297 files changed, 19790 insertions, 7084 deletions

diff --git a/Documentation/nfc/nfc-hci.txt b/Documentation/nfc/nfc-hci.txt
index 89a339c9b079..0686c9e211c2 100644
--- a/Documentation/nfc/nfc-hci.txt
+++ b/Documentation/nfc/nfc-hci.txt
@@ -17,10 +17,12 @@ HCI
 HCI registers as an nfc device with NFC Core. Requests coming from userspace are
 routed through netlink sockets to NFC Core and then to HCI. From this point,
 they are translated in a sequence of HCI commands sent to the HCI layer in the
-host controller (the chip). The sending context blocks while waiting for the
-response to arrive.
+host controller (the chip). Commands can be executed synchronously (the sending
+context blocks waiting for response) or asynchronously (the response is returned
+from HCI Rx context).
 HCI events can also be received from the host controller. They will be handled
-and a translation will be forwarded to NFC Core as needed.
+and a translation will be forwarded to NFC Core as needed. There are hooks to
+let the HCI driver handle proprietary events or override standard behavior.
 HCI uses 2 execution contexts:
 - one for executing commands : nfc_hci_msg_tx_work(). Only one command
 can be executing at any given moment.
@@ -33,6 +35,8 @@ The Session initialization is an HCI standard which must unfortunately
 support proprietary gates. This is the reason why the driver will pass a list
 of proprietary gates that must be part of the session. HCI will ensure all
 those gates have pipes connected when the hci device is set up.
+In case the chip supports pre-opened gates and pseudo-static pipes, the driver
+can pass that information to HCI core.
 
 HCI Gates and Pipes
 -------------------
@@ -46,6 +50,13 @@ without knowing the pipe connected to it.
 Driver interface
 ----------------
 
+A driver is generally written in two parts : the physical link management and
+the HCI management. This makes it easier to maintain a driver for a chip that
+can be connected using various phy (i2c, spi, ...)
+
+HCI Management
+--------------
+
 A driver would normally register itself with HCI and provide the following
 entry points:
 
@@ -53,58 +64,113 @@ struct nfc_hci_ops {
         int (*open)(struct nfc_hci_dev *hdev);
         void (*close)(struct nfc_hci_dev *hdev);
         int (*hci_ready) (struct nfc_hci_dev *hdev);
-        int (*xmit)(struct nfc_hci_dev *hdev, struct sk_buff *skb);
-        int (*start_poll)(struct nfc_hci_dev *hdev, u32 protocols);
-        int (*target_from_gate)(struct nfc_hci_dev *hdev, u8 gate,
-                                struct nfc_target *target);
+        int (*xmit) (struct nfc_hci_dev *hdev, struct sk_buff *skb);
+        int (*start_poll) (struct nfc_hci_dev *hdev,
+                           u32 im_protocols, u32 tm_protocols);
+        int (*dep_link_up)(struct nfc_hci_dev *hdev, struct nfc_target *target,
+                           u8 comm_mode, u8 *gb, size_t gb_len);
+        int (*dep_link_down)(struct nfc_hci_dev *hdev);
+        int (*target_from_gate) (struct nfc_hci_dev *hdev, u8 gate,
+                                 struct nfc_target *target);
         int (*complete_target_discovered) (struct nfc_hci_dev *hdev, u8 gate,
                                            struct nfc_target *target);
-        int (*data_exchange) (struct nfc_hci_dev *hdev,
-                              struct nfc_target *target,
-                              struct sk_buff *skb, struct sk_buff **res_skb);
+        int (*im_transceive) (struct nfc_hci_dev *hdev,
+                              struct nfc_target *target, struct sk_buff *skb,
+                              data_exchange_cb_t cb, void *cb_context);
+        int (*tm_send)(struct nfc_hci_dev *hdev, struct sk_buff *skb);
         int (*check_presence)(struct nfc_hci_dev *hdev,
                               struct nfc_target *target);
+        int (*event_received)(struct nfc_hci_dev *hdev, u8 gate, u8 event,
+                              struct sk_buff *skb);
 };
 
 - open() and close() shall turn the hardware on and off.
 - hci_ready() is an optional entry point that is called right after the hci
 session has been set up. The driver can use it to do additional initialization
 that must be performed using HCI commands.
-- xmit() shall simply write a frame to the chip.
+- xmit() shall simply write a frame to the physical link.
 - start_poll() is an optional entrypoint that shall set the hardware in polling
 mode. This must be implemented only if the hardware uses proprietary gates or a
 mechanism slightly different from the HCI standard.
+- dep_link_up() is called after a p2p target has been detected, to finish
+the p2p connection setup with hardware parameters that need to be passed back
+to nfc core.
+- dep_link_down() is called to bring the p2p link down.
 - target_from_gate() is an optional entrypoint to return the nfc protocols
 corresponding to a proprietary gate.
 - complete_target_discovered() is an optional entry point to let the driver
 perform additional proprietary processing necessary to auto activate the
 discovered target.
-- data_exchange() must be implemented by the driver if proprietary HCI commands
+- im_transceive() must be implemented by the driver if proprietary HCI commands
 are required to send data to the tag. Some tag types will require custom
 commands, others can be written to using the standard HCI commands. The driver
 can check the tag type and either do proprietary processing, or return 1 to ask
-for standard processing.
+for standard processing. The data exchange command itself must be sent
+asynchronously.
+- tm_send() is called to send data in the case of a p2p connection
 - check_presence() is an optional entry point that will be called regularly
 by the core to check that an activated tag is still in the field. If this is
 not implemented, the core will not be able to push tag_lost events to the user
 space
+- event_received() is called to handle an event coming from the chip. Driver
+can handle the event or return 1 to let HCI attempt standard processing.
 
 On the rx path, the driver is responsible to push incoming HCP frames to HCI
 using nfc_hci_recv_frame(). HCI will take care of re-aggregation and handling
 This must be done from a context that can sleep.
 
-SHDLC
------
+PHY Management
+--------------
+
+The physical link (i2c, ...) management is defined by the following struture:
+
+struct nfc_phy_ops {
+        int (*write)(void *dev_id, struct sk_buff *skb);
+        int (*enable)(void *dev_id);
+        void (*disable)(void *dev_id);
+};
+
+enable(): turn the phy on (power on), make it ready to transfer data
+disable(): turn the phy off
+write(): Send a data frame to the chip. Note that to enable higher
+layers such as an llc to store the frame for re-emission, this function must
+not alter the skb. It must also not return a positive result (return 0 for
+success, negative for failure).
+
+Data coming from the chip shall be sent directly to nfc_hci_recv_frame().
+
+LLC
+---
+
+Communication between the CPU and the chip often requires some link layer
+protocol. Those are isolated as modules managed by the HCI layer. There are
+currently two modules : nop (raw transfert) and shdlc.
+A new llc must implement the following functions:
+
+struct nfc_llc_ops {
+        void *(*init) (struct nfc_hci_dev *hdev, xmit_to_drv_t xmit_to_drv,
+                       rcv_to_hci_t rcv_to_hci, int tx_headroom,
+                       int tx_tailroom, int *rx_headroom, int *rx_tailroom,
+                       llc_failure_t llc_failure);
+        void (*deinit) (struct nfc_llc *llc);
+        int (*start) (struct nfc_llc *llc);
+        int (*stop) (struct nfc_llc *llc);
+        void (*rcv_from_drv) (struct nfc_llc *llc, struct sk_buff *skb);
+        int (*xmit_from_hci) (struct nfc_llc *llc, struct sk_buff *skb);
+};
+
+- init() : allocate and init your private storage
+- deinit() : cleanup
+- start() : establish the logical connection
+- stop () : terminate the logical connection
+- rcv_from_drv() : handle data coming from the chip, going to HCI
+- xmit_from_hci() : handle data sent by HCI, going to the chip
 
-Most chips use shdlc to ensure integrity and delivery ordering of the HCP
-frames between the host controller (the chip) and hosts (entities connected
-to the chip, like the cpu). In order to simplify writing the driver, an shdlc
-layer is available for use by the driver.
-When used, the driver actually registers with shdlc, and shdlc will register
-with HCI. HCI sees shdlc as the driver and thus send its HCP frames
-through shdlc->xmit.
-SHDLC adds a new execution context (nfc_shdlc_sm_work()) to run its state
-machine and handle both its rx and tx path.
+The llc must be registered with nfc before it can be used. Do that by
+calling nfc_llc_register(const char *name, struct nfc_llc_ops *ops);
+
+Again, note that the llc does not handle the physical link. It is thus very
+easy to mix any physical link with any llc for a given chip driver.
 
 Included Drivers
 ----------------
@@ -117,10 +183,12 @@ Execution Contexts
 
 The execution contexts are the following:
 - IRQ handler (IRQH):
-fast, cannot sleep. stores incoming frames into an shdlc rx queue
+fast, cannot sleep. sends incoming frames to HCI where they are passed to
+the current llc. In case of shdlc, the frame is queued in shdlc rx queue.
 
 - SHDLC State Machine worker (SMW)
-handles shdlc rx & tx queues. Dispatches HCI cmd responses.
+Only when llc_shdlc is used: handles shdlc rx & tx queues.
+Dispatches HCI cmd responses.
 
 - HCI Tx Cmd worker (MSGTXWQ)
 Serializes execution of HCI commands. Completes execution in case of response
@@ -166,6 +234,15 @@ waiting command execution. Response processing involves invoking the completion
 callback that was provided by nfc_hci_msg_tx_work() when it sent the command.
 The completion callback will then wake the syscall context.
 
+It is also possible to execute the command asynchronously using this API:
+
+static int nfc_hci_execute_cmd_async(struct nfc_hci_dev *hdev, u8 pipe, u8 cmd,
+                               const u8 *param, size_t param_len,
+                               data_exchange_cb_t cb, void *cb_context)
+
+The workflow is the same, except that the API call returns immediately, and
+the callback will be called with the result from the SMW context.
+
 Workflow receiving an HCI event or command
 ------------------------------------------
 
diff --git a/Documentation/nfc/nfc-pn544.txt b/Documentation/nfc/nfc-pn544.txt
index 2fcac9f5996e..b36ca14ca2d6 100644
--- a/Documentation/nfc/nfc-pn544.txt
+++ b/Documentation/nfc/nfc-pn544.txt
@@ -1,32 +1,15 @@
 Kernel driver for the NXP Semiconductors PN544 Near Field
 Communication chip
 
-Author: Jari Vanhala
-Contact: Matti Aaltonen (matti.j.aaltonen at nokia.com)
-
 General
 -------
 
 The PN544 is an integrated transmission module for contactless
 communication. The driver goes under drives/nfc/ and is compiled as a
-module named "pn544". It registers a misc device and creates a device
-file named "/dev/pn544".
+module named "pn544".
 
 Host Interfaces: I2C, SPI and HSU, this driver supports currently only I2C.
 
-The Interface
--------------
-
-The driver offers a sysfs interface for a hardware test and an IOCTL
-interface for selecting between two operating modes. There are read,
-write and poll functions for transferring messages. The two operating
-modes are the normal (HCI) mode and the firmware update mode.
-
-PN544 is controlled by sending messages from the userspace to the
-chip. The main function of the driver is just to pass those messages
-without caring about the message content.
-
-
 Protocols
 ---------
 
@@ -47,68 +30,3 @@ and third (LSB) bytes of the message. The maximum FW message length is
 
 For the ETSI HCI specification see
 http://www.etsi.org/WebSite/Technologies/ProtocolSpecification.aspx
-
-The Hardware Test
------------------
-
-The idea of the test is that it can performed by reading from the
-corresponding sysfs file. The test is implemented in the board file
-and it should test that PN544 can be put into the firmware update
-mode. If the test is not implemented the sysfs file does not get
-created.
-
-Example:
-> cat /sys/module/pn544/drivers/i2c\:pn544/3-002b/nfc_test
-1
-
-Normal Operation
-----------------
-
-PN544 is powered up when the device file is opened, otherwise it's
-turned off. Only one instance can use the device at a time.
-
-Userspace applications control PN544 with HCI messages. The hardware
-sends an interrupt when data is available for reading. Data is
-physically read when the read function is called by a userspace
-application. Poll() checks the read interrupt state. Configuration and
-self testing are also done from the userspace using read and write.
-
-Example platform data:
-
-static int rx71_pn544_nfc_request_resources(struct i2c_client *client)
-{
-        /* Get and setup the HW resources for the device */
-}
-
-static void rx71_pn544_nfc_free_resources(void)
-{
-        /* Release the HW resources */
-}
-
-static void rx71_pn544_nfc_enable(int fw)
-{
-        /* Turn the device on */
-}
-
-static int rx71_pn544_nfc_test(void)
-{
-        /*
-         * Put the device into the FW update mode
-         * and then back to the normal mode.
-         * Check the behavior and return one on success,
-         * zero on failure.
-         */
-}
-
-static void rx71_pn544_nfc_disable(void)
-{
-        /* turn the power off */
-}
-
-static struct pn544_nfc_platform_data rx71_nfc_data = {
-        .request_resources = rx71_pn544_nfc_request_resources,
-        .free_resources = rx71_pn544_nfc_free_resources,
-        .enable = rx71_pn544_nfc_enable,
-        .test = rx71_pn544_nfc_test,
-        .disable = rx71_pn544_nfc_disable,
-};
diff --git a/MAINTAINERS b/MAINTAINERS
index 4e2a1f67a1fc..16c3506da16c 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1353,6 +1353,14 @@ W:	http://wireless.kernel.org/en/users/Drivers/ath9k
 S:      Supported
 F:      drivers/net/wireless/ath/ath9k/
 
+WILOCITY WIL6210 WIRELESS DRIVER
+M:      Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
+L:      linux-wireless@vger.kernel.org
+L:      wil6210@qca.qualcomm.com
+S:      Supported
+W:      http://wireless.kernel.org/en/users/Drivers/wil6210
+F:      drivers/net/wireless/ath/wil6210/
+
 CARL9170 LINUX COMMUNITY WIRELESS DRIVER
 M:      Christian Lamparter <chunkeey@googlemail.com>
 L:      linux-wireless@vger.kernel.org
diff --git a/arch/mips/bcm47xx/serial.c b/arch/mips/bcm47xx/serial.c
index 57981e4fe2bc..b8ef965705cf 100644
--- a/arch/mips/bcm47xx/serial.c
+++ b/arch/mips/bcm47xx/serial.c
@@ -62,7 +62,7 @@ static int __init uart8250_init_bcma(void)
 
                 p->mapbase = (unsigned int) bcma_port->regs;
                 p->membase = (void *) bcma_port->regs;
-                p->irq = bcma_port->irq + 2;
+                p->irq = bcma_port->irq;
                 p->uartclk = bcma_port->baud_base;
                 p->regshift = bcma_port->reg_shift;
                 p->iotype = UPIO_MEM;
diff --git a/drivers/bcma/Kconfig b/drivers/bcma/Kconfig
index d7b56a88c9f4..8b4221cfd118 100644
--- a/drivers/bcma/Kconfig
+++ b/drivers/bcma/Kconfig
@@ -67,8 +67,7 @@ config BCMA_DRIVER_GMAC_CMN
 
 config BCMA_DRIVER_GPIO
         bool "BCMA GPIO driver"
-        depends on BCMA
-        select GPIOLIB
+        depends on BCMA && GPIOLIB
         help
           Driver to provide access to the GPIO pins of the bcma bus.
 
diff --git a/drivers/bcma/bcma_private.h b/drivers/bcma/bcma_private.h
index 4a2d72ec6d43..16c1dddfda00 100644
--- a/drivers/bcma/bcma_private.h
+++ b/drivers/bcma/bcma_private.h
@@ -31,6 +31,8 @@ int __init bcma_bus_early_register(struct bcma_bus *bus,
 int bcma_bus_suspend(struct bcma_bus *bus);
 int bcma_bus_resume(struct bcma_bus *bus);
 #endif
+struct bcma_device *bcma_find_core_unit(struct bcma_bus *bus, u16 coreid,
+                                        u8 unit);
 
 /* scan.c */
 int bcma_bus_scan(struct bcma_bus *bus);
@@ -45,6 +47,7 @@ int bcma_sprom_get(struct bcma_bus *bus);
 /* driver_chipcommon.c */
 #ifdef CONFIG_BCMA_DRIVER_MIPS
 void bcma_chipco_serial_init(struct bcma_drv_cc *cc);
+extern struct platform_device bcma_pflash_dev;
 #endif /* CONFIG_BCMA_DRIVER_MIPS */
 
 /* driver_chipcommon_pmu.c */
diff --git a/drivers/bcma/driver_chipcommon.c b/drivers/bcma/driver_chipcommon.c
index e461ad25fda4..28fa50ad87be 100644
--- a/drivers/bcma/driver_chipcommon.c
+++ b/drivers/bcma/driver_chipcommon.c
@@ -329,7 +329,7 @@ void bcma_chipco_serial_init(struct bcma_drv_cc *cc)
                 return;
         }
 
-        irq = bcma_core_mips_irq(cc->core);
+        irq = bcma_core_irq(cc->core);
 
         /* Determine the registers of the UARTs */
         cc->nr_serial_ports = (cc->capabilities & BCMA_CC_CAP_NRUART);
diff --git a/drivers/bcma/driver_chipcommon_sflash.c b/drivers/bcma/driver_chipcommon_sflash.c
index 63e688393825..1e694db4532d 100644
--- a/drivers/bcma/driver_chipcommon_sflash.c
+++ b/drivers/bcma/driver_chipcommon_sflash.c
@@ -35,7 +35,7 @@ static struct bcma_sflash_tbl_e bcma_sflash_st_tbl[] = {
         { "M25P40", 0x12, 0x10000, 8, },
 
         { "M25P16", 0x14, 0x10000, 32, },
-        { "M25P32", 0x14, 0x10000, 64, },
+        { "M25P32", 0x15, 0x10000, 64, },
         { "M25P64", 0x16, 0x10000, 128, },
         { "M25FL128", 0x17, 0x10000, 256, },
         { 0 },
diff --git a/drivers/bcma/driver_gpio.c b/drivers/bcma/driver_gpio.c
index 9a6f585da2d9..0b5df538dfd9 100644
--- a/drivers/bcma/driver_gpio.c
+++ b/drivers/bcma/driver_gpio.c
@@ -73,6 +73,16 @@ static void bcma_gpio_free(struct gpio_chip *chip, unsigned gpio)
         bcma_chipco_gpio_pullup(cc, 1 << gpio, 0);
 }
 
