIXME: check busy words */
+
+        wl1271_dump(DEBUG_SPI, "spi_read cmd -> ", cmd, sizeof(*cmd));
+        wl1271_dump(DEBUG_SPI, "spi_read buf <- ", buf, len);
+}
+
+void wl1271_spi_write(struct wl1271 *wl, int addr, void *buf,
+                      size_t len, bool fixed)
+{
+        struct spi_transfer t[2];
+        struct spi_message m;
+        u32 *cmd;
+
+        cmd = &wl->buffer_cmd;
+
+        *cmd = 0;
+        *cmd |= WSPI_CMD_WRITE;
+        *cmd |= (len << WSPI_CMD_BYTE_LENGTH_OFFSET) & WSPI_CMD_BYTE_LENGTH;
+        *cmd |= addr & WSPI_CMD_BYTE_ADDR;
+
+        if (fixed)
+                *cmd |= WSPI_CMD_FIXED;
+
+        spi_message_init(&m);
+        memset(t, 0, sizeof(t));
+
+        t[0].tx_buf = cmd;
+        t[0].len = sizeof(*cmd);
+        spi_message_add_tail(&t[0], &m);
+
+        t[1].tx_buf = buf;
+        t[1].len = len;
+        spi_message_add_tail(&t[1], &m);
+
+        spi_sync(wl->spi, &m);
+
+        wl1271_dump(DEBUG_SPI, "spi_write cmd -> ", cmd, sizeof(*cmd));
+        wl1271_dump(DEBUG_SPI, "spi_write buf -> ", buf, len);
+}
+
+void wl1271_spi_mem_read(struct wl1271 *wl, int addr, void *buf,
+                         size_t len)
+{
+        int physical;
+
+        physical = wl1271_translate_mem_addr(wl, addr);
+
+        wl1271_spi_read(wl, physical, buf, len, false);
+}
+
+void wl1271_spi_mem_write(struct wl1271 *wl, int addr, void *buf,
+                          size_t len)
+{
+        int physical;
+
+        physical = wl1271_translate_mem_addr(wl, addr);
+
+        wl1271_spi_write(wl, physical, buf, len, false);
+}
+
+void wl1271_spi_reg_read(struct wl1271 *wl, int addr, void *buf, size_t len,
+                         bool fixed)
+{
+        int physical;
+
+        physical = wl1271_translate_reg_addr(wl, addr);
+
+        wl1271_spi_read(wl, physical, buf, len, fixed);
+}
+
+void wl1271_spi_reg_write(struct wl1271 *wl, int addr, void *buf, size_t len,
+                          bool fixed)
+{
+        int physical;
+
+        physical = wl1271_translate_reg_addr(wl, addr);
+
+        wl1271_spi_write(wl, physical, buf, len, fixed);
+}
+
+u32 wl1271_mem_read32(struct wl1271 *wl, int addr)
+{
+        return wl1271_read32(wl, wl1271_translate_mem_addr(wl, addr));
+}
+
+void wl1271_mem_write32(struct wl1271 *wl, int addr, u32 val)
+{
+        wl1271_write32(wl, wl1271_translate_mem_addr(wl, addr), val);
+}
+
+u32 wl1271_reg_read32(struct wl1271 *wl, int addr)
+{
+        return wl1271_read32(wl, wl1271_translate_reg_addr(wl, addr));
+}
+
+void wl1271_reg_write32(struct wl1271 *wl, int addr, u32 val)
+{
+        wl1271_write32(wl, wl1271_translate_reg_addr(wl, addr), val);
+}
diff --git a/drivers/net/wireless/wl12xx/wl1271_spi.h b/drivers/net/wireless/wl12xx/wl1271_spi.h
new file mode 100644
index 000000000000..2c9968458646
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/wl1271_spi.h
@@ -0,0 +1,113 @@
+/*
+ * This file is part of wl1271
+ *
+ * Copyright (C) 1998-2009 Texas Instruments. All rights reserved.
+ * Copyright (C) 2008-2009 Nokia Corporation
+ *
+ * Contact: Luciano Coelho <luciano.coelho@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#ifndef __WL1271_SPI_H__
+#define __WL1271_SPI_H__
+
+#include "wl1271_reg.h"
+
+#define HW_ACCESS_MEMORY_MAX_RANGE              0x1FFC0
+
+#define HW_ACCESS_PART0_SIZE_ADDR           0x1FFC0
+#define HW_ACCESS_PART0_START_ADDR          0x1FFC4
+#define HW_ACCESS_PART1_SIZE_ADDR           0x1FFC8
+#define HW_ACCESS_PART1_START_ADDR          0x1FFCC
+
+#define HW_ACCESS_REGISTER_SIZE             4
+
+#define HW_ACCESS_PRAM_MAX_RANGE                0x3c000
+
+#define WSPI_CMD_READ                 0x40000000
+#define WSPI_CMD_WRITE                0x00000000
+#define WSPI_CMD_FIXED                0x20000000
+#define WSPI_CMD_BYTE_LENGTH          0x1FFE0000
+#define WSPI_CMD_BYTE_LENGTH_OFFSET   17
+#define WSPI_CMD_BYTE_ADDR            0x0001FFFF
+
+#define WSPI_INIT_CMD_CRC_LEN       5
+
+#define WSPI_INIT_CMD_START         0x00
+#define WSPI_INIT_CMD_TX            0x40
+/* the extra bypass bit is sampled by the TNET as '1' */
+#define WSPI_INIT_CMD_BYPASS_BIT    0x80
+#define WSPI_INIT_CMD_FIXEDBUSY_LEN 0x07
+#define WSPI_INIT_CMD_EN_FIXEDBUSY  0x80
+#define WSPI_INIT_CMD_DIS_FIXEDBUSY 0x00
+#define WSPI_INIT_CMD_IOD           0x40
+#define WSPI_INIT_CMD_IP            0x20
+#define WSPI_INIT_CMD_CS            0x10
+#define WSPI_INIT_CMD_WS            0x08
+#define WSPI_INIT_CMD_WSPI          0x01
+#define WSPI_INIT_CMD_END           0x01
+
+#define WSPI_INIT_CMD_LEN           8
+
+#define HW_ACCESS_WSPI_FIXED_BUSY_LEN \
+                ((WL1271_BUSY_WORD_LEN - 4) / sizeof(u32))
+#define HW_ACCESS_WSPI_INIT_CMD_MASK  0
+
+
+/* Raw target IO, address is not translated */
+void wl1271_spi_write(struct wl1271 *wl, int addr, void *buf,
+                      size_t len, bool fixed);
+void wl1271_spi_read(struct wl1271 *wl, int addr, void *buf,
+                     size_t len, bool fixed);
+
+/* Memory target IO, address is tranlated to partition 0 */
+void wl1271_spi_mem_read(struct wl1271 *wl, int addr, void *buf, size_t len);
+void wl1271_spi_mem_write(struct wl1271 *wl, int addr, void *buf, size_t len);
+u32 wl1271_mem_read32(struct wl1271 *wl, int addr);
+void wl1271_mem_write32(struct wl1271 *wl, int addr, u32 val);
+
+/* Registers IO */
+void wl1271_spi_reg_read(struct wl1271 *wl, int addr, void *buf, size_t len,
+                         bool fixed);
+void wl1271_spi_reg_write(struct wl1271 *wl, int addr, void *buf, size_t len,
+                          bool fixed);
+u32 wl1271_reg_read32(struct wl1271 *wl, int addr);
+void wl1271_reg_write32(struct wl1271 *wl, int addr, u32 val);
+
+/* INIT and RESET words */
+void wl1271_spi_reset(struct wl1271 *wl);
+void wl1271_spi_init(struct wl1271 *wl);
+int wl1271_set_partition(struct wl1271 *wl,
+                         u32 part_start, u32 part_size,
+                         u32 reg_start,  u32 reg_size);
+
+static inline u32 wl1271_read32(struct wl1271 *wl, int addr)
+{
+        wl1271_spi_read(wl, addr, &wl->buffer_32,
+                        sizeof(wl->buffer_32), false);
+
+        return wl->buffer_32;
+}
+
+static inline void wl1271_write32(struct wl1271 *wl, int addr, u32 val)
+{
+        wl->buffer_32 = val;
+        wl1271_spi_write(wl, addr, &wl->buffer_32,
+                         sizeof(wl->buffer_32), false);
+}
+
+#endif /* __WL1271_SPI_H__ */
diff --git a/drivers/net/wireless/wl12xx/wl1271_tx.c b/drivers/net/wireless/wl12xx/wl1271_tx.c
new file mode 100644
index 000000000000..ff221258b941
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/wl1271_tx.c
@@ -0,0 +1,378 @@
+/*
+ * This file is part of wl1271
+ *
+ * Copyright (C) 2009 Nokia Corporation
+ *
+ * Contact: Luciano Coelho <luciano.coelho@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+
+#include "wl1271.h"
+#include "wl1271_spi.h"
+#include "wl1271_reg.h"
+#include "wl1271_ps.h"
+#include "wl1271_tx.h"
+
+static int wl1271_tx_id(struct wl1271 *wl, struct sk_buff *skb)
+{
+        int i;
+
+        for (i = 0; i < FW_TX_CMPLT_BLOCK_SIZE; i++)
+                if (wl->tx_frames[i] == NULL) {
+                        wl->tx_frames[i] = skb;
+                        return i;
+                }
+
+        return -EBUSY;
+}
+
+static int wl1271_tx_allocate(struct wl1271 *wl, struct sk_buff *skb, u32 extra)
+{
+        struct wl1271_tx_hw_descr *desc;
+        u32 total_len = skb->len + sizeof(struct wl1271_tx_hw_descr) + extra;
+        u32 total_blocks, excluded;
+        int id, ret = -EBUSY;
+
+        /* allocate free identifier for the packet */
+        id = wl1271_tx_id(wl, skb);
+        if (id < 0)
+                return id;
+
+        /* approximate the number of blocks required for this packet
+           in the firmware */
+        /* FIXME: try to figure out what is done here and make it cleaner */
+        total_blocks = (skb->len) >> TX_HW_BLOCK_SHIFT_DIV;
+        excluded = (total_blocks << 2) + (skb->len & 0xff) + 34;
+        total_blocks += (excluded > 252) ? 2 : 1;
+        total_blocks += TX_HW_BLOCK_SPARE;
+
+        if (total_blocks <= wl->tx_blocks_available) {
+                desc = (struct wl1271_tx_hw_descr *)skb_push(
+                        skb, total_len - skb->len);
+
+                desc->extra_mem_blocks = TX_HW_BLOCK_SPARE;
+                desc->total_mem_blocks = total_blocks;
+                desc->id = id;
+
+                wl->tx_blocks_available -= total_blocks;
+
+                ret = 0;
+
+                wl1271_debug(DEBUG_TX,
+                             "tx_allocate: size: %d, blocks: %d, id: %d",
+                             total_len, total_blocks, id);
+        } else
+                wl->tx_frames[id] = NULL;
+
+        return ret;
+}
+
+static int wl1271_tx_fill_hdr(struct wl1271 *wl, struct sk_buff *skb,
+                              u32 extra, struct ieee80211_tx_info *control)
+{
+        struct wl1271_tx_hw_descr *desc;
+        int pad;
+
+        desc = (struct wl1271_tx_hw_descr *) skb->data;
+
+        /* configure packet life time */
+        desc->start_time = jiffies_to_usecs(jiffies) - wl->time_offset;
+        desc->life_time = TX_HW_MGMT_PKT_LIFETIME_TU;
+
+        /* configure the tx attributes */
+        desc->tx_attr = wl->session_counter << TX_HW_ATTR_OFST_SESSION_COUNTER;
+        /* FIXME: do we know the packet priority? can we identify mgmt
+           packets, and use max prio for them at least? */
+        desc->tid = 0;
+        desc->aid = TX_HW_DEFAULT_AID;
+        desc->reserved = 0;
+
+        /* align the length (and store in terms of words) */
+        pad = WL1271_TX_ALIGN(skb->len);
+        desc->length = pad >> 2;
+
+        /* calculate number of padding bytes */
+        pad = pad - skb->len;
+        desc->tx_attr |= pad << TX_HW_ATTR_OFST_LAST_WORD_PAD;
+
+        wl1271_debug(DEBUG_TX, "tx_fill_hdr: pad: %d", pad);
+        return 0;
+}
+
+static int wl1271_tx_send_packet(struct wl1271 *wl, struct sk_buff *skb,
+                                 struct ieee80211_tx_info *control)
+{
+
+        struct wl1271_tx_hw_descr *desc;
+        int len;
+
+        /* FIXME: This is a workaround for getting non-aligned packets.
+           This happens at least with EAPOL packets from the user space.
+           Our DMA requires packets to be aligned on a 4-byte boundary.
+        */
+        if (unlikely((long)skb->data & 0x03)) {
+                int offset = (4 - (long)skb->data) & 0x03;
+                wl1271_debug(DEBUG_TX, "skb offset %d", offset);
+
+                /* check whether the current skb can be used */
+                if (!skb_cloned(skb) && (skb_tailroom(skb) >= offset)) {
+                        unsigned char *src = skb->data;
+
+                        /* align the buffer on a 4-byte boundary */
+                        skb_reserve(skb, offset);
+                        memmove(skb->data, src, skb->len);
+                } else {
+                        wl1271_info("No handler, fixme!");
+                        return -EINVAL;
+                }
+        }
+
+        len = WL1271_TX_ALIGN(skb->len);
+
+        /* perform a fixed address block write with the packet */
+        wl1271_spi_reg_write(wl, WL1271_SLV_MEM_DATA, skb->data, len, true);
+
+        /* write packet new counter into the write access register */
+        wl->tx_packets_count++;
+        wl1271_reg_write32(wl, WL1271_HOST_WR_ACCESS, wl->tx_packets_count);
+
+        desc = (struct wl1271_tx_hw_descr *) skb->data;
+        wl1271_debug(DEBUG_TX, "tx id %u skb 0x%p payload %u (%u words)",
+                     desc->id, skb, len, desc->length);
+
+        return 0;
+}
+
+/* caller must hold wl->mutex */
+static int wl1271_tx_frame(struct wl1271 *wl, struct sk_buff *skb)
+{
+        struct ieee80211_tx_info *info;
+        u32 extra = 0;
+        int ret = 0;
+        u8 idx;
+
+        if (!skb)
+                return -EINVAL;
+
+        info = IEEE80211_SKB_CB(skb);
+
+        if (info->control.hw_key &&
+            info->control.hw_key->alg == ALG_TKIP)
+                extra = WL1271_TKIP_IV_SPACE;
+
+        if (info->control.hw_key) {
+                idx = info->control.hw_key->hw_key_idx;
+
+                /* FIXME: do we have to do this if we're not using WEP? */
+                if (unlikely(wl->default_key != idx)) {
+                        ret = wl1271_cmd_set_default_wep_key(wl, idx);
+                        if (ret < 0)
+                                return ret;
+                }
+        }
+
+        ret = wl1271_tx_allocate(wl, skb, extra);
+        if (ret < 0)
+                return ret;
+
+        ret = wl1271_tx_fill_hdr(wl, skb, extra, info);
+        if (ret < 0)
+                return ret;
+
+        ret = wl1271_tx_send_packet(wl, skb, info);
+        if (ret < 0)
+                return ret;
+
+        return ret;
+}
+
+void wl1271_tx_work(struct work_struct *work)
+{
+        struct wl1271 *wl = container_of(work, struct wl1271, tx_work);
+        struct sk_buff *skb;
+        bool woken_up = false;
+        int ret;
+
+        mutex_lock(&wl->mutex);
+
+        if (unlikely(wl->state == WL1271_STATE_OFF))
+                goto out;
+
+        while ((skb = skb_dequeue(&wl->tx_queue))) {
+                if (!woken_up) {
+                        ret = wl1271_ps_elp_wakeup(wl, false);
+                        if (ret < 0)
+                                goto out;
+                        woken_up = true;
+                }
+
+                ret = wl1271_tx_frame(wl, skb);
+                if (ret == -EBUSY) {
+                        /* firmware buffer is full, stop queues */
+                        wl1271_debug(DEBUG_TX, "tx_work: fw buffer full, "
+                                     "stop queues");
+                        ieee80211_stop_queues(wl->hw);
+                        wl->tx_queue_stopped = true;
+                        skb_queue_head(&wl->tx_queue, skb);
+                        goto out;
+                } else if (ret < 0) {
+                        dev_kfree_skb(skb);
+                        goto out;
+                } else if (wl->tx_queue_stopped) {
+                        /* firmware buffer has space, restart queues */
+                        wl1271_debug(DEBUG_TX,
+                                     "complete_packet: waking queues");
+                        ieee80211_wake_queues(wl->hw);
+                        wl->tx_queue_stopped = false;
+                }
+        }
+
+out:
+        if (woken_up)
+                wl1271_ps_elp_sleep(wl);
+
+        mutex_unlock(&wl->mutex);
+}
+
+static void wl1271_tx_complete_packet(struct wl1271 *wl,
+                                      struct wl1271_tx_hw_res_descr *result)
+{
+
+        struct ieee80211_tx_info *info;
+        struct sk_buff *skb;
+        u32 header_len;
+        int id = result->id;
+
+        /* check for id legality */
+        if (id >= TX_HW_RESULT_QUEUE_LEN || wl->tx_frames[id] == NULL) {
+                wl1271_warning("TX result illegal id: %d", id);
+                return;
+        }
+
+        skb = wl->tx_frames[id];
+        info = IEEE80211_SKB_CB(skb);
+
+        /* update packet status */
+        if (!(info->flags & IEEE80211_TX_CTL_NO_ACK)) {
+                if (result->status == TX_SUCCESS)
+                        info->flags |= IEEE80211_TX_STAT_ACK;
+                if (result->status & TX_RETRY_EXCEEDED) {
+                        /* FIXME */
+                        /* info->status.excessive_retries = 1; */
+                        wl->stats.excessive_retries++;
+                }
+        }
+
+        /* FIXME */
+        /* info->status.retry_count = result->ack_failures; */
+        wl->stats.retry_count += result->ack_failures;
+
+        /* get header len */
+        if (info->control.hw_key &&
+            info->control.hw_key->alg == ALG_TKIP)
+                header_len = WL1271_TKIP_IV_SPACE +
+                        sizeof(struct wl1271_tx_hw_descr);
+        else
+                header_len = sizeof(struct wl1271_tx_hw_descr);
+
+        wl1271_debug(DEBUG_TX, "tx status id %u skb 0x%p failures %u rate 0x%x"
+                     " status 0x%x",
+                     result->id, skb, result->ack_failures,
+                     result->rate_class_index, result->status);
+
+        /* remove private header from packet */
+        skb_pull(skb, header_len);
+
+        /* return the packet to the stack */
+        ieee80211_tx_status(wl->hw, skb);
+        wl->tx_frames[result->id] = NULL;
+}
+
+/* Called upon reception of a TX complete interrupt */
+void wl1271_tx_complete(struct wl1271 *wl, u32 count)
+{
+        struct wl1271_acx_mem_map *memmap =
+                (struct wl1271_acx_mem_map *)wl->target_mem_map;
+        u32 i;
+
+        wl1271_debug(DEBUG_TX, "tx_complete received, packets: %d", count);
+
+        /* read the tx results from the chipset */
+        wl1271_spi_mem_read(wl, memmap->tx_result,
+                            wl->tx_res_if, sizeof(*wl->tx_res_if));
+
+        /* verify that the result buffer is not getting overrun */
+        if (count > TX_HW_RESULT_QUEUE_LEN) {
+                wl1271_warning("TX result overflow from chipset: %d", count);
+                count = TX_HW_RESULT_QUEUE_LEN;
+        }
+
+        /* process the results */
+        for (i = 0; i < count; i++) {
+                struct wl1271_tx_hw_res_descr *result;
+                u8 offset = wl->tx_results_count & TX_HW_RESULT_QUEUE_LEN_MASK;
+
+                /* process the packet */
+                result =  &(wl->tx_res_if->tx_results_queue[offset]);
+                wl1271_tx_complete_packet(wl, result);
+
+                wl->tx_results_count++;
+        }
+
+        /* write host counter to chipset (to ack) */
+        wl1271_mem_write32(wl, memmap->tx_result +
+                           offsetof(struct wl1271_tx_hw_res_if,
+                                    tx_result_host_counter),
+                           wl->tx_res_if->tx_result_fw_counter);
+}
+
+/* caller must hold wl->mutex */
+void wl1271_tx_flush(struct wl1271 *wl)
+{
+        int i;
+        struct sk_buff *skb;
+        struct ieee80211_tx_info *info;
+
+        /* TX failure */
+/*      control->flags = 0; FIXME */
+
+        while ((skb = skb_dequeue(&wl->tx_queue))) {
+                info = IEEE80211_SKB_CB(skb);
+
+                wl1271_debug(DEBUG_TX, "flushing skb 0x%p", skb);
+
+                if (!(info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS))
+                                continue;
+
+                ieee80211_tx_status(wl->hw, skb);
+        }
+
+        for (i = 0; i < FW_TX_CMPLT_BLOCK_SIZE; i++)
+                if (wl->tx_frames[i] != NULL) {
+                        skb = wl->tx_frames[i];
+                        info = IEEE80211_SKB_CB(skb);
+
+                        if (!(info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS))
+                                continue;
+
+                        ieee80211_tx_status(wl->hw, skb);
+                        wl->tx_frames[i] = NULL;
+                }
+}
diff --git a/drivers/net/wireless/wl12xx/wl1271_tx.h b/drivers/net/wireless/wl12xx/wl1271_tx.h
new file mode 100644
index 000000000000..4a614067ddba
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/wl1271_tx.h
@@ -0,0 +1,130 @@
+/*
+ * This file is part of wl1271
+ *
+ * Copyright (C) 1998-2009 Texas Instruments. All rights reserved.
+ * Copyright (C) 2009 Nokia Corporation
+ *
+ * Contact: Luciano Coelho <luciano.coelho@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#ifndef __WL1271_TX_H__
+#define __WL1271_TX_H__
+
+#define TX_HW_BLOCK_SPARE                2
+#define TX_HW_BLOCK_SHIFT_DIV            8
+
+#define TX_HW_MGMT_PKT_LIFETIME_TU       2000
+/* The chipset reference driver states, that the "aid" value 1
+ * is for infra-BSS, but is still always used */
+#define TX_HW_DEFAULT_AID                1
+
+#define TX_HW_ATTR_SAVE_RETRIES          BIT(0)
+#define TX_HW_ATTR_HEADER_PAD            BIT(1)
+#define TX_HW_ATTR_SESSION_COUNTER       (BIT(2) | BIT(3) | BIT(4))
+#define TX_HW_ATTR_RATE_POLICY           (BIT(5) | BIT(6) | BIT(7) | \
+                                          BIT(8) | BIT(9))
+#define TX_HW_ATTR_LAST_WORD_PAD         (BIT(10) | BIT(11))
+#define TX_HW_ATTR_TX_CMPLT_REQ          BIT(12)
+
+#define TX_HW_ATTR_OFST_SAVE_RETRIES     0
+#define TX_HW_ATTR_OFST_HEADER_PAD       1
+#define TX_HW_ATTR_OFST_SESSION_COUNTER  2
+#define TX_HW_ATTR_OFST_RATE_POLICY      5
+#define TX_HW_ATTR_OFST_LAST_WORD_PAD    10
+#define TX_HW_ATTR_OFST_TX_CMPLT_REQ     12
+
+#define TX_HW_RESULT_QUEUE_LEN           16
+#define TX_HW_RESULT_QUEUE_LEN_MASK      0xf
+
+#define WL1271_TX_ALIGN_TO 4
+#define WL1271_TX_ALIGN(len) (((len) + WL1271_TX_ALIGN_TO - 1) & \
+                             ~(WL1271_TX_ALIGN_TO - 1))
+#define WL1271_TKIP_IV_SPACE 4
+
+struct wl1271_tx_hw_descr {
+        /* Length of packet in words, including descriptor+header+data */
+        u16 length;
+        /* Number of extra memory blocks to allocate for this packet in
+           addition to the number of blocks derived from the packet length */
+        u8 extra_mem_blocks;
+        /* Total number of memory blocks allocated by the host for this packet.
+           Must be equal or greater than the actual blocks number allocated by
+           HW!! */
+        u8 total_mem_blocks;
+        /* Device time (in us) when the packet arrived to the driver */
+        u32 start_time;
+        /* Max delay in TUs until transmission. The last device time the
+           packet can be transmitted is: startTime+(1024*LifeTime) */
+        u16 life_time;
+        /* Bitwise fields - see TX_ATTR... definitions above. */
+        u16 tx_attr;
+        /* Packet identifier used also in the Tx-Result. */
+        u8 id;
+        /* The packet TID value (as User-Priority) */
+        u8 tid;
+        /* Identifier of the remote STA in IBSS, 1 in infra-BSS */
+        u8 aid;
+        u8 reserved;
+} __attribute__ ((packed));
+
+enum wl1271_tx_hw_res_status {
+        TX_SUCCESS          = 0,
+        TX_HW_ERROR         = 1,
+        TX_DISABLED         = 2,
+        TX_RETRY_EXCEEDED   = 3,
+        TX_TIMEOUT          = 4,
+        TX_KEY_NOT_FOUND    = 5,
+        TX_PEER_NOT_FOUND   = 6,
+        TX_SESSION_MISMATCH = 7
+};
+
+struct wl1271_tx_hw_res_descr {
+        /* Packet Identifier - same value used in the Tx descriptor.*/
+        u8 id;
+        /* The status of the transmission, indicating success or one of
+           several possible reasons for failure. */
+        u8 status;
+        /* Total air access duration including all retrys and overheads.*/
+        u16 medium_usage;
+        /* The time passed from host xfer to Tx-complete.*/
+        u32 fw_handling_time;
+        /* Total media delay
+           (from 1st EDCA AIFS counter until TX Complete). */
+        u32 medium_delay;
+        /* LS-byte of last TKIP seq-num (saved per AC for recovery). */
+        u8 lsb_security_sequence_number;
+        /* Retry count - number of transmissions without successful ACK.*/
+        u8 ack_failures;
+        /* The rate that succeeded getting ACK
+           (Valid only if status=SUCCESS). */
+        u8 rate_class_index;
+        /* for 4-byte alignment. */
+        u8 spare;
+} __attribute__ ((packed));
+
+struct wl1271_tx_hw_res_if {
+        u32 tx_result_fw_counter;
+        u32 tx_result_host_counter;
+        struct wl1271_tx_hw_res_descr tx_results_queue[TX_HW_RESULT_QUEUE_LEN];
+} __attribute__ ((packed));
+
+void wl1271_tx_work(struct work_struct *work);
+void wl1271_tx_complete(struct wl1271 *wl, u32 count);
+void wl1271_tx_flush(struct wl1271 *wl);
+
+#endif
diff --git a/drivers/net/wireless/zd1211rw/zd_chip.c b/drivers/net/wireless/zd1211rw/zd_chip.c
index 2c813d87092c..5e110a2328ae 100644
--- a/drivers/net/wireless/zd1211rw/zd_chip.c
+++ b/drivers/net/wireless/zd1211rw/zd_chip.c
@@ -1278,11 +1278,11 @@ int zd_chip_control_leds(struct zd_chip *chip, enum led_status status)
         other_led = chip->link_led == LED1 ? LED2 : LED1;
 