+static int bcma_gpio_to_irq(struct gpio_chip *chip, unsigned gpio)
+{
+        struct bcma_drv_cc *cc = bcma_gpio_get_cc(chip);
+
+        if (cc->core->bus->hosttype == BCMA_HOSTTYPE_SOC)
+                return bcma_core_irq(cc->core);
+        else
+                return -EINVAL;
+}
+
 int bcma_gpio_init(struct bcma_drv_cc *cc)
 {
         struct gpio_chip *chip = &cc->gpio;
@@ -85,6 +95,7 @@ int bcma_gpio_init(struct bcma_drv_cc *cc)
         chip->set               = bcma_gpio_set_value;
         chip->direction_input   = bcma_gpio_direction_input;
         chip->direction_output  = bcma_gpio_direction_output;
+        chip->to_irq            = bcma_gpio_to_irq;
         chip->ngpio             = 16;
         /* There is just one SoC in one device and its GPIO addresses should be
          * deterministic to address them more easily. The other buses could get
diff --git a/drivers/bcma/driver_mips.c b/drivers/bcma/driver_mips.c
index 792daad28cbc..9a7f0e3ab5a3 100644
--- a/drivers/bcma/driver_mips.c
+++ b/drivers/bcma/driver_mips.c
@@ -14,11 +14,33 @@
 
 #include <linux/bcma/bcma.h>
 
+#include <linux/mtd/physmap.h>
+#include <linux/platform_device.h>
 #include <linux/serial.h>
 #include <linux/serial_core.h>
 #include <linux/serial_reg.h>
 #include <linux/time.h>
 
+static const char *part_probes[] = { "bcm47xxpart", NULL };
+
+static struct physmap_flash_data bcma_pflash_data = {
+        .part_probe_types       = part_probes,
+};
+
+static struct resource bcma_pflash_resource = {
+        .name   = "bcma_pflash",
+        .flags  = IORESOURCE_MEM,
+};
+
+struct platform_device bcma_pflash_dev = {
+        .name           = "physmap-flash",
+        .dev            = {
+                .platform_data  = &bcma_pflash_data,
+        },
+        .resource       = &bcma_pflash_resource,
+        .num_resources  = 1,
+};
+
 /* The 47162a0 hangs when reading MIPS DMP registers registers */
 static inline bool bcma_core_mips_bcm47162a0_quirk(struct bcma_device *dev)
 {
@@ -74,28 +96,41 @@ static u32 bcma_core_mips_irqflag(struct bcma_device *dev)
                 return dev->core_index;
         flag = bcma_aread32(dev, BCMA_MIPS_OOBSELOUTA30);
 
-        return flag & 0x1F;
+        if (flag)
+                return flag & 0x1F;
+        else
+                return 0x3f;
 }
 
 /* Get the MIPS IRQ assignment for a specified device.
  * If unassigned, 0 is returned.
+ * If disabled, 5 is returned.
+ * If not supported, 6 is returned.
  */
-unsigned int bcma_core_mips_irq(struct bcma_device *dev)
+static unsigned int bcma_core_mips_irq(struct bcma_device *dev)
 {
         struct bcma_device *mdev = dev->bus->drv_mips.core;
         u32 irqflag;
         unsigned int irq;
 
         irqflag = bcma_core_mips_irqflag(dev);
+        if (irqflag == 0x3f)
+                return 6;
 
-        for (irq = 1; irq <= 4; irq++)
+        for (irq = 0; irq <= 4; irq++)
                 if (bcma_read32(mdev, BCMA_MIPS_MIPS74K_INTMASK(irq)) &
                     (1 << irqflag))
                         return irq;
 
-        return 0;
+        return 5;
+}
+
+unsigned int bcma_core_irq(struct bcma_device *dev)
+{
+        unsigned int mips_irq = bcma_core_mips_irq(dev);
+        return mips_irq <= 4 ? mips_irq + 2 : 0;
 }
-EXPORT_SYMBOL(bcma_core_mips_irq);
+EXPORT_SYMBOL(bcma_core_irq);
 
 static void bcma_core_mips_set_irq(struct bcma_device *dev, unsigned int irq)
 {
@@ -114,7 +149,7 @@ static void bcma_core_mips_set_irq(struct bcma_device *dev, unsigned int irq)
                 bcma_write32(mdev, BCMA_MIPS_MIPS74K_INTMASK(0),
                             bcma_read32(mdev, BCMA_MIPS_MIPS74K_INTMASK(0)) &
                             ~(1 << irqflag));
-        else
+        else if (oldirq != 5)
                 bcma_write32(mdev, BCMA_MIPS_MIPS74K_INTMASK(oldirq), 0);
 
         /* assign the new one */
@@ -123,9 +158,9 @@ static void bcma_core_mips_set_irq(struct bcma_device *dev, unsigned int irq)
                             bcma_read32(mdev, BCMA_MIPS_MIPS74K_INTMASK(0)) |
                             (1 << irqflag));
         } else {
-                u32 oldirqflag = bcma_read32(mdev,
-                                             BCMA_MIPS_MIPS74K_INTMASK(irq));
-                if (oldirqflag) {
+                u32 irqinitmask = bcma_read32(mdev,
+                                              BCMA_MIPS_MIPS74K_INTMASK(irq));
+                if (irqinitmask) {
                         struct bcma_device *core;
 
                         /* backplane irq line is in use, find out who uses
@@ -133,7 +168,7 @@ static void bcma_core_mips_set_irq(struct bcma_device *dev, unsigned int irq)
                          */
                         list_for_each_entry(core, &bus->cores, list) {
                                 if ((1 << bcma_core_mips_irqflag(core)) ==
-                                    oldirqflag) {
+                                    irqinitmask) {
                                         bcma_core_mips_set_irq(core, 0);
                                         break;
                                 }
@@ -143,15 +178,31 @@ static void bcma_core_mips_set_irq(struct bcma_device *dev, unsigned int irq)
                              1 << irqflag);
         }
 
-        bcma_info(bus, "set_irq: core 0x%04x, irq %d => %d\n",
-                  dev->id.id, oldirq + 2, irq + 2);
+        bcma_debug(bus, "set_irq: core 0x%04x, irq %d => %d\n",
+                   dev->id.id, oldirq <= 4 ? oldirq + 2 : 0, irq + 2);
+}
+
+static void bcma_core_mips_set_irq_name(struct bcma_bus *bus, unsigned int irq,
+                                        u16 coreid, u8 unit)
+{
+        struct bcma_device *core;
+
+        core = bcma_find_core_unit(bus, coreid, unit);
+        if (!core) {
+                bcma_warn(bus,
+                          "Can not find core (id: 0x%x, unit %i) for IRQ configuration.\n",
+                          coreid, unit);
+                return;
+        }
+
+        bcma_core_mips_set_irq(core, irq);
 }
 
 static void bcma_core_mips_print_irq(struct bcma_device *dev, unsigned int irq)
 {
         int i;
         static const char *irq_name[] = {"2(S)", "3", "4", "5", "6", "D", "I"};
-        printk(KERN_INFO KBUILD_MODNAME ": core 0x%04x, irq :", dev->id.id);
+        printk(KERN_DEBUG KBUILD_MODNAME ": core 0x%04x, irq :", dev->id.id);
         for (i = 0; i <= 6; i++)
                 printk(" %s%s", irq_name[i], i == irq ? "*" : " ");
         printk("\n");
@@ -182,6 +233,7 @@ static void bcma_core_mips_flash_detect(struct bcma_drv_mips *mcore)
 {
         struct bcma_bus *bus = mcore->core->bus;
         struct bcma_drv_cc *cc = &bus->drv_cc;
+        struct bcma_pflash *pflash = &cc->pflash;
 
         switch (cc->capabilities & BCMA_CC_CAP_FLASHT) {
         case BCMA_CC_FLASHT_STSER:
@@ -191,15 +243,20 @@ static void bcma_core_mips_flash_detect(struct bcma_drv_mips *mcore)
                 break;
         case BCMA_CC_FLASHT_PARA:
                 bcma_debug(bus, "Found parallel flash\n");
-                cc->pflash.present = true;
-                cc->pflash.window = BCMA_SOC_FLASH2;
-                cc->pflash.window_size = BCMA_SOC_FLASH2_SZ;
+                pflash->present = true;
+                pflash->window = BCMA_SOC_FLASH2;
+                pflash->window_size = BCMA_SOC_FLASH2_SZ;
 
                 if ((bcma_read32(cc->core, BCMA_CC_FLASH_CFG) &
                      BCMA_CC_FLASH_CFG_DS) == 0)
-                        cc->pflash.buswidth = 1;
+                        pflash->buswidth = 1;
                 else
-                        cc->pflash.buswidth = 2;
+                        pflash->buswidth = 2;
+
+                bcma_pflash_data.width = pflash->buswidth;
+                bcma_pflash_resource.start = pflash->window;
+                bcma_pflash_resource.end = pflash->window + pflash->window_size;
+
                 break;
         default:
                 bcma_err(bus, "Flash type not supported\n");
@@ -227,6 +284,32 @@ void bcma_core_mips_early_init(struct bcma_drv_mips *mcore)
         mcore->early_setup_done = true;
 }
 
+static void bcma_fix_i2s_irqflag(struct bcma_bus *bus)
+{
+        struct bcma_device *cpu, *pcie, *i2s;
+
+        /* Fixup the interrupts in 4716/4748 for i2s core (2010 Broadcom SDK)
+         * (IRQ flags > 7 are ignored when setting the interrupt masks)
+         */
+        if (bus->chipinfo.id != BCMA_CHIP_ID_BCM4716 &&
+            bus->chipinfo.id != BCMA_CHIP_ID_BCM4748)
+                return;
+
+        cpu = bcma_find_core(bus, BCMA_CORE_MIPS_74K);
+        pcie = bcma_find_core(bus, BCMA_CORE_PCIE);
+        i2s = bcma_find_core(bus, BCMA_CORE_I2S);
+        if (cpu && pcie && i2s &&
+            bcma_aread32(cpu, BCMA_MIPS_OOBSELINA74) == 0x08060504 &&
+            bcma_aread32(pcie, BCMA_MIPS_OOBSELINA74) == 0x08060504 &&
+            bcma_aread32(i2s, BCMA_MIPS_OOBSELOUTA30) == 0x88) {
+                bcma_awrite32(cpu, BCMA_MIPS_OOBSELINA74, 0x07060504);
+                bcma_awrite32(pcie, BCMA_MIPS_OOBSELINA74, 0x07060504);
+                bcma_awrite32(i2s, BCMA_MIPS_OOBSELOUTA30, 0x87);
+                bcma_debug(bus,
+                           "Moved i2s interrupt to oob line 7 instead of 8\n");
+        }
+}
+
 void bcma_core_mips_init(struct bcma_drv_mips *mcore)
 {
         struct bcma_bus *bus;
@@ -236,43 +319,55 @@ void bcma_core_mips_init(struct bcma_drv_mips *mcore)
         if (mcore->setup_done)
                 return;
 
-        bcma_info(bus, "Initializing MIPS core...\n");
+        bcma_debug(bus, "Initializing MIPS core...\n");
 
         bcma_core_mips_early_init(mcore);
 
-        mcore->assigned_irqs = 1;
-
-        /* Assign IRQs to all cores on the bus */
-        list_for_each_entry(core, &bus->cores, list) {
-                int mips_irq;
-                if (core->irq)
-                        continue;
-
-                mips_irq = bcma_core_mips_irq(core);
-                if (mips_irq > 4)
-                        core->irq = 0;
-                else
-                        core->irq = mips_irq + 2;
-                if (core->irq > 5)
-                        continue;
-                switch (core->id.id) {
-                case BCMA_CORE_PCI:
-                case BCMA_CORE_PCIE:
-                case BCMA_CORE_ETHERNET:
-                case BCMA_CORE_ETHERNET_GBIT:
-                case BCMA_CORE_MAC_GBIT:
-                case BCMA_CORE_80211:
-                case BCMA_CORE_USB20_HOST:
-                        /* These devices get their own IRQ line if available,
-                         * the rest goes on IRQ0
-                         */
-                        if (mcore->assigned_irqs <= 4)
-                                bcma_core_mips_set_irq(core,
-                                                       mcore->assigned_irqs++);
-                        break;
+        bcma_fix_i2s_irqflag(bus);
+
+        switch (bus->chipinfo.id) {
+        case BCMA_CHIP_ID_BCM4716:
+        case BCMA_CHIP_ID_BCM4748:
+                bcma_core_mips_set_irq_name(bus, 1, BCMA_CORE_80211, 0);
+                bcma_core_mips_set_irq_name(bus, 2, BCMA_CORE_MAC_GBIT, 0);
+                bcma_core_mips_set_irq_name(bus, 3, BCMA_CORE_USB20_HOST, 0);
+                bcma_core_mips_set_irq_name(bus, 4, BCMA_CORE_PCIE, 0);
+                bcma_core_mips_set_irq_name(bus, 0, BCMA_CORE_CHIPCOMMON, 0);
+                bcma_core_mips_set_irq_name(bus, 0, BCMA_CORE_I2S, 0);
+                break;
+        case BCMA_CHIP_ID_BCM5356:
+        case BCMA_CHIP_ID_BCM47162:
+        case BCMA_CHIP_ID_BCM53572:
+                bcma_core_mips_set_irq_name(bus, 1, BCMA_CORE_80211, 0);
+                bcma_core_mips_set_irq_name(bus, 2, BCMA_CORE_MAC_GBIT, 0);
+                bcma_core_mips_set_irq_name(bus, 0, BCMA_CORE_CHIPCOMMON, 0);
+                break;
+        case BCMA_CHIP_ID_BCM5357:
+        case BCMA_CHIP_ID_BCM4749:
+                bcma_core_mips_set_irq_name(bus, 1, BCMA_CORE_80211, 0);
+                bcma_core_mips_set_irq_name(bus, 2, BCMA_CORE_MAC_GBIT, 0);
+                bcma_core_mips_set_irq_name(bus, 3, BCMA_CORE_USB20_HOST, 0);
+                bcma_core_mips_set_irq_name(bus, 0, BCMA_CORE_CHIPCOMMON, 0);
+                bcma_core_mips_set_irq_name(bus, 0, BCMA_CORE_I2S, 0);
+                break;
+        case BCMA_CHIP_ID_BCM4706:
+                bcma_core_mips_set_irq_name(bus, 1, BCMA_CORE_PCIE, 0);
+                bcma_core_mips_set_irq_name(bus, 2, BCMA_CORE_4706_MAC_GBIT,
+                                            0);
+                bcma_core_mips_set_irq_name(bus, 3, BCMA_CORE_PCIE, 1);
+                bcma_core_mips_set_irq_name(bus, 4, BCMA_CORE_USB20_HOST, 0);
+                bcma_core_mips_set_irq_name(bus, 0, BCMA_CORE_4706_CHIPCOMMON,
+                                            0);
+                break;
+        default:
+                list_for_each_entry(core, &bus->cores, list) {
+                        core->irq = bcma_core_irq(core);
                 }
+                bcma_err(bus,
+                         "Unknown device (0x%x) found, can not configure IRQs\n",
+                         bus->chipinfo.id);
         }
-        bcma_info(bus, "IRQ reconfiguration done\n");
+        bcma_debug(bus, "IRQ reconfiguration done\n");
         bcma_core_mips_dump_irq(bus);
 
         mcore->setup_done = true;
diff --git a/drivers/bcma/driver_pci_host.c b/drivers/bcma/driver_pci_host.c
index e6b5c89469dc..221f8bb76390 100644
--- a/drivers/bcma/driver_pci_host.c
+++ b/drivers/bcma/driver_pci_host.c
@@ -94,19 +94,19 @@ static int bcma_extpci_read_config(struct bcma_drv_pci *pc, unsigned int dev,
         if (dev == 0) {
                 /* we support only two functions on device 0 */
                 if (func > 1)
-                        return -EINVAL;
+                        goto out;
 
                 /* accesses to config registers with offsets >= 256
                  * requires indirect access.
                  */
                 if (off >= PCI_CONFIG_SPACE_SIZE) {
                         addr = (func << 12);
-                        addr |= (off & 0x0FFF);
+                        addr |= (off & 0x0FFC);
                         val = bcma_pcie_read_config(pc, addr);
                 } else {
                         addr = BCMA_CORE_PCI_PCICFG0;
                         addr |= (func << 8);
-                        addr |= (off & 0xfc);
+                        addr |= (off & 0xFC);
                         val = pcicore_read32(pc, addr);
                 }
         } else {
@@ -119,11 +119,9 @@ static int bcma_extpci_read_config(struct bcma_drv_pci *pc, unsigned int dev,
                         goto out;
 
                 if (mips_busprobe32(val, mmio)) {
-                        val = 0xffffffff;
+                        val = 0xFFFFFFFF;
                         goto unmap;
                 }
-
-                val = readl(mmio);
         }
         val >>= (8 * (off & 3));
 
@@ -151,7 +149,7 @@ static int bcma_extpci_write_config(struct bcma_drv_pci *pc, unsigned int dev,
                                    const void *buf, int len)
 {
         int err = -EINVAL;
-        u32 addr = 0, val = 0;
+        u32 addr, val;
         void __iomem *mmio = 0;
         u16 chipid = pc->core->bus->chipinfo.id;
 
@@ -159,16 +157,22 @@ static int bcma_extpci_write_config(struct bcma_drv_pci *pc, unsigned int dev,
         if (unlikely(len != 1 && len != 2 && len != 4))
                 goto out;
         if (dev == 0) {
+                /* we support only two functions on device 0 */
+                if (func > 1)
+                        goto out;
+
                 /* accesses to config registers with offsets >= 256
                  * requires indirect access.
                  */
-                if (off < PCI_CONFIG_SPACE_SIZE) {
-                        addr = pc->core->addr + BCMA_CORE_PCI_PCICFG0;
+                if (off >= PCI_CONFIG_SPACE_SIZE) {
+                        addr = (func << 12);
+                        addr |= (off & 0x0FFC);
+                        val = bcma_pcie_read_config(pc, addr);
+                } else {
+                        addr = BCMA_CORE_PCI_PCICFG0;
                         addr |= (func << 8);
-                        addr |= (off & 0xfc);
-                        mmio = ioremap_nocache(addr, sizeof(val));
-                        if (!mmio)
-                                goto out;
+                        addr |= (off & 0xFC);
+                        val = pcicore_read32(pc, addr);
                 }
         } else {
                 addr = bcma_get_cfgspace_addr(pc, dev, func, off);
@@ -180,19 +184,17 @@ static int bcma_extpci_write_config(struct bcma_drv_pci *pc, unsigned int dev,
                         goto out;
 
                 if (mips_busprobe32(val, mmio)) {
-                        val = 0xffffffff;
+                        val = 0xFFFFFFFF;
                         goto unmap;
                 }
         }
 
         switch (len) {
         case 1:
-                val = readl(mmio);
                 val &= ~(0xFF << (8 * (off & 3)));
                 val |= *((const u8 *)buf) << (8 * (off & 3));
                 break;
         case 2:
-                val = readl(mmio);
                 val &= ~(0xFFFF << (8 * (off & 3)));
                 val |= *((const u16 *)buf) << (8 * (off & 3));
                 break;
@@ -200,13 +202,14 @@ static int bcma_extpci_write_config(struct bcma_drv_pci *pc, unsigned int dev,
                 val = *((const u32 *)buf);
                 break;
         }
-        if (dev == 0 && !addr) {
+        if (dev == 0) {
                 /* accesses to config registers with offsets >= 256
                  * requires indirect access.
                  */
-                addr = (func << 12);
-                addr |= (off & 0x0FFF);
-                bcma_pcie_write_config(pc, addr, val);
+                if (off >= PCI_CONFIG_SPACE_SIZE)
+                        bcma_pcie_write_config(pc, addr, val);
+                else
+                        pcicore_write32(pc, addr, val);
         } else {
                 writel(val, mmio);
 