         switch (status) {
-        case LED_OFF:
+        case ZD_LED_OFF:
                 ioreqs[0].value = FW_LINK_OFF;
                 ioreqs[1].value = v[1] & ~(LED1|LED2);
                 break;
-        case LED_SCANNING:
+        case ZD_LED_SCANNING:
                 ioreqs[0].value = FW_LINK_OFF;
                 ioreqs[1].value = v[1] & ~other_led;
                 if (get_seconds() % 3 == 0) {
@@ -1291,7 +1291,7 @@ int zd_chip_control_leds(struct zd_chip *chip, enum led_status status)
                         ioreqs[1].value |= chip->link_led;
                 }
                 break;
-        case LED_ASSOCIATED:
+        case ZD_LED_ASSOCIATED:
                 ioreqs[0].value = FW_LINK_TX;
                 ioreqs[1].value = v[1] & ~other_led;
                 ioreqs[1].value |= chip->link_led;
diff --git a/drivers/net/wireless/zd1211rw/zd_chip.h b/drivers/net/wireless/zd1211rw/zd_chip.h
index ee42751d5cb0..678c139a840c 100644
--- a/drivers/net/wireless/zd1211rw/zd_chip.h
+++ b/drivers/net/wireless/zd1211rw/zd_chip.h
@@ -897,9 +897,9 @@ int zd_chip_lock_phy_regs(struct zd_chip *chip);
 int zd_chip_unlock_phy_regs(struct zd_chip *chip);
 
 enum led_status {
-        LED_OFF = 0,
-        LED_SCANNING = 1,
-        LED_ASSOCIATED = 2,
+        ZD_LED_OFF = 0,
+        ZD_LED_SCANNING = 1,
+        ZD_LED_ASSOCIATED = 2,
 };
 
 int zd_chip_control_leds(struct zd_chip *chip, enum led_status status);
diff --git a/drivers/net/wireless/zd1211rw/zd_mac.c b/drivers/net/wireless/zd1211rw/zd_mac.c
index 54abdd0c0045..55b7fbdc85dc 100644
--- a/drivers/net/wireless/zd1211rw/zd_mac.c
+++ b/drivers/net/wireless/zd1211rw/zd_mac.c
@@ -1013,7 +1013,7 @@ static void link_led_handler(struct work_struct *work)
         spin_unlock_irq(&mac->lock);
 
         r = zd_chip_control_leds(chip,
-                                 is_associated ? LED_ASSOCIATED : LED_SCANNING);
+                                 is_associated ? ZD_LED_ASSOCIATED : ZD_LED_SCANNING);
         if (r)
                 dev_dbg_f(zd_mac_dev(mac), "zd_chip_control_leds error %d\n", r);
 
@@ -1038,5 +1038,5 @@ static void housekeeping_disable(struct zd_mac *mac)
         dev_dbg_f(zd_mac_dev(mac), "\n");
         cancel_rearming_delayed_workqueue(zd_workqueue,
                 &mac->housekeeping.link_led_work);
-        zd_chip_control_leds(&mac->chip, LED_OFF);
+        zd_chip_control_leds(&mac->chip, ZD_LED_OFF);
 }
diff --git a/drivers/ssb/pci.c b/drivers/ssb/pci.c
index 40ea41762247..593fc618a2ea 100644
--- a/drivers/ssb/pci.c
+++ b/drivers/ssb/pci.c
@@ -169,8 +169,14 @@ err_pci:
 /* Get the word-offset for a SSB_SPROM_XXX define. */
 #define SPOFF(offset)   (((offset) - SSB_SPROM_BASE) / sizeof(u16))
 /* Helper to extract some _offset, which is one of the SSB_SPROM_XXX defines. */
-#define SPEX(_outvar, _offset, _mask, _shift)   \
+#define SPEX16(_outvar, _offset, _mask, _shift) \
         out->_outvar = ((in[SPOFF(_offset)] & (_mask)) >> (_shift))
+#define SPEX32(_outvar, _offset, _mask, _shift) \
+        out->_outvar = ((((u32)in[SPOFF((_offset)+2)] << 16 | \
+                           in[SPOFF(_offset)]) & (_mask)) >> (_shift))
+#define SPEX(_outvar, _offset, _mask, _shift) \
+        SPEX16(_outvar, _offset, _mask, _shift)
+
 
 static inline u8 ssb_crc8(u8 crc, u8 data)
 {
@@ -480,6 +486,8 @@ static void sprom_extract_r8(struct ssb_sprom *out, const u16 *in)
         SPEX(country_code, SSB_SPROM8_CCODE, 0xFFFF, 0);
         SPEX(boardflags_lo, SSB_SPROM8_BFLLO, 0xFFFF, 0);
         SPEX(boardflags_hi, SSB_SPROM8_BFLHI, 0xFFFF, 0);
+        SPEX(boardflags2_lo, SSB_SPROM8_BFL2LO, 0xFFFF, 0);
+        SPEX(boardflags2_hi, SSB_SPROM8_BFL2HI, 0xFFFF, 0);
         SPEX(ant_available_a, SSB_SPROM8_ANTAVAIL, SSB_SPROM8_ANTAVAIL_A,
              SSB_SPROM8_ANTAVAIL_A_SHIFT);
         SPEX(ant_available_bg, SSB_SPROM8_ANTAVAIL, SSB_SPROM8_ANTAVAIL_BG,
@@ -490,12 +498,55 @@ static void sprom_extract_r8(struct ssb_sprom *out, const u16 *in)
         SPEX(maxpwr_a, SSB_SPROM8_MAXP_A, SSB_SPROM8_MAXP_A_MASK, 0);
         SPEX(itssi_a, SSB_SPROM8_MAXP_A, SSB_SPROM8_ITSSI_A,
              SSB_SPROM8_ITSSI_A_SHIFT);
+        SPEX(maxpwr_ah, SSB_SPROM8_MAXP_AHL, SSB_SPROM8_MAXP_AH_MASK, 0);
+        SPEX(maxpwr_al, SSB_SPROM8_MAXP_AHL, SSB_SPROM8_MAXP_AL_MASK,
+             SSB_SPROM8_MAXP_AL_SHIFT);
         SPEX(gpio0, SSB_SPROM8_GPIOA, SSB_SPROM8_GPIOA_P0, 0);
         SPEX(gpio1, SSB_SPROM8_GPIOA, SSB_SPROM8_GPIOA_P1,
              SSB_SPROM8_GPIOA_P1_SHIFT);
         SPEX(gpio2, SSB_SPROM8_GPIOB, SSB_SPROM8_GPIOB_P2, 0);
         SPEX(gpio3, SSB_SPROM8_GPIOB, SSB_SPROM8_GPIOB_P3,
              SSB_SPROM8_GPIOB_P3_SHIFT);
+        SPEX(tri2g, SSB_SPROM8_TRI25G, SSB_SPROM8_TRI2G, 0);
+        SPEX(tri5g, SSB_SPROM8_TRI25G, SSB_SPROM8_TRI5G,
+             SSB_SPROM8_TRI5G_SHIFT);
+        SPEX(tri5gl, SSB_SPROM8_TRI5GHL, SSB_SPROM8_TRI5GL, 0);
+        SPEX(tri5gh, SSB_SPROM8_TRI5GHL, SSB_SPROM8_TRI5GH,
+             SSB_SPROM8_TRI5GH_SHIFT);
+        SPEX(rxpo2g, SSB_SPROM8_RXPO, SSB_SPROM8_RXPO2G, 0);
+        SPEX(rxpo5g, SSB_SPROM8_RXPO, SSB_SPROM8_RXPO5G,
+             SSB_SPROM8_RXPO5G_SHIFT);
+        SPEX(rssismf2g, SSB_SPROM8_RSSIPARM2G, SSB_SPROM8_RSSISMF2G, 0);
+        SPEX(rssismc2g, SSB_SPROM8_RSSIPARM2G, SSB_SPROM8_RSSISMC2G,
+             SSB_SPROM8_RSSISMC2G_SHIFT);
+        SPEX(rssisav2g, SSB_SPROM8_RSSIPARM2G, SSB_SPROM8_RSSISAV2G,
+             SSB_SPROM8_RSSISAV2G_SHIFT);
+        SPEX(bxa2g, SSB_SPROM8_RSSIPARM2G, SSB_SPROM8_BXA2G,
+             SSB_SPROM8_BXA2G_SHIFT);
+        SPEX(rssismf5g, SSB_SPROM8_RSSIPARM5G, SSB_SPROM8_RSSISMF5G, 0);
+        SPEX(rssismc5g, SSB_SPROM8_RSSIPARM5G, SSB_SPROM8_RSSISMC5G,
+             SSB_SPROM8_RSSISMC5G_SHIFT);
+        SPEX(rssisav5g, SSB_SPROM8_RSSIPARM5G, SSB_SPROM8_RSSISAV5G,
+             SSB_SPROM8_RSSISAV5G_SHIFT);
+        SPEX(bxa5g, SSB_SPROM8_RSSIPARM5G, SSB_SPROM8_BXA5G,
+             SSB_SPROM8_BXA5G_SHIFT);
+        SPEX(pa0b0, SSB_SPROM8_PA0B0, 0xFFFF, 0);
+        SPEX(pa0b1, SSB_SPROM8_PA0B1, 0xFFFF, 0);
+        SPEX(pa0b2, SSB_SPROM8_PA0B2, 0xFFFF, 0);
+        SPEX(pa1b0, SSB_SPROM8_PA1B0, 0xFFFF, 0);
+        SPEX(pa1b1, SSB_SPROM8_PA1B1, 0xFFFF, 0);
+        SPEX(pa1b2, SSB_SPROM8_PA1B2, 0xFFFF, 0);
+        SPEX(pa1lob0, SSB_SPROM8_PA1LOB0, 0xFFFF, 0);
+        SPEX(pa1lob1, SSB_SPROM8_PA1LOB1, 0xFFFF, 0);
+        SPEX(pa1lob2, SSB_SPROM8_PA1LOB2, 0xFFFF, 0);
+        SPEX(pa1hib0, SSB_SPROM8_PA1HIB0, 0xFFFF, 0);
+        SPEX(pa1hib1, SSB_SPROM8_PA1HIB1, 0xFFFF, 0);
+        SPEX(pa1hib2, SSB_SPROM8_PA1HIB2, 0xFFFF, 0);
+        SPEX(cck2gpo, SSB_SPROM8_CCK2GPO, 0xFFFF, 0);
+        SPEX32(ofdm2gpo, SSB_SPROM8_OFDM2GPO, 0xFFFFFFFF, 0);
+        SPEX32(ofdm5glpo, SSB_SPROM8_OFDM5GLPO, 0xFFFFFFFF, 0);
+        SPEX32(ofdm5gpo, SSB_SPROM8_OFDM5GPO, 0xFFFFFFFF, 0);
+        SPEX32(ofdm5ghpo, SSB_SPROM8_OFDM5GHPO, 0xFFFFFFFF, 0);
 
         /* Extract the antenna gain values. */
         SPEX(antenna_gain.ghz24.a0, SSB_SPROM8_AGAIN01,
diff --git a/include/linux/nl80211.h b/include/linux/nl80211.h
index cb3dc6027fd9..a8d71ed43a0e 100644
--- a/include/linux/nl80211.h
+++ b/include/linux/nl80211.h
@@ -480,10 +480,6 @@ enum nl80211_commands {
  * @NL80211_ATTR_SCAN_FREQUENCIES: nested attribute with frequencies (in MHz)
  * @NL80211_ATTR_SCAN_SSIDS: nested attribute with SSIDs, leave out for passive
  *      scanning and include a zero-length SSID (wildcard) for wildcard scan
- * @NL80211_ATTR_SCAN_GENERATION: the scan generation increases whenever the
- *      scan result list changes (BSS expired or added) so that applications
- *      can verify that they got a single, consistent snapshot (when all dump
- *      messages carried the same generation number)
  * @NL80211_ATTR_BSS: scan result BSS
  *
  * @NL80211_ATTR_REG_INITIATOR: indicates who requested the regulatory domain
@@ -580,6 +576,14 @@ enum nl80211_commands {
  *
  * @NL80211_ATTR_PID: Process ID of a network namespace.
  *
+ * @NL80211_ATTR_GENERATION: Used to indicate consistent snapshots for
+ *      dumps. This number increases whenever the object list being
+ *      dumped changes, and as such userspace can verify that it has
+ *      obtained a complete and consistent snapshot by verifying that
+ *      all dump messages contain the same generation number. If it
+ *      changed then the list changed and the dump should be repeated
+ *      completely from scratch.
+ *
  * @NL80211_ATTR_MAX: highest attribute number currently defined
  * @__NL80211_ATTR_AFTER_LAST: internal use
  */
@@ -651,7 +655,7 @@ enum nl80211_attrs {
 
         NL80211_ATTR_SCAN_FREQUENCIES,
         NL80211_ATTR_SCAN_SSIDS,
-        NL80211_ATTR_SCAN_GENERATION,
+        NL80211_ATTR_GENERATION, /* replaces old SCAN_GENERATION */
         NL80211_ATTR_BSS,
 
         NL80211_ATTR_REG_INITIATOR,
@@ -716,6 +720,9 @@ enum nl80211_attrs {
         NL80211_ATTR_MAX = __NL80211_ATTR_AFTER_LAST - 1
 };
 
+/* source-level API compatibility */
+#define NL80211_ATTR_SCAN_GENERATION NL80211_ATTR_GENERATION
+
 /*
  * Allow user space programs to use #ifdef on new attributes by defining them
  * here
diff --git a/include/linux/ssb/ssb.h b/include/linux/ssb/ssb.h
index 5ae8fa22d331..17ffc1f84d76 100644
--- a/include/linux/ssb/ssb.h
+++ b/include/linux/ssb/ssb.h
@@ -27,24 +27,54 @@ struct ssb_sprom {
         u8 et1mdcport;          /* MDIO for enet1 */
         u8 board_rev;           /* Board revision number from SPROM. */
         u8 country_code;        /* Country Code */
-        u8 ant_available_a;     /* A-PHY antenna available bits (up to 4) */
-        u8 ant_available_bg;    /* B/G-PHY antenna available bits (up to 4) */
+        u8 ant_available_a;     /* 2GHz antenna available bits (up to 4) */
+        u8 ant_available_bg;    /* 5GHz antenna available bits (up to 4) */
         u16 pa0b0;
         u16 pa0b1;
         u16 pa0b2;
         u16 pa1b0;
         u16 pa1b1;
         u16 pa1b2;
+        u16 pa1lob0;
+        u16 pa1lob1;
+        u16 pa1lob2;
+        u16 pa1hib0;
+        u16 pa1hib1;
+        u16 pa1hib2;
         u8 gpio0;               /* GPIO pin 0 */
         u8 gpio1;               /* GPIO pin 1 */
         u8 gpio2;               /* GPIO pin 2 */
         u8 gpio3;               /* GPIO pin 3 */
-        u16 maxpwr_a;           /* A-PHY Amplifier Max Power (in dBm Q5.2) */
-        u16 maxpwr_bg;          /* B/G-PHY Amplifier Max Power (in dBm Q5.2) */
+        u16 maxpwr_bg;          /* 2.4GHz Amplifier Max Power (in dBm Q5.2) */
+        u16 maxpwr_al;          /* 5.2GHz Amplifier Max Power (in dBm Q5.2) */
+        u16 maxpwr_a;           /* 5.3GHz Amplifier Max Power (in dBm Q5.2) */
+        u16 maxpwr_ah;          /* 5.8GHz Amplifier Max Power (in dBm Q5.2) */
         u8 itssi_a;             /* Idle TSSI Target for A-PHY */
         u8 itssi_bg;            /* Idle TSSI Target for B/G-PHY */
-        u16 boardflags_lo;      /* Boardflags (low 16 bits) */
-        u16 boardflags_hi;      /* Boardflags (high 16 bits) */
+        u8 tri2g;               /* 2.4GHz TX isolation */
+        u8 tri5gl;              /* 5.2GHz TX isolation */
+        u8 tri5g;               /* 5.3GHz TX isolation */
+        u8 tri5gh;              /* 5.8GHz TX isolation */
+        u8 rxpo2g;              /* 2GHz RX power offset */
+        u8 rxpo5g;              /* 5GHz RX power offset */
+        u8 rssisav2g;           /* 2GHz RSSI params */
+        u8 rssismc2g;
+        u8 rssismf2g;
+        u8 bxa2g;               /* 2GHz BX arch */
+        u8 rssisav5g;           /* 5GHz RSSI params */
+        u8 rssismc5g;
+        u8 rssismf5g;
+        u8 bxa5g;               /* 5GHz BX arch */
+        u16 cck2gpo;            /* CCK power offset */
+        u32 ofdm2gpo;           /* 2.4GHz OFDM power offset */
+        u32 ofdm5glpo;          /* 5.2GHz OFDM power offset */
+        u32 ofdm5gpo;           /* 5.3GHz OFDM power offset */
+        u32 ofdm5ghpo;          /* 5.8GHz OFDM power offset */
+        u16 boardflags_lo;      /* Board flags (bits 0-15) */
+        u16 boardflags_hi;      /* Board flags (bits 16-31) */
+        u16 boardflags2_lo;     /* Board flags (bits 32-47) */
+        u16 boardflags2_hi;     /* Board flags (bits 48-63) */
+        /* TODO store board flags in a single u64 */
 