@@ -277,7 +280,7 @@ static u8 __devinit bcma_find_pci_capability(struct bcma_drv_pci *pc,
         /* check for Header type 0 */
         bcma_extpci_read_config(pc, dev, func, PCI_HEADER_TYPE, &byte_val,
                                 sizeof(u8));
-        if ((byte_val & 0x7f) != PCI_HEADER_TYPE_NORMAL)
+        if ((byte_val & 0x7F) != PCI_HEADER_TYPE_NORMAL)
                 return cap_ptr;
 
         /* check if the capability pointer field exists */
@@ -427,7 +430,7 @@ void __devinit bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc)
         /* Reset RC */
         usleep_range(3000, 5000);
         pcicore_write32(pc, BCMA_CORE_PCI_CTL, BCMA_CORE_PCI_CTL_RST_OE);
-        usleep_range(1000, 2000);
+        msleep(50);
         pcicore_write32(pc, BCMA_CORE_PCI_CTL, BCMA_CORE_PCI_CTL_RST |
                         BCMA_CORE_PCI_CTL_RST_OE);
 
@@ -489,6 +492,17 @@ void __devinit bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc)
 
         bcma_core_pci_enable_crs(pc);
 
+        if (bus->chipinfo.id == BCMA_CHIP_ID_BCM4706 ||
+            bus->chipinfo.id == BCMA_CHIP_ID_BCM4716) {
+                u16 val16;
+                bcma_extpci_read_config(pc, 0, 0, BCMA_CORE_PCI_CFG_DEVCTRL,
+                                        &val16, sizeof(val16));
+                val16 |= (2 << 5);      /* Max payload size of 512 */
+                val16 |= (2 << 12);     /* MRRS 512 */
+                bcma_extpci_write_config(pc, 0, 0, BCMA_CORE_PCI_CFG_DEVCTRL,
+                                         &val16, sizeof(val16));
+        }
+
         /* Enable PCI bridge BAR0 memory & master access */
         tmp = PCI_COMMAND_MASTER | PCI_COMMAND_MEMORY;
         bcma_extpci_write_config(pc, 0, 0, PCI_COMMAND, &tmp, sizeof(tmp));
@@ -577,7 +591,7 @@ int bcma_core_pci_plat_dev_init(struct pci_dev *dev)
         pr_info("PCI: Fixing up device %s\n", pci_name(dev));
 
         /* Fix up interrupt lines */
-        dev->irq = bcma_core_mips_irq(pc_host->pdev->core) + 2;
+        dev->irq = bcma_core_irq(pc_host->pdev->core);
         pci_write_config_byte(dev, PCI_INTERRUPT_LINE, dev->irq);
 
         return 0;
@@ -596,6 +610,6 @@ int bcma_core_pci_pcibios_map_irq(const struct pci_dev *dev)
 
         pc_host = container_of(dev->bus->ops, struct bcma_drv_pci_host,
                                pci_ops);
-        return bcma_core_mips_irq(pc_host->pdev->core) + 2;
+        return bcma_core_irq(pc_host->pdev->core);
 }
 EXPORT_SYMBOL(bcma_core_pci_pcibios_map_irq);
diff --git a/drivers/bcma/main.c b/drivers/bcma/main.c
index 53ba20ca17e0..95ba5756c67e 100644
--- a/drivers/bcma/main.c
+++ b/drivers/bcma/main.c
@@ -81,8 +81,8 @@ struct bcma_device *bcma_find_core(struct bcma_bus *bus, u16 coreid)
 }
 EXPORT_SYMBOL_GPL(bcma_find_core);
 
-static struct bcma_device *bcma_find_core_unit(struct bcma_bus *bus, u16 coreid,
-                                               u8 unit)
+struct bcma_device *bcma_find_core_unit(struct bcma_bus *bus, u16 coreid,
+                                        u8 unit)
 {
         struct bcma_device *core;
 
@@ -149,6 +149,14 @@ static int bcma_register_cores(struct bcma_bus *bus)
                 dev_id++;
         }
 
+#ifdef CONFIG_BCMA_DRIVER_MIPS
+        if (bus->drv_cc.pflash.present) {
+                err = platform_device_register(&bcma_pflash_dev);
+                if (err)
+                        bcma_err(bus, "Error registering parallel flash\n");
+        }
+#endif
+
 #ifdef CONFIG_BCMA_SFLASH
         if (bus->drv_cc.sflash.present) {
                 err = platform_device_register(&bcma_sflash_dev);
diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
index b00000e8aef6..33c9a44a9678 100644
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -77,10 +77,15 @@ static struct usb_device_id ath3k_table[] = {
         { USB_DEVICE(0x0CF3, 0x311D) },
         { USB_DEVICE(0x13d3, 0x3375) },
         { USB_DEVICE(0x04CA, 0x3005) },
+        { USB_DEVICE(0x04CA, 0x3006) },
+        { USB_DEVICE(0x04CA, 0x3008) },
         { USB_DEVICE(0x13d3, 0x3362) },
         { USB_DEVICE(0x0CF3, 0xE004) },
         { USB_DEVICE(0x0930, 0x0219) },
         { USB_DEVICE(0x0489, 0xe057) },
+        { USB_DEVICE(0x13d3, 0x3393) },
+        { USB_DEVICE(0x0489, 0xe04e) },
+        { USB_DEVICE(0x0489, 0xe056) },
 
         /* Atheros AR5BBU12 with sflash firmware */
         { USB_DEVICE(0x0489, 0xE02C) },
@@ -104,10 +109,15 @@ static struct usb_device_id ath3k_blist_tbl[] = {
         { USB_DEVICE(0x0cf3, 0x311D), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
 
         /* Atheros AR5BBU22 with sflash firmware */
         { USB_DEVICE(0x0489, 0xE03C), .driver_info = BTUSB_ATH3012 },
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index a1d4ede5b892..7e351e345476 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -135,10 +135,15 @@ static struct usb_device_id blacklist_table[] = {
         { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
 
         /* Atheros AR5BBU12 with sflash firmware */
         { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
diff --git a/drivers/net/wireless/ath/Kconfig b/drivers/net/wireless/ath/Kconfig
index 1a67a4f829fe..2c02b4e84094 100644
--- a/drivers/net/wireless/ath/Kconfig
+++ b/drivers/net/wireless/ath/Kconfig
@@ -30,5 +30,6 @@ source "drivers/net/wireless/ath/ath9k/Kconfig"
 source "drivers/net/wireless/ath/carl9170/Kconfig"
 source "drivers/net/wireless/ath/ath6kl/Kconfig"
 source "drivers/net/wireless/ath/ar5523/Kconfig"
+source "drivers/net/wireless/ath/wil6210/Kconfig"
 
 endif
diff --git a/drivers/net/wireless/ath/Makefile b/drivers/net/wireless/ath/Makefile
index 1e18621326dc..97b964ded2be 100644
--- a/drivers/net/wireless/ath/Makefile
+++ b/drivers/net/wireless/ath/Makefile
@@ -3,6 +3,7 @@ obj-$(CONFIG_ATH9K_HW)		+= ath9k/
 obj-$(CONFIG_CARL9170)          += carl9170/
 obj-$(CONFIG_ATH6KL)            += ath6kl/
 obj-$(CONFIG_AR5523)            += ar5523/
+obj-$(CONFIG_WIL6210)           += wil6210/
 
 obj-$(CONFIG_ATH_COMMON)        += ath.o
 
diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
index 30ca0a60a64c..1d264c0f5a9b 100644
--- a/drivers/net/wireless/ath/ath5k/base.c
+++ b/drivers/net/wireless/ath/ath5k/base.c
@@ -240,13 +240,14 @@ static const struct ath_ops ath5k_common_ops = {
 * Driver Initialization *
 \***********************/
 
-static int ath5k_reg_notifier(struct wiphy *wiphy, struct regulatory_request *request)
+static void ath5k_reg_notifier(struct wiphy *wiphy,
+                               struct regulatory_request *request)
 {
         struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
         struct ath5k_hw *ah = hw->priv;
         struct ath_regulatory *regulatory = ath5k_hw_regulatory(ah);
 
-        return ath_reg_notifier_apply(wiphy, request, regulatory);
+        ath_reg_notifier_apply(wiphy, request, regulatory);
 }
 
 /********************\
diff --git a/drivers/net/wireless/ath/ath6kl/cfg80211.c b/drivers/net/wireless/ath/ath6kl/cfg80211.c
index 5516a8ccc3c6..4225cca0f198 100644
--- a/drivers/net/wireless/ath/ath6kl/cfg80211.c
+++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c
@@ -3492,8 +3492,8 @@ void ath6kl_cfg80211_stop_all(struct ath6kl *ar)
                 ath6kl_cfg80211_stop(vif);
 }
 
-static int ath6kl_cfg80211_reg_notify(struct wiphy *wiphy,
-                                      struct regulatory_request *request)
+static void ath6kl_cfg80211_reg_notify(struct wiphy *wiphy,
+                                       struct regulatory_request *request)
 {
         struct ath6kl *ar = wiphy_priv(wiphy);
         u32 rates[IEEE80211_NUM_BANDS];
@@ -3506,17 +3506,13 @@ static int ath6kl_cfg80211_reg_notify(struct wiphy *wiphy,
                    request->processed ? " processed" : "",
                    request->initiator, request->user_reg_hint_type);
 
-        /*
-         * As firmware is not able intersect regdoms, we can only listen to
-         * cellular hints.
-         */
         if (request->user_reg_hint_type != NL80211_USER_REG_HINT_CELL_BASE)
-                return -EOPNOTSUPP;
+                return;
 
         ret = ath6kl_wmi_set_regdomain_cmd(ar->wmi, request->alpha2);
         if (ret) {
                 ath6kl_err("failed to set regdomain: %d\n", ret);
-                return ret;
+                return;
         }
 
         /*
@@ -3536,10 +3532,8 @@ static int ath6kl_cfg80211_reg_notify(struct wiphy *wiphy,
         if (ret) {
                 ath6kl_err("failed to start scan for a regdomain change: %d\n",
                            ret);
-                return ret;
+                return;
         }
-
-        return 0;
 }
 
 static int ath6kl_cfg80211_vif_init(struct ath6kl_vif *vif)
diff --git a/drivers/net/wireless/ath/ath9k/Kconfig b/drivers/net/wireless/ath/ath9k/Kconfig
index 5fc15bf8be09..7647ed6b73d7 100644
--- a/drivers/net/wireless/ath/ath9k/Kconfig
+++ b/drivers/net/wireless/ath/ath9k/Kconfig
@@ -2,6 +2,7 @@ config ATH9K_HW
         tristate
 config ATH9K_COMMON
         tristate
+        select ATH_COMMON
 config ATH9K_DFS_DEBUGFS
         def_bool y
         depends on ATH9K_DEBUGFS && ATH9K_DFS_CERTIFIED
@@ -17,7 +18,6 @@ config ATH9K_BTCOEX_SUPPORT
 config ATH9K
         tristate "Atheros 802.11n wireless cards support"
         depends on MAC80211
-        select ATH_COMMON
         select ATH9K_HW
         select MAC80211_LEDS
         select LEDS_CLASS
@@ -56,7 +56,8 @@ config ATH9K_AHB
 
 config ATH9K_DEBUGFS
         bool "Atheros ath9k debugging"
-        depends on ATH9K && DEBUG_FS
+        depends on ATH9K
+        select MAC80211_DEBUGFS
         ---help---
           Say Y, if you need access to ath9k's statistics for
           interrupts, rate control, etc.
diff --git a/drivers/net/wireless/ath/ath9k/ahb.c b/drivers/net/wireless/ath/ath9k/ahb.c
index 3a69804f4c16..d1ff3c246a12 100644
--- a/drivers/net/wireless/ath/ath9k/ahb.c
+++ b/drivers/net/wireless/ath/ath9k/ahb.c
@@ -86,29 +86,25 @@ static int ath_ahb_probe(struct platform_device *pdev)
 
         if (!pdev->dev.platform_data) {
                 dev_err(&pdev->dev, "no platform data specified\n");
-                ret = -EINVAL;
-                goto err_out;
+                return -EINVAL;
         }
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         if (res == NULL) {
                 dev_err(&pdev->dev, "no memory resource found\n");
-                ret = -ENXIO;
-                goto err_out;
+                return -ENXIO;
         }
 
-        mem = ioremap_nocache(res->start, resource_size(res));
+        mem = devm_ioremap_nocache(&pdev->dev, res->start, resource_size(res));
         if (mem == NULL) {
                 dev_err(&pdev->dev, "ioremap failed\n");
-                ret = -ENOMEM;
-                goto err_out;
+                return -ENOMEM;
         }
 
         res = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
         if (res == NULL) {
                 dev_err(&pdev->dev, "no IRQ resource found\n");
-                ret = -ENXIO;
-                goto err_iounmap;
+                return -ENXIO;
         }
 
         irq = res->start;
@@ -116,8 +112,7 @@ static int ath_ahb_probe(struct platform_device *pdev)
         hw = ieee80211_alloc_hw(sizeof(struct ath_softc), &ath9k_ops);
         if (hw == NULL) {
                 dev_err(&pdev->dev, "no memory for ieee80211_hw\n");
-                ret = -ENOMEM;
-                goto err_iounmap;
+                return -ENOMEM;
         }
 
         SET_IEEE80211_DEV(hw, &pdev->dev);
@@ -156,9 +151,6 @@ static int ath_ahb_probe(struct platform_device *pdev)
  err_free_hw:
         ieee80211_free_hw(hw);
         platform_set_drvdata(pdev, NULL);
- err_iounmap:
-        iounmap(mem);
- err_out:
         return ret;
 }
 
@@ -168,12 +160,10 @@ static int ath_ahb_remove(struct platform_device *pdev)
 
         if (hw) {
                 struct ath_softc *sc = hw->priv;
-                void __iomem *mem = sc->mem;
 
                 ath9k_deinit_device(sc);
                 free_irq(sc->irq, sc);
                 ieee80211_free_hw(sc->hw);
-                iounmap(mem);
                 platform_set_drvdata(pdev, NULL);
         }
 
diff --git a/drivers/net/wireless/ath/ath9k/ani.c b/drivers/net/wireless/ath/ath9k/ani.c
index e09ec40ce71a..7ecd40f07a74 100644
--- a/drivers/net/wireless/ath/ath9k/ani.c
+++ b/drivers/net/wireless/ath/ath9k/ani.c
@@ -152,7 +152,8 @@ static void ath9k_hw_set_ofdm_nil(struct ath_hw *ah, u8 immunityLevel,
         ath_dbg(common, ANI, "**** ofdmlevel %d=>%d, rssi=%d[lo=%d hi=%d]\n",
                 aniState->ofdmNoiseImmunityLevel,
                 immunityLevel, BEACON_RSSI(ah),
-                aniState->rssiThrLow, aniState->rssiThrHigh);
+                ATH9K_ANI_RSSI_THR_LOW,
+                ATH9K_ANI_RSSI_THR_HIGH);
 
         if (!scan)
                 aniState->ofdmNoiseImmunityLevel = immunityLevel;
@@ -173,7 +174,7 @@ static void ath9k_hw_set_ofdm_nil(struct ath_hw *ah, u8 immunityLevel,
 
         weak_sig = entry_ofdm->ofdm_weak_signal_on;
         if (ah->opmode == NL80211_IFTYPE_STATION &&
-            BEACON_RSSI(ah) <= aniState->rssiThrHigh)
+            BEACON_RSSI(ah) <= ATH9K_ANI_RSSI_THR_HIGH)
                 weak_sig = true;
 
         if (aniState->ofdmWeakSigDetect != weak_sig)
@@ -216,11 +217,11 @@ static void ath9k_hw_set_cck_nil(struct ath_hw *ah, u_int8_t immunityLevel,
 
         ath_dbg(common, ANI, "**** ccklevel %d=>%d, rssi=%d[lo=%d hi=%d]\n",
                 aniState->cckNoiseImmunityLevel, immunityLevel,
-                BEACON_RSSI(ah), aniState->rssiThrLow,
-                aniState->rssiThrHigh);
+                BEACON_RSSI(ah), ATH9K_ANI_RSSI_THR_LOW,
+                ATH9K_ANI_RSSI_THR_HIGH);
 
         if (ah->opmode == NL80211_IFTYPE_STATION &&
-            BEACON_RSSI(ah) <= aniState->rssiThrLow &&
+            BEACON_RSSI(ah) <= ATH9K_ANI_RSSI_THR_LOW &&
             immunityLevel > ATH9K_ANI_CCK_MAX_LEVEL_LOW_RSSI)
                 immunityLevel = ATH9K_ANI_CCK_MAX_LEVEL_LOW_RSSI;
 
@@ -418,9 +419,6 @@ void ath9k_hw_ani_monitor(struct ath_hw *ah, struct ath9k_channel *chan)
                 return;
 
         aniState = &ah->curchan->ani;
-        if (WARN_ON(!aniState))
-                return;
-
         if (!ath9k_hw_ani_read_counters(ah))
                 return;
 
@@ -489,23 +487,6 @@ void ath9k_hw_disable_mib_counters(struct ath_hw *ah)
 }
 EXPORT_SYMBOL(ath9k_hw_disable_mib_counters);
 