         /* Antenna gain values for up to 4 antennas
          * on each band. Values in dBm/4 (Q5.2). Negative gain means the
@@ -58,7 +88,7 @@ struct ssb_sprom {
                 } ghz5;         /* 5GHz band */
         } antenna_gain;
 
-        /* TODO - add any parameters needed from rev 2, 3, or 4 SPROMs */
+        /* TODO - add any parameters needed from rev 2, 3, 4, 5 or 8 SPROMs */
 };
 
 /* Information about the PCB the circuitry is soldered on. */
diff --git a/include/linux/ssb/ssb_regs.h b/include/linux/ssb/ssb_regs.h
index a01b982b5783..9ae9082eaeb4 100644
--- a/include/linux/ssb/ssb_regs.h
+++ b/include/linux/ssb/ssb_regs.h
@@ -162,7 +162,7 @@
 
 /* SPROM shadow area. If not otherwise noted, fields are
  * two bytes wide. Note that the SPROM can _only_ be read
- * in two-byte quantinies.
+ * in two-byte quantities.
  */
 #define SSB_SPROMSIZE_WORDS             64
 #define SSB_SPROMSIZE_BYTES             (SSB_SPROMSIZE_WORDS * sizeof(u16))
@@ -327,8 +327,11 @@
 #define  SSB_SPROM5_GPIOB_P3_SHIFT      8
 
 /* SPROM Revision 8 */
-#define SSB_SPROM8_BFLLO                0x1084  /* Boardflags (low 16 bits) */
-#define SSB_SPROM8_BFLHI                0x1086  /* Boardflags Hi */
+#define SSB_SPROM8_BOARDREV             0x1082  /* Board revision */
+#define SSB_SPROM8_BFLLO                0x1084  /* Board flags (bits 0-15) */
+#define SSB_SPROM8_BFLHI                0x1086  /* Board flags (bits 16-31) */
+#define SSB_SPROM8_BFL2LO               0x1088  /* Board flags (bits 32-47) */
+#define SSB_SPROM8_BFL2HI               0x108A  /* Board flags (bits 48-63) */
 #define SSB_SPROM8_IL0MAC               0x108C  /* 6 byte MAC address */
 #define SSB_SPROM8_CCODE                0x1092  /* 2 byte country code */
 #define SSB_SPROM8_ANTAVAIL             0x109C  /* Antenna available bitfields*/
@@ -354,14 +357,63 @@
 #define  SSB_SPROM8_GPIOB_P2            0x00FF  /* Pin 2 */
 #define  SSB_SPROM8_GPIOB_P3            0xFF00  /* Pin 3 */
 #define  SSB_SPROM8_GPIOB_P3_SHIFT      8
-#define SSB_SPROM8_MAXP_BG              0x10C0  /* Max Power BG in path 1 */
-#define  SSB_SPROM8_MAXP_BG_MASK        0x00FF  /* Mask for Max Power BG */
+#define SSB_SPROM8_RSSIPARM2G           0x10A4  /* RSSI params for 2GHz */
+#define  SSB_SPROM8_RSSISMF2G           0x000F
+#define  SSB_SPROM8_RSSISMC2G           0x00F0
+#define  SSB_SPROM8_RSSISMC2G_SHIFT     4
+#define  SSB_SPROM8_RSSISAV2G           0x0700
+#define  SSB_SPROM8_RSSISAV2G_SHIFT     8
+#define  SSB_SPROM8_BXA2G               0x1800
+#define  SSB_SPROM8_BXA2G_SHIFT         11
+#define SSB_SPROM8_RSSIPARM5G           0x10A6  /* RSSI params for 5GHz */
+#define  SSB_SPROM8_RSSISMF5G           0x000F
+#define  SSB_SPROM8_RSSISMC5G           0x00F0
+#define  SSB_SPROM8_RSSISMC5G_SHIFT     4
+#define  SSB_SPROM8_RSSISAV5G           0x0700
+#define  SSB_SPROM8_RSSISAV5G_SHIFT     8
+#define  SSB_SPROM8_BXA5G               0x1800
+#define  SSB_SPROM8_BXA5G_SHIFT         11
+#define SSB_SPROM8_TRI25G               0x10A8  /* TX isolation 2.4&5.3GHz */
+#define  SSB_SPROM8_TRI2G               0x00FF  /* TX isolation 2.4GHz */
+#define  SSB_SPROM8_TRI5G               0xFF00  /* TX isolation 5.3GHz */
+#define  SSB_SPROM8_TRI5G_SHIFT         8
+#define SSB_SPROM8_TRI5GHL              0x10AA  /* TX isolation 5.2/5.8GHz */
+#define  SSB_SPROM8_TRI5GL              0x00FF  /* TX isolation 5.2GHz */
+#define  SSB_SPROM8_TRI5GH              0xFF00  /* TX isolation 5.8GHz */
+#define  SSB_SPROM8_TRI5GH_SHIFT        8
+#define SSB_SPROM8_RXPO                 0x10AC  /* RX power offsets */
+#define  SSB_SPROM8_RXPO2G              0x00FF  /* 2GHz RX power offset */
+#define  SSB_SPROM8_RXPO5G              0xFF00  /* 5GHz RX power offset */
+#define  SSB_SPROM8_RXPO5G_SHIFT        8
+#define SSB_SPROM8_MAXP_BG              0x10C0  /* Max Power 2GHz in path 1 */
+#define  SSB_SPROM8_MAXP_BG_MASK        0x00FF  /* Mask for Max Power 2GHz */
 #define  SSB_SPROM8_ITSSI_BG            0xFF00  /* Mask for path 1 itssi_bg */
 #define  SSB_SPROM8_ITSSI_BG_SHIFT      8
-#define SSB_SPROM8_MAXP_A               0x10C8  /* Max Power A in path 1 */
-#define  SSB_SPROM8_MAXP_A_MASK         0x00FF  /* Mask for Max Power A */
+#define SSB_SPROM8_PA0B0                0x10C2  /* 2GHz power amp settings */
+#define SSB_SPROM8_PA0B1                0x10C4
+#define SSB_SPROM8_PA0B2                0x10C6
+#define SSB_SPROM8_MAXP_A               0x10C8  /* Max Power 5.3GHz */
+#define  SSB_SPROM8_MAXP_A_MASK         0x00FF  /* Mask for Max Power 5.3GHz */
 #define  SSB_SPROM8_ITSSI_A             0xFF00  /* Mask for path 1 itssi_a */
 #define  SSB_SPROM8_ITSSI_A_SHIFT       8
+#define SSB_SPROM8_MAXP_AHL             0x10CA  /* Max Power 5.2/5.8GHz */
+#define  SSB_SPROM8_MAXP_AH_MASK        0x00FF  /* Mask for Max Power 5.8GHz */
+#define  SSB_SPROM8_MAXP_AL_MASK        0xFF00  /* Mask for Max Power 5.2GHz */
+#define  SSB_SPROM8_MAXP_AL_SHIFT       8
+#define SSB_SPROM8_PA1B0                0x10CC  /* 5.3GHz power amp settings */
+#define SSB_SPROM8_PA1B1                0x10CE
+#define SSB_SPROM8_PA1B2                0x10D0
+#define SSB_SPROM8_PA1LOB0              0x10D2  /* 5.2GHz power amp settings */
+#define SSB_SPROM8_PA1LOB1              0x10D4
+#define SSB_SPROM8_PA1LOB2              0x10D6
+#define SSB_SPROM8_PA1HIB0              0x10D8  /* 5.8GHz power amp settings */
+#define SSB_SPROM8_PA1HIB1              0x10DA
+#define SSB_SPROM8_PA1HIB2              0x10DC
+#define SSB_SPROM8_CCK2GPO              0x1140  /* CCK power offset */
+#define SSB_SPROM8_OFDM2GPO             0x1142  /* 2.4GHz OFDM power offset */
+#define SSB_SPROM8_OFDM5GPO             0x1146  /* 5.3GHz OFDM power offset */
+#define SSB_SPROM8_OFDM5GLPO            0x114A  /* 5.2GHz OFDM power offset */
+#define SSB_SPROM8_OFDM5GHPO            0x114E  /* 5.8GHz OFDM power offset */
 
 /* Values for SSB_SPROM1_BINF_CCODE */
 enum {
diff --git a/include/linux/usb/usbnet.h b/include/linux/usb/usbnet.h
index de8b4b18961b..09514252d84e 100644
--- a/include/linux/usb/usbnet.h
+++ b/include/linux/usb/usbnet.h
@@ -53,6 +53,7 @@ struct usbnet {
         struct sk_buff_head     rxq;
         struct sk_buff_head     txq;
         struct sk_buff_head     done;
+        struct sk_buff_head     rxq_pause;
         struct urb              *interrupt;
         struct tasklet_struct   bh;
 
@@ -63,6 +64,7 @@ struct usbnet {
 #               define EVENT_RX_MEMORY  2
 #               define EVENT_STS_SPLIT  3
 #               define EVENT_LINK_RESET 4
+#               define EVENT_RX_PAUSED  5
 };
 
 static inline struct usb_driver *driver_of(struct usb_interface *intf)
@@ -190,6 +192,10 @@ extern void usbnet_defer_kevent (struct usbnet *, int);
 extern void usbnet_skb_return (struct usbnet *, struct sk_buff *);
 extern void usbnet_unlink_rx_urbs(struct usbnet *);
 
+extern void usbnet_pause_rx(struct usbnet *);
+extern void usbnet_resume_rx(struct usbnet *);
+extern void usbnet_purge_paused_rxq(struct usbnet *);
+
 extern int usbnet_get_settings (struct net_device *net, struct ethtool_cmd *cmd);
 extern int usbnet_set_settings (struct net_device *net, struct ethtool_cmd *cmd);
 extern u32 usbnet_get_link (struct net_device *net);
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 64df51d9a89f..0b146bb2dd14 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -80,7 +80,6 @@ enum ieee80211_channel_flags {
  * with cfg80211.
  *
  * @center_freq: center frequency in MHz
- * @max_bandwidth: maximum allowed bandwidth for this channel, in MHz
  * @hw_value: hardware-specific value for the channel
  * @flags: channel flags from &enum ieee80211_channel_flags.
  * @orig_flags: channel flags at registration time, used by regulatory
@@ -97,7 +96,6 @@ enum ieee80211_channel_flags {
 struct ieee80211_channel {
         enum ieee80211_band band;
         u16 center_freq;
-        u8 max_bandwidth;
         u16 hw_value;
         u32 flags;
         int max_antenna_gain;
@@ -372,6 +370,10 @@ struct rate_info {
  * @txrate: current unicast bitrate to this station
  * @rx_packets: packets received from this station
  * @tx_packets: packets transmitted to this station
+ * @generation: generation number for nl80211 dumps.
+ *      This number should increase every time the list of stations
+ *      changes, i.e. when a station is added or removed, so that
+ *      userspace can tell whether it got a consistent snapshot.
  */
 struct station_info {
         u32 filled;
@@ -385,6 +387,8 @@ struct station_info {
         struct rate_info txrate;
         u32 rx_packets;
         u32 tx_packets;
+
+        int generation;
 };
 
 /**
@@ -444,6 +448,10 @@ enum mpath_info_flags {
  * @flags: mesh path flags
  * @discovery_timeout: total mesh path discovery timeout, in msecs
  * @discovery_retries: mesh path discovery retries
+ * @generation: generation number for nl80211 dumps.
+ *      This number should increase every time the list of mesh paths
+ *      changes, i.e. when a station is added or removed, so that
+ *      userspace can tell whether it got a consistent snapshot.
  */
 struct mpath_info {
         u32 filled;
@@ -454,6 +462,8 @@ struct mpath_info {
         u32 discovery_timeout;
         u8 discovery_retries;
         u8 flags;
+
+        int generation;
 };
 
 /**
@@ -547,7 +557,6 @@ struct cfg80211_ssid {
 struct cfg80211_scan_request {
         struct cfg80211_ssid *ssids;
         int n_ssids;
-        struct ieee80211_channel **channels;
         u32 n_channels;
         const u8 *ie;
         size_t ie_len;
@@ -556,6 +565,9 @@ struct cfg80211_scan_request {
         struct wiphy *wiphy;
         struct net_device *dev;
         bool aborted;
+
+        /* keep last */
+        struct ieee80211_channel *channels[0];
 };
 
 /**
@@ -1096,6 +1108,9 @@ struct cfg80211_ops {
  * @net: the network namespace this wiphy currently lives in
  * @netnsok: if set to false, do not allow changing the netns of this
  *      wiphy at all
+ * @ps_default: default for powersave, will be set depending on the
+ *      kernel's default on wiphy_new(), but can be changed by the
+ *      driver if it has a good reason to override the default
  */
 struct wiphy {
         /* assign these fields before you register the wiphy */
@@ -1111,6 +1126,7 @@ struct wiphy {
         bool disable_beacon_hints;
 
         bool netnsok;
+        bool ps_default;
 
         enum cfg80211_signal_type signal_type;
 
@@ -1335,10 +1351,10 @@ struct wireless_dev {
                 struct cfg80211_cached_keys *keys;
                 u8 *ie;
                 size_t ie_len;
-                u8 bssid[ETH_ALEN];
+                u8 bssid[ETH_ALEN], prev_bssid[ETH_ALEN];
                 u8 ssid[IEEE80211_MAX_SSID_LEN];
                 s8 default_key, default_mgmt_key;
-                bool ps;
+                bool ps, prev_bssid_valid;
                 int ps_timeout;
         } wext;
 #endif
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index e2fb5767e1fa..76d43e12cc29 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -239,7 +239,14 @@ struct ieee80211_bss_conf {
  * @IEEE80211_TX_CTL_AMPDU: this frame should be sent as part of an A-MPDU
  * @IEEE80211_TX_CTL_INJECTED: Frame was injected, internal to mac80211.
  * @IEEE80211_TX_STAT_TX_FILTERED: The frame was not transmitted
- *      because the destination STA was in powersave mode.
+ *      because the destination STA was in powersave mode. Note that to
+ *      avoid race conditions, the filter must be set by the hardware or
+ *      firmware upon receiving a frame that indicates that the station
+ *      went to sleep (must be done on device to filter frames already on
+ *      the queue) and may only be unset after mac80211 gives the OK for
+ *      that by setting the IEEE80211_TX_CTL_CLEAR_PS_FILT (see above),
+ *      since only then is it guaranteed that no more frames are in the
+ *      hardware queue.
  * @IEEE80211_TX_STAT_ACK: Frame was acknowledged
  * @IEEE80211_TX_STAT_AMPDU: The frame was aggregated, so status
  *      is for the whole aggregation.
@@ -261,6 +268,10 @@ struct ieee80211_bss_conf {
  * @IEEE80211_TX_CTL_PSPOLL_RESPONSE: (internal?)
  *      This frame is a response to a PS-poll frame and should be sent
  *      although the station is in powersave mode.
+ * @IEEE80211_TX_CTL_MORE_FRAMES: More frames will be passed to the
+ *      transmit function after the current frame, this can be used
+ *      by drivers to kick the DMA queue only if unset or when the
+ *      queue gets full.
  */
 enum mac80211_tx_control_flags {
         IEEE80211_TX_CTL_REQ_TX_STATUS          = BIT(0),
@@ -281,6 +292,7 @@ enum mac80211_tx_control_flags {
         IEEE80211_TX_INTFL_RETRIED              = BIT(15),
         IEEE80211_TX_INTFL_DONT_ENCRYPT         = BIT(16),
         IEEE80211_TX_CTL_PSPOLL_RESPONSE        = BIT(17),
+        IEEE80211_TX_CTL_MORE_FRAMES            = BIT(18),
 };
 
 /**
@@ -338,6 +350,21 @@ enum mac80211_rate_control_flags {
  *
  * When used for transmit status reporting, the driver should
  * always report the rate along with the flags it used.
+ *
+ * &struct ieee80211_tx_info contains an array of these structs
+ * in the control information, and it will be filled by the rate
+ * control algorithm according to what should be sent. For example,
+ * if this array contains, in the format { <idx>, <count> } the
+ * information
+ *    { 3, 2 }, { 2, 2 }, { 1, 4 }, { -1, 0 }, { -1, 0 }
+ * then this means that the frame should be transmitted
+ * up to twice at rate 3, up to twice at rate 2, and up to four
+ * times at rate 1 if it doesn't get acknowledged. Say it gets
+ * acknowledged by the peer after the fifth attempt, the status
+ * information should then contain
+ *   { 3, 2 }, { 2, 2 }, { 1, 1 }, { -1, 0 } ...
+ * since it was transmitted twice at rate 3, twice at rate 2
+ * and once at rate 1 after which we received an acknowledgement.
  */
 struct ieee80211_tx_rate {
         s8 idx;
diff --git a/net/mac80211/Kconfig b/net/mac80211/Kconfig
index 7dd77b6d4c9a..9db4ff836a3d 100644
--- a/net/mac80211/Kconfig
+++ b/net/mac80211/Kconfig
@@ -66,12 +66,12 @@ endmenu
 config MAC80211_MESH
         bool "Enable mac80211 mesh networking (pre-802.11s) support"
         depends on MAC80211 && EXPERIMENTAL
-        depends on BROKEN
         ---help---
          This options enables support of Draft 802.11s mesh networking.
-         The implementation is based on Draft 1.08 of the Mesh Networking
-         amendment. For more information visit http://o11s.org/.
-
+         The implementation is based on Draft 2.08 of the Mesh Networking
+         amendment.  However, no compliance with that draft is claimed or even
+         possible, as drafts leave a number of identifiers to be defined after
+         ratification.  For more information visit http://o11s.org/.
 
 config MAC80211_LEDS
         bool "Enable LED triggers"
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 4bbf5007799b..5608f6c68413 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -323,6 +323,8 @@ static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
 {
         struct ieee80211_sub_if_data *sdata = sta->sdata;
 
+        sinfo->generation = sdata->local->sta_generation;
+
         sinfo->filled = STATION_INFO_INACTIVE_TIME |
                         STATION_INFO_RX_BYTES |
                         STATION_INFO_TX_BYTES |
@@ -909,6 +911,8 @@ static void mpath_set_pinfo(struct mesh_path *mpath, u8 *next_hop,
         else
                 memset(next_hop, 0, ETH_ALEN);
 
+        pinfo->generation = mesh_paths_generation;
+
         pinfo->filled = MPATH_INFO_FRAME_QLEN |
                         MPATH_INFO_DSN |
                         MPATH_INFO_METRIC |
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 630a438180fd..a6abc7dfd903 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -284,6 +284,7 @@ struct ieee80211_if_managed {
 
         struct mutex mtx;
         struct ieee80211_bss *associated;
+        struct ieee80211_mgd_work *old_associate_work;
         struct list_head work_list;
 
         u8 bssid[ETH_ALEN];
@@ -354,7 +355,7 @@ struct ieee80211_if_mesh {
 
         unsigned long timers_running;
 
-        bool housekeeping;
+        unsigned long wrkq_flags;
 
         u8 mesh_id[IEEE80211_MAX_MESH_ID_LEN];
         size_t mesh_id_len;
@@ -677,6 +678,7 @@ struct ieee80211_local {
         struct list_head sta_list;
         struct sta_info *sta_hash[STA_HASH_SIZE];
         struct timer_list sta_cleanup;
+        int sta_generation;
 
         struct sk_buff_head pending[IEEE80211_MAX_QUEUES];
         struct tasklet_struct tx_pending_tasklet;
@@ -713,7 +715,7 @@ struct ieee80211_local {
         struct mutex scan_mtx;
         unsigned long scanning;
         struct cfg80211_ssid scan_ssid;
-        struct cfg80211_scan_request int_scan_req;
+        struct cfg80211_scan_request *int_scan_req;
         struct cfg80211_scan_request *scan_req;
         struct ieee80211_channel *scan_channel;
         const u8 *orig_ies;
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 0c4f8e122ed6..b03fd84777fa 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -765,9 +765,9 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
                 supp_ht = supp_ht || sband->ht_cap.ht_supported;
         }
 
-        local->int_scan_req.n_channels = channels;
-        local->int_scan_req.channels = kzalloc(sizeof(void *) * channels, GFP_KERNEL);
-        if (!local->int_scan_req.channels)
+        local->int_scan_req = kzalloc(sizeof(*local->int_scan_req) +
+                                      sizeof(void *) * channels, GFP_KERNEL);
+        if (!local->int_scan_req)
                 return -ENOMEM;
 
         /* if low-level driver supports AP, we also support VLAN */
@@ -882,13 +882,13 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
 
         /* alloc internal scan request */
         i = 0;
-        local->int_scan_req.ssids = &local->scan_ssid;
-        local->int_scan_req.n_ssids = 1;
+        local->int_scan_req->ssids = &local->scan_ssid;
+        local->int_scan_req->n_ssids = 1;
         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
                 if (!hw->wiphy->bands[band])
                         continue;
                 for (j = 0; j < hw->wiphy->bands[band]->n_channels; j++) {
-                        local->int_scan_req.channels[i] =
+                        local->int_scan_req->channels[i] =
                                 &hw->wiphy->bands[band]->channels[j];
                         i++;
                 }
@@ -920,7 +920,7 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
  fail_workqueue:
         wiphy_unregister(local->hw.wiphy);
  fail_wiphy_register:
-        kfree(local->int_scan_req.channels);
+        kfree(local->int_scan_req->channels);
         return result;
 }
 EXPORT_SYMBOL(ieee80211_register_hw);
@@ -962,7 +962,7 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
         wiphy_unregister(local->hw.wiphy);
         ieee80211_wep_free(local);
         ieee80211_led_exit(local);
-        kfree(local->int_scan_req.channels);
+        kfree(local->int_scan_req);
 }
 EXPORT_SYMBOL(ieee80211_unregister_hw);
 
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 2f4f518ab45c..3185e18c8214 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -47,14 +47,14 @@ static void ieee80211_mesh_housekeeping_timer(unsigned long data)
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
 
-        ifmsh->housekeeping = true;
+        ifmsh->wrkq_flags |= MESH_WORK_HOUSEKEEPING;
 
         if (local->quiescing) {
                 set_bit(TMR_RUNNING_HK, &ifmsh->timers_running);
                 return;
         }
 
-        ieee80211_queue_work(local->hw.workqueue, &ifmsh->work);
+        ieee80211_queue_work(&local->hw, &ifmsh->work);
 }
 
 /**
@@ -320,30 +320,6 @@ struct mesh_table *mesh_table_alloc(int size_order)
         return newtbl;
 }
 
-static void __mesh_table_free(struct mesh_table *tbl)
-{
-        kfree(tbl->hash_buckets);
-        kfree(tbl->hashwlock);
-        kfree(tbl);
-}
-
-void mesh_table_free(struct mesh_table *tbl, bool free_leafs)
-{
-        struct hlist_head *mesh_hash;
-        struct hlist_node *p, *q;
-        int i;
-
-        mesh_hash = tbl->hash_buckets;
-        for (i = 0; i <= tbl->hash_mask; i++) {
-                spin_lock(&tbl->hashwlock[i]);
-                hlist_for_each_safe(p, q, &mesh_hash[i]) {
-                        tbl->free_node(p, free_leafs);
-                        atomic_dec(&tbl->entries);
-                }
-                spin_unlock(&tbl->hashwlock[i]);
-        }
-        __mesh_table_free(tbl);
-}
 
 static void ieee80211_mesh_path_timer(unsigned long data)
 {
@@ -357,63 +333,79 @@ static void ieee80211_mesh_path_timer(unsigned long data)
                 return;
         }
 
-        ieee80211_queue_work(local->hw.workqueue, &ifmsh->work);
+        ieee80211_queue_work(&local->hw, &ifmsh->work);
 }
 
-struct mesh_table *mesh_table_grow(struct mesh_table *tbl)
-{
-        struct mesh_table *newtbl;
-        struct hlist_head *oldhash;
-        struct hlist_node *p, *q;
-        int i;
-
-        if (atomic_read(&tbl->entries)
-                        < tbl->mean_chain_len * (tbl->hash_mask + 1))
-                goto endgrow;
-
-        newtbl = mesh_table_alloc(tbl->size_order + 1);
-        if (!newtbl)
-                goto endgrow;
-
-        newtbl->free_node = tbl->free_node;
-        newtbl->mean_chain_len = tbl->mean_chain_len;
-        newtbl->copy_node = tbl->copy_node;
-        atomic_set(&newtbl->entries, atomic_read(&tbl->entries));
-
-        oldhash = tbl->hash_buckets;
-        for (i = 0; i <= tbl->hash_mask; i++)
-                hlist_for_each(p, &oldhash[i])
-                        if (tbl->copy_node(p, newtbl) < 0)
-                                goto errcopy;
-
-        return newtbl;
-
-errcopy:
-        for (i = 0; i <= newtbl->hash_mask; i++) {
-                hlist_for_each_safe(p, q, &newtbl->hash_buckets[i])
-                        tbl->free_node(p, 0);
+/**
+ * ieee80211_fill_mesh_addresses - fill addresses of a locally originated mesh frame
+ * @hdr:        802.11 frame header
+ * @fc:         frame control field
+ * @meshda:     destination address in the mesh
+ * @meshsa:     source address address in the mesh.  Same as TA, as frame is
+ *              locally originated.
+ *
+ * Return the length of the 802.11 (does not include a mesh control header)
+ */
+int ieee80211_fill_mesh_addresses(struct ieee80211_hdr *hdr, __le16 *fc, char
+                *meshda, char *meshsa) {
+        if (is_multicast_ether_addr(meshda)) {
+                *fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS);
+                /* DA TA SA */
+                memcpy(hdr->addr1, meshda, ETH_ALEN);
+                memcpy(hdr->addr2, meshsa, ETH_ALEN);
+                memcpy(hdr->addr3, meshsa, ETH_ALEN);
+                return 24;
+        } else {
+                *fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS |
+                                IEEE80211_FCTL_TODS);
+                /* RA TA DA SA */
+                memset(hdr->addr1, 0, ETH_ALEN);   /* RA is resolved later */
+                memcpy(hdr->addr2, meshsa, ETH_ALEN);
+                memcpy(hdr->addr3, meshda, ETH_ALEN);
+                memcpy(hdr->addr4, meshsa, ETH_ALEN);
+                return 30;
         }
-        __mesh_table_free(newtbl);
-endgrow:
-        return NULL;
 }
 
 /**
  * ieee80211_new_mesh_header - create a new mesh header
  * @meshhdr:    uninitialized mesh header
  * @sdata:      mesh interface to be used
+ * @addr4:      addr4 of the mesh frame (1st in ae header)
+ *              may be NULL
+ * @addr5:      addr5 of the mesh frame (1st or 2nd in ae header)
+ *              may be NULL unless addr6 is present
+ * @addr6:      addr6 of the mesh frame (2nd or 3rd in ae header)
+ *              may be NULL unless addr5 is present
  *
  * Return the header length.
  */
 int ieee80211_new_mesh_header(struct ieee80211s_hdr *meshhdr,
-                struct ieee80211_sub_if_data *sdata)
+                struct ieee80211_sub_if_data *sdata, char *addr4,
+                char *addr5, char *addr6)
 {
-        meshhdr->flags = 0;
+        int aelen = 0;
+        memset(meshhdr, 0, sizeof(meshhdr));
         meshhdr->ttl = sdata->u.mesh.mshcfg.dot11MeshTTL;
         put_unaligned(cpu_to_le32(sdata->u.mesh.mesh_seqnum), &meshhdr->seqnum);
         sdata->u.mesh.mesh_seqnum++;
-
-        return 6;
+        if (addr4) {
+                meshhdr->flags |= MESH_FLAGS_AE_A4;
+                aelen += ETH_ALEN;
+                memcpy(meshhdr->eaddr1, addr4, ETH_ALEN);
+        }
+        if (addr5 && addr6) {
+                meshhdr->flags |= MESH_FLAGS_AE_A5_A6;
+                aelen += 2 * ETH_ALEN;
+                if (!addr4) {
+                        memcpy(meshhdr->eaddr1, addr5, ETH_ALEN);
+                        memcpy(meshhdr->eaddr2, addr6, ETH_ALEN);
+                } else {
+                        memcpy(meshhdr->eaddr2, addr5, ETH_ALEN);
+                        memcpy(meshhdr->eaddr3, addr6, ETH_ALEN);
+                }
+        }
+        return 6 + aelen;
 }
 
 static void ieee80211_mesh_housekeeping(struct ieee80211_sub_if_data *sdata,
@@ -433,7 +425,6 @@ static void ieee80211_mesh_housekeeping(struct ieee80211_sub_if_data *sdata,
         if (free_plinks != sdata->u.mesh.accepting_plinks)
                 ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
 
-        ifmsh->housekeeping = false;
         mod_timer(&ifmsh->housekeeping_timer,
                   round_jiffies(jiffies + IEEE80211_MESH_HOUSEKEEPING_INTERVAL));
 }
@@ -470,10 +461,12 @@ void ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata)
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
         struct ieee80211_local *local = sdata->local;
 
-        ifmsh->housekeeping = true;
-        ieee80211_queue_work(local->hw.workqueue, &ifmsh->work);
+        ifmsh->wrkq_flags |= MESH_WORK_HOUSEKEEPING;
+        ieee80211_queue_work(&local->hw, &ifmsh->work);
+        sdata->vif.bss_conf.beacon_int = MESH_DEFAULT_BEACON_INTERVAL;
         ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON |
-                                                BSS_CHANGED_BEACON_ENABLED);
+                                                BSS_CHANGED_BEACON_ENABLED |
+                                                BSS_CHANGED_BEACON_INT);
 }
 
 void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata)
@@ -608,7 +601,13 @@ static void ieee80211_mesh_work(struct work_struct *work)
                        ifmsh->last_preq + msecs_to_jiffies(ifmsh->mshcfg.dot11MeshHWMPpreqMinInterval)))
                 mesh_path_start_discovery(sdata);
 
-        if (ifmsh->housekeeping)
+        if (test_and_clear_bit(MESH_WORK_GROW_MPATH_TABLE, &ifmsh->wrkq_flags))
+                mesh_mpath_table_grow();
+
+        if (test_and_clear_bit(MESH_WORK_GROW_MPATH_TABLE, &ifmsh->wrkq_flags))
+                mesh_mpp_table_grow();
+
+        if (test_and_clear_bit(MESH_WORK_HOUSEKEEPING, &ifmsh->wrkq_flags))
                 ieee80211_mesh_housekeeping(sdata, ifmsh);
 }
 
@@ -619,7 +618,7 @@ void ieee80211_mesh_notify_scan_completed(struct ieee80211_local *local)
         rcu_read_lock();
         list_for_each_entry_rcu(sdata, &local->interfaces, list)
                 if (ieee80211_vif_is_mesh(&sdata->vif))
-                        ieee80211_queue_work(local->hw.workqueue, &sdata->u.mesh.work);
+                        ieee80211_queue_work(&local->hw, &sdata->u.mesh.work);
         rcu_read_unlock();
 }
 
@@ -692,7 +691,7 @@ ieee80211_mesh_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
         case IEEE80211_STYPE_PROBE_RESP:
         case IEEE80211_STYPE_BEACON:
                 skb_queue_tail(&ifmsh->skb_queue, skb);
-                ieee80211_queue_work(local->hw.workqueue, &ifmsh->work);
+                ieee80211_queue_work(&local->hw, &ifmsh->work);
                 return RX_QUEUED;
         }
 
diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h
index 2a2ed182cb7e..eb23fc639b2b 100644
--- a/net/mac80211/mesh.h
+++ b/net/mac80211/mesh.h
@@ -44,6 +44,23 @@ enum mesh_path_flags {
 };
 
 /**
+ * enum mesh_deferred_task_flags - mac80211 mesh deferred tasks
+ *
+ *
+ *
+ * @MESH_WORK_HOUSEKEEPING: run the periodic mesh housekeeping tasks
+ * @MESH_WORK_GROW_MPATH_TABLE: the mesh path table is full and needs
+ * to grow.
+ * @MESH_WORK_GROW_MPP_TABLE: the mesh portals table is full and needs to
+ * grow
+ */
+enum mesh_deferred_task_flags {
+        MESH_WORK_HOUSEKEEPING,
+        MESH_WORK_GROW_MPATH_TABLE,
+        MESH_WORK_GROW_MPP_TABLE,
+};
+
+/**
  * struct mesh_path - mac80211 mesh path structure
  *
  * @dst: mesh path destination mac address
@@ -61,7 +78,7 @@ enum mesh_path_flags {
  *      retry
  * @discovery_retries: number of discovery retries
  * @flags: mesh path flags, as specified on &enum mesh_path_flags
- * @state_lock: mesh pat state lock
+ * @state_lock: mesh path state lock
  *
  *
  * The combination of dst and sdata is unique in the mesh path table. Since the
@@ -174,6 +191,7 @@ struct mesh_rmc {
  */
 #define MESH_PATH_REFRESH_TIME                  1000
 #define MESH_MIN_DISCOVERY_TIMEOUT (2 * MESH_DIAM_TRAVERSAL_TIME)
+#define MESH_DEFAULT_BEACON_INTERVAL            1000    /* in 1024 us units */
 
 #define MESH_MAX_PREQ_RETRIES 4
 #define MESH_PATH_EXPIRE (600 * HZ)
@@ -193,8 +211,11 @@ struct mesh_rmc {
 
 /* Public interfaces */
 /* Various */
+int ieee80211_fill_mesh_addresses(struct ieee80211_hdr *hdr, __le16 *fc,
+                char *da, char *sa);
 int ieee80211_new_mesh_header(struct ieee80211s_hdr *meshhdr,
-                struct ieee80211_sub_if_data *sdata);
+                struct ieee80211_sub_if_data *sdata, char *addr4,
+                char *addr5, char *addr6);
 int mesh_rmc_check(u8 *addr, struct ieee80211s_hdr *mesh_hdr,
                 struct ieee80211_sub_if_data *sdata);
 bool mesh_matches_local(struct ieee802_11_elems *ie,
@@ -246,7 +267,8 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata,
 /* Mesh tables */
 struct mesh_table *mesh_table_alloc(int size_order);
 void mesh_table_free(struct mesh_table *tbl, bool free_leafs);
-struct mesh_table *mesh_table_grow(struct mesh_table *tbl);
+void mesh_mpath_table_grow(void);
+void mesh_mpp_table_grow(void);
 u32 mesh_table_hash(u8 *addr, struct ieee80211_sub_if_data *sdata,
                 struct mesh_table *tbl);
 /* Mesh paths */
@@ -265,6 +287,8 @@ void mesh_path_discard_frame(struct sk_buff *skb,
 void mesh_path_quiesce(struct ieee80211_sub_if_data *sdata);
 void mesh_path_restart(struct ieee80211_sub_if_data *sdata);
 
+extern int mesh_paths_generation;
+
 #ifdef CONFIG_MAC80211_MESH
 extern int mesh_allocated;
 
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index 11ab71a68ff9..ef1efd362691 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -397,7 +397,8 @@ static u32 hwmp_route_info_get(struct ieee80211_sub_if_data *sdata,
 
 static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata,
                                     struct ieee80211_mgmt *mgmt,
-                                    u8 *preq_elem, u32 metric) {
+                                    u8 *preq_elem, u32 metric)
+{
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
         struct mesh_path *mpath;
         u8 *dst_addr, *orig_addr;
@@ -430,7 +431,7 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata,
                         if ((!(mpath->flags & MESH_PATH_DSN_VALID)) ||
                                         DSN_LT(mpath->dsn, dst_dsn)) {
                                 mpath->dsn = dst_dsn;
-                                mpath->flags &= MESH_PATH_DSN_VALID;
+                                mpath->flags |= MESH_PATH_DSN_VALID;
                         } else if ((!(dst_flags & MP_F_DO)) &&
                                         (mpath->flags & MESH_PATH_ACTIVE)) {
                                 reply = true;
@@ -660,14 +661,14 @@ static void mesh_queue_preq(struct mesh_path *mpath, u8 flags)
         spin_unlock(&ifmsh->mesh_preq_queue_lock);
 
         if (time_after(jiffies, ifmsh->last_preq + min_preq_int_jiff(sdata)))
-                ieee80211_queue_work(sdata->local->hw.workqueue, &ifmsh->work);
+                ieee80211_queue_work(&sdata->local->hw, &ifmsh->work);
 
         else if (time_before(jiffies, ifmsh->last_preq)) {
                 /* avoid long wait if did not send preqs for a long time
                  * and jiffies wrapped around
                  */
                 ifmsh->last_preq = jiffies - min_preq_int_jiff(sdata) - 1;
-                ieee80211_queue_work(sdata->local->hw.workqueue, &ifmsh->work);
+                ieee80211_queue_work(&sdata->local->hw, &ifmsh->work);
         } else
                 mod_timer(&ifmsh->mesh_path_timer, ifmsh->last_preq +
                                                 min_preq_int_jiff(sdata));
@@ -791,7 +792,7 @@ int mesh_nexthop_lookup(struct sk_buff *skb,
         }
 
         if (mpath->flags & MESH_PATH_ACTIVE) {
-                if (time_after(jiffies, mpath->exp_time -
+                if (time_after(jiffies, mpath->exp_time +
                         msecs_to_jiffies(sdata->u.mesh.mshcfg.path_refresh_time))
                                 && !memcmp(sdata->dev->dev_addr, hdr->addr4,
                                            ETH_ALEN)
@@ -810,10 +811,8 @@ int mesh_nexthop_lookup(struct sk_buff *skb,
                 }
 
                 if (skb_queue_len(&mpath->frame_queue) >=
-                                MESH_FRAME_QUEUE_LEN) {
-                        skb_to_free = mpath->frame_queue.next;
-                        skb_unlink(skb_to_free, &mpath->frame_queue);
-                }
+                                MESH_FRAME_QUEUE_LEN)
+                        skb_to_free = skb_dequeue(&mpath->frame_queue);
 
                 info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
                 skb_queue_tail(&mpath->frame_queue, skb);
diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index 04b9e4d61b8e..751c4d0e2b36 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -38,6 +38,71 @@ struct mpath_node {
 static struct mesh_table *mesh_paths;
 static struct mesh_table *mpp_paths; /* Store paths for MPP&MAP */
 
+int mesh_paths_generation;
+static void __mesh_table_free(struct mesh_table *tbl)
+{
+        kfree(tbl->hash_buckets);
+        kfree(tbl->hashwlock);
+        kfree(tbl);
+}
+
+void mesh_table_free(struct mesh_table *tbl, bool free_leafs)
+{
+        struct hlist_head *mesh_hash;
+        struct hlist_node *p, *q;
+        int i;
+
+        mesh_hash = tbl->hash_buckets;
+        for (i = 0; i <= tbl->hash_mask; i++) {
+                spin_lock(&tbl->hashwlock[i]);
+                hlist_for_each_safe(p, q, &mesh_hash[i]) {
+                        tbl->free_node(p, free_leafs);
+                        atomic_dec(&tbl->entries);
+                }
+                spin_unlock(&tbl->hashwlock[i]);
+        }
+        __mesh_table_free(tbl);
+}
+
+static struct mesh_table *mesh_table_grow(struct mesh_table *tbl)
+{
+        struct mesh_table *newtbl;
+        struct hlist_head *oldhash;
+        struct hlist_node *p, *q;
+        int i;
+
+        if (atomic_read(&tbl->entries)
+                        < tbl->mean_chain_len * (tbl->hash_mask + 1))
+                goto endgrow;
+
+        newtbl = mesh_table_alloc(tbl->size_order + 1);
+        if (!newtbl)
+                goto endgrow;
+
+        newtbl->free_node = tbl->free_node;
+        newtbl->mean_chain_len = tbl->mean_chain_len;
+        newtbl->copy_node = tbl->copy_node;
+        atomic_set(&newtbl->entries, atomic_read(&tbl->entries));
+
+        oldhash = tbl->hash_buckets;
+        for (i = 0; i <= tbl->hash_mask; i++)
+                hlist_for_each(p, &oldhash[i])
+                        if (tbl->copy_node(p, newtbl) < 0)
+                                goto errcopy;
+
+        return newtbl;
+
+errcopy:
+        for (i = 0; i <= newtbl->hash_mask; i++) {
+                hlist_for_each_safe(p, q, &newtbl->hash_buckets[i])
+                        tbl->free_node(p, 0);
+        }
+        __mesh_table_free(newtbl);
+endgrow:
+        return NULL;
+}
+
+
 /* This lock will have the grow table function as writer and add / delete nodes
  * as readers. When reading the table (i.e. doing lookups) we are well protected
  * by RCU
@@ -185,6 +250,8 @@ struct mesh_path *mesh_path_lookup_by_idx(int idx, struct ieee80211_sub_if_data
  */
 int mesh_path_add(u8 *dst, struct ieee80211_sub_if_data *sdata)
 {
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+        struct ieee80211_local *local = sdata->local;
         struct mesh_path *mpath, *new_mpath;
         struct mpath_node *node, *new_node;
         struct hlist_head *bucket;
@@ -193,8 +260,6 @@ int mesh_path_add(u8 *dst, struct ieee80211_sub_if_data *sdata)
         int err = 0;
         u32 hash_idx;
 