-void ath9k_hw_ani_setup(struct ath_hw *ah)
-{
-        int i;
-
-        static const int totalSizeDesired[] = { -55, -55, -55, -55, -62 };
-        static const int coarseHigh[] = { -14, -14, -14, -14, -12 };
-        static const int coarseLow[] = { -64, -64, -64, -64, -70 };
-        static const int firpwr[] = { -78, -78, -78, -78, -80 };
-
-        for (i = 0; i < 5; i++) {
-                ah->totalSizeDesired[i] = totalSizeDesired[i];
-                ah->coarse_high[i] = coarseHigh[i];
-                ah->coarse_low[i] = coarseLow[i];
-                ah->firpwr[i] = firpwr[i];
-        }
-}
-
 void ath9k_hw_ani_init(struct ath_hw *ah)
 {
         struct ath_common *common = ath9k_hw_common(ah);
@@ -531,8 +512,6 @@ void ath9k_hw_ani_init(struct ath_hw *ah)
 
                 ani->ofdmsTurn = true;
 
-                ani->rssiThrHigh = ATH9K_ANI_RSSI_THR_HIGH;
-                ani->rssiThrLow = ATH9K_ANI_RSSI_THR_LOW;
                 ani->ofdmWeakSigDetect = ATH9K_ANI_USE_OFDM_WEAK_SIG;
                 ani->cckNoiseImmunityLevel = ATH9K_ANI_CCK_DEF_LEVEL;
                 ani->ofdmNoiseImmunityLevel = ATH9K_ANI_OFDM_DEF_LEVEL;
diff --git a/drivers/net/wireless/ath/ath9k/ani.h b/drivers/net/wireless/ath/ath9k/ani.h
index 1485bf5e3518..dddb1361039a 100644
--- a/drivers/net/wireless/ath/ath9k/ani.h
+++ b/drivers/net/wireless/ath/ath9k/ani.h
@@ -104,7 +104,6 @@ struct ath9k_ani_default {
 };
 
 struct ar5416AniState {
-        struct ath9k_channel *c;
         u8 noiseImmunityLevel;
         u8 ofdmNoiseImmunityLevel;
         u8 cckNoiseImmunityLevel;
@@ -113,15 +112,9 @@ struct ar5416AniState {
         u8 spurImmunityLevel;
         u8 firstepLevel;
         u8 ofdmWeakSigDetect;
-        u8 cckWeakSigThreshold;
         u32 listenTime;
-        int32_t rssiThrLow;
-        int32_t rssiThrHigh;
         u32 ofdmPhyErrCount;
         u32 cckPhyErrCount;
-        int16_t pktRssi[2];
-        int16_t ofdmErrRssi[2];
-        int16_t cckErrRssi[2];
         struct ath9k_ani_default iniDef;
 };
 
@@ -147,7 +140,6 @@ struct ar5416Stats {
 
 void ath9k_enable_mib_counters(struct ath_hw *ah);
 void ath9k_hw_disable_mib_counters(struct ath_hw *ah);
-void ath9k_hw_ani_setup(struct ath_hw *ah);
 void ath9k_hw_ani_init(struct ath_hw *ah);
 
 #endif /* ANI_H */
diff --git a/drivers/net/wireless/ath/ath9k/ar5008_initvals.h b/drivers/net/wireless/ath/ath9k/ar5008_initvals.h
index f81e7fc60a36..467ccfae2cee 100644
--- a/drivers/net/wireless/ath/ath9k/ar5008_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar5008_initvals.h
@@ -466,7 +466,7 @@ static const u32 ar5416Bank0[][2] = {
 };
 
 static const u32 ar5416BB_RfGain[][3] = {
-        /* Addr      5G_HT20     5G_HT40   */
+        /* Addr      5G          2G        */
         {0x00009a00, 0x00000000, 0x00000000},
         {0x00009a04, 0x00000040, 0x00000040},
         {0x00009a08, 0x00000080, 0x00000080},
@@ -546,12 +546,12 @@ static const u32 ar5416Bank2[][2] = {
 };
 
 static const u32 ar5416Bank3[][3] = {
-        /* Addr      5G_HT20     5G_HT40   */
+        /* Addr      5G          2G        */
         {0x000098f0, 0x01400018, 0x01c00018},
 };
 
 static const u32 ar5416Bank6[][3] = {
-        /* Addr      5G_HT20     5G_HT40   */
+        /* Addr      5G          2G        */
         {0x0000989c, 0x00000000, 0x00000000},
         {0x0000989c, 0x00000000, 0x00000000},
         {0x0000989c, 0x00000000, 0x00000000},
@@ -588,7 +588,7 @@ static const u32 ar5416Bank6[][3] = {
 };
 
 static const u32 ar5416Bank6TPC[][3] = {
-        /* Addr      5G_HT20     5G_HT40   */
+        /* Addr      5G          2G        */
         {0x0000989c, 0x00000000, 0x00000000},
         {0x0000989c, 0x00000000, 0x00000000},
         {0x0000989c, 0x00000000, 0x00000000},
diff --git a/drivers/net/wireless/ath/ath9k/ar5008_phy.c b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
index 874186bfda41..fd69376ecc83 100644
--- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
@@ -470,16 +470,15 @@ static void ar5008_hw_spur_mitigate(struct ath_hw *ah,
 static int ar5008_hw_rf_alloc_ext_banks(struct ath_hw *ah)
 {
 #define ATH_ALLOC_BANK(bank, size) do { \
-                bank = kzalloc((sizeof(u32) * size), GFP_KERNEL); \
-                if (!bank) { \
-                        ath_err(common, "Cannot allocate RF banks\n"); \
-                        return -ENOMEM; \
-                } \
+                bank = devm_kzalloc(ah->dev, sizeof(u32) * size, GFP_KERNEL); \
+                if (!bank) \
+                        goto error; \
         } while (0);
 
         struct ath_common *common = ath9k_hw_common(ah);
 
-        BUG_ON(AR_SREV_9280_20_OR_LATER(ah));
+        if (AR_SREV_9280_20_OR_LATER(ah))
+            return 0;
 
         ATH_ALLOC_BANK(ah->analogBank0Data, ah->iniBank0.ia_rows);
         ATH_ALLOC_BANK(ah->analogBank1Data, ah->iniBank1.ia_rows);
@@ -492,35 +491,12 @@ static int ar5008_hw_rf_alloc_ext_banks(struct ath_hw *ah)
 
         return 0;
 #undef ATH_ALLOC_BANK
+error:
+        ath_err(common, "Cannot allocate RF banks\n");
+        return -ENOMEM;
 }
 
 
-/**
- * ar5008_hw_rf_free_ext_banks - Free memory for analog bank scratch buffers
- * @ah: atheros hardware struture
- * For the external AR2133/AR5133 radios banks.
- */
-static void ar5008_hw_rf_free_ext_banks(struct ath_hw *ah)
-{
-#define ATH_FREE_BANK(bank) do { \
-                kfree(bank); \
-                bank = NULL; \
-        } while (0);
-
-        BUG_ON(AR_SREV_9280_20_OR_LATER(ah));
-
-        ATH_FREE_BANK(ah->analogBank0Data);
-        ATH_FREE_BANK(ah->analogBank1Data);
-        ATH_FREE_BANK(ah->analogBank2Data);
-        ATH_FREE_BANK(ah->analogBank3Data);
-        ATH_FREE_BANK(ah->analogBank6Data);
-        ATH_FREE_BANK(ah->analogBank6TPCData);
-        ATH_FREE_BANK(ah->analogBank7Data);
-        ATH_FREE_BANK(ah->bank6Temp);
-
-#undef ATH_FREE_BANK
-}
-
 /* *
  * ar5008_hw_set_rf_regs - programs rf registers based on EEPROM
  * @ah: atheros hardware structure
@@ -1380,7 +1356,7 @@ static void ar5008_hw_set_radar_conf(struct ath_hw *ah)
         conf->radar_inband = 8;
 }
 
-void ar5008_hw_attach_phy_ops(struct ath_hw *ah)
+int ar5008_hw_attach_phy_ops(struct ath_hw *ah)
 {
         struct ath_hw_private_ops *priv_ops = ath9k_hw_private_ops(ah);
         static const u32 ar5416_cca_regs[6] = {
@@ -1391,12 +1367,15 @@ void ar5008_hw_attach_phy_ops(struct ath_hw *ah)
                 AR_PHY_CH1_EXT_CCA,
                 AR_PHY_CH2_EXT_CCA
         };
+        int ret;
+
+        ret = ar5008_hw_rf_alloc_ext_banks(ah);
+        if (ret)
+            return ret;
 
         priv_ops->rf_set_freq = ar5008_hw_set_channel;
         priv_ops->spur_mitigate_freq = ar5008_hw_spur_mitigate;
 
-        priv_ops->rf_alloc_ext_banks = ar5008_hw_rf_alloc_ext_banks;
-        priv_ops->rf_free_ext_banks = ar5008_hw_rf_free_ext_banks;
         priv_ops->set_rf_regs = ar5008_hw_set_rf_regs;
         priv_ops->set_channel_regs = ar5008_hw_set_channel_regs;
         priv_ops->init_bb = ar5008_hw_init_bb;
@@ -1421,4 +1400,5 @@ void ar5008_hw_attach_phy_ops(struct ath_hw *ah)
         ar5008_hw_set_nf_limits(ah);
         ar5008_hw_set_radar_conf(ah);
         memcpy(ah->nf_regs, ar5416_cca_regs, sizeof(ah->nf_regs));
+        return 0;
 }
diff --git a/drivers/net/wireless/ath/ath9k/ar9001_initvals.h b/drivers/net/wireless/ath/ath9k/ar9001_initvals.h
index ea4a230997ac..59524e1d4678 100644
--- a/drivers/net/wireless/ath/ath9k/ar9001_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9001_initvals.h
@@ -460,7 +460,7 @@ static const u32 ar5416Common_9100[][2] = {
 };
 
 static const u32 ar5416Bank6_9100[][3] = {
-        /* Addr      5G_HT20     5G_HT40   */
+        /* Addr      5G          2G        */
         {0x0000989c, 0x00000000, 0x00000000},
         {0x0000989c, 0x00000000, 0x00000000},
         {0x0000989c, 0x00000000, 0x00000000},
@@ -497,7 +497,7 @@ static const u32 ar5416Bank6_9100[][3] = {
 };
 
 static const u32 ar5416Bank6TPC_9100[][3] = {
-        /* Addr      5G_HT20     5G_HT40   */
+        /* Addr      5G          2G        */
         {0x0000989c, 0x00000000, 0x00000000},
         {0x0000989c, 0x00000000, 0x00000000},
         {0x0000989c, 0x00000000, 0x00000000},
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_hw.c b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
index 648da3e885e9..f053d978540e 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_hw.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
@@ -23,13 +23,13 @@
 
 /* General hardware code for the A5008/AR9001/AR9002 hadware families */
 
-static void ar9002_hw_init_mode_regs(struct ath_hw *ah)
+static int ar9002_hw_init_mode_regs(struct ath_hw *ah)
 {
         if (AR_SREV_9271(ah)) {
                 INIT_INI_ARRAY(&ah->iniModes, ar9271Modes_9271);
                 INIT_INI_ARRAY(&ah->iniCommon, ar9271Common_9271);
                 INIT_INI_ARRAY(&ah->iniModes_9271_ANI_reg, ar9271Modes_9271_ANI_reg);
-                return;
+                return 0;
         }
 
         if (ah->config.pcie_clock_req)
@@ -102,9 +102,9 @@ static void ar9002_hw_init_mode_regs(struct ath_hw *ah)
                 u32 size = sizeof(u32) * addac->ia_rows * addac->ia_columns;
                 u32 *data;
 
-                data = kmalloc(size, GFP_KERNEL);
+                data = devm_kzalloc(ah->dev, size, GFP_KERNEL);
                 if (!data)
-                        return;
+                        return -ENOMEM;
 
                 memcpy(data, addac->ia_array, size);
                 addac->ia_array = data;
@@ -120,6 +120,7 @@ static void ar9002_hw_init_mode_regs(struct ath_hw *ah)
                 INIT_INI_ARRAY(&ah->iniCckfirJapan2484,
                        ar9287Common_japan_2484_cck_fir_coeff_9287_1_1);
         }
+        return 0;
 }
 
 static void ar9280_20_hw_init_rxgain_ini(struct ath_hw *ah)
@@ -409,22 +410,30 @@ void ar9002_hw_enable_async_fifo(struct ath_hw *ah)
 }
 
 /* Sets up the AR5008/AR9001/AR9002 hardware familiy callbacks */
-void ar9002_hw_attach_ops(struct ath_hw *ah)
+int ar9002_hw_attach_ops(struct ath_hw *ah)
 {
         struct ath_hw_private_ops *priv_ops = ath9k_hw_private_ops(ah);
         struct ath_hw_ops *ops = ath9k_hw_ops(ah);
+        int ret;
+
+        ret = ar9002_hw_init_mode_regs(ah);
+        if (ret)
+                return ret;
 
-        priv_ops->init_mode_regs = ar9002_hw_init_mode_regs;
         priv_ops->init_mode_gain_regs = ar9002_hw_init_mode_gain_regs;
 
         ops->config_pci_powersave = ar9002_hw_configpcipowersave;
 
-        ar5008_hw_attach_phy_ops(ah);
+        ret = ar5008_hw_attach_phy_ops(ah);
+        if (ret)
+                return ret;
+
         if (AR_SREV_9280_20_OR_LATER(ah))
                 ar9002_hw_attach_phy_ops(ah);
 
         ar9002_hw_attach_calib_ops(ah);
         ar9002_hw_attach_mac_ops(ah);
+        return 0;
 }
 
 void ar9002_hw_load_ani_reg(struct ath_hw *ah, struct ath9k_channel *chan)
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_phy.c b/drivers/net/wireless/ath/ath9k/ar9002_phy.c
index 846dd7974eb8..f4003512d8d5 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_phy.c
@@ -555,14 +555,73 @@ static void ar9002_hw_antdiv_comb_conf_set(struct ath_hw *ah,
         REG_WRITE(ah, AR_PHY_MULTICHAIN_GAIN_CTL, regval);
 }
 
+static void ar9002_hw_spectral_scan_config(struct ath_hw *ah,
+                                    struct ath_spec_scan *param)
+{
+        u8 count;
+
+        if (!param->enabled) {
+                REG_CLR_BIT(ah, AR_PHY_SPECTRAL_SCAN,
+                            AR_PHY_SPECTRAL_SCAN_ENABLE);
+                return;
+        }
+        REG_SET_BIT(ah, AR_PHY_RADAR_0, AR_PHY_RADAR_0_FFT_ENA);
+        REG_SET_BIT(ah, AR_PHY_SPECTRAL_SCAN, AR_PHY_SPECTRAL_SCAN_ENABLE);
+
+        if (param->short_repeat)
+                REG_SET_BIT(ah, AR_PHY_SPECTRAL_SCAN,
+                            AR_PHY_SPECTRAL_SCAN_SHORT_REPEAT);
+        else
+                REG_CLR_BIT(ah, AR_PHY_SPECTRAL_SCAN,
+                            AR_PHY_SPECTRAL_SCAN_SHORT_REPEAT);
+
+        /* on AR92xx, the highest bit of count will make the the chip send
+         * spectral samples endlessly. Check if this really was intended,
+         * and fix otherwise.
+         */
+        count = param->count;
+        if (param->endless)
+                count = 0x80;
+        else if (count & 0x80)
+                count = 0x7f;
+
+        REG_RMW_FIELD(ah, AR_PHY_SPECTRAL_SCAN,
+                      AR_PHY_SPECTRAL_SCAN_COUNT, count);
+        REG_RMW_FIELD(ah, AR_PHY_SPECTRAL_SCAN,
+                      AR_PHY_SPECTRAL_SCAN_PERIOD, param->period);
+        REG_RMW_FIELD(ah, AR_PHY_SPECTRAL_SCAN,
+                      AR_PHY_SPECTRAL_SCAN_FFT_PERIOD, param->fft_period);
+
+        return;
+}
+
+static void ar9002_hw_spectral_scan_trigger(struct ath_hw *ah)
+{
+        REG_SET_BIT(ah, AR_PHY_SPECTRAL_SCAN, AR_PHY_SPECTRAL_SCAN_ENABLE);
+        /* Activate spectral scan */
+        REG_SET_BIT(ah, AR_PHY_SPECTRAL_SCAN,
+                    AR_PHY_SPECTRAL_SCAN_ACTIVE);
+}
+
+static void ar9002_hw_spectral_scan_wait(struct ath_hw *ah)
+{
+        struct ath_common *common = ath9k_hw_common(ah);
+
+        /* Poll for spectral scan complete */
+        if (!ath9k_hw_wait(ah, AR_PHY_SPECTRAL_SCAN,
+                           AR_PHY_SPECTRAL_SCAN_ACTIVE,
+                           0, AH_WAIT_TIMEOUT)) {
+                ath_err(common, "spectral scan wait failed\n");
+                return;
+        }
+}
+
 void ar9002_hw_attach_phy_ops(struct ath_hw *ah)
 {
         struct ath_hw_private_ops *priv_ops = ath9k_hw_private_ops(ah);
         struct ath_hw_ops *ops = ath9k_hw_ops(ah);
 
         priv_ops->set_rf_regs = NULL;
-        priv_ops->rf_alloc_ext_banks = NULL;
-        priv_ops->rf_free_ext_banks = NULL;
         priv_ops->rf_set_freq = ar9002_hw_set_channel;
         priv_ops->spur_mitigate_freq = ar9002_hw_spur_mitigate;
         priv_ops->olc_init = ar9002_olc_init;
@@ -571,6 +630,9 @@ void ar9002_hw_attach_phy_ops(struct ath_hw *ah)
 
         ops->antdiv_comb_conf_get = ar9002_hw_antdiv_comb_conf_get;
         ops->antdiv_comb_conf_set = ar9002_hw_antdiv_comb_conf_set;
+        ops->spectral_scan_config = ar9002_hw_spectral_scan_config;
+        ops->spectral_scan_trigger = ar9002_hw_spectral_scan_trigger;
+        ops->spectral_scan_wait = ar9002_hw_spectral_scan_wait;
 
         ar9002_hw_set_nf_limits(ah);
 }
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h b/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
index 262e1e036fd7..db5ffada2217 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
@@ -744,6 +744,186 @@ static const u32 ar9300Modes_high_ob_db_tx_gain_table_2p2[][5] = {
         {0x00016868, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
 };
 
+static const u32 ar9300Modes_mixed_ob_db_tx_gain_table_2p2[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x0000a2dc, 0x00033800, 0x00033800, 0x03aaa352, 0x03aaa352},
+        {0x0000a2e0, 0x0003c000, 0x0003c000, 0x03ccc584, 0x03ccc584},
+        {0x0000a2e4, 0x03fc0000, 0x03fc0000, 0x03f0f800, 0x03f0f800},
+        {0x0000a2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
+        {0x0000a410, 0x000050d9, 0x000050d9, 0x000050d9, 0x000050d9},
+        {0x0000a500, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a504, 0x06000003, 0x06000003, 0x04000002, 0x04000002},
+        {0x0000a508, 0x0a000020, 0x0a000020, 0x08000004, 0x08000004},
+        {0x0000a50c, 0x10000023, 0x10000023, 0x0b000200, 0x0b000200},
+        {0x0000a510, 0x16000220, 0x16000220, 0x0f000202, 0x0f000202},
+        {0x0000a514, 0x1c000223, 0x1c000223, 0x11000400, 0x11000400},
+        {0x0000a518, 0x21002220, 0x21002220, 0x15000402, 0x15000402},
+        {0x0000a51c, 0x27002223, 0x27002223, 0x19000404, 0x19000404},
+        {0x0000a520, 0x2b022220, 0x2b022220, 0x1b000603, 0x1b000603},
+        {0x0000a524, 0x2f022222, 0x2f022222, 0x1f000a02, 0x1f000a02},
+        {0x0000a528, 0x34022225, 0x34022225, 0x23000a04, 0x23000a04},
+        {0x0000a52c, 0x3a02222a, 0x3a02222a, 0x26000a20, 0x26000a20},
+        {0x0000a530, 0x3e02222c, 0x3e02222c, 0x2a000e20, 0x2a000e20},
+        {0x0000a534, 0x4202242a, 0x4202242a, 0x2e000e22, 0x2e000e22},
+        {0x0000a538, 0x4702244a, 0x4702244a, 0x31000e24, 0x31000e24},
+        {0x0000a53c, 0x4b02244c, 0x4b02244c, 0x34001640, 0x34001640},
+        {0x0000a540, 0x4e02246c, 0x4e02246c, 0x38001660, 0x38001660},
+        {0x0000a544, 0x52022470, 0x52022470, 0x3b001861, 0x3b001861},
+        {0x0000a548, 0x55022490, 0x55022490, 0x3e001a81, 0x3e001a81},
+        {0x0000a54c, 0x59022492, 0x59022492, 0x42001a83, 0x42001a83},
+        {0x0000a550, 0x5d022692, 0x5d022692, 0x44001c84, 0x44001c84},
+        {0x0000a554, 0x61022892, 0x61022892, 0x48001ce3, 0x48001ce3},
+        {0x0000a558, 0x65024890, 0x65024890, 0x4c001ce5, 0x4c001ce5},
+        {0x0000a55c, 0x69024892, 0x69024892, 0x50001ce9, 0x50001ce9},
+        {0x0000a560, 0x6e024c92, 0x6e024c92, 0x54001ceb, 0x54001ceb},
+        {0x0000a564, 0x74026e92, 0x74026e92, 0x56001eec, 0x56001eec},
+        {0x0000a568, 0x74026e92, 0x74026e92, 0x56001eec, 0x56001eec},
+        {0x0000a56c, 0x74026e92, 0x74026e92, 0x56001eec, 0x56001eec},
+        {0x0000a570, 0x74026e92, 0x74026e92, 0x56001eec, 0x56001eec},
+        {0x0000a574, 0x74026e92, 0x74026e92, 0x56001eec, 0x56001eec},
+        {0x0000a578, 0x74026e92, 0x74026e92, 0x56001eec, 0x56001eec},
+        {0x0000a57c, 0x74026e92, 0x74026e92, 0x56001eec, 0x56001eec},
+        {0x0000a580, 0x00800000, 0x00800000, 0x00800000, 0x00800000},
+        {0x0000a584, 0x06800003, 0x06800003, 0x04800002, 0x04800002},
+        {0x0000a588, 0x0a800020, 0x0a800020, 0x08800004, 0x08800004},
+        {0x0000a58c, 0x10800023, 0x10800023, 0x0b800200, 0x0b800200},
+        {0x0000a590, 0x16800220, 0x16800220, 0x0f800202, 0x0f800202},
+        {0x0000a594, 0x1c800223, 0x1c800223, 0x11800400, 0x11800400},
+        {0x0000a598, 0x21802220, 0x21802220, 0x15800402, 0x15800402},
+        {0x0000a59c, 0x27802223, 0x27802223, 0x19800404, 0x19800404},
+        {0x0000a5a0, 0x2b822220, 0x2b822220, 0x1b800603, 0x1b800603},
+        {0x0000a5a4, 0x2f822222, 0x2f822222, 0x1f800a02, 0x1f800a02},
+        {0x0000a5a8, 0x34822225, 0x34822225, 0x23800a04, 0x23800a04},
+        {0x0000a5ac, 0x3a82222a, 0x3a82222a, 0x26800a20, 0x26800a20},
+        {0x0000a5b0, 0x3e82222c, 0x3e82222c, 0x2a800e20, 0x2a800e20},
+        {0x0000a5b4, 0x4282242a, 0x4282242a, 0x2e800e22, 0x2e800e22},
+        {0x0000a5b8, 0x4782244a, 0x4782244a, 0x31800e24, 0x31800e24},
+        {0x0000a5bc, 0x4b82244c, 0x4b82244c, 0x34801640, 0x34801640},
+        {0x0000a5c0, 0x4e82246c, 0x4e82246c, 0x38801660, 0x38801660},
+        {0x0000a5c4, 0x52822470, 0x52822470, 0x3b801861, 0x3b801861},
+        {0x0000a5c8, 0x55822490, 0x55822490, 0x3e801a81, 0x3e801a81},
+        {0x0000a5cc, 0x59822492, 0x59822492, 0x42801a83, 0x42801a83},
+        {0x0000a5d0, 0x5d822692, 0x5d822692, 0x44801c84, 0x44801c84},
+        {0x0000a5d4, 0x61822892, 0x61822892, 0x48801ce3, 0x48801ce3},
+        {0x0000a5d8, 0x65824890, 0x65824890, 0x4c801ce5, 0x4c801ce5},
+        {0x0000a5dc, 0x69824892, 0x69824892, 0x50801ce9, 0x50801ce9},
+        {0x0000a5e0, 0x6e824c92, 0x6e824c92, 0x54801ceb, 0x54801ceb},
+        {0x0000a5e4, 0x74826e92, 0x74826e92, 0x56801eec, 0x56801eec},
+        {0x0000a5e8, 0x74826e92, 0x74826e92, 0x56801eec, 0x56801eec},
+        {0x0000a5ec, 0x74826e92, 0x74826e92, 0x56801eec, 0x56801eec},
+        {0x0000a5f0, 0x74826e92, 0x74826e92, 0x56801eec, 0x56801eec},
+        {0x0000a5f4, 0x74826e92, 0x74826e92, 0x56801eec, 0x56801eec},
+        {0x0000a5f8, 0x74826e92, 0x74826e92, 0x56801eec, 0x56801eec},
+        {0x0000a5fc, 0x74826e92, 0x74826e92, 0x56801eec, 0x56801eec},
+        {0x0000a600, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a604, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a608, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a60c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a610, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a614, 0x02004000, 0x02004000, 0x01404000, 0x01404000},
+        {0x0000a618, 0x02004801, 0x02004801, 0x01404501, 0x01404501},
+        {0x0000a61c, 0x02808a02, 0x02808a02, 0x02008501, 0x02008501},
+        {0x0000a620, 0x0380ce03, 0x0380ce03, 0x0280ca03, 0x0280ca03},
+        {0x0000a624, 0x04411104, 0x04411104, 0x03010c04, 0x03010c04},
+        {0x0000a628, 0x04411104, 0x04411104, 0x04014c04, 0x04014c04},
+        {0x0000a62c, 0x04411104, 0x04411104, 0x04015005, 0x04015005},
+        {0x0000a630, 0x04411104, 0x04411104, 0x04015005, 0x04015005},
+        {0x0000a634, 0x04411104, 0x04411104, 0x04015005, 0x04015005},
+        {0x0000a638, 0x04411104, 0x04411104, 0x04015005, 0x04015005},
+        {0x0000a63c, 0x04411104, 0x04411104, 0x04015005, 0x04015005},
+        {0x0000b2dc, 0x00033800, 0x00033800, 0x03aaa352, 0x03aaa352},
+        {0x0000b2e0, 0x0003c000, 0x0003c000, 0x03ccc584, 0x03ccc584},
+        {0x0000b2e4, 0x03fc0000, 0x03fc0000, 0x03f0f800, 0x03f0f800},
+        {0x0000b2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
+        {0x0000c2dc, 0x00033800, 0x00033800, 0x03aaa352, 0x03aaa352},
+        {0x0000c2e0, 0x0003c000, 0x0003c000, 0x03ccc584, 0x03ccc584},
+        {0x0000c2e4, 0x03fc0000, 0x03fc0000, 0x03f0f800, 0x03f0f800},
+        {0x0000c2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
+        {0x00016044, 0x012492d4, 0x012492d4, 0x056db2e4, 0x056db2e4},
+        {0x00016048, 0x66480001, 0x66480001, 0x8e480001, 0x8e480001},
+        {0x00016068, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
+        {0x00016444, 0x012492d4, 0x012492d4, 0x056db2e4, 0x056db2e4},
+        {0x00016448, 0x66480001, 0x66480001, 0x8e480001, 0x8e480001},
+        {0x00016468, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
+        {0x00016844, 0x012492d4, 0x012492d4, 0x056db2e4, 0x056db2e4},
+        {0x00016848, 0x66480001, 0x66480001, 0x8e480001, 0x8e480001},
+        {0x00016868, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
+};
+
+static const u32 ar9300Modes_type5_tx_gain_table_2p2[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x0000a2dc, 0x000cfff0, 0x000cfff0, 0x03aaa352, 0x03aaa352},
+        {0x0000a2e0, 0x000f0000, 0x000f0000, 0x03ccc584, 0x03ccc584},
+        {0x0000a2e4, 0x03f00000, 0x03f00000, 0x03f0f800, 0x03f0f800},
+        {0x0000a2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
+        {0x0000a410, 0x000050d9, 0x000050d9, 0x000050d9, 0x000050d9},
+        {0x0000a500, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a504, 0x06000003, 0x06000003, 0x04000002, 0x04000002},
+        {0x0000a508, 0x0a000020, 0x0a000020, 0x08000004, 0x08000004},
+        {0x0000a50c, 0x10000023, 0x10000023, 0x0b000200, 0x0b000200},
+        {0x0000a510, 0x15000028, 0x15000028, 0x0f000202, 0x0f000202},
+        {0x0000a514, 0x1b00002b, 0x1b00002b, 0x12000400, 0x12000400},
+        {0x0000a518, 0x1f020028, 0x1f020028, 0x16000402, 0x16000402},
+        {0x0000a51c, 0x2502002b, 0x2502002b, 0x19000404, 0x19000404},
+        {0x0000a520, 0x2a04002a, 0x2a04002a, 0x1c000603, 0x1c000603},
+        {0x0000a524, 0x2e06002a, 0x2e06002a, 0x21000a02, 0x21000a02},
+        {0x0000a528, 0x3302202d, 0x3302202d, 0x25000a04, 0x25000a04},
+        {0x0000a52c, 0x3804202c, 0x3804202c, 0x28000a20, 0x28000a20},
+        {0x0000a530, 0x3c06202c, 0x3c06202c, 0x2c000e20, 0x2c000e20},
+        {0x0000a534, 0x4108202d, 0x4108202d, 0x30000e22, 0x30000e22},
+        {0x0000a538, 0x4506402d, 0x4506402d, 0x34000e24, 0x34000e24},
+        {0x0000a53c, 0x4906222d, 0x4906222d, 0x38001640, 0x38001640},
+        {0x0000a540, 0x4d062231, 0x4d062231, 0x3c001660, 0x3c001660},
+        {0x0000a544, 0x50082231, 0x50082231, 0x3f001861, 0x3f001861},
+        {0x0000a548, 0x5608422e, 0x5608422e, 0x43001a81, 0x43001a81},
+        {0x0000a54c, 0x5e08442e, 0x5e08442e, 0x47001a83, 0x47001a83},
+        {0x0000a550, 0x620a4431, 0x620a4431, 0x4a001c84, 0x4a001c84},
+        {0x0000a554, 0x640a4432, 0x640a4432, 0x4e001ce3, 0x4e001ce3},
+        {0x0000a558, 0x680a4434, 0x680a4434, 0x52001ce5, 0x52001ce5},
+        {0x0000a55c, 0x6c0a6434, 0x6c0a6434, 0x56001ce9, 0x56001ce9},
+        {0x0000a560, 0x6f0a6633, 0x6f0a6633, 0x5a001ceb, 0x5a001ceb},
+        {0x0000a564, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
+        {0x0000a568, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
+        {0x0000a56c, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
+        {0x0000a570, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
+        {0x0000a574, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
+        {0x0000a578, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
+        {0x0000a57c, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
+        {0x0000a600, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a604, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a608, 0x01804601, 0x01804601, 0x00000000, 0x00000000},
+        {0x0000a60c, 0x01804601, 0x01804601, 0x00000000, 0x00000000},
+        {0x0000a610, 0x01804601, 0x01804601, 0x00000000, 0x00000000},
+        {0x0000a614, 0x01804601, 0x01804601, 0x01404000, 0x01404000},
+        {0x0000a618, 0x01804601, 0x01804601, 0x01404501, 0x01404501},
+        {0x0000a61c, 0x01804601, 0x01804601, 0x02008501, 0x02008501},
+        {0x0000a620, 0x03408d02, 0x03408d02, 0x0280ca03, 0x0280ca03},
+        {0x0000a624, 0x0300cc03, 0x0300cc03, 0x03010c04, 0x03010c04},
+        {0x0000a628, 0x03410d04, 0x03410d04, 0x04014c04, 0x04014c04},
+        {0x0000a62c, 0x03410d04, 0x03410d04, 0x04015005, 0x04015005},
+        {0x0000a630, 0x03410d04, 0x03410d04, 0x04015005, 0x04015005},
+        {0x0000a634, 0x03410d04, 0x03410d04, 0x04015005, 0x04015005},
+        {0x0000a638, 0x03410d04, 0x03410d04, 0x04015005, 0x04015005},
+        {0x0000a63c, 0x03410d04, 0x03410d04, 0x04015005, 0x04015005},
+        {0x0000b2dc, 0x000cfff0, 0x000cfff0, 0x03aaa352, 0x03aaa352},
+        {0x0000b2e0, 0x000f0000, 0x000f0000, 0x03ccc584, 0x03ccc584},
+        {0x0000b2e4, 0x03f00000, 0x03f00000, 0x03f0f800, 0x03f0f800},
+        {0x0000b2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
+        {0x0000c2dc, 0x000cfff0, 0x000cfff0, 0x03aaa352, 0x03aaa352},
+        {0x0000c2e0, 0x000f0000, 0x000f0000, 0x03ccc584, 0x03ccc584},
+        {0x0000c2e4, 0x03f00000, 0x03f00000, 0x03f0f800, 0x03f0f800},
+        {0x0000c2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
+        {0x00016044, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4},
+        {0x00016048, 0x65240001, 0x65240001, 0x66480001, 0x66480001},
+        {0x00016068, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
+        {0x00016444, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4},
+        {0x00016448, 0x65240001, 0x65240001, 0x66480001, 0x66480001},
+        {0x00016468, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
+        {0x00016844, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4},
+        {0x00016848, 0x65240001, 0x65240001, 0x66480001, 0x66480001},
+        {0x00016868, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
+};
+
 static const u32 ar9300Common_rx_gain_table_2p2[][2] = {
         /* Addr      allmodes  */
         {0x0000a000, 0x00010000},
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_calib.c b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
index 8b0d8dcd7625..4cc13940c895 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_calib.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
@@ -32,7 +32,6 @@ struct coeff {
 
 enum ar9003_cal_types {
         IQ_MISMATCH_CAL = BIT(0),
-        TEMP_COMP_CAL = BIT(1),
 };
 
 static void ar9003_hw_setup_calibration(struct ath_hw *ah,
@@ -49,7 +48,7 @@ static void ar9003_hw_setup_calibration(struct ath_hw *ah,
                  */
                 REG_RMW_FIELD(ah, AR_PHY_TIMING4,
                               AR_PHY_TIMING4_IQCAL_LOG_COUNT_MAX,
-                currCal->calData->calCountMax);
+                              currCal->calData->calCountMax);
                 REG_WRITE(ah, AR_PHY_CALMODE, AR_PHY_CALMODE_IQ);
 
                 ath_dbg(common, CALIBRATE,
@@ -58,14 +57,8 @@ static void ar9003_hw_setup_calibration(struct ath_hw *ah,
                 /* Kick-off cal */
                 REG_SET_BIT(ah, AR_PHY_TIMING4, AR_PHY_TIMING4_DO_CAL);
                 break;
-        case TEMP_COMP_CAL:
-                REG_RMW_FIELD(ah, AR_PHY_65NM_CH0_THERM,
-                              AR_PHY_65NM_CH0_THERM_LOCAL, 1);
-                REG_RMW_FIELD(ah, AR_PHY_65NM_CH0_THERM,
-                              AR_PHY_65NM_CH0_THERM_START, 1);
-
-                ath_dbg(common, CALIBRATE,
-                        "starting Temperature Compensation Calibration\n");
+        default:
+                ath_err(common, "Invalid calibration type\n");
                 break;
         }
 }
@@ -323,6 +316,14 @@ static const struct ath9k_percal_data iq_cal_single_sample = {
 static void ar9003_hw_init_cal_settings(struct ath_hw *ah)
 {
         ah->iq_caldata.calData = &iq_cal_single_sample;
+
+        if (AR_SREV_9300_20_OR_LATER(ah)) {
+                ah->enabled_cals |= TX_IQ_CAL;
+                if (AR_SREV_9485_OR_LATER(ah) && !AR_SREV_9340(ah))
+                        ah->enabled_cals |= TX_IQ_ON_AGC_CAL;
+        }
+
+        ah->supp_cals = IQ_MISMATCH_CAL;
 }
 
 /*
@@ -959,22 +960,70 @@ static void ar9003_hw_manual_peak_cal(struct ath_hw *ah, u8 chain, bool is_2g)
                       AR_PHY_65NM_RXRF_AGC_AGC_CAL_OVR, 0);
 }
 