-        might_sleep();
-
         if (memcmp(dst, sdata->dev->dev_addr, ETH_ALEN) == 0)
                 /* never add ourselves as neighbours */
                 return -ENOTSUPP;
@@ -206,11 +271,11 @@ int mesh_path_add(u8 *dst, struct ieee80211_sub_if_data *sdata)
                 return -ENOSPC;
 
         err = -ENOMEM;
-        new_mpath = kzalloc(sizeof(struct mesh_path), GFP_KERNEL);
+        new_mpath = kzalloc(sizeof(struct mesh_path), GFP_ATOMIC);
         if (!new_mpath)
                 goto err_path_alloc;
 
-        new_node = kmalloc(sizeof(struct mpath_node), GFP_KERNEL);
+        new_node = kmalloc(sizeof(struct mpath_node), GFP_ATOMIC);
         if (!new_node)
                 goto err_node_alloc;
 
@@ -243,23 +308,13 @@ int mesh_path_add(u8 *dst, struct ieee80211_sub_if_data *sdata)
                 mesh_paths->mean_chain_len * (mesh_paths->hash_mask + 1))
                 grow = 1;
 
+        mesh_paths_generation++;
+
         spin_unlock(&mesh_paths->hashwlock[hash_idx]);
         read_unlock(&pathtbl_resize_lock);
         if (grow) {
-                struct mesh_table *oldtbl, *newtbl;
-
-                write_lock(&pathtbl_resize_lock);
-                oldtbl = mesh_paths;
-                newtbl = mesh_table_grow(mesh_paths);
-                if (!newtbl) {
-                        write_unlock(&pathtbl_resize_lock);
-                        return 0;
-                }
-                rcu_assign_pointer(mesh_paths, newtbl);
-                write_unlock(&pathtbl_resize_lock);
-
-                synchronize_rcu();
-                mesh_table_free(oldtbl, false);
+                set_bit(MESH_WORK_GROW_MPATH_TABLE,  &ifmsh->wrkq_flags);
+                ieee80211_queue_work(&local->hw, &ifmsh->work);
         }
         return 0;
 
@@ -274,9 +329,46 @@ err_path_alloc:
         return err;
 }
 
+void mesh_mpath_table_grow(void)
+{
+        struct mesh_table *oldtbl, *newtbl;
+
+        write_lock(&pathtbl_resize_lock);
+        oldtbl = mesh_paths;
+        newtbl = mesh_table_grow(mesh_paths);
+        if (!newtbl) {
+                write_unlock(&pathtbl_resize_lock);
+                return;
+        }
+        rcu_assign_pointer(mesh_paths, newtbl);
+        write_unlock(&pathtbl_resize_lock);
+
+        synchronize_rcu();
+        mesh_table_free(oldtbl, false);
+}
+
+void mesh_mpp_table_grow(void)
+{
+        struct mesh_table *oldtbl, *newtbl;
+
+        write_lock(&pathtbl_resize_lock);
+        oldtbl = mpp_paths;
+        newtbl = mesh_table_grow(mpp_paths);
+        if (!newtbl) {
+                write_unlock(&pathtbl_resize_lock);
+                return;
+        }
+        rcu_assign_pointer(mpp_paths, newtbl);
+        write_unlock(&pathtbl_resize_lock);
+
+        synchronize_rcu();
+        mesh_table_free(oldtbl, false);
+}
 
 int mpp_path_add(u8 *dst, u8 *mpp, struct ieee80211_sub_if_data *sdata)
 {
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+        struct ieee80211_local *local = sdata->local;
         struct mesh_path *mpath, *new_mpath;
         struct mpath_node *node, *new_node;
         struct hlist_head *bucket;
@@ -285,8 +377,6 @@ int mpp_path_add(u8 *dst, u8 *mpp, struct ieee80211_sub_if_data *sdata)
         int err = 0;
         u32 hash_idx;
 
-        might_sleep();
-
         if (memcmp(dst, sdata->dev->dev_addr, ETH_ALEN) == 0)
                 /* never add ourselves as neighbours */
                 return -ENOTSUPP;
@@ -295,11 +385,11 @@ int mpp_path_add(u8 *dst, u8 *mpp, struct ieee80211_sub_if_data *sdata)
                 return -ENOTSUPP;
 
         err = -ENOMEM;
-        new_mpath = kzalloc(sizeof(struct mesh_path), GFP_KERNEL);
+        new_mpath = kzalloc(sizeof(struct mesh_path), GFP_ATOMIC);
         if (!new_mpath)
                 goto err_path_alloc;
 
-        new_node = kmalloc(sizeof(struct mpath_node), GFP_KERNEL);
+        new_node = kmalloc(sizeof(struct mpath_node), GFP_ATOMIC);
         if (!new_node)
                 goto err_node_alloc;
 
@@ -333,20 +423,8 @@ int mpp_path_add(u8 *dst, u8 *mpp, struct ieee80211_sub_if_data *sdata)
         spin_unlock(&mpp_paths->hashwlock[hash_idx]);
         read_unlock(&pathtbl_resize_lock);
         if (grow) {
-                struct mesh_table *oldtbl, *newtbl;
-
-                write_lock(&pathtbl_resize_lock);
-                oldtbl = mpp_paths;
-                newtbl = mesh_table_grow(mpp_paths);
-                if (!newtbl) {
-                        write_unlock(&pathtbl_resize_lock);
-                        return 0;
-                }
-                rcu_assign_pointer(mpp_paths, newtbl);
-                write_unlock(&pathtbl_resize_lock);
-
-                synchronize_rcu();
-                mesh_table_free(oldtbl, false);
+                set_bit(MESH_WORK_GROW_MPP_TABLE,  &ifmsh->wrkq_flags);
+                ieee80211_queue_work(&local->hw, &ifmsh->work);
         }
         return 0;
 
@@ -484,6 +562,7 @@ int mesh_path_del(u8 *addr, struct ieee80211_sub_if_data *sdata)
 
         err = -ENXIO;
 enddel:
+        mesh_paths_generation++;
         spin_unlock(&mesh_paths->hashwlock[hash_idx]);
         read_unlock(&pathtbl_resize_lock);
         return err;
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index cb14253587f1..ffcbad75e09b 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -409,7 +409,7 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
         baselen = (u8 *) mgmt->u.action.u.plink_action.variable - (u8 *) mgmt;
         if (mgmt->u.action.u.plink_action.action_code == PLINK_CONFIRM) {
                 baseaddr += 4;
-                baselen -= 4;
+                baselen += 4;
         }
         ieee802_11_parse_elems(baseaddr, len - baselen, &elems);
         if (!elems.peer_link) {
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 6d5a1ee0445f..c374d2d73fa4 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -880,10 +880,11 @@ static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
 }
 
 static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
-                                     struct ieee80211_bss *bss,
+                                     struct ieee80211_mgd_work *wk,
                                      u32 bss_info_changed)
 {
         struct ieee80211_local *local = sdata->local;
+        struct ieee80211_bss *bss = wk->bss;
 
         bss_info_changed |= BSS_CHANGED_ASSOC;
         /* set timing information */
@@ -896,6 +897,7 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
                 bss->cbss.capability, bss->has_erp_value, bss->erp_value);
 
         sdata->u.mgd.associated = bss;
+        sdata->u.mgd.old_associate_work = wk;
         memcpy(sdata->u.mgd.bssid, bss->cbss.bssid, ETH_ALEN);
 
         /* just to be sure */
@@ -1010,7 +1012,8 @@ ieee80211_authenticate(struct ieee80211_sub_if_data *sdata,
         return RX_MGMT_NONE;
 }
 
-static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata)
+static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
+                                   bool deauth)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
@@ -1028,6 +1031,16 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata)
         ifmgd->associated = NULL;
         memset(ifmgd->bssid, 0, ETH_ALEN);
 
+        if (deauth) {
+                kfree(ifmgd->old_associate_work);
+                ifmgd->old_associate_work = NULL;
+        } else {
+                struct ieee80211_mgd_work *wk = ifmgd->old_associate_work;
+
+                wk->state = IEEE80211_MGD_STATE_IDLE;
+                list_add(&wk->list, &ifmgd->work_list);
+        }
+
         /*
          * we need to commit the associated = NULL change because the
          * scan code uses that to determine whether this iface should
@@ -1345,7 +1358,7 @@ ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
                         sdata->dev->name, bssid, reason_code);
 
         if (!wk) {
-                ieee80211_set_disassoc(sdata);
+                ieee80211_set_disassoc(sdata, true);
         } else {
                 list_del(&wk->list);
                 kfree(wk);
@@ -1378,7 +1391,7 @@ ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
         printk(KERN_DEBUG "%s: disassociated (Reason: %u)\n",
                         sdata->dev->name, reason_code);
 
-        ieee80211_set_disassoc(sdata);
+        ieee80211_set_disassoc(sdata, false);
         return RX_MGMT_CFG80211_DISASSOC;
 }
 
@@ -1581,7 +1594,8 @@ ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
          * ieee80211_set_associated() will tell the driver */
         bss_conf->aid = aid;
         bss_conf->assoc_capability = capab_info;
-        ieee80211_set_associated(sdata, wk->bss, changed);
+        /* this will take ownership of wk */
+        ieee80211_set_associated(sdata, wk, changed);
 
         /*
          * Start timer to probe the connection to the AP now.
@@ -1590,7 +1604,6 @@ ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
         ieee80211_sta_rx_notify(sdata, (struct ieee80211_hdr *)mgmt);
         mod_beacon_timer(sdata);
 
-        kfree(wk);
         return RX_MGMT_CFG80211_ASSOC;
 }
 
@@ -2096,7 +2109,7 @@ static void ieee80211_sta_work(struct work_struct *work)
                         printk(KERN_DEBUG "No probe response from AP %pM"
                                 " after %dms, disconnecting.\n",
                                 bssid, (1000 * IEEE80211_PROBE_WAIT)/HZ);
-                        ieee80211_set_disassoc(sdata);
+                        ieee80211_set_disassoc(sdata, true);
                         mutex_unlock(&ifmgd->mtx);
                         /*
                          * must be outside lock due to cfg80211,
@@ -2500,7 +2513,7 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
 
         if (ifmgd->associated && &ifmgd->associated->cbss == req->bss) {
                 bssid = req->bss->bssid;
-                ieee80211_set_disassoc(sdata);
+                ieee80211_set_disassoc(sdata, true);
         } else list_for_each_entry(wk, &ifmgd->work_list, list) {
                 if (&wk->bss->cbss == req->bss) {
                         bssid = req->bss->bssid;
@@ -2552,7 +2565,7 @@ int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
                 return -ENOLINK;
         }
 
-        ieee80211_set_disassoc(sdata);
+        ieee80211_set_disassoc(sdata, false);
 
         mutex_unlock(&ifmgd->mtx);
 
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index 7c5142988bbb..007164919e02 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -51,6 +51,7 @@
 #include <linux/random.h>
 #include <linux/ieee80211.h>
 #include <net/mac80211.h>
+#include "mesh.h"
 #include "rate.h"
 #include "rc80211_minstrel.h"
 
@@ -155,12 +156,16 @@ minstrel_tx_status(void *priv, struct ieee80211_supported_band *sband,
                    struct sk_buff *skb)
 {
         struct minstrel_sta_info *mi = priv_sta;
+        struct minstrel_priv *mp = (struct minstrel_priv *)priv;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct ieee80211_tx_rate *ar = info->status.rates;
+        struct ieee80211_local *local = hw_to_local(mp->hw);
+        struct sta_info *si;
         int i, ndx;
         int success;
 
         success = !!(info->flags & IEEE80211_TX_STAT_ACK);
+        si = sta_info_get(local, sta->addr);
 
         for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
                 if (ar[i].idx < 0)
@@ -172,8 +177,17 @@ minstrel_tx_status(void *priv, struct ieee80211_supported_band *sband,
 
                 mi->r[ndx].attempts += ar[i].count;
 
-                if ((i != IEEE80211_TX_MAX_RATES - 1) && (ar[i + 1].idx < 0))
+                if ((i != IEEE80211_TX_MAX_RATES - 1) && (ar[i + 1].idx < 0)) {
                         mi->r[ndx].success += success;
+                        if (si) {
+                                si->fail_avg = (18050 - mi->r[ndx].probability)
+                                        / 180;
+                                WARN_ON(si->fail_avg > 100);
+                                if (si->fail_avg == 100 &&
+                                        ieee80211_vif_is_mesh(&si->sdata->vif))
+                                        mesh_plink_broken(si);
+                        }
+                }
         }
 
         if ((info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE) && (i >= 0))
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 25a669c86e14..4cd9e45b1443 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -489,12 +489,21 @@ ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
         unsigned int hdrlen = ieee80211_hdrlen(hdr->frame_control);
+        char *dev_addr = rx->dev->dev_addr;
 
         if (ieee80211_is_data(hdr->frame_control)) {
-                if (!ieee80211_has_a4(hdr->frame_control))
-                        return RX_DROP_MONITOR;
-                if (memcmp(hdr->addr4, rx->dev->dev_addr, ETH_ALEN) == 0)
-                        return RX_DROP_MONITOR;
+                if (is_multicast_ether_addr(hdr->addr1)) {
+                        if (ieee80211_has_tods(hdr->frame_control) ||
+                                !ieee80211_has_fromds(hdr->frame_control))
+                                return RX_DROP_MONITOR;
+                        if (memcmp(hdr->addr3, dev_addr, ETH_ALEN) == 0)
+                                return RX_DROP_MONITOR;
+                } else {
+                        if (!ieee80211_has_a4(hdr->frame_control))
+                                return RX_DROP_MONITOR;
+                        if (memcmp(hdr->addr4, dev_addr, ETH_ALEN) == 0)
+                                return RX_DROP_MONITOR;
+                }
         }
 
         /* If there is not an established peer link and this is not a peer link
@@ -527,7 +536,7 @@ ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
 
         if (ieee80211_is_data(hdr->frame_control) &&
             is_multicast_ether_addr(hdr->addr1) &&
-            mesh_rmc_check(hdr->addr4, msh_h_get(hdr, hdrlen), rx->sdata))
+            mesh_rmc_check(hdr->addr3, msh_h_get(hdr, hdrlen), rx->sdata))
                 return RX_DROP_MONITOR;
 #undef msh_h_get
 
@@ -1495,7 +1504,8 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
                 /* illegal frame */
                 return RX_DROP_MONITOR;
 
-        if (mesh_hdr->flags & MESH_FLAGS_AE_A5_A6){
+        if (!is_multicast_ether_addr(hdr->addr1) &&
+                        (mesh_hdr->flags & MESH_FLAGS_AE_A5_A6)) {
                 struct mesh_path *mppath;
 
                 rcu_read_lock();
@@ -1512,7 +1522,9 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
                 rcu_read_unlock();
         }
 
-        if (compare_ether_addr(rx->dev->dev_addr, hdr->addr3) == 0)
+        /* Frame has reached destination.  Don't forward */
+        if (!is_multicast_ether_addr(hdr->addr1) &&
+                        compare_ether_addr(rx->dev->dev_addr, hdr->addr3) == 0)
                 return RX_CONTINUE;
 
         mesh_hdr->ttl--;
@@ -1532,22 +1544,21 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
                                                    rx->dev->name);
 
                         fwd_hdr =  (struct ieee80211_hdr *) fwd_skb->data;
-                        /*
-                         * Save TA to addr1 to send TA a path error if a
-                         * suitable next hop is not found
-                         */
-                        memcpy(fwd_hdr->addr1, fwd_hdr->addr2, ETH_ALEN);
                         memcpy(fwd_hdr->addr2, rx->dev->dev_addr, ETH_ALEN);
                         info = IEEE80211_SKB_CB(fwd_skb);
                         memset(info, 0, sizeof(*info));
                         info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
                         info->control.vif = &rx->sdata->vif;
                         ieee80211_select_queue(local, fwd_skb);
-                        if (is_multicast_ether_addr(fwd_hdr->addr3))
-                                memcpy(fwd_hdr->addr1, fwd_hdr->addr3,
+                        if (!is_multicast_ether_addr(fwd_hdr->addr1)) {
+                                int err;
+                                /*
+                                 * Save TA to addr1 to send TA a path error if a
+                                 * suitable next hop is not found
+                                 */
+                                memcpy(fwd_hdr->addr1, fwd_hdr->addr2,
                                                 ETH_ALEN);
-                        else {
-                                int err = mesh_nexthop_lookup(fwd_skb, sdata);
+                                err = mesh_nexthop_lookup(fwd_skb, sdata);
                                 /* Failed to immediately resolve next hop:
                                  * fwded frame was dropped or will be added
                                  * later to the pending skb queue.  */
@@ -1560,7 +1571,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
                 }
         }
 
-        if (is_multicast_ether_addr(hdr->addr3) ||
+        if (is_multicast_ether_addr(hdr->addr1) ||
             rx->dev->flags & IFF_PROMISC)
                 return RX_CONTINUE;
         else
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 244f53f3c8b4..e091cbc3434f 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -277,7 +277,7 @@ void ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
         if (test_bit(SCAN_HW_SCANNING, &local->scanning))
                 ieee80211_restore_scan_ies(local);
 
-        if (local->scan_req != &local->int_scan_req)
+        if (local->scan_req != local->int_scan_req)
                 cfg80211_scan_done(local->scan_req, aborted);
         local->scan_req = NULL;
 
@@ -423,7 +423,7 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
         local->scan_req = req;
         local->scan_sdata = sdata;
 
-        if (req != &local->int_scan_req &&
+        if (req != local->int_scan_req &&
             sdata->vif.type == NL80211_IFTYPE_STATION &&
             !list_empty(&ifmgd->work_list)) {
                 /* actually wait for the work it's doing to finish/time out */
@@ -743,10 +743,10 @@ int ieee80211_request_internal_scan(struct ieee80211_sub_if_data *sdata,
         if (local->scan_req)
                 goto unlock;
 
-        memcpy(local->int_scan_req.ssids[0].ssid, ssid, IEEE80211_MAX_SSID_LEN);
-        local->int_scan_req.ssids[0].ssid_len = ssid_len;
+        memcpy(local->int_scan_req->ssids[0].ssid, ssid, IEEE80211_MAX_SSID_LEN);
+        local->int_scan_req->ssids[0].ssid_len = ssid_len;
 
-        ret = __ieee80211_start_scan(sdata, &sdata->local->int_scan_req);
+        ret = __ieee80211_start_scan(sdata, sdata->local->int_scan_req);
  unlock:
         mutex_unlock(&local->scan_mtx);
         return ret;
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index a360bceeba59..eec001491e66 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -349,6 +349,7 @@ int sta_info_insert(struct sta_info *sta)
                 goto out_free;
         }
         list_add(&sta->list, &local->sta_list);
+        local->sta_generation++;
         local->num_sta++;
         sta_info_hash_add(local, sta);
 
@@ -485,6 +486,7 @@ static void __sta_info_unlink(struct sta_info **sta)
         }
 
         local->num_sta--;
+        local->sta_generation++;
 
         if (local->ops->sta_notify) {
                 if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 7cffaa046b33..0c08d1e60cb5 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -317,30 +317,30 @@ ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx)
         if (!atomic_read(&tx->sdata->bss->num_sta_ps))
                 return TX_CONTINUE;
 
+        /* buffered in hardware */
+        if (!(tx->local->hw.flags & IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING)) {
+                info->flags |= IEEE80211_TX_CTL_SEND_AFTER_DTIM;
+
+                return TX_CONTINUE;
+        }
+
         /* buffered in mac80211 */
-        if (tx->local->hw.flags & IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING) {
-                if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER)
-                        purge_old_ps_buffers(tx->local);
-                if (skb_queue_len(&tx->sdata->bss->ps_bc_buf) >=
-                    AP_MAX_BC_BUFFER) {
+        if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER)
+                purge_old_ps_buffers(tx->local);
+
+        if (skb_queue_len(&tx->sdata->bss->ps_bc_buf) >= AP_MAX_BC_BUFFER) {
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
-                        if (net_ratelimit()) {
-                                printk(KERN_DEBUG "%s: BC TX buffer full - "
-                                       "dropping the oldest frame\n",
-                                       tx->dev->name);
-                        }
+                if (net_ratelimit())
+                        printk(KERN_DEBUG "%s: BC TX buffer full - dropping the oldest frame\n",
+                               tx->dev->name);
 #endif
-                        dev_kfree_skb(skb_dequeue(&tx->sdata->bss->ps_bc_buf));
-                } else
-                        tx->local->total_ps_buffered++;
-                skb_queue_tail(&tx->sdata->bss->ps_bc_buf, tx->skb);
-                return TX_QUEUED;
-        }
+                dev_kfree_skb(skb_dequeue(&tx->sdata->bss->ps_bc_buf));
+        } else
+                tx->local->total_ps_buffered++;
 
-        /* buffered in hardware */
-        info->flags |= IEEE80211_TX_CTL_SEND_AFTER_DTIM;
+        skb_queue_tail(&tx->sdata->bss->ps_bc_buf, tx->skb);
 
-        return TX_CONTINUE;
+        return TX_QUEUED;
 }
 
 static int ieee80211_use_mfp(__le16 fc, struct sta_info *sta,
@@ -700,7 +700,6 @@ ieee80211_tx_h_sequence(struct ieee80211_tx_data *tx)
                 /* for pure STA mode without beacons, we can do it */
                 hdr->seq_ctrl = cpu_to_le16(tx->sdata->sequence_number);
                 tx->sdata->sequence_number += 0x10;
-                tx->sdata->sequence_number &= IEEE80211_SCTL_SEQ;
                 return TX_CONTINUE;
         }
 
@@ -844,6 +843,23 @@ ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
 }
 
 static ieee80211_tx_result debug_noinline
+ieee80211_tx_h_stats(struct ieee80211_tx_data *tx)
+{
+        struct sk_buff *skb = tx->skb;
+
+        if (!tx->sta)
+                return TX_CONTINUE;
+
+        tx->sta->tx_packets++;
+        do {
+                tx->sta->tx_fragments++;
+                tx->sta->tx_bytes += skb->len;
+        } while ((skb = skb->next));
+
+        return TX_CONTINUE;
+}
+
+static ieee80211_tx_result debug_noinline
 ieee80211_tx_h_encrypt(struct ieee80211_tx_data *tx)
 {
         if (!tx->key)
@@ -887,23 +903,6 @@ ieee80211_tx_h_calculate_duration(struct ieee80211_tx_data *tx)
         return TX_CONTINUE;
 }
 
-static ieee80211_tx_result debug_noinline
-ieee80211_tx_h_stats(struct ieee80211_tx_data *tx)
-{
-        struct sk_buff *skb = tx->skb;
-
-        if (!tx->sta)
-                return TX_CONTINUE;
-
-        tx->sta->tx_packets++;
-        do {
-                tx->sta->tx_fragments++;
-                tx->sta->tx_bytes += skb->len;
-        } while ((skb = skb->next));
-
-        return TX_CONTINUE;
-}
-
 /* actual transmit path */
 
 /*
@@ -1154,6 +1153,9 @@ static int __ieee80211_tx(struct ieee80211_local *local,
                 next = skb->next;
                 len = skb->len;
 
+                if (next)
+                        info->flags |= IEEE80211_TX_CTL_MORE_FRAMES;
+
                 sdata = vif_to_sdata(info->control.vif);
 
                 switch (sdata->vif.type) {
@@ -1210,9 +1212,9 @@ static int invoke_tx_handlers(struct ieee80211_tx_data *tx)
         CALL_TXH(ieee80211_tx_h_sequence)
         CALL_TXH(ieee80211_tx_h_fragment)
         /* handlers after fragment must be aware of tx info fragmentation! */
+        CALL_TXH(ieee80211_tx_h_stats)
         CALL_TXH(ieee80211_tx_h_encrypt)
         CALL_TXH(ieee80211_tx_h_calculate_duration)
-        CALL_TXH(ieee80211_tx_h_stats)
 #undef CALL_TXH
 
  txh_done:
@@ -1410,16 +1412,7 @@ static void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,
 
         info->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
 
-        if (ieee80211_vif_is_mesh(&sdata->vif) &&
-            ieee80211_is_data(hdr->frame_control)) {
-                if (is_multicast_ether_addr(hdr->addr3))
-                        memcpy(hdr->addr1, hdr->addr3, ETH_ALEN);
-                else
-                        if (mesh_nexthop_lookup(skb, sdata)) {
-                                dev_put(sdata->dev);
-                                return;
-                        }
-        } else if (unlikely(sdata->vif.type == NL80211_IFTYPE_MONITOR)) {
+        if (unlikely(sdata->vif.type == NL80211_IFTYPE_MONITOR)) {
                 int hdrlen;
                 u16 len_rthdr;
 
@@ -1476,6 +1469,15 @@ static void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,
 
         info->control.vif = &sdata->vif;
 
+        if (ieee80211_vif_is_mesh(&sdata->vif) &&
+            ieee80211_is_data(hdr->frame_control) &&
+                !is_multicast_ether_addr(hdr->addr1))
+                        if (mesh_nexthop_lookup(skb, sdata)) {
+                                /* skb queued: don't free */
+                                dev_put(sdata->dev);
+                                return;
+                        }
+
         ieee80211_select_queue(local, skb);
         ieee80211_tx(sdata, skb, false);
         dev_put(sdata->dev);
@@ -1617,52 +1619,58 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
                 break;
 #ifdef CONFIG_MAC80211_MESH
         case NL80211_IFTYPE_MESH_POINT:
-                fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
                 if (!sdata->u.mesh.mshcfg.dot11MeshTTL) {
                         /* Do not send frames with mesh_ttl == 0 */
                         sdata->u.mesh.mshstats.dropped_frames_ttl++;
                         ret = NETDEV_TX_OK;
                         goto fail;
                 }
-                memset(&mesh_hdr, 0, sizeof(mesh_hdr));
 
                 if (compare_ether_addr(dev->dev_addr,
                                           skb->data + ETH_ALEN) == 0) {
-                        /* RA TA DA SA */
-                        memset(hdr.addr1, 0, ETH_ALEN);
-                        memcpy(hdr.addr2, dev->dev_addr, ETH_ALEN);
-                        memcpy(hdr.addr3, skb->data, ETH_ALEN);
-                        memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN);
-                        meshhdrlen = ieee80211_new_mesh_header(&mesh_hdr, sdata);
+                        hdrlen = ieee80211_fill_mesh_addresses(&hdr, &fc,
+                                        skb->data, skb->data + ETH_ALEN);
+                        meshhdrlen = ieee80211_new_mesh_header(&mesh_hdr,
+                                        sdata, NULL, NULL, NULL);
                 } else {
                         /* packet from other interface */
                         struct mesh_path *mppath;
+                        int is_mesh_mcast = 1;
+                        char *mesh_da;
 
-                        memset(hdr.addr1, 0, ETH_ALEN);
-                        memcpy(hdr.addr2, dev->dev_addr, ETH_ALEN);
-                        memcpy(hdr.addr4, dev->dev_addr, ETH_ALEN);
-
+                        rcu_read_lock();
                         if (is_multicast_ether_addr(skb->data))
-                                memcpy(hdr.addr3, skb->data, ETH_ALEN);
+                                /* DA TA mSA AE:SA */
+                                mesh_da = skb->data;
                         else {
-                                rcu_read_lock();
                                 mppath = mpp_path_lookup(skb->data, sdata);
-                                if (mppath)
-                                        memcpy(hdr.addr3, mppath->mpp, ETH_ALEN);
-                                else
-                                        memset(hdr.addr3, 0xff, ETH_ALEN);
-                                rcu_read_unlock();
+                                if (mppath) {
+                                        /* RA TA mDA mSA AE:DA SA */
+                                        mesh_da = mppath->mpp;
+                                        is_mesh_mcast = 0;
+                                } else
+                                        /* DA TA mSA AE:SA */
+                                        mesh_da = dev->broadcast;
                         }
+                        hdrlen = ieee80211_fill_mesh_addresses(&hdr, &fc,
+                                        mesh_da, dev->dev_addr);
+                        rcu_read_unlock();
+                        if (is_mesh_mcast)
+                                meshhdrlen =
+                                        ieee80211_new_mesh_header(&mesh_hdr,
+                                                        sdata,
+                                                        skb->data + ETH_ALEN,
+                                                        NULL,
+                                                        NULL);
+                        else
+                                meshhdrlen =
+                                        ieee80211_new_mesh_header(&mesh_hdr,
+                                                        sdata,
+                                                        NULL,
+                                                        skb->data,
+                                                        skb->data + ETH_ALEN);
 
-                        mesh_hdr.flags |= MESH_FLAGS_AE_A5_A6;
-                        mesh_hdr.ttl = sdata->u.mesh.mshcfg.dot11MeshTTL;
-                        put_unaligned(cpu_to_le32(sdata->u.mesh.mesh_seqnum), &mesh_hdr.seqnum);
-                        memcpy(mesh_hdr.eaddr1, skb->data, ETH_ALEN);
-                        memcpy(mesh_hdr.eaddr2, skb->data + ETH_ALEN, ETH_ALEN);
-                        sdata->u.mesh.mesh_seqnum++;
-                        meshhdrlen = 18;
                 }
-                hdrlen = 30;
                 break;
 #endif
         case NL80211_IFTYPE_STATION:
diff --git a/net/wireless/Makefile b/net/wireless/Makefile
index d74cc77fa57a..3ecaa9179977 100644
--- a/net/wireless/Makefile
+++ b/net/wireless/Makefile
@@ -5,7 +5,8 @@ obj-$(CONFIG_LIB80211_CRYPT_WEP) += lib80211_crypt_wep.o
 obj-$(CONFIG_LIB80211_CRYPT_CCMP) += lib80211_crypt_ccmp.o
 obj-$(CONFIG_LIB80211_CRYPT_TKIP) += lib80211_crypt_tkip.o
 
-cfg80211-y += core.o sysfs.o radiotap.o util.o reg.o scan.o nl80211.o mlme.o ibss.o sme.o
+cfg80211-y += core.o sysfs.o radiotap.o util.o reg.o scan.o nl80211.o
+cfg80211-y += mlme.o ibss.o sme.o chan.o
 cfg80211-$(CONFIG_CFG80211_DEBUGFS) += debugfs.o
 cfg80211-$(CONFIG_WIRELESS_EXT) += wext-compat.o wext-sme.o
 
diff --git a/net/wireless/chan.c b/net/wireless/chan.c
new file mode 100644
index 000000000000..a46ac6c9b365
--- /dev/null
+++ b/net/wireless/chan.c
@@ -0,0 +1,89 @@
+/*
+ * This file contains helper code to handle channel
+ * settings and keeping track of what is possible at
+ * any point in time.
+ *
+ * Copyright 2009       Johannes Berg <johannes@sipsolutions.net>
+ */
+
+#include <net/cfg80211.h>
+#include "core.h"
+
+struct ieee80211_channel *
+rdev_fixed_channel(struct cfg80211_registered_device *rdev,
+                   struct wireless_dev *for_wdev)
+{
+        struct wireless_dev *wdev;
+        struct ieee80211_channel *result = NULL;
+
+        WARN_ON(!mutex_is_locked(&rdev->devlist_mtx));
+
+        list_for_each_entry(wdev, &rdev->netdev_list, list) {
+                if (wdev == for_wdev)
+                        continue;
+
+                /*
+                 * Lock manually to tell lockdep about allowed
+                 * nesting here if for_wdev->mtx is held already.
+                 * This is ok as it's all under the rdev devlist
+                 * mutex and as such can only be done once at any
+                 * given time.
+                 */
+                mutex_lock_nested(&wdev->mtx, SINGLE_DEPTH_NESTING);
+                if (wdev->current_bss)
+                        result = wdev->current_bss->pub.channel;
+                wdev_unlock(wdev);
+
+                if (result)
+                        break;
+        }
+
+        return result;
+}
+
+int rdev_set_freq(struct cfg80211_registered_device *rdev,
+                  struct wireless_dev *for_wdev,
+                  int freq, enum nl80211_channel_type channel_type)
+{
+        struct ieee80211_channel *chan;
+        struct ieee80211_sta_ht_cap *ht_cap;
+        int result;
+
+        if (rdev_fixed_channel(rdev, for_wdev))
+                return -EBUSY;
+
+        if (!rdev->ops->set_channel)
+                return -EOPNOTSUPP;
+
+        chan = ieee80211_get_channel(&rdev->wiphy, freq);
+
+        /* Primary channel not allowed */
+        if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
+                return -EINVAL;
+
+        if (channel_type == NL80211_CHAN_HT40MINUS &&
+            chan->flags & IEEE80211_CHAN_NO_HT40MINUS)
+                return -EINVAL;
+        else if (channel_type == NL80211_CHAN_HT40PLUS &&
+                 chan->flags & IEEE80211_CHAN_NO_HT40PLUS)
+                return -EINVAL;
+
+        ht_cap = &rdev->wiphy.bands[chan->band]->ht_cap;
+
+        if (channel_type != NL80211_CHAN_NO_HT) {
+                if (!ht_cap->ht_supported)
+                        return -EINVAL;
+
+                if (!(ht_cap->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) ||
+                    ht_cap->cap & IEEE80211_HT_CAP_40MHZ_INTOLERANT)
+                        return -EINVAL;
+        }
+
+        result = rdev->ops->set_channel(&rdev->wiphy, chan, channel_type);
+        if (result)
+                return result;
+
+        rdev->channel = chan;
+
+        return 0;
+}
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 1e189306560d..bc99e4ec7463 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -32,6 +32,7 @@ MODULE_DESCRIPTION("wireless configuration support");
  * only read the list, and that can happen quite
  * often because we need to do it for each command */
 LIST_HEAD(cfg80211_rdev_list);
+int cfg80211_rdev_list_generation;
 
 /*
  * This is used to protect the cfg80211_rdev_list
@@ -411,6 +412,8 @@ struct wiphy *wiphy_new(const struct cfg80211_ops *ops, int sizeof_priv)
         rdev->wiphy.dev.class = &ieee80211_class;
         rdev->wiphy.dev.platform_data = rdev;
 
+        rdev->wiphy.ps_default = CONFIG_CFG80211_DEFAULT_PS_VALUE;
+
         wiphy_net_set(&rdev->wiphy, &init_net);
 
         rdev->rfkill_ops.set_block = cfg80211_rfkill_set_block;
@@ -511,6 +514,7 @@ int wiphy_register(struct wiphy *wiphy)
         wiphy_update_regulatory(wiphy, NL80211_REGDOM_SET_BY_CORE);
 
         list_add(&rdev->list, &cfg80211_rdev_list);
+        cfg80211_rdev_list_generation++;
 
         mutex_unlock(&cfg80211_mutex);
 
@@ -593,13 +597,14 @@ void wiphy_unregister(struct wiphy *wiphy)
         reg_device_remove(wiphy);
 
         list_del(&rdev->list);
+        cfg80211_rdev_list_generation++;
         device_del(&rdev->wiphy.dev);
         debugfs_remove(rdev->wiphy.debugfsdir);
 
         mutex_unlock(&cfg80211_mutex);
 
+        flush_work(&rdev->scan_done_wk);
         cancel_work_sync(&rdev->conn_work);
-        cancel_work_sync(&rdev->scan_done_wk);
         kfree(rdev->scan_req);
         flush_work(&rdev->event_work);
 }
@@ -653,6 +658,7 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                 spin_lock_init(&wdev->event_lock);
                 mutex_lock(&rdev->devlist_mtx);
                 list_add(&wdev->list, &rdev->netdev_list);
+                rdev->devlist_generation++;
                 /* can only change netns with wiphy */
                 dev->features |= NETIF_F_NETNS_LOCAL;
 
@@ -670,7 +676,7 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                 wdev->wext.default_key = -1;
                 wdev->wext.default_mgmt_key = -1;
                 wdev->wext.connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
-                wdev->wext.ps = CONFIG_CFG80211_DEFAULT_PS_VALUE;
+                wdev->wext.ps = wdev->wiphy->ps_default;
                 wdev->wext.ps_timeout = 100;
                 if (rdev->ops->set_power_mgmt)
                         if (rdev->ops->set_power_mgmt(wdev->wiphy, dev,
@@ -706,6 +712,7 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
         case NETDEV_UP:
 #ifdef CONFIG_WIRELESS_EXT
                 cfg80211_lock_rdev(rdev);
+                mutex_lock(&rdev->devlist_mtx);
                 wdev_lock(wdev);
                 switch (wdev->iftype) {
                 case NL80211_IFTYPE_ADHOC:
@@ -718,10 +725,18 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                         break;
                 }
                 wdev_unlock(wdev);
+                mutex_unlock(&rdev->devlist_mtx);
                 cfg80211_unlock_rdev(rdev);
 #endif
                 break;
         case NETDEV_UNREGISTER:
+                cfg80211_lock_rdev(rdev);
+
+                if (WARN_ON(rdev->scan_req && rdev->scan_req->dev == dev)) {
+                        rdev->scan_req->aborted = true;
+                        ___cfg80211_scan_done(rdev);
+                }
+
                 mutex_lock(&rdev->devlist_mtx);
                 /*
                  * It is possible to get NETDEV_UNREGISTER
@@ -733,12 +748,14 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                 if (!list_empty(&wdev->list)) {
                         sysfs_remove_link(&dev->dev.kobj, "phy80211");
                         list_del_init(&wdev->list);
+                        rdev->devlist_generation++;
                         mutex_destroy(&wdev->mtx);
 #ifdef CONFIG_WIRELESS_EXT
                         kfree(wdev->wext.keys);
 #endif
                 }
                 mutex_unlock(&rdev->devlist_mtx);
+                cfg80211_unlock_rdev(rdev);
                 break;
         case NETDEV_PRE_UP:
                 if (!(wdev->wiphy->interface_modes & BIT(wdev->iftype)))
diff --git a/net/wireless/core.h b/net/wireless/core.h
index 325c17e6198c..c603f5286326 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -49,6 +49,7 @@ struct cfg80211_registered_device {
         /* associate netdev list */
         struct mutex devlist_mtx;
         struct list_head netdev_list;
+        int devlist_generation;
 
         /* BSSes/scanning */
         spinlock_t bss_lock;
@@ -101,6 +102,7 @@ bool wiphy_idx_valid(int wiphy_idx)
 
 extern struct mutex cfg80211_mutex;
 extern struct list_head cfg80211_rdev_list;
+extern int cfg80211_rdev_list_generation;
 
 #define assert_cfg80211_lock() WARN_ON(!mutex_is_locked(&cfg80211_mutex))
 
@@ -335,7 +337,8 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
 int __cfg80211_connect(struct cfg80211_registered_device *rdev,
                        struct net_device *dev,
                        struct cfg80211_connect_params *connect,
-                       struct cfg80211_cached_keys *connkeys);
+                       struct cfg80211_cached_keys *connkeys,
+                       const u8 *prev_bssid);
 int cfg80211_connect(struct cfg80211_registered_device *rdev,
                      struct net_device *dev,
                      struct cfg80211_connect_params *connect,
@@ -353,6 +356,7 @@ int cfg80211_mgd_wext_connect(struct cfg80211_registered_device *rdev,
                               struct wireless_dev *wdev);
 
 void cfg80211_conn_work(struct work_struct *work);
+bool cfg80211_sme_failed_reassoc(struct wireless_dev *wdev);
 
 /* internal helpers */
 int cfg80211_validate_key_settings(struct cfg80211_registered_device *rdev,
@@ -364,6 +368,14 @@ void cfg80211_sme_scan_done(struct net_device *dev);
 void cfg80211_sme_rx_auth(struct net_device *dev, const u8 *buf, size_t len);
 void cfg80211_sme_disassoc(struct net_device *dev, int idx);
 void __cfg80211_scan_done(struct work_struct *wk);
+void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev);
 void cfg80211_upload_connect_keys(struct wireless_dev *wdev);
 
+struct ieee80211_channel *
+rdev_fixed_channel(struct cfg80211_registered_device *rdev,
+                   struct wireless_dev *for_wdev);
+int rdev_set_freq(struct cfg80211_registered_device *rdev,
+                  struct wireless_dev *for_wdev,
+                  int freq, enum nl80211_channel_type channel_type);
+
 #endif /* __NET_WIRELESS_CORE_H */
diff --git a/net/wireless/ibss.c b/net/wireless/ibss.c
index 4d7a084b35e2..42840a01be74 100644
--- a/net/wireless/ibss.c
+++ b/net/wireless/ibss.c
@@ -78,10 +78,15 @@ int __cfg80211_join_ibss(struct cfg80211_registered_device *rdev,
                          struct cfg80211_cached_keys *connkeys)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct ieee80211_channel *chan;
         int err;
 
         ASSERT_WDEV_LOCK(wdev);
 
+        chan = rdev_fixed_channel(rdev, wdev);
+        if (chan && chan != params->channel)
+                return -EBUSY;
+
         if (wdev->ssid_len)
                 return -EALREADY;
 
@@ -112,9 +117,11 @@ int cfg80211_join_ibss(struct cfg80211_registered_device *rdev,
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         int err;
 
+        mutex_lock(&rdev->devlist_mtx);
         wdev_lock(wdev);
         err = __cfg80211_join_ibss(rdev, dev, params, connkeys);
         wdev_unlock(wdev);
+        mutex_unlock(&rdev->devlist_mtx);
 
         return err;
 }
@@ -264,27 +271,32 @@ int cfg80211_ibss_wext_join(struct cfg80211_registered_device *rdev,
 
 int cfg80211_ibss_wext_siwfreq(struct net_device *dev,
                                struct iw_request_info *info,
-                               struct iw_freq *freq, char *extra)
+                               struct iw_freq *wextfreq, char *extra)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct ieee80211_channel *chan;
-        int err;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct ieee80211_channel *chan = NULL;
+        int err, freq;
 
         /* call only for ibss! */
         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_ADHOC))
                 return -EINVAL;
 
-        if (!wiphy_to_dev(wdev->wiphy)->ops->join_ibss)
+        if (!rdev->ops->join_ibss)
                 return -EOPNOTSUPP;
 