+static void ar9003_hw_do_manual_peak_cal(struct ath_hw *ah,
+                                         struct ath9k_channel *chan)
+{
+        int i;
+
+        if (!AR_SREV_9462(ah) && !AR_SREV_9565(ah))
+                return;
+
+        for (i = 0; i < AR9300_MAX_CHAINS; i++) {
+                if (!(ah->rxchainmask & (1 << i)))
+                        continue;
+                ar9003_hw_manual_peak_cal(ah, i, IS_CHAN_2GHZ(chan));
+        }
+}
+
+static void ar9003_hw_cl_cal_post_proc(struct ath_hw *ah, bool is_reusable)
+{
+        u32 cl_idx[AR9300_MAX_CHAINS] = { AR_PHY_CL_TAB_0,
+                                          AR_PHY_CL_TAB_1,
+                                          AR_PHY_CL_TAB_2 };
+        struct ath9k_hw_cal_data *caldata = ah->caldata;
+        bool txclcal_done = false;
+        int i, j;
+
+        if (!caldata || !(ah->enabled_cals & TX_CL_CAL))
+                return;
+
+        txclcal_done = !!(REG_READ(ah, AR_PHY_AGC_CONTROL) &
+                          AR_PHY_AGC_CONTROL_CLC_SUCCESS);
+
+        if (caldata->done_txclcal_once) {
+                for (i = 0; i < AR9300_MAX_CHAINS; i++) {
+                        if (!(ah->txchainmask & (1 << i)))
+                                continue;
+                        for (j = 0; j < MAX_CL_TAB_ENTRY; j++)
+                                REG_WRITE(ah, CL_TAB_ENTRY(cl_idx[i]),
+                                          caldata->tx_clcal[i][j]);
+                }
+        } else if (is_reusable && txclcal_done) {
+                for (i = 0; i < AR9300_MAX_CHAINS; i++) {
+                        if (!(ah->txchainmask & (1 << i)))
+                                continue;
+                        for (j = 0; j < MAX_CL_TAB_ENTRY; j++)
+                                caldata->tx_clcal[i][j] =
+                                        REG_READ(ah, CL_TAB_ENTRY(cl_idx[i]));
+                }
+                caldata->done_txclcal_once = true;
+        }
+}
+
 static bool ar9003_hw_init_cal(struct ath_hw *ah,
                                struct ath9k_channel *chan)
 {
         struct ath_common *common = ath9k_hw_common(ah);
         struct ath9k_hw_cal_data *caldata = ah->caldata;
-        bool txiqcal_done = false, txclcal_done = false;
+        bool txiqcal_done = false;
         bool is_reusable = true, status = true;
-        bool run_rtt_cal = false, run_agc_cal;
+        bool run_rtt_cal = false, run_agc_cal, sep_iq_cal = false;
         bool rtt = !!(ah->caps.hw_caps & ATH9K_HW_CAP_RTT);
         u32 agc_ctrl = 0, agc_supp_cals = AR_PHY_AGC_CONTROL_OFFSET_CAL |
                                           AR_PHY_AGC_CONTROL_FLTR_CAL   |
                                           AR_PHY_AGC_CONTROL_PKDET_CAL;
-        int i, j;
-        u32 cl_idx[AR9300_MAX_CHAINS] = { AR_PHY_CL_TAB_0,
-                                          AR_PHY_CL_TAB_1,
-                                          AR_PHY_CL_TAB_2 };
+
+        ar9003_hw_set_chain_masks(ah, ah->caps.rx_chainmask, ah->caps.tx_chainmask);
 
         if (rtt) {
                 if (!ar9003_hw_rtt_restore(ah, chan))
@@ -1012,7 +1061,8 @@ static bool ar9003_hw_init_cal(struct ath_hw *ah,
                 }
         }
 
-        if (!(ah->enabled_cals & TX_IQ_CAL))
+        if ((IS_CHAN_HALF_RATE(chan) || IS_CHAN_QUARTER_RATE(chan)) ||
+            !(ah->enabled_cals & TX_IQ_CAL))
                 goto skip_tx_iqcal;
 
         /* Do Tx IQ Calibration */
@@ -1032,21 +1082,22 @@ static bool ar9003_hw_init_cal(struct ath_hw *ah,
                         REG_CLR_BIT(ah, AR_PHY_TX_IQCAL_CONTROL_0,
                                     AR_PHY_TX_IQCAL_CONTROL_0_ENABLE_TXIQ_CAL);
                 txiqcal_done = run_agc_cal = true;
-                goto skip_tx_iqcal;
-        } else if (caldata && !caldata->done_txiqcal_once)
+        } else if (caldata && !caldata->done_txiqcal_once) {
                 run_agc_cal = true;
+                sep_iq_cal = true;
+        }
 
+skip_tx_iqcal:
         if (ath9k_hw_mci_is_enabled(ah) && IS_CHAN_2GHZ(chan) && run_agc_cal)
                 ar9003_mci_init_cal_req(ah, &is_reusable);
 
-        if (!(IS_CHAN_HALF_RATE(chan) || IS_CHAN_QUARTER_RATE(chan))) {
+        if (sep_iq_cal) {
                 txiqcal_done = ar9003_hw_tx_iq_cal_run(ah);
                 REG_WRITE(ah, AR_PHY_ACTIVE, AR_PHY_ACTIVE_DIS);
                 udelay(5);
                 REG_WRITE(ah, AR_PHY_ACTIVE, AR_PHY_ACTIVE_EN);
         }
 
-skip_tx_iqcal:
         if (run_agc_cal || !(ah->ah_flags & AH_FASTCC)) {
                 /* Calibrate the AGC */
                 REG_WRITE(ah, AR_PHY_AGC_CONTROL,
@@ -1057,14 +1108,8 @@ skip_tx_iqcal:
                 status = ath9k_hw_wait(ah, AR_PHY_AGC_CONTROL,
                                        AR_PHY_AGC_CONTROL_CAL,
                                        0, AH_WAIT_TIMEOUT);
-                if (AR_SREV_9462(ah) || AR_SREV_9565(ah)) {
-                        for (i = 0; i < AR9300_MAX_CHAINS; i++) {
-                                if (!(ah->rxchainmask & (1 << i)))
-                                        continue;
-                                ar9003_hw_manual_peak_cal(ah, i,
-                                                          IS_CHAN_2GHZ(chan));
-                        }
-                }
+
+                ar9003_hw_do_manual_peak_cal(ah, chan);
         }
 
         if (ath9k_hw_mci_is_enabled(ah) && IS_CHAN_2GHZ(chan) && run_agc_cal)
@@ -1089,31 +1134,7 @@ skip_tx_iqcal:
         else if (caldata && caldata->done_txiqcal_once)
                 ar9003_hw_tx_iq_cal_reload(ah);
 
-#define CL_TAB_ENTRY(reg_base)  (reg_base + (4 * j))
-        if (caldata && (ah->enabled_cals & TX_CL_CAL)) {
-                txclcal_done = !!(REG_READ(ah, AR_PHY_AGC_CONTROL) &
-                                           AR_PHY_AGC_CONTROL_CLC_SUCCESS);
-                if (caldata->done_txclcal_once) {
-                        for (i = 0; i < AR9300_MAX_CHAINS; i++) {
-                                if (!(ah->txchainmask & (1 << i)))
-                                        continue;
-                                for (j = 0; j < MAX_CL_TAB_ENTRY; j++)
-                                        REG_WRITE(ah, CL_TAB_ENTRY(cl_idx[i]),
-                                                  caldata->tx_clcal[i][j]);
-                        }
-                } else if (is_reusable && txclcal_done) {
-                        for (i = 0; i < AR9300_MAX_CHAINS; i++) {
-                                if (!(ah->txchainmask & (1 << i)))
-                                        continue;
-                                for (j = 0; j < MAX_CL_TAB_ENTRY; j++)
-                                        caldata->tx_clcal[i][j] =
-                                                REG_READ(ah,
-                                                  CL_TAB_ENTRY(cl_idx[i]));
-                        }
-                        caldata->done_txclcal_once = true;
-                }
-        }
-#undef CL_TAB_ENTRY
+        ar9003_hw_cl_cal_post_proc(ah, is_reusable);
 
         if (run_rtt_cal && caldata) {
                 if (is_reusable) {
@@ -1131,20 +1152,10 @@ skip_tx_iqcal:
 
         /* Initialize list pointers */
         ah->cal_list = ah->cal_list_last = ah->cal_list_curr = NULL;
-        ah->supp_cals = IQ_MISMATCH_CAL;
-
-        if (ah->supp_cals & IQ_MISMATCH_CAL) {
-                INIT_CAL(&ah->iq_caldata);
-                INSERT_CAL(ah, &ah->iq_caldata);
-                ath_dbg(common, CALIBRATE, "enabling IQ Calibration\n");
-        }
 
-        if (ah->supp_cals & TEMP_COMP_CAL) {
-                INIT_CAL(&ah->tempCompCalData);
-                INSERT_CAL(ah, &ah->tempCompCalData);
-                ath_dbg(common, CALIBRATE,
-                        "enabling Temperature Compensation Calibration\n");
-        }
+        INIT_CAL(&ah->iq_caldata);
+        INSERT_CAL(ah, &ah->iq_caldata);
+        ath_dbg(common, CALIBRATE, "enabling IQ Calibration\n");
 
         /* Initialize current pointer to first element in list */
         ah->cal_list_curr = ah->cal_list;
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index 562186ca9b52..881e989ea470 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -4586,14 +4586,14 @@ static int ar9003_hw_cal_pier_get(struct ath_hw *ah,
         return 0;
 }
 
-static int ar9003_hw_power_control_override(struct ath_hw *ah,
-                                            int frequency,
-                                            int *correction,
-                                            int *voltage, int *temperature)
+static void ar9003_hw_power_control_override(struct ath_hw *ah,
+                                             int frequency,
+                                             int *correction,
+                                             int *voltage, int *temperature)
 {
-        int tempSlope = 0;
+        int temp_slope = 0, temp_slope1 = 0, temp_slope2 = 0;
         struct ar9300_eeprom *eep = &ah->eeprom.ar9300_eep;
-        int f[8], t[8], i;
+        int f[8], t[8], t1[3], t2[3], i;
 
         REG_RMW(ah, AR_PHY_TPC_11_B0,
                 (correction[0] << AR_PHY_TPC_OLPC_GAIN_DELTA_S),
@@ -4624,38 +4624,108 @@ static int ar9003_hw_power_control_override(struct ath_hw *ah,
          * enable temperature compensation
          * Need to use register names
          */
-        if (frequency < 4000)
-                tempSlope = eep->modalHeader2G.tempSlope;
-        else if ((eep->baseEepHeader.miscConfiguration & 0x20) != 0) {
-                for (i = 0; i < 8; i++) {
-                        t[i] = eep->base_ext1.tempslopextension[i];
-                        f[i] = FBIN2FREQ(eep->calFreqPier5G[i], 0);
+        if (frequency < 4000) {
+                temp_slope = eep->modalHeader2G.tempSlope;
+        } else {
+                if (AR_SREV_9550(ah)) {
+                        t[0] = eep->base_ext1.tempslopextension[2];
+                        t1[0] = eep->base_ext1.tempslopextension[3];
+                        t2[0] = eep->base_ext1.tempslopextension[4];
+                        f[0] = 5180;
+
+                        t[1] = eep->modalHeader5G.tempSlope;
+                        t1[1] = eep->base_ext1.tempslopextension[0];
+                        t2[1] = eep->base_ext1.tempslopextension[1];
+                        f[1] = 5500;
+
+                        t[2] = eep->base_ext1.tempslopextension[5];
+                        t1[2] = eep->base_ext1.tempslopextension[6];
+                        t2[2] = eep->base_ext1.tempslopextension[7];
+                        f[2] = 5785;
+
+                        temp_slope = ar9003_hw_power_interpolate(frequency,
+                                                                 f, t, 3);
+                        temp_slope1 = ar9003_hw_power_interpolate(frequency,
+                                                                   f, t1, 3);
+                        temp_slope2 = ar9003_hw_power_interpolate(frequency,
+                                                                   f, t2, 3);
+
+                        goto tempslope;
                 }
-                tempSlope = ar9003_hw_power_interpolate((s32) frequency,
-                                                        f, t, 8);
-        } else if (eep->base_ext2.tempSlopeLow != 0) {
-                t[0] = eep->base_ext2.tempSlopeLow;
-                f[0] = 5180;
-                t[1] = eep->modalHeader5G.tempSlope;
-                f[1] = 5500;
-                t[2] = eep->base_ext2.tempSlopeHigh;
-                f[2] = 5785;
-                tempSlope = ar9003_hw_power_interpolate((s32) frequency,
-                                                        f, t, 3);
-        } else
-                tempSlope = eep->modalHeader5G.tempSlope;
 
-        REG_RMW_FIELD(ah, AR_PHY_TPC_19, AR_PHY_TPC_19_ALPHA_THERM, tempSlope);
+                if ((eep->baseEepHeader.miscConfiguration & 0x20) != 0) {
+                        for (i = 0; i < 8; i++) {
+                                t[i] = eep->base_ext1.tempslopextension[i];
+                                f[i] = FBIN2FREQ(eep->calFreqPier5G[i], 0);
+                        }
+                        temp_slope = ar9003_hw_power_interpolate((s32) frequency,
+                                                                 f, t, 8);
+                } else if (eep->base_ext2.tempSlopeLow != 0) {
+                        t[0] = eep->base_ext2.tempSlopeLow;
+                        f[0] = 5180;
+                        t[1] = eep->modalHeader5G.tempSlope;
+                        f[1] = 5500;
+                        t[2] = eep->base_ext2.tempSlopeHigh;
+                        f[2] = 5785;
+                        temp_slope = ar9003_hw_power_interpolate((s32) frequency,
+                                                                 f, t, 3);
+                } else {
+                        temp_slope = eep->modalHeader5G.tempSlope;
+                }
+        }
+
+tempslope:
+        if (AR_SREV_9550(ah)) {
+                /*
+                 * AR955x has tempSlope register for each chain.
+                 * Check whether temp_compensation feature is enabled or not.
+                 */
+                if (eep->baseEepHeader.featureEnable & 0x1) {
+                        if (frequency < 4000) {
+                                REG_RMW_FIELD(ah, AR_PHY_TPC_19,
+                                              AR_PHY_TPC_19_ALPHA_THERM,
+                                              eep->base_ext2.tempSlopeLow);
+                                REG_RMW_FIELD(ah, AR_PHY_TPC_19_B1,
+                                              AR_PHY_TPC_19_ALPHA_THERM,
+                                              temp_slope);
+                                REG_RMW_FIELD(ah, AR_PHY_TPC_19_B2,
+                                              AR_PHY_TPC_19_ALPHA_THERM,
+                                              eep->base_ext2.tempSlopeHigh);
+                        } else {
+                                REG_RMW_FIELD(ah, AR_PHY_TPC_19,
+                                              AR_PHY_TPC_19_ALPHA_THERM,
+                                              temp_slope);
+                                REG_RMW_FIELD(ah, AR_PHY_TPC_19_B1,
+                                              AR_PHY_TPC_19_ALPHA_THERM,
+                                              temp_slope1);
+                                REG_RMW_FIELD(ah, AR_PHY_TPC_19_B2,
+                                              AR_PHY_TPC_19_ALPHA_THERM,
+                                              temp_slope2);
+                        }
+                } else {
+                        /*
+                         * If temp compensation is not enabled,
+                         * set all registers to 0.
+                         */
+                        REG_RMW_FIELD(ah, AR_PHY_TPC_19,
+                                      AR_PHY_TPC_19_ALPHA_THERM, 0);
+                        REG_RMW_FIELD(ah, AR_PHY_TPC_19_B1,
+                                      AR_PHY_TPC_19_ALPHA_THERM, 0);
+                        REG_RMW_FIELD(ah, AR_PHY_TPC_19_B2,
+                                      AR_PHY_TPC_19_ALPHA_THERM, 0);
+                }
+        } else {
+                REG_RMW_FIELD(ah, AR_PHY_TPC_19,
+                              AR_PHY_TPC_19_ALPHA_THERM, temp_slope);
+        }
 
         if (AR_SREV_9462_20(ah))
                 REG_RMW_FIELD(ah, AR_PHY_TPC_19_B1,
-                              AR_PHY_TPC_19_B1_ALPHA_THERM, tempSlope);
+                              AR_PHY_TPC_19_B1_ALPHA_THERM, temp_slope);
 
 
         REG_RMW_FIELD(ah, AR_PHY_TPC_18, AR_PHY_TPC_18_THERM_CAL_VALUE,
                       temperature[0]);
-
-        return 0;
 }
 
 /* Apply the recorded correction values. */
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_hw.c b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
index 74fd3977feeb..a3523c969a3a 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_hw.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
@@ -507,28 +507,59 @@ static void ar9003_tx_gain_table_mode4(struct ath_hw *ah)
         else if (AR_SREV_9580(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar9580_1p0_mixed_ob_db_tx_gain_table);
+        else
+                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                        ar9300Modes_mixed_ob_db_tx_gain_table_2p2);
+}
+
+static void ar9003_tx_gain_table_mode5(struct ath_hw *ah)
+{
+        if (AR_SREV_9485_11(ah))
+                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                        ar9485Modes_green_ob_db_tx_gain_1_1);
+        else if (AR_SREV_9340(ah))
+                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                        ar9340Modes_ub124_tx_gain_table_1p0);
+        else if (AR_SREV_9580(ah))
+                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                        ar9580_1p0_type5_tx_gain_table);
+        else if (AR_SREV_9300_22(ah))
+                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                        ar9300Modes_type5_tx_gain_table_2p2);
+}
+
+static void ar9003_tx_gain_table_mode6(struct ath_hw *ah)
+{
+        if (AR_SREV_9340(ah))
+                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                        ar9340Modes_low_ob_db_and_spur_tx_gain_table_1p0);
+        else if (AR_SREV_9485_11(ah))
+                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                        ar9485Modes_green_spur_ob_db_tx_gain_1_1);
+        else if (AR_SREV_9580(ah))
+                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                        ar9580_1p0_type6_tx_gain_table);
 }
 