-        chan = cfg80211_wext_freq(wdev->wiphy, freq);
-        if (chan && IS_ERR(chan))
-                return PTR_ERR(chan);
+        freq = cfg80211_wext_freq(wdev->wiphy, wextfreq);
+        if (freq < 0)
+                return freq;
 
-        if (chan &&
-            (chan->flags & IEEE80211_CHAN_NO_IBSS ||
-             chan->flags & IEEE80211_CHAN_DISABLED))
-                return -EINVAL;
+        if (freq) {
+                chan = ieee80211_get_channel(wdev->wiphy, freq);
+                if (!chan)
+                        return -EINVAL;
+                if (chan->flags & IEEE80211_CHAN_NO_IBSS ||
+                    chan->flags & IEEE80211_CHAN_DISABLED)
+                        return -EINVAL;
+        }
 
         if (wdev->wext.ibss.channel == chan)
                 return 0;
@@ -292,8 +304,7 @@ int cfg80211_ibss_wext_siwfreq(struct net_device *dev,
         wdev_lock(wdev);
         err = 0;
         if (wdev->ssid_len)
-                err = __cfg80211_leave_ibss(wiphy_to_dev(wdev->wiphy),
-                                            dev, true);
+                err = __cfg80211_leave_ibss(rdev, dev, true);
         wdev_unlock(wdev);
 
         if (err)
@@ -307,9 +318,11 @@ int cfg80211_ibss_wext_siwfreq(struct net_device *dev,
                 wdev->wext.ibss.channel_fixed = false;
         }
 
+        mutex_lock(&rdev->devlist_mtx);
         wdev_lock(wdev);
-        err = cfg80211_ibss_wext_join(wiphy_to_dev(wdev->wiphy), wdev);
+        err = cfg80211_ibss_wext_join(rdev, wdev);
         wdev_unlock(wdev);
+        mutex_unlock(&rdev->devlist_mtx);
 
         return err;
 }
@@ -347,6 +360,7 @@ int cfg80211_ibss_wext_siwessid(struct net_device *dev,
                                 struct iw_point *data, char *ssid)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
         size_t len = data->length;
         int err;
 
@@ -354,14 +368,13 @@ int cfg80211_ibss_wext_siwessid(struct net_device *dev,
         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_ADHOC))
                 return -EINVAL;
 
-        if (!wiphy_to_dev(wdev->wiphy)->ops->join_ibss)
+        if (!rdev->ops->join_ibss)
                 return -EOPNOTSUPP;
 
         wdev_lock(wdev);
         err = 0;
         if (wdev->ssid_len)
-                err = __cfg80211_leave_ibss(wiphy_to_dev(wdev->wiphy),
-                                            dev, true);
+                err = __cfg80211_leave_ibss(rdev, dev, true);
         wdev_unlock(wdev);
 
         if (err)
@@ -375,9 +388,11 @@ int cfg80211_ibss_wext_siwessid(struct net_device *dev,
         memcpy(wdev->wext.ibss.ssid, ssid, len);
         wdev->wext.ibss.ssid_len = len;
 
+        mutex_lock(&rdev->devlist_mtx);
         wdev_lock(wdev);
-        err = cfg80211_ibss_wext_join(wiphy_to_dev(wdev->wiphy), wdev);
+        err = cfg80211_ibss_wext_join(rdev, wdev);
         wdev_unlock(wdev);
+        mutex_unlock(&rdev->devlist_mtx);
 
         return err;
 }
@@ -414,6 +429,7 @@ int cfg80211_ibss_wext_siwap(struct net_device *dev,
                              struct sockaddr *ap_addr, char *extra)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
         u8 *bssid = ap_addr->sa_data;
         int err;
 
@@ -421,7 +437,7 @@ int cfg80211_ibss_wext_siwap(struct net_device *dev,
         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_ADHOC))
                 return -EINVAL;
 
-        if (!wiphy_to_dev(wdev->wiphy)->ops->join_ibss)
+        if (!rdev->ops->join_ibss)
                 return -EOPNOTSUPP;
 
         if (ap_addr->sa_family != ARPHRD_ETHER)
@@ -443,8 +459,7 @@ int cfg80211_ibss_wext_siwap(struct net_device *dev,
         wdev_lock(wdev);
         err = 0;
         if (wdev->ssid_len)
-                err = __cfg80211_leave_ibss(wiphy_to_dev(wdev->wiphy),
-                                            dev, true);
+                err = __cfg80211_leave_ibss(rdev, dev, true);
         wdev_unlock(wdev);
 
         if (err)
@@ -456,9 +471,11 @@ int cfg80211_ibss_wext_siwap(struct net_device *dev,
         } else
                 wdev->wext.ibss.bssid = NULL;
 
+        mutex_lock(&rdev->devlist_mtx);
         wdev_lock(wdev);
-        err = cfg80211_ibss_wext_join(wiphy_to_dev(wdev->wiphy), wdev);
+        err = cfg80211_ibss_wext_join(rdev, wdev);
         wdev_unlock(wdev);
+        mutex_unlock(&rdev->devlist_mtx);
 
         return err;
 }
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index 525e8e247b30..da64071ceb84 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -67,6 +67,16 @@ void cfg80211_send_rx_assoc(struct net_device *dev, const u8 *buf, size_t len)
 
         status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
 
+        /*
+         * This is a bit of a hack, we don't notify userspace of
+         * a (re-)association reply if we tried to send a reassoc
+         * and got a reject -- we only try again with an assoc
+         * frame instead of reassoc.
+         */
+        if (status_code != WLAN_STATUS_SUCCESS && wdev->conn &&
+            cfg80211_sme_failed_reassoc(wdev))
+                goto out;
+
         nl80211_send_rx_assoc(rdev, dev, buf, len, GFP_KERNEL);
 
         if (status_code == WLAN_STATUS_SUCCESS) {
@@ -97,6 +107,7 @@ void cfg80211_send_rx_assoc(struct net_device *dev, const u8 *buf, size_t len)
                 cfg80211_put_bss(&bss->pub);
         }
 
+ out:
         wdev_unlock(wdev);
 }
 EXPORT_SYMBOL(cfg80211_send_rx_assoc);
@@ -149,7 +160,7 @@ static void __cfg80211_send_deauth(struct net_device *dev,
 
                 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
 
-                from_ap = memcmp(mgmt->da, dev->dev_addr, ETH_ALEN) == 0;
+                from_ap = memcmp(mgmt->sa, dev->dev_addr, ETH_ALEN) != 0;
                 __cfg80211_disconnected(dev, NULL, 0, reason_code, from_ap);
         } else if (wdev->sme_state == CFG80211_SME_CONNECTING) {
                 __cfg80211_connect_result(dev, mgmt->bssid, NULL, 0, NULL, 0,
@@ -198,7 +209,7 @@ static void __cfg80211_send_disassoc(struct net_device *dev,
                 return;
 
         if (wdev->current_bss &&
-            memcmp(wdev->current_bss, bssid, ETH_ALEN) == 0) {
+            memcmp(wdev->current_bss->pub.bssid, bssid, ETH_ALEN) == 0) {
                 for (i = 0; i < MAX_AUTH_BSSES; i++) {
                         if (wdev->authtry_bsses[i] || wdev->auth_bsses[i])
                                 continue;
@@ -215,7 +226,7 @@ static void __cfg80211_send_disassoc(struct net_device *dev,
 
         reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
 
-        from_ap = memcmp(mgmt->da, dev->dev_addr, ETH_ALEN) == 0;
+        from_ap = memcmp(mgmt->sa, dev->dev_addr, ETH_ALEN) != 0;
         __cfg80211_disconnected(dev, NULL, 0, reason_code, from_ap);
 }
 
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 0cd548267d4a..a8aaadeb6773 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -408,6 +408,9 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
 
+        NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
+                    cfg80211_rdev_list_generation);
+
         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
                    dev->wiphy.retry_short);
         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
@@ -701,15 +704,8 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 
         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
                 enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
-                struct ieee80211_channel *chan;
-                struct ieee80211_sta_ht_cap *ht_cap;
                 u32 freq;
 
-                if (!rdev->ops->set_channel) {
-                        result = -EOPNOTSUPP;
-                        goto bad_res;
-                }
-
                 result = -EINVAL;
 
                 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
@@ -723,42 +719,12 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
                 }
 
                 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
-                chan = ieee80211_get_channel(&rdev->wiphy, freq);
-
-                /* Primary channel not allowed */
-                if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
-                        goto bad_res;
-
-                if (channel_type == NL80211_CHAN_HT40MINUS &&
-                    (chan->flags & IEEE80211_CHAN_NO_HT40MINUS))
-                        goto bad_res;
-                else if (channel_type == NL80211_CHAN_HT40PLUS &&
-                         (chan->flags & IEEE80211_CHAN_NO_HT40PLUS))
-                        goto bad_res;
-
-                /*
-                 * At this point we know if that if HT40 was requested
-                 * we are allowed to use it and the extension channel
-                 * exists.
-                 */
-
-                ht_cap = &rdev->wiphy.bands[chan->band]->ht_cap;
-
-                /* no HT capabilities or intolerant */
-                if (channel_type != NL80211_CHAN_NO_HT) {
-                        if (!ht_cap->ht_supported)
-                                goto bad_res;
-                        if (!(ht_cap->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) ||
-                            (ht_cap->cap & IEEE80211_HT_CAP_40MHZ_INTOLERANT))
-                                goto bad_res;
-                }
 
-                result = rdev->ops->set_channel(&rdev->wiphy, chan,
-                                                channel_type);
+                mutex_lock(&rdev->devlist_mtx);
+                result = rdev_set_freq(rdev, NULL, freq, channel_type);
+                mutex_unlock(&rdev->devlist_mtx);
                 if (result)
                         goto bad_res;
-
-                rdev->channel = chan;
         }
 
         changed = 0;
@@ -862,6 +828,11 @@ static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
+
+        NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
+                    rdev->devlist_generation ^
+                        (cfg80211_rdev_list_generation << 2));
+
         return genlmsg_end(msg, hdr);
 
  nla_put_failure:
@@ -875,12 +846,12 @@ static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *
         int if_idx = 0;
         int wp_start = cb->args[0];
         int if_start = cb->args[1];
-        struct cfg80211_registered_device *dev;
+        struct cfg80211_registered_device *rdev;
         struct wireless_dev *wdev;
 
         mutex_lock(&cfg80211_mutex);
-        list_for_each_entry(dev, &cfg80211_rdev_list, list) {
-                if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
+        list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
+                if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
                         continue;
                 if (wp_idx < wp_start) {
                         wp_idx++;
@@ -888,21 +859,21 @@ static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *
                 }
                 if_idx = 0;
 
-                mutex_lock(&dev->devlist_mtx);
-                list_for_each_entry(wdev, &dev->netdev_list, list) {
+                mutex_lock(&rdev->devlist_mtx);
+                list_for_each_entry(wdev, &rdev->netdev_list, list) {
                         if (if_idx < if_start) {
                                 if_idx++;
                                 continue;
                         }
                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
-                                               dev, wdev->netdev) < 0) {
-                                mutex_unlock(&dev->devlist_mtx);
+                                               rdev, wdev->netdev) < 0) {
+                                mutex_unlock(&rdev->devlist_mtx);
                                 goto out;
                         }
                         if_idx++;
                 }
-                mutex_unlock(&dev->devlist_mtx);
+                mutex_unlock(&rdev->devlist_mtx);
 
                 wp_idx++;
         }
@@ -1653,6 +1624,8 @@ static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
 
+        NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, sinfo->generation);
+
         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
         if (!sinfoattr)
                 goto nla_put_failure;
@@ -2138,6 +2111,8 @@ static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
         NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
 
+        NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, pinfo->generation);
+
         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
         if (!pinfoattr)
                 goto nla_put_failure;
@@ -3027,10 +3002,9 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
                 goto out;
         }
 
-        request->channels = (void *)((char *)request + sizeof(*request));
         request->n_channels = n_channels;
         if (n_ssids)
-                request->ssids = (void *)(request->channels + n_channels);
+                request->ssids = (void *)&request->channels[n_channels];
         request->n_ssids = n_ssids;
         if (ie_len) {
                 if (request->ssids)
@@ -3127,8 +3101,7 @@ static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
         if (!hdr)
                 return -1;
 
-        NLA_PUT_U32(msg, NL80211_ATTR_SCAN_GENERATION,
-                    rdev->bss_generation);
+        NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation);
         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex);
 
         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
@@ -3453,7 +3426,7 @@ static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
         struct cfg80211_registered_device *rdev;
         struct net_device *dev;
         struct cfg80211_crypto_settings crypto;
-        struct ieee80211_channel *chan;
+        struct ieee80211_channel *chan, *fixedchan;
         const u8 *bssid, *ssid, *ie = NULL, *prev_bssid = NULL;
         int err, ssid_len, ie_len = 0;
         bool use_mfp = false;
@@ -3496,6 +3469,15 @@ static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
                 goto out;
         }
 
+        mutex_lock(&rdev->devlist_mtx);
+        fixedchan = rdev_fixed_channel(rdev, NULL);
+        if (fixedchan && chan != fixedchan) {
+                err = -EBUSY;
+                mutex_unlock(&rdev->devlist_mtx);
+                goto out;
+        }
+        mutex_unlock(&rdev->devlist_mtx);
+
         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
 
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 0f61ae613f3b..f256dfffbf46 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -1018,7 +1018,6 @@ static void handle_channel(struct wiphy *wiphy, enum ieee80211_band band,
                         map_regdom_flags(reg_rule->flags) | bw_flags;
                 chan->max_antenna_gain = chan->orig_mag =
                         (int) MBI_TO_DBI(power_rule->max_antenna_gain);
-                chan->max_bandwidth = KHZ_TO_MHZ(desired_bw_khz);
                 chan->max_power = chan->orig_mpwr =
                         (int) MBM_TO_DBM(power_rule->max_eirp);
                 return;
@@ -1027,7 +1026,6 @@ static void handle_channel(struct wiphy *wiphy, enum ieee80211_band band,
         chan->flags = flags | bw_flags | map_regdom_flags(reg_rule->flags);
         chan->max_antenna_gain = min(chan->orig_mag,
                 (int) MBI_TO_DBI(power_rule->max_antenna_gain));
-        chan->max_bandwidth = KHZ_TO_MHZ(desired_bw_khz);
         if (chan->orig_mpwr)
                 chan->max_power = min(chan->orig_mpwr,
                         (int) MBM_TO_DBM(power_rule->max_eirp));
@@ -1329,7 +1327,6 @@ static void handle_channel_custom(struct wiphy *wiphy,
 
         chan->flags |= map_regdom_flags(reg_rule->flags) | bw_flags;
         chan->max_antenna_gain = (int) MBI_TO_DBI(power_rule->max_antenna_gain);
-        chan->max_bandwidth = KHZ_TO_MHZ(desired_bw_khz);
         chan->max_power = (int) MBM_TO_DBM(power_rule->max_eirp);
 }
 
@@ -1427,7 +1424,7 @@ static int ignore_request(struct wiphy *wiphy,
                         if (last_wiphy != wiphy) {
                                 /*
                                  * Two cards with two APs claiming different
-                                 * different Country IE alpha2s. We could
+                                 * Country IE alpha2s. We could
                                  * intersect them, but that seems unlikely
                                  * to be correct. Reject second one for now.
                                  */
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 0ccf3a07dc02..fe575a24c95c 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -18,19 +18,14 @@
 
 #define IEEE80211_SCAN_RESULT_EXPIRE    (15 * HZ)
 
-void __cfg80211_scan_done(struct work_struct *wk)
+void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev)
 {
-        struct cfg80211_registered_device *rdev;
         struct cfg80211_scan_request *request;
         struct net_device *dev;
 #ifdef CONFIG_WIRELESS_EXT
         union iwreq_data wrqu;
 #endif
 
-        rdev = container_of(wk, struct cfg80211_registered_device,
-                            scan_done_wk);
-
-        mutex_lock(&rdev->mtx);
         request = rdev->scan_req;
 
         dev = request->dev;
@@ -43,9 +38,9 @@ void __cfg80211_scan_done(struct work_struct *wk)
         cfg80211_sme_scan_done(dev);
 
         if (request->aborted)
-                nl80211_send_scan_aborted(wiphy_to_dev(request->wiphy), dev);
+                nl80211_send_scan_aborted(rdev, dev);
         else
-                nl80211_send_scan_done(wiphy_to_dev(request->wiphy), dev);
+                nl80211_send_scan_done(rdev, dev);
 
 #ifdef CONFIG_WIRELESS_EXT
         if (!request->aborted) {
@@ -57,11 +52,22 @@ void __cfg80211_scan_done(struct work_struct *wk)
 
         dev_put(dev);
 
-        cfg80211_unlock_rdev(rdev);
-        wiphy_to_dev(request->wiphy)->scan_req = NULL;
+        rdev->scan_req = NULL;
         kfree(request);
 }
 
+void __cfg80211_scan_done(struct work_struct *wk)
+{
+        struct cfg80211_registered_device *rdev;
+
+        rdev = container_of(wk, struct cfg80211_registered_device,
+                            scan_done_wk);
+
+        cfg80211_lock_rdev(rdev);
+        ___cfg80211_scan_done(rdev);
+        cfg80211_unlock_rdev(rdev);
+}
+
 void cfg80211_scan_done(struct cfg80211_scan_request *request, bool aborted)
 {
         WARN_ON(request != wiphy_to_dev(request->wiphy)->scan_req);
@@ -562,6 +568,7 @@ void cfg80211_unlink_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
         spin_lock_bh(&dev->bss_lock);
 
         list_del(&bss->list);
+        dev->bss_generation++;
         rb_erase(&bss->rbn, &dev->bss_tree);
 
         spin_unlock_bh(&dev->bss_lock);
@@ -611,8 +618,8 @@ int cfg80211_wext_siwscan(struct net_device *dev,
 
         creq->wiphy = wiphy;
         creq->dev = dev;
-        creq->ssids = (void *)(creq + 1);
-        creq->channels = (void *)(creq->ssids + 1);
+        /* SSIDs come after channels */
+        creq->ssids = (void *)&creq->channels[n_channels];
         creq->n_channels = n_channels;
         creq->n_ssids = 1;
 
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index 8a7dcbf90602..8e2ef54ea714 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -27,10 +27,10 @@ struct cfg80211_conn {
                 CFG80211_CONN_ASSOCIATE_NEXT,
                 CFG80211_CONN_ASSOCIATING,
         } state;
-        u8 bssid[ETH_ALEN];
+        u8 bssid[ETH_ALEN], prev_bssid[ETH_ALEN];
         u8 *ie;
         size_t ie_len;
-        bool auto_auth;
+        bool auto_auth, prev_bssid_valid;
 };
 
 
@@ -65,7 +65,6 @@ static int cfg80211_conn_scan(struct wireless_dev *wdev)
         if (!request)
                 return -ENOMEM;
 
-        request->channels = (void *)((char *)request + sizeof(*request));
         if (wdev->conn->params.channel)
                 request->channels[0] = wdev->conn->params.channel;
         else {
@@ -82,7 +81,7 @@ static int cfg80211_conn_scan(struct wireless_dev *wdev)
                 }
         }
         request->n_channels = n_channels;
-        request->ssids = (void *)(request->channels + n_channels);
+        request->ssids = (void *)&request->channels[n_channels];
         request->n_ssids = 1;
 
         memcpy(request->ssids[0].ssid, wdev->conn->params.ssid,
@@ -110,6 +109,7 @@ static int cfg80211_conn_do_work(struct wireless_dev *wdev)
 {
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
         struct cfg80211_connect_params *params;
+        const u8 *prev_bssid = NULL;
         int err;
 
         ASSERT_WDEV_LOCK(wdev);
@@ -135,15 +135,11 @@ static int cfg80211_conn_do_work(struct wireless_dev *wdev)
         case CFG80211_CONN_ASSOCIATE_NEXT:
                 BUG_ON(!rdev->ops->assoc);
                 wdev->conn->state = CFG80211_CONN_ASSOCIATING;
-                /*
-                 * We could, later, implement roaming here and then actually
-                 * set prev_bssid to non-NULL. But then we need to be aware
-                 * that some APs don't like that -- so we'd need to retry
-                 * the association.
-                 */
+                if (wdev->conn->prev_bssid_valid)
+                        prev_bssid = wdev->conn->prev_bssid;
                 err = __cfg80211_mlme_assoc(rdev, wdev->netdev,
                                             params->channel, params->bssid,
-                                            NULL,
+                                            prev_bssid,
                                             params->ssid, params->ssid_len,
                                             params->ie, params->ie_len,
                                             false, &params->crypto);
@@ -256,9 +252,11 @@ void cfg80211_sme_scan_done(struct net_device *dev)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
 
+        mutex_lock(&wiphy_to_dev(wdev->wiphy)->devlist_mtx);
         wdev_lock(wdev);
         __cfg80211_sme_scan_done(dev);
         wdev_unlock(wdev);
+        mutex_unlock(&wiphy_to_dev(wdev->wiphy)->devlist_mtx);
 }
 
 void cfg80211_sme_rx_auth(struct net_device *dev,
@@ -314,6 +312,28 @@ void cfg80211_sme_rx_auth(struct net_device *dev,
         }
 }
 