+typedef void (*ath_txgain_tab)(struct ath_hw *ah);
+
 static void ar9003_tx_gain_table_apply(struct ath_hw *ah)
 {
-        switch (ar9003_hw_get_tx_gain_idx(ah)) {
-        case 0:
-        default:
-                ar9003_tx_gain_table_mode0(ah);
-                break;
-        case 1:
-                ar9003_tx_gain_table_mode1(ah);
-                break;
-        case 2:
-                ar9003_tx_gain_table_mode2(ah);
-                break;
-        case 3:
-                ar9003_tx_gain_table_mode3(ah);
-                break;
-        case 4:
-                ar9003_tx_gain_table_mode4(ah);
-                break;
-        }
+        static const ath_txgain_tab modes[] = {
+                ar9003_tx_gain_table_mode0,
+                ar9003_tx_gain_table_mode1,
+                ar9003_tx_gain_table_mode2,
+                ar9003_tx_gain_table_mode3,
+                ar9003_tx_gain_table_mode4,
+                ar9003_tx_gain_table_mode5,
+                ar9003_tx_gain_table_mode6,
+        };
+        int idx = ar9003_hw_get_tx_gain_idx(ah);
+
+        if (idx >= ARRAY_SIZE(modes))
+                idx = 0;
+
+        modes[idx](ah);
 }
 
 static void ar9003_rx_gain_table_mode0(struct ath_hw *ah)
@@ -544,7 +575,7 @@ static void ar9003_rx_gain_table_mode0(struct ath_hw *ah)
                                 ar9340Common_rx_gain_table_1p0);
         else if (AR_SREV_9485_11(ah))
                 INIT_INI_ARRAY(&ah->iniModesRxGain,
-                                ar9485Common_wo_xlna_rx_gain_1_1);
+                               ar9485_common_rx_gain_1_1);
         else if (AR_SREV_9550(ah)) {
                 INIT_INI_ARRAY(&ah->iniModesRxGain,
                                 ar955x_1p0_common_rx_gain_table);
@@ -673,7 +704,7 @@ void ar9003_hw_attach_ops(struct ath_hw *ah)
         struct ath_hw_private_ops *priv_ops = ath9k_hw_private_ops(ah);
         struct ath_hw_ops *ops = ath9k_hw_ops(ah);
 
-        priv_ops->init_mode_regs = ar9003_hw_init_mode_regs;
+        ar9003_hw_init_mode_regs(ah);
         priv_ops->init_mode_gain_regs = ar9003_hw_init_mode_gain_regs;
 
         ops->config_pci_powersave = ar9003_hw_configpcipowersave;
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
index ce19c09fa8e8..2bf6548dd143 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
@@ -68,7 +68,7 @@ static const int m2ThreshExt_off = 127;
 static int ar9003_hw_set_channel(struct ath_hw *ah, struct ath9k_channel *chan)
 {
         u16 bMode, fracMode = 0, aModeRefSel = 0;
-        u32 freq, channelSel = 0, reg32 = 0;
+        u32 freq, chan_frac, div, channelSel = 0, reg32 = 0;
         struct chan_centers centers;
         int loadSynthChannel;
 
@@ -77,9 +77,6 @@ static int ar9003_hw_set_channel(struct ath_hw *ah, struct ath9k_channel *chan)
 
         if (freq < 4800) {     /* 2 GHz, fractional mode */
                 if (AR_SREV_9330(ah)) {
-                        u32 chan_frac;
-                        u32 div;
-
                         if (ah->is_clk_25mhz)
                                 div = 75;
                         else
@@ -89,34 +86,40 @@ static int ar9003_hw_set_channel(struct ath_hw *ah, struct ath9k_channel *chan)
                         chan_frac = (((freq * 4) % div) * 0x20000) / div;
                         channelSel = (channelSel << 17) | chan_frac;
                 } else if (AR_SREV_9485(ah) || AR_SREV_9565(ah)) {
-                        u32 chan_frac;
-
                         /*
-                         * freq_ref = 40 / (refdiva >> amoderefsel); where refdiva=1 and amoderefsel=0
+                         * freq_ref = 40 / (refdiva >> amoderefsel);
+                         * where refdiva=1 and amoderefsel=0
                          * ndiv = ((chan_mhz * 4) / 3) / freq_ref;
                          * chansel = int(ndiv), chanfrac = (ndiv - chansel) * 0x20000
                          */
                         channelSel = (freq * 4) / 120;
                         chan_frac = (((freq * 4) % 120) * 0x20000) / 120;
                         channelSel = (channelSel << 17) | chan_frac;
-                } else if (AR_SREV_9340(ah) || AR_SREV_9550(ah)) {
+                } else if (AR_SREV_9340(ah)) {
                         if (ah->is_clk_25mhz) {
-                                u32 chan_frac;
-
                                 channelSel = (freq * 2) / 75;
                                 chan_frac = (((freq * 2) % 75) * 0x20000) / 75;
                                 channelSel = (channelSel << 17) | chan_frac;
-                        } else
+                        } else {
                                 channelSel = CHANSEL_2G(freq) >> 1;
-                } else
+                        }
+                } else if (AR_SREV_9550(ah)) {
+                        if (ah->is_clk_25mhz)
+                                div = 75;
+                        else
+                                div = 120;
+
+                        channelSel = (freq * 4) / div;
+                        chan_frac = (((freq * 4) % div) * 0x20000) / div;
+                        channelSel = (channelSel << 17) | chan_frac;
+                } else {
                         channelSel = CHANSEL_2G(freq);
+                }
                 /* Set to 2G mode */
                 bMode = 1;
         } else {
                 if ((AR_SREV_9340(ah) || AR_SREV_9550(ah)) &&
                     ah->is_clk_25mhz) {
-                        u32 chan_frac;
-
                         channelSel = freq / 75;
                         chan_frac = ((freq % 75) * 0x20000) / 75;
                         channelSel = (channelSel << 17) | chan_frac;
@@ -586,32 +589,19 @@ static void ar9003_hw_init_bb(struct ath_hw *ah,
         ath9k_hw_synth_delay(ah, chan, synthDelay);
 }
 
-static void ar9003_hw_set_chain_masks(struct ath_hw *ah, u8 rx, u8 tx)
+void ar9003_hw_set_chain_masks(struct ath_hw *ah, u8 rx, u8 tx)
 {
-        switch (rx) {
-        case 0x5:
+        if (ah->caps.tx_chainmask == 5 || ah->caps.rx_chainmask == 5)
                 REG_SET_BIT(ah, AR_PHY_ANALOG_SWAP,
                             AR_PHY_SWAP_ALT_CHAIN);
-        case 0x3:
-        case 0x1:
-        case 0x2:
-        case 0x7:
-                REG_WRITE(ah, AR_PHY_RX_CHAINMASK, rx);
-                REG_WRITE(ah, AR_PHY_CAL_CHAINMASK, rx);
-                break;
-        default:
-                break;
-        }
+
+        REG_WRITE(ah, AR_PHY_RX_CHAINMASK, rx);
+        REG_WRITE(ah, AR_PHY_CAL_CHAINMASK, rx);
 
         if ((ah->caps.hw_caps & ATH9K_HW_CAP_APM) && (tx == 0x7))
-                REG_WRITE(ah, AR_SELFGEN_MASK, 0x3);
-        else
-                REG_WRITE(ah, AR_SELFGEN_MASK, tx);
+                tx = 3;
 
-        if (tx == 0x5) {
-                REG_SET_BIT(ah, AR_PHY_ANALOG_SWAP,
-                            AR_PHY_SWAP_ALT_CHAIN);
-        }
+        REG_WRITE(ah, AR_SELFGEN_MASK, tx);
 }
 
 /*
@@ -1450,6 +1440,67 @@ set_rfmode:
         return 0;
 }
 
+static void ar9003_hw_spectral_scan_config(struct ath_hw *ah,
+                                           struct ath_spec_scan *param)
+{
+        u8 count;
+
+        if (!param->enabled) {
+                REG_CLR_BIT(ah, AR_PHY_SPECTRAL_SCAN,
+                            AR_PHY_SPECTRAL_SCAN_ENABLE);
+                return;
+        }
+
+        REG_SET_BIT(ah, AR_PHY_RADAR_0, AR_PHY_RADAR_0_FFT_ENA);
+        REG_SET_BIT(ah, AR_PHY_SPECTRAL_SCAN, AR_PHY_SPECTRAL_SCAN_ENABLE);
+
+        /* on AR93xx and newer, count = 0 will make the the chip send
+         * spectral samples endlessly. Check if this really was intended,
+         * and fix otherwise.
+         */
+        count = param->count;
+        if (param->endless)
+                count = 0;
+        else if (param->count == 0)
+                count = 1;
+
+        if (param->short_repeat)
+                REG_SET_BIT(ah, AR_PHY_SPECTRAL_SCAN,
+                            AR_PHY_SPECTRAL_SCAN_SHORT_REPEAT);
+        else
+                REG_CLR_BIT(ah, AR_PHY_SPECTRAL_SCAN,
+                            AR_PHY_SPECTRAL_SCAN_SHORT_REPEAT);
+
+        REG_RMW_FIELD(ah, AR_PHY_SPECTRAL_SCAN,
+                      AR_PHY_SPECTRAL_SCAN_COUNT, count);
+        REG_RMW_FIELD(ah, AR_PHY_SPECTRAL_SCAN,
+                      AR_PHY_SPECTRAL_SCAN_PERIOD, param->period);
+        REG_RMW_FIELD(ah, AR_PHY_SPECTRAL_SCAN,
+                      AR_PHY_SPECTRAL_SCAN_FFT_PERIOD, param->fft_period);
+
+        return;
+}
+
+static void ar9003_hw_spectral_scan_trigger(struct ath_hw *ah)
+{
+        /* Activate spectral scan */
+        REG_SET_BIT(ah, AR_PHY_SPECTRAL_SCAN,
+                    AR_PHY_SPECTRAL_SCAN_ACTIVE);
+}
+
+static void ar9003_hw_spectral_scan_wait(struct ath_hw *ah)
+{
+        struct ath_common *common = ath9k_hw_common(ah);
+
+        /* Poll for spectral scan complete */
+        if (!ath9k_hw_wait(ah, AR_PHY_SPECTRAL_SCAN,
+                           AR_PHY_SPECTRAL_SCAN_ACTIVE,
+                           0, AH_WAIT_TIMEOUT)) {
+                ath_err(common, "spectral scan wait failed\n");
+                return;
+        }
+}
+
 void ar9003_hw_attach_phy_ops(struct ath_hw *ah)
 {
         struct ath_hw_private_ops *priv_ops = ath9k_hw_private_ops(ah);
@@ -1483,6 +1534,9 @@ void ar9003_hw_attach_phy_ops(struct ath_hw *ah)
         ops->antdiv_comb_conf_get = ar9003_hw_antdiv_comb_conf_get;
         ops->antdiv_comb_conf_set = ar9003_hw_antdiv_comb_conf_set;
         ops->antctrl_shared_chain_lnadiv = ar9003_hw_antctrl_shared_chain_lnadiv;
+        ops->spectral_scan_config = ar9003_hw_spectral_scan_config;
+        ops->spectral_scan_trigger = ar9003_hw_spectral_scan_trigger;
+        ops->spectral_scan_wait = ar9003_hw_spectral_scan_wait;
 
         ar9003_hw_set_nf_limits(ah);
         ar9003_hw_set_radar_conf(ah);
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.h b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
index 107956298488..e71774196c01 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
@@ -1028,7 +1028,7 @@
 #define AR_PHY_TPC_5_B2          (AR_SM2_BASE + 0x208)
 #define AR_PHY_TPC_6_B2          (AR_SM2_BASE + 0x20c)
 #define AR_PHY_TPC_11_B2         (AR_SM2_BASE + 0x220)
-#define AR_PHY_PDADC_TAB_2       (AR_SM2_BASE + 0x240)
+#define AR_PHY_TPC_19_B2         (AR_SM2_BASE + 0x240)
 #define AR_PHY_TX_IQCAL_STATUS_B2   (AR_SM2_BASE + 0x48c)
 #define AR_PHY_TX_IQCAL_CORR_COEFF_B2(_i)    (AR_SM2_BASE + 0x450 + ((_i) << 2))
 
diff --git a/drivers/net/wireless/ath/ath9k/ar9340_initvals.h b/drivers/net/wireless/ath/ath9k/ar9340_initvals.h
index f69d292bdc02..25db9215985a 100644
--- a/drivers/net/wireless/ath/ath9k/ar9340_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9340_initvals.h
@@ -1172,6 +1172,106 @@ static const u32 ar9340Modes_mixed_ob_db_tx_gain_table_1p0[][5] = {
         {0x00016448, 0x24925666, 0x24925666, 0x8e481266, 0x8e481266},
 };
 
+static const u32 ar9340Modes_low_ob_db_and_spur_tx_gain_table_1p0[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x0000a2dc, 0x0380c7fc, 0x0380c7fc, 0x03eaac5a, 0x03eaac5a},
+        {0x0000a2e0, 0x0000f800, 0x0000f800, 0x03f330ac, 0x03f330ac},
+        {0x0000a2e4, 0x03ff0000, 0x03ff0000, 0x03fc3f00, 0x03fc3f00},
+        {0x0000a2e8, 0x00000000, 0x00000000, 0x03ffc000, 0x03ffc000},
+        {0x0000a394, 0x00000444, 0x00000444, 0x00000404, 0x00000404},
+        {0x0000a410, 0x000050d9, 0x000050d9, 0x000050d9, 0x000050d9},
+        {0x0000a500, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a504, 0x06000003, 0x06000003, 0x02000001, 0x02000001},
+        {0x0000a508, 0x0a000020, 0x0a000020, 0x05000003, 0x05000003},
+        {0x0000a50c, 0x10000023, 0x10000023, 0x0a000005, 0x0a000005},
+        {0x0000a510, 0x16000220, 0x16000220, 0x0e000201, 0x0e000201},
+        {0x0000a514, 0x1c000223, 0x1c000223, 0x11000203, 0x11000203},
+        {0x0000a518, 0x21002220, 0x21002220, 0x14000401, 0x14000401},
+        {0x0000a51c, 0x27002223, 0x27002223, 0x18000403, 0x18000403},
+        {0x0000a520, 0x2b022220, 0x2b022220, 0x1b000602, 0x1b000602},
+        {0x0000a524, 0x2f022222, 0x2f022222, 0x1f000802, 0x1f000802},
+        {0x0000a528, 0x34022225, 0x34022225, 0x21000620, 0x21000620},
+        {0x0000a52c, 0x3a02222a, 0x3a02222a, 0x25000820, 0x25000820},
+        {0x0000a530, 0x3e02222c, 0x3e02222c, 0x29000822, 0x29000822},
+        {0x0000a534, 0x4202242a, 0x4202242a, 0x2d000824, 0x2d000824},
+        {0x0000a538, 0x4702244a, 0x4702244a, 0x30000828, 0x30000828},
+        {0x0000a53c, 0x4b02244c, 0x4b02244c, 0x3400082a, 0x3400082a},
+        {0x0000a540, 0x4e02246c, 0x4e02246c, 0x38000849, 0x38000849},
+        {0x0000a544, 0x5302266c, 0x5302266c, 0x3b000a2c, 0x3b000a2c},
+        {0x0000a548, 0x5702286c, 0x5702286c, 0x3e000e2b, 0x3e000e2b},
+        {0x0000a54c, 0x5c02486b, 0x5c02486b, 0x42000e2d, 0x42000e2d},
+        {0x0000a550, 0x61024a6c, 0x61024a6c, 0x4500124a, 0x4500124a},
+        {0x0000a554, 0x66026a6c, 0x66026a6c, 0x4900124c, 0x4900124c},
+        {0x0000a558, 0x6b026e6c, 0x6b026e6c, 0x4c00126c, 0x4c00126c},
+        {0x0000a55c, 0x7002708c, 0x7002708c, 0x4f00128c, 0x4f00128c},
+        {0x0000a560, 0x7302b08a, 0x7302b08a, 0x52001290, 0x52001290},
+        {0x0000a564, 0x7702b08c, 0x7702b08c, 0x56001292, 0x56001292},
+        {0x0000a568, 0x7702b08c, 0x7702b08c, 0x56001292, 0x56001292},
+        {0x0000a56c, 0x7702b08c, 0x7702b08c, 0x56001292, 0x56001292},
+        {0x0000a570, 0x7702b08c, 0x7702b08c, 0x56001292, 0x56001292},
+        {0x0000a574, 0x7702b08c, 0x7702b08c, 0x56001292, 0x56001292},
+        {0x0000a578, 0x7702b08c, 0x7702b08c, 0x56001292, 0x56001292},
+        {0x0000a57c, 0x7702b08c, 0x7702b08c, 0x56001292, 0x56001292},
+        {0x0000a580, 0x00800000, 0x00800000, 0x00800000, 0x00800000},
+        {0x0000a584, 0x06800003, 0x06800003, 0x02800001, 0x02800001},
+        {0x0000a588, 0x0a800020, 0x0a800020, 0x05800003, 0x05800003},
+        {0x0000a58c, 0x10800023, 0x10800023, 0x0a800005, 0x0a800005},
+        {0x0000a590, 0x16800220, 0x16800220, 0x0e800201, 0x0e800201},
+        {0x0000a594, 0x1c800223, 0x1c800223, 0x11800203, 0x11800203},
+        {0x0000a598, 0x21820220, 0x21820220, 0x14800401, 0x14800401},
+        {0x0000a59c, 0x27820223, 0x27820223, 0x18800403, 0x18800403},
+        {0x0000a5a0, 0x2b822220, 0x2b822220, 0x1b800602, 0x1b800602},
+        {0x0000a5a4, 0x2f822222, 0x2f822222, 0x1f800802, 0x1f800802},
+        {0x0000a5a8, 0x34822225, 0x34822225, 0x21800620, 0x21800620},
+        {0x0000a5ac, 0x3a82222a, 0x3a82222a, 0x25800820, 0x25800820},
+        {0x0000a5b0, 0x3e82222c, 0x3e82222c, 0x29800822, 0x29800822},
+        {0x0000a5b4, 0x4282242a, 0x4282242a, 0x2d800824, 0x2d800824},
+        {0x0000a5b8, 0x4782244a, 0x4782244a, 0x30800828, 0x30800828},
+        {0x0000a5bc, 0x4b82244c, 0x4b82244c, 0x3480082a, 0x3480082a},
+        {0x0000a5c0, 0x4e82246c, 0x4e82246c, 0x38800849, 0x38800849},
+        {0x0000a5c4, 0x5382266c, 0x5382266c, 0x3b800a2c, 0x3b800a2c},
+        {0x0000a5c8, 0x5782286c, 0x5782286c, 0x3e800e2b, 0x3e800e2b},
+        {0x0000a5cc, 0x5c84286b, 0x5c84286b, 0x42800e2d, 0x42800e2d},
+        {0x0000a5d0, 0x61842a6c, 0x61842a6c, 0x4580124a, 0x4580124a},
+        {0x0000a5d4, 0x66862a6c, 0x66862a6c, 0x4980124c, 0x4980124c},
+        {0x0000a5d8, 0x6b862e6c, 0x6b862e6c, 0x4c80126c, 0x4c80126c},
+        {0x0000a5dc, 0x7086308c, 0x7086308c, 0x4f80128c, 0x4f80128c},
+        {0x0000a5e0, 0x738a308a, 0x738a308a, 0x52801290, 0x52801290},
+        {0x0000a5e4, 0x778a308c, 0x778a308c, 0x56801292, 0x56801292},
+        {0x0000a5e8, 0x778a308c, 0x778a308c, 0x56801292, 0x56801292},
+        {0x0000a5ec, 0x778a308c, 0x778a308c, 0x56801292, 0x56801292},
+        {0x0000a5f0, 0x778a308c, 0x778a308c, 0x56801292, 0x56801292},
+        {0x0000a5f4, 0x778a308c, 0x778a308c, 0x56801292, 0x56801292},
+        {0x0000a5f8, 0x778a308c, 0x778a308c, 0x56801292, 0x56801292},
+        {0x0000a5fc, 0x778a308c, 0x778a308c, 0x56801292, 0x56801292},
+        {0x0000a600, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a604, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a608, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a60c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a610, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a614, 0x01404000, 0x01404000, 0x01404501, 0x01404501},
+        {0x0000a618, 0x01404501, 0x01404501, 0x01404501, 0x01404501},
+        {0x0000a61c, 0x02008802, 0x02008802, 0x01404501, 0x01404501},
+        {0x0000a620, 0x0300cc03, 0x0300cc03, 0x03c0cf02, 0x03c0cf02},
+        {0x0000a624, 0x0300cc03, 0x0300cc03, 0x03c0cf03, 0x03c0cf03},
+        {0x0000a628, 0x0300cc03, 0x0300cc03, 0x04011004, 0x04011004},
+        {0x0000a62c, 0x03810c03, 0x03810c03, 0x05419405, 0x05419405},
+        {0x0000a630, 0x03810e04, 0x03810e04, 0x05419506, 0x05419506},
+        {0x0000a634, 0x03810e04, 0x03810e04, 0x05419506, 0x05419506},
+        {0x0000a638, 0x03810e04, 0x03810e04, 0x05419506, 0x05419506},
+        {0x0000a63c, 0x03810e04, 0x03810e04, 0x05419506, 0x05419506},
+        {0x0000b2dc, 0x0380c7fc, 0x0380c7fc, 0x03eaac5a, 0x03eaac5a},
+        {0x0000b2e0, 0x0000f800, 0x0000f800, 0x03f330ac, 0x03f330ac},
+        {0x0000b2e4, 0x03ff0000, 0x03ff0000, 0x03fc3f00, 0x03fc3f00},
+        {0x0000b2e8, 0x00000000, 0x00000000, 0x03ffc000, 0x03ffc000},
+        {0x00016044, 0x022492db, 0x022492db, 0x022492db, 0x022492db},
+        {0x00016048, 0x24925666, 0x24925666, 0x24925266, 0x24925266},
+        {0x00016280, 0x01000015, 0x01000015, 0x01001015, 0x01001015},
+        {0x00016288, 0xf0318000, 0xf0318000, 0xf0318000, 0xf0318000},
+        {0x00016444, 0x022492db, 0x022492db, 0x022492db, 0x022492db},
+        {0x00016448, 0x24925666, 0x24925666, 0x24925266, 0x24925266},
+};
+
 static const u32 ar9340_1p0_mac_core[][2] = {
         /* Addr      allmodes  */
         {0x00000008, 0x00000000},
diff --git a/drivers/net/wireless/ath/ath9k/ar9485_initvals.h b/drivers/net/wireless/ath/ath9k/ar9485_initvals.h
index a3710f3bb90c..712f415b8c08 100644
--- a/drivers/net/wireless/ath/ath9k/ar9485_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9485_initvals.h
@@ -260,6 +260,79 @@ static const u32 ar9485Modes_high_power_tx_gain_1_1[][5] = {
         {0x00016048, 0x6c924260, 0x6c924260, 0x6c924260, 0x6c924260},
 };
 