+bool cfg80211_sme_failed_reassoc(struct wireless_dev *wdev)
+{
+        struct wiphy *wiphy = wdev->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+
+        if (WARN_ON(!wdev->conn))
+                return false;
+
+        if (!wdev->conn->prev_bssid_valid)
+                return false;
+
+        /*
+         * Some stupid APs don't accept reassoc, so we
+         * need to fall back to trying regular assoc.
+         */
+        wdev->conn->prev_bssid_valid = false;
+        wdev->conn->state = CFG80211_CONN_ASSOCIATE_NEXT;
+        schedule_work(&rdev->conn_work);
+
+        return true;
+}
+
 void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
                                const u8 *req_ie, size_t req_ie_len,
                                const u8 *resp_ie, size_t resp_ie_len,
@@ -357,8 +377,11 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
 
                 memset(&wrqu, 0, sizeof(wrqu));
                 wrqu.ap_addr.sa_family = ARPHRD_ETHER;
-                if (bssid && status == WLAN_STATUS_SUCCESS)
+                if (bssid && status == WLAN_STATUS_SUCCESS) {
                         memcpy(wrqu.ap_addr.sa_data, bssid, ETH_ALEN);
+                        memcpy(wdev->wext.prev_bssid, bssid, ETH_ALEN);
+                        wdev->wext.prev_bssid_valid = true;
+                }
                 wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
         }
 #endif
@@ -509,6 +532,8 @@ void __cfg80211_roamed(struct wireless_dev *wdev, const u8 *bssid,
         memset(&wrqu, 0, sizeof(wrqu));
         wrqu.ap_addr.sa_family = ARPHRD_ETHER;
         memcpy(wrqu.ap_addr.sa_data, bssid, ETH_ALEN);
+        memcpy(wdev->wext.prev_bssid, bssid, ETH_ALEN);
+        wdev->wext.prev_bssid_valid = true;
         wireless_send_event(wdev->netdev, SIOCGIWAP, &wrqu, NULL);
 #endif
 }
@@ -570,10 +595,30 @@ void __cfg80211_disconnected(struct net_device *dev, const u8 *ie,
         wdev->ssid_len = 0;
 
         if (wdev->conn) {
+                const u8 *bssid;
+                int ret;
+
                 kfree(wdev->conn->ie);
                 wdev->conn->ie = NULL;
                 kfree(wdev->conn);
                 wdev->conn = NULL;
+
+                /*
+                 * If this disconnect was due to a disassoc, we
+                 * we might still have an auth BSS around. For
+                 * the userspace SME that's currently expected,
+                 * but for the kernel SME (nl80211 CONNECT or
+                 * wireless extensions) we want to clear up all
+                 * state.
+                 */
+                for (i = 0; i < MAX_AUTH_BSSES; i++) {
+                        if (!wdev->auth_bsses[i])
+                                continue;
+                        bssid = wdev->auth_bsses[i]->pub.bssid;
+                        ret = __cfg80211_mlme_deauth(rdev, dev, bssid, NULL, 0,
+                                                WLAN_REASON_DEAUTH_LEAVING);
+                        WARN(ret, "deauth failed: %d\n", ret);
+                }
         }
 
         nl80211_send_disconnected(rdev, dev, reason, ie, ie_len, from_ap);
@@ -621,9 +666,11 @@ EXPORT_SYMBOL(cfg80211_disconnected);
 int __cfg80211_connect(struct cfg80211_registered_device *rdev,
                        struct net_device *dev,
                        struct cfg80211_connect_params *connect,
-                       struct cfg80211_cached_keys *connkeys)
+                       struct cfg80211_cached_keys *connkeys,
+                       const u8 *prev_bssid)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct ieee80211_channel *chan;
         int err;
 
         ASSERT_WDEV_LOCK(wdev);
@@ -631,6 +678,10 @@ int __cfg80211_connect(struct cfg80211_registered_device *rdev,
         if (wdev->sme_state != CFG80211_SME_IDLE)
                 return -EALREADY;
 
+        chan = rdev_fixed_channel(rdev, wdev);
+        if (chan && chan != connect->channel)
+                return -EBUSY;
+
         if (WARN_ON(wdev->connect_keys)) {
                 kfree(wdev->connect_keys);
                 wdev->connect_keys = NULL;
@@ -638,14 +689,28 @@ int __cfg80211_connect(struct cfg80211_registered_device *rdev,
 
         if (connkeys && connkeys->def >= 0) {
                 int idx;
+                u32 cipher;
 
                 idx = connkeys->def;
+                cipher = connkeys->params[idx].cipher;
                 /* If given a WEP key we may need it for shared key auth */
-                if (connkeys->params[idx].cipher == WLAN_CIPHER_SUITE_WEP40 ||
-                    connkeys->params[idx].cipher == WLAN_CIPHER_SUITE_WEP104) {
+                if (cipher == WLAN_CIPHER_SUITE_WEP40 ||
+                    cipher == WLAN_CIPHER_SUITE_WEP104) {
                         connect->key_idx = idx;
                         connect->key = connkeys->params[idx].key;
                         connect->key_len = connkeys->params[idx].key_len;
+
+                        /*
+                         * If ciphers are not set (e.g. when going through
+                         * iwconfig), we have to set them appropriately here.
+                         */
+                        if (connect->crypto.cipher_group == 0)
+                                connect->crypto.cipher_group = cipher;
+
+                        if (connect->crypto.n_ciphers_pairwise == 0) {
+                                connect->crypto.n_ciphers_pairwise = 1;
+                                connect->crypto.ciphers_pairwise[0] = cipher;
+                        }
                 }
         }
 
@@ -701,6 +766,11 @@ int __cfg80211_connect(struct cfg80211_registered_device *rdev,
                 wdev->sme_state = CFG80211_SME_CONNECTING;
                 wdev->connect_keys = connkeys;
 
+                if (prev_bssid) {
+                        memcpy(wdev->conn->prev_bssid, prev_bssid, ETH_ALEN);
+                        wdev->conn->prev_bssid_valid = true;
+                }
+
                 /* we're good if we have both BSSID and channel */
                 if (wdev->conn->params.bssid && wdev->conn->params.channel) {
                         wdev->conn->state = CFG80211_CONN_AUTHENTICATE_NEXT;
@@ -751,9 +821,11 @@ int cfg80211_connect(struct cfg80211_registered_device *rdev,
 {
         int err;
 
+        mutex_lock(&rdev->devlist_mtx);
         wdev_lock(dev->ieee80211_ptr);
-        err = __cfg80211_connect(rdev, dev, connect, connkeys);
+        err = __cfg80211_connect(rdev, dev, connect, connkeys, NULL);
         wdev_unlock(dev->ieee80211_ptr);
+        mutex_unlock(&rdev->devlist_mtx);
 
         return err;
 }
diff --git a/net/wireless/util.c b/net/wireless/util.c
index ba387d85dcfd..693275a16a26 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -274,11 +274,11 @@ static int ieee80211_get_mesh_hdrlen(struct ieee80211s_hdr *meshhdr)
         switch (ae) {
         case 0:
                 return 6;
-        case 1:
+        case MESH_FLAGS_AE_A4:
                 return 12;
-        case 2:
+        case MESH_FLAGS_AE_A5_A6:
                 return 18;
-        case 3:
+        case (MESH_FLAGS_AE_A4 | MESH_FLAGS_AE_A5_A6):
                 return 24;
         default:
                 return 6;
@@ -333,10 +333,18 @@ int ieee80211_data_to_8023(struct sk_buff *skb, u8 *addr,
                 }
                 break;
         case cpu_to_le16(IEEE80211_FCTL_FROMDS):
-                if (iftype != NL80211_IFTYPE_STATION ||
+                if ((iftype != NL80211_IFTYPE_STATION &&
+                    iftype != NL80211_IFTYPE_MESH_POINT) ||
                     (is_multicast_ether_addr(dst) &&
                      !compare_ether_addr(src, addr)))
                         return -1;
+                if (iftype == NL80211_IFTYPE_MESH_POINT) {
+                        struct ieee80211s_hdr *meshdr =
+                                (struct ieee80211s_hdr *) (skb->data + hdrlen);
+                        hdrlen += ieee80211_get_mesh_hdrlen(meshdr);
+                        if (meshdr->flags & MESH_FLAGS_AE_A4)
+                                memcpy(src, meshdr->eaddr1, ETH_ALEN);
+                }
                 break;
         case cpu_to_le16(0):
                 if (iftype != NL80211_IFTYPE_ADHOC)
diff --git a/net/wireless/wext-compat.c b/net/wireless/wext-compat.c
index e4e90e249bab..c44917492210 100644
--- a/net/wireless/wext-compat.c
+++ b/net/wireless/wext-compat.c
@@ -267,39 +267,26 @@ EXPORT_SYMBOL_GPL(cfg80211_wext_giwrange);
  * @wiphy: the wiphy
  * @freq: the wext freq encoding
  *
- * Returns a channel, %NULL for auto, or an ERR_PTR for errors!
+ * Returns a frequency, or a negative error code, or 0 for auto.
  */
-struct ieee80211_channel *cfg80211_wext_freq(struct wiphy *wiphy,
-                                             struct iw_freq *freq)
+int cfg80211_wext_freq(struct wiphy *wiphy, struct iw_freq *freq)
 {
-        struct ieee80211_channel *chan;
-        int f;
-
         /*
-         * Parse frequency - return NULL for auto and
+         * Parse frequency - return 0 for auto and
          * -EINVAL for impossible things.
          */
         if (freq->e == 0) {
                 if (freq->m < 0)
-                        return NULL;
-                f = ieee80211_channel_to_frequency(freq->m);
+                        return 0;
+                return ieee80211_channel_to_frequency(freq->m);
         } else {
                 int i, div = 1000000;
                 for (i = 0; i < freq->e; i++)
                         div /= 10;
                 if (div <= 0)
-                        return ERR_PTR(-EINVAL);
-                f = freq->m / div;
+                        return -EINVAL;
+                return freq->m / div;
         }
-
-        /*
-         * Look up channel struct and return -EINVAL when
-         * it cannot be found.
-         */
-        chan = ieee80211_get_channel(wiphy, f);
-        if (!chan)
-                return ERR_PTR(-EINVAL);
-        return chan;
 }
 
 int cfg80211_wext_siwrts(struct net_device *dev,
@@ -761,33 +748,29 @@ EXPORT_SYMBOL_GPL(cfg80211_wext_giwencode);
 
 int cfg80211_wext_siwfreq(struct net_device *dev,
                           struct iw_request_info *info,
-                          struct iw_freq *freq, char *extra)
+                          struct iw_freq *wextfreq, char *extra)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
-        struct ieee80211_channel *chan;
-        int err;
+        int freq, err;
 
         switch (wdev->iftype) {
         case NL80211_IFTYPE_STATION:
-                return cfg80211_mgd_wext_siwfreq(dev, info, freq, extra);
+                return cfg80211_mgd_wext_siwfreq(dev, info, wextfreq, extra);
         case NL80211_IFTYPE_ADHOC:
-                return cfg80211_ibss_wext_siwfreq(dev, info, freq, extra);
+                return cfg80211_ibss_wext_siwfreq(dev, info, wextfreq, extra);
         default:
-                chan = cfg80211_wext_freq(wdev->wiphy, freq);
-                if (!chan)
+                freq = cfg80211_wext_freq(wdev->wiphy, wextfreq);
+                if (freq < 0)
+                        return freq;
+                if (freq == 0)
                         return -EINVAL;
-                if (IS_ERR(chan))
-                        return PTR_ERR(chan);
-                err = rdev->ops->set_channel(wdev->wiphy, chan,
-                                             NL80211_CHAN_NO_HT);
-                if (err)
-                        return err;
-                rdev->channel = chan;
-                return 0;
+                mutex_lock(&rdev->devlist_mtx);
+                err = rdev_set_freq(rdev, NULL, freq, NL80211_CHAN_NO_HT);
+                mutex_unlock(&rdev->devlist_mtx);
+                return err;
         }
 }
-EXPORT_SYMBOL_GPL(cfg80211_wext_siwfreq);
 
 int cfg80211_wext_giwfreq(struct net_device *dev,
                           struct iw_request_info *info,
diff --git a/net/wireless/wext-compat.h b/net/wireless/wext-compat.h
index 9a3774749589..20b3daef6964 100644
--- a/net/wireless/wext-compat.h
+++ b/net/wireless/wext-compat.h
@@ -42,8 +42,7 @@ int cfg80211_mgd_wext_giwessid(struct net_device *dev,
                                struct iw_request_info *info,
                                struct iw_point *data, char *ssid);
 
-struct ieee80211_channel *cfg80211_wext_freq(struct wiphy *wiphy,
-                                             struct iw_freq *freq);
+int cfg80211_wext_freq(struct wiphy *wiphy, struct iw_freq *freq);
 
 
 extern const struct iw_handler_def cfg80211_wext_handler;
diff --git a/net/wireless/wext-sme.c b/net/wireless/wext-sme.c
index 7bacbd1c2af6..d16cd9ea4d00 100644
--- a/net/wireless/wext-sme.c
+++ b/net/wireless/wext-sme.c
@@ -15,6 +15,7 @@ int cfg80211_mgd_wext_connect(struct cfg80211_registered_device *rdev,
                               struct wireless_dev *wdev)
 {
         struct cfg80211_cached_keys *ck = NULL;
+        const u8 *prev_bssid = NULL;
         int err, i;
 
         ASSERT_RDEV_LOCK(rdev);
@@ -42,8 +43,12 @@ int cfg80211_mgd_wext_connect(struct cfg80211_registered_device *rdev,
                 for (i = 0; i < 6; i++)
                         ck->params[i].key = ck->data[i];
         }
+
+        if (wdev->wext.prev_bssid_valid)
+                prev_bssid = wdev->wext.prev_bssid;
+
         err = __cfg80211_connect(rdev, wdev->netdev,
-                                 &wdev->wext.connect, ck);
+                                 &wdev->wext.connect, ck, prev_bssid);
         if (err)
                 kfree(ck);
 
@@ -52,25 +57,31 @@ int cfg80211_mgd_wext_connect(struct cfg80211_registered_device *rdev,
 
 int cfg80211_mgd_wext_siwfreq(struct net_device *dev,
                               struct iw_request_info *info,
-                              struct iw_freq *freq, char *extra)
+                              struct iw_freq *wextfreq, char *extra)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
-        struct ieee80211_channel *chan;
-        int err;
+        struct ieee80211_channel *chan = NULL;
+        int err, freq;
 
         /* call only for station! */
         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION))
                 return -EINVAL;
 
-        chan = cfg80211_wext_freq(wdev->wiphy, freq);
-        if (chan && IS_ERR(chan))
-                return PTR_ERR(chan);
+        freq = cfg80211_wext_freq(wdev->wiphy, wextfreq);
+        if (freq < 0)
+                return freq;
 
-        if (chan && (chan->flags & IEEE80211_CHAN_DISABLED))
-                return -EINVAL;
+        if (freq) {
+                chan = ieee80211_get_channel(wdev->wiphy, freq);
+                if (!chan)
+                        return -EINVAL;
+                if (chan->flags & IEEE80211_CHAN_DISABLED)
+                        return -EINVAL;
+        }
 
         cfg80211_lock_rdev(rdev);
+        mutex_lock(&rdev->devlist_mtx);
         wdev_lock(wdev);
 
         if (wdev->sme_state != CFG80211_SME_IDLE) {
@@ -84,9 +95,8 @@ int cfg80211_mgd_wext_siwfreq(struct net_device *dev,
                 /* if SSID set, we'll try right again, avoid event */
                 if (wdev->wext.connect.ssid_len)
                         event = false;
-                err = __cfg80211_disconnect(wiphy_to_dev(wdev->wiphy),
-                                            dev, WLAN_REASON_DEAUTH_LEAVING,
-                                            event);
+                err = __cfg80211_disconnect(rdev, dev,
+                                            WLAN_REASON_DEAUTH_LEAVING, event);
                 if (err)
                         goto out;
         }
@@ -95,17 +105,15 @@ int cfg80211_mgd_wext_siwfreq(struct net_device *dev,
         wdev->wext.connect.channel = chan;
 
         /* SSID is not set, we just want to switch channel */
-        if (wdev->wext.connect.ssid_len && chan) {
-                err = -EOPNOTSUPP;
-                if (rdev->ops->set_channel)
-                        err = rdev->ops->set_channel(wdev->wiphy, chan,
-                                                     NL80211_CHAN_NO_HT);
+        if (chan && !wdev->wext.connect.ssid_len) {
+                err = rdev_set_freq(rdev, wdev, freq, NL80211_CHAN_NO_HT);
                 goto out;
         }
 
-        err = cfg80211_mgd_wext_connect(wiphy_to_dev(wdev->wiphy), wdev);
+        err = cfg80211_mgd_wext_connect(rdev, wdev);
  out:
         wdev_unlock(wdev);
+        mutex_unlock(&rdev->devlist_mtx);
         cfg80211_unlock_rdev(rdev);
         return err;
 }
@@ -143,6 +151,7 @@ int cfg80211_mgd_wext_siwessid(struct net_device *dev,
                                struct iw_point *data, char *ssid)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
         size_t len = data->length;
         int err;
 
@@ -157,7 +166,8 @@ int cfg80211_mgd_wext_siwessid(struct net_device *dev,
         if (len > 0 && ssid[len - 1] == '\0')
                 len--;
 
-        cfg80211_lock_rdev(wiphy_to_dev(wdev->wiphy));
+        cfg80211_lock_rdev(rdev);
+        mutex_lock(&rdev->devlist_mtx);
         wdev_lock(wdev);
 
         err = 0;
@@ -173,23 +183,24 @@ int cfg80211_mgd_wext_siwessid(struct net_device *dev,
                 /* if SSID set now, we'll try to connect, avoid event */
                 if (len)
                         event = false;
-                err = __cfg80211_disconnect(wiphy_to_dev(wdev->wiphy),
-                                            dev, WLAN_REASON_DEAUTH_LEAVING,
-                                            event);
+                err = __cfg80211_disconnect(rdev, dev,
+                                            WLAN_REASON_DEAUTH_LEAVING, event);
                 if (err)
                         goto out;
         }
 
+        wdev->wext.prev_bssid_valid = false;
         wdev->wext.connect.ssid = wdev->wext.ssid;
         memcpy(wdev->wext.ssid, ssid, len);
         wdev->wext.connect.ssid_len = len;
 
         wdev->wext.connect.crypto.control_port = false;
 
-        err = cfg80211_mgd_wext_connect(wiphy_to_dev(wdev->wiphy), wdev);
+        err = cfg80211_mgd_wext_connect(rdev, wdev);
  out:
         wdev_unlock(wdev);
-        cfg80211_unlock_rdev(wiphy_to_dev(wdev->wiphy));
+        mutex_unlock(&rdev->devlist_mtx);
+        cfg80211_unlock_rdev(rdev);
         return err;
 }
 
@@ -206,7 +217,15 @@ int cfg80211_mgd_wext_giwessid(struct net_device *dev,
         data->flags = 0;
 
         wdev_lock(wdev);
-        if (wdev->wext.connect.ssid && wdev->wext.connect.ssid_len) {
+        if (wdev->current_bss) {
+                const u8 *ie = ieee80211_bss_get_ie(&wdev->current_bss->pub,
+                                                    WLAN_EID_SSID);
+                if (ie) {
+                        data->flags = 1;
+                        data->length = ie[1];
+                        memcpy(ssid, ie + 2, data->length);
+                }
+        } else if (wdev->wext.connect.ssid && wdev->wext.connect.ssid_len) {
                 data->flags = 1;
                 data->length = wdev->wext.connect.ssid_len;
                 memcpy(ssid, wdev->wext.connect.ssid, data->length);
@@ -222,6 +241,7 @@ int cfg80211_mgd_wext_siwap(struct net_device *dev,
                             struct sockaddr *ap_addr, char *extra)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
         u8 *bssid = ap_addr->sa_data;
         int err;
 
@@ -236,7 +256,8 @@ int cfg80211_mgd_wext_siwap(struct net_device *dev,
         if (is_zero_ether_addr(bssid) || is_broadcast_ether_addr(bssid))
                 bssid = NULL;
 
-        cfg80211_lock_rdev(wiphy_to_dev(wdev->wiphy));
+        cfg80211_lock_rdev(rdev);
+        mutex_lock(&rdev->devlist_mtx);
         wdev_lock(wdev);
 
         if (wdev->sme_state != CFG80211_SME_IDLE) {
@@ -250,9 +271,8 @@ int cfg80211_mgd_wext_siwap(struct net_device *dev,
                     compare_ether_addr(bssid, wdev->wext.connect.bssid) == 0)
                         goto out;
 
-                err = __cfg80211_disconnect(wiphy_to_dev(wdev->wiphy),
-                                            dev, WLAN_REASON_DEAUTH_LEAVING,
-                                            false);
+                err = __cfg80211_disconnect(rdev, dev,
+                                            WLAN_REASON_DEAUTH_LEAVING, false);
                 if (err)
                         goto out;
         }
@@ -263,10 +283,11 @@ int cfg80211_mgd_wext_siwap(struct net_device *dev,
         } else
                 wdev->wext.connect.bssid = NULL;
 
-        err = cfg80211_mgd_wext_connect(wiphy_to_dev(wdev->wiphy), wdev);
+        err = cfg80211_mgd_wext_connect(rdev, wdev);
  out:
         wdev_unlock(wdev);
-        cfg80211_unlock_rdev(wiphy_to_dev(wdev->wiphy));
+        mutex_unlock(&rdev->devlist_mtx);
+        cfg80211_unlock_rdev(rdev);
         return err;
 }