+static const u32 ar9485Modes_green_ob_db_tx_gain_1_1[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x000098bc, 0x00000003, 0x00000003, 0x00000003, 0x00000003},
+        {0x0000a410, 0x000050d9, 0x000050d9, 0x000050d8, 0x000050d8},
+        {0x0000a458, 0x80000000, 0x80000000, 0x80000000, 0x80000000},
+        {0x0000a500, 0x00022200, 0x00022200, 0x00000006, 0x00000006},
+        {0x0000a504, 0x05062002, 0x05062002, 0x03000201, 0x03000201},
+        {0x0000a508, 0x0c002e00, 0x0c002e00, 0x06000203, 0x06000203},
+        {0x0000a50c, 0x11062202, 0x11062202, 0x0a000401, 0x0a000401},
+        {0x0000a510, 0x17022e00, 0x17022e00, 0x0e000403, 0x0e000403},
+        {0x0000a514, 0x1d000ec2, 0x1d000ec2, 0x12000405, 0x12000405},
+        {0x0000a518, 0x25020ec0, 0x25020ec0, 0x15000604, 0x15000604},
+        {0x0000a51c, 0x2b020ec3, 0x2b020ec3, 0x18000605, 0x18000605},
+        {0x0000a520, 0x2f001f04, 0x2f001f04, 0x1c000a04, 0x1c000a04},
+        {0x0000a524, 0x35001fc4, 0x35001fc4, 0x21000a06, 0x21000a06},
+        {0x0000a528, 0x3c022f04, 0x3c022f04, 0x29000a24, 0x29000a24},
+        {0x0000a52c, 0x41023e85, 0x41023e85, 0x2f000e21, 0x2f000e21},
+        {0x0000a530, 0x48023ec6, 0x48023ec6, 0x31000e20, 0x31000e20},
+        {0x0000a534, 0x4d023f01, 0x4d023f01, 0x33000e20, 0x33000e20},
+        {0x0000a538, 0x53023f4b, 0x53023f4b, 0x43000e62, 0x43000e62},
+        {0x0000a53c, 0x5a027f09, 0x5a027f09, 0x45000e63, 0x45000e63},
+        {0x0000a540, 0x5f027fc9, 0x5f027fc9, 0x49000e65, 0x49000e65},
+        {0x0000a544, 0x6502feca, 0x6502feca, 0x4b000e66, 0x4b000e66},
+        {0x0000a548, 0x6b02ff4a, 0x6b02ff4a, 0x4d001645, 0x4d001645},
+        {0x0000a54c, 0x7203feca, 0x7203feca, 0x51001865, 0x51001865},
+        {0x0000a550, 0x7703ff0b, 0x7703ff0b, 0x55001a86, 0x55001a86},
+        {0x0000a554, 0x7d06ffcb, 0x7d06ffcb, 0x57001ce9, 0x57001ce9},
+        {0x0000a558, 0x8407ff0b, 0x8407ff0b, 0x5a001ceb, 0x5a001ceb},
+        {0x0000a55c, 0x8907ffcb, 0x8907ffcb, 0x5e001eeb, 0x5e001eeb},
+        {0x0000a560, 0x900fff0b, 0x900fff0b, 0x5e001eeb, 0x5e001eeb},
+        {0x0000a564, 0x960fffcb, 0x960fffcb, 0x5e001eeb, 0x5e001eeb},
+        {0x0000a568, 0x9c1fff0b, 0x9c1fff0b, 0x5e001eeb, 0x5e001eeb},
+        {0x0000a56c, 0x9c1fff0b, 0x9c1fff0b, 0x5e001eeb, 0x5e001eeb},
+        {0x0000a570, 0x9c1fff0b, 0x9c1fff0b, 0x5e001eeb, 0x5e001eeb},
+        {0x0000a574, 0x9c1fff0b, 0x9c1fff0b, 0x5e001eeb, 0x5e001eeb},
+        {0x0000a578, 0x9c1fff0b, 0x9c1fff0b, 0x5e001eeb, 0x5e001eeb},
+        {0x0000a57c, 0x9c1fff0b, 0x9c1fff0b, 0x5e001eeb, 0x5e001eeb},
+        {0x0000b500, 0x0000001a, 0x0000001a, 0x0000001a, 0x0000001a},
+        {0x0000b504, 0x0000001a, 0x0000001a, 0x0000001a, 0x0000001a},
+        {0x0000b508, 0x0000001a, 0x0000001a, 0x0000001a, 0x0000001a},
+        {0x0000b50c, 0x0000001a, 0x0000001a, 0x0000001a, 0x0000001a},
+        {0x0000b510, 0x0000001a, 0x0000001a, 0x0000001a, 0x0000001a},
+        {0x0000b514, 0x0000001a, 0x0000001a, 0x0000001a, 0x0000001a},
+        {0x0000b518, 0x0000001a, 0x0000001a, 0x0000001a, 0x0000001a},
+        {0x0000b51c, 0x0000001a, 0x0000001a, 0x0000001a, 0x0000001a},
+        {0x0000b520, 0x0000001a, 0x0000001a, 0x0000001a, 0x0000001a},
+        {0x0000b524, 0x0000001a, 0x0000001a, 0x0000001a, 0x0000001a},
+        {0x0000b528, 0x0000001a, 0x0000001a, 0x0000001a, 0x0000001a},
+        {0x0000b52c, 0x0000002a, 0x0000002a, 0x0000002a, 0x0000002a},
+        {0x0000b530, 0x0000003a, 0x0000003a, 0x0000003a, 0x0000003a},
+        {0x0000b534, 0x0000004a, 0x0000004a, 0x0000004a, 0x0000004a},
+        {0x0000b538, 0x0000005b, 0x0000005b, 0x0000005b, 0x0000005b},
+        {0x0000b53c, 0x0000005b, 0x0000005b, 0x0000005b, 0x0000005b},
+        {0x0000b540, 0x0000005b, 0x0000005b, 0x0000005b, 0x0000005b},
+        {0x0000b544, 0x0000005b, 0x0000005b, 0x0000005b, 0x0000005b},
+        {0x0000b548, 0x0000005b, 0x0000005b, 0x0000005b, 0x0000005b},
+        {0x0000b54c, 0x0000005b, 0x0000005b, 0x0000005b, 0x0000005b},
+        {0x0000b550, 0x0000005b, 0x0000005b, 0x0000005b, 0x0000005b},
+        {0x0000b554, 0x0000005b, 0x0000005b, 0x0000005b, 0x0000005b},
+        {0x0000b558, 0x0000005b, 0x0000005b, 0x0000005b, 0x0000005b},
+        {0x0000b55c, 0x0000005b, 0x0000005b, 0x0000005b, 0x0000005b},
+        {0x0000b560, 0x0000005b, 0x0000005b, 0x0000005b, 0x0000005b},
+        {0x0000b564, 0x0000005b, 0x0000005b, 0x0000005b, 0x0000005b},
+        {0x0000b568, 0x0000005b, 0x0000005b, 0x0000005b, 0x0000005b},
+        {0x0000b56c, 0x0000005b, 0x0000005b, 0x0000005b, 0x0000005b},
+        {0x0000b570, 0x0000005b, 0x0000005b, 0x0000005b, 0x0000005b},
+        {0x0000b574, 0x0000005b, 0x0000005b, 0x0000005b, 0x0000005b},
+        {0x0000b578, 0x0000005b, 0x0000005b, 0x0000005b, 0x0000005b},
+        {0x0000b57c, 0x0000005b, 0x0000005b, 0x0000005b, 0x0000005b},
+        {0x00016044, 0x05d6b2db, 0x05d6b2db, 0x05d6b2db, 0x05d6b2db},
+        {0x00016048, 0x6c924260, 0x6c924260, 0x6c924260, 0x6c924260},
+};
+
 static const u32 ar9485Modes_high_ob_db_tx_gain_1_1[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
         {0x000098bc, 0x00000002, 0x00000002, 0x00000002, 0x00000002},
@@ -450,6 +523,79 @@ static const u32 ar9485Modes_low_ob_db_tx_gain_1_1[][5] = {
 
 #define ar9485_modes_lowest_ob_db_tx_gain_1_1 ar9485Modes_low_ob_db_tx_gain_1_1
 
+static const u32 ar9485Modes_green_spur_ob_db_tx_gain_1_1[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x000098bc, 0x00000003, 0x00000003, 0x00000003, 0x00000003},
+        {0x0000a410, 0x000050d9, 0x000050d9, 0x000050d8, 0x000050d8},
+        {0x0000a458, 0x80000000, 0x80000000, 0x80000000, 0x80000000},
+        {0x0000a500, 0x00022200, 0x00022200, 0x00000006, 0x00000006},
+        {0x0000a504, 0x05062002, 0x05062002, 0x03000201, 0x03000201},
+        {0x0000a508, 0x0c002e00, 0x0c002e00, 0x07000203, 0x07000203},
+        {0x0000a50c, 0x11062202, 0x11062202, 0x0a000401, 0x0a000401},
+        {0x0000a510, 0x17022e00, 0x17022e00, 0x0e000403, 0x0e000403},
+        {0x0000a514, 0x1d000ec2, 0x1d000ec2, 0x12000405, 0x12000405},
+        {0x0000a518, 0x25020ec0, 0x25020ec0, 0x14000406, 0x14000406},
+        {0x0000a51c, 0x2b020ec3, 0x2b020ec3, 0x1800040a, 0x1800040a},
+        {0x0000a520, 0x2f001f04, 0x2f001f04, 0x1c000460, 0x1c000460},
+        {0x0000a524, 0x35001fc4, 0x35001fc4, 0x22000463, 0x22000463},
+        {0x0000a528, 0x3c022f04, 0x3c022f04, 0x26000465, 0x26000465},
+        {0x0000a52c, 0x41023e85, 0x41023e85, 0x2e0006e0, 0x2e0006e0},
+        {0x0000a530, 0x48023ec6, 0x48023ec6, 0x310006e0, 0x310006e0},
+        {0x0000a534, 0x4d023f01, 0x4d023f01, 0x330006e0, 0x330006e0},
+        {0x0000a538, 0x53023f4b, 0x53023f4b, 0x3e0008e3, 0x3e0008e3},
+        {0x0000a53c, 0x5a027f09, 0x5a027f09, 0x410008e5, 0x410008e5},
+        {0x0000a540, 0x5f027fc9, 0x5f027fc9, 0x430008e6, 0x430008e6},
+        {0x0000a544, 0x6502feca, 0x6502feca, 0x4a0008ec, 0x4a0008ec},
+        {0x0000a548, 0x6b02ff4a, 0x6b02ff4a, 0x4e0008f1, 0x4e0008f1},
+        {0x0000a54c, 0x7203feca, 0x7203feca, 0x520008f3, 0x520008f3},
+        {0x0000a550, 0x7703ff0b, 0x7703ff0b, 0x54000eed, 0x54000eed},
+        {0x0000a554, 0x7d06ffcb, 0x7d06ffcb, 0x58000ef1, 0x58000ef1},
+        {0x0000a558, 0x8407ff0b, 0x8407ff0b, 0x5c000ef3, 0x5c000ef3},
+        {0x0000a55c, 0x8907ffcb, 0x8907ffcb, 0x60000ef5, 0x60000ef5},
+        {0x0000a560, 0x900fff0b, 0x900fff0b, 0x62000ef6, 0x62000ef6},
+        {0x0000a564, 0x960fffcb, 0x960fffcb, 0x62000ef6, 0x62000ef6},
+        {0x0000a568, 0x9c1fff0b, 0x9c1fff0b, 0x62000ef6, 0x62000ef6},
+        {0x0000a56c, 0x9c1fff0b, 0x9c1fff0b, 0x62000ef6, 0x62000ef6},
+        {0x0000a570, 0x9c1fff0b, 0x9c1fff0b, 0x62000ef6, 0x62000ef6},
+        {0x0000a574, 0x9c1fff0b, 0x9c1fff0b, 0x62000ef6, 0x62000ef6},
+        {0x0000a578, 0x9c1fff0b, 0x9c1fff0b, 0x62000ef6, 0x62000ef6},
+        {0x0000a57c, 0x9c1fff0b, 0x9c1fff0b, 0x62000ef6, 0x62000ef6},
+        {0x0000b500, 0x0000001a, 0x0000001a, 0x0000001a, 0x0000001a},
+        {0x0000b504, 0x0000001a, 0x0000001a, 0x0000001a, 0x0000001a},
+        {0x0000b508, 0x0000001a, 0x0000001a, 0x0000001a, 0x0000001a},
+        {0x0000b50c, 0x0000001a, 0x0000001a, 0x0000001a, 0x0000001a},
+        {0x0000b510, 0x0000001a, 0x0000001a, 0x0000001a, 0x0000001a},
+        {0x0000b514, 0x0000001a, 0x0000001a, 0x0000001a, 0x0000001a},
+        {0x0000b518, 0x0000001a, 0x0000001a, 0x0000001a, 0x0000001a},
+        {0x0000b51c, 0x0000001a, 0x0000001a, 0x0000001a, 0x0000001a},
+        {0x0000b520, 0x0000001a, 0x0000001a, 0x0000001a, 0x0000001a},
+        {0x0000b524, 0x0000001a, 0x0000001a, 0x0000001a, 0x0000001a},
+        {0x0000b528, 0x0000001a, 0x0000001a, 0x0000001a, 0x0000001a},
+        {0x0000b52c, 0x0000002a, 0x0000002a, 0x0000002a, 0x0000002a},
+        {0x0000b530, 0x0000003a, 0x0000003a, 0x0000003a, 0x0000003a},
+        {0x0000b534, 0x0000004a, 0x0000004a, 0x0000004a, 0x0000004a},
+        {0x0000b538, 0x0000005b, 0x0000005b, 0x0000005b, 0x0000005b},
+        {0x0000b53c, 0x0000005b, 0x0000005b, 0x0000005b, 0x0000005b},
+        {0x0000b540, 0x0000005b, 0x0000005b, 0x0000005b, 0x0000005b},
+        {0x0000b544, 0x0000005b, 0x0000005b, 0x0000005b, 0x0000005b},
+        {0x0000b548, 0x0000005b, 0x0000005b, 0x0000005b, 0x0000005b},
+        {0x0000b54c, 0x0000005b, 0x0000005b, 0x0000005b, 0x0000005b},
+        {0x0000b550, 0x0000005b, 0x0000005b, 0x0000005b, 0x0000005b},
+        {0x0000b554, 0x0000005b, 0x0000005b, 0x0000005b, 0x0000005b},
+        {0x0000b558, 0x0000005b, 0x0000005b, 0x0000005b, 0x0000005b},
+        {0x0000b55c, 0x0000005b, 0x0000005b, 0x0000005b, 0x0000005b},
+        {0x0000b560, 0x0000005b, 0x0000005b, 0x0000005b, 0x0000005b},
+        {0x0000b564, 0x0000005b, 0x0000005b, 0x0000005b, 0x0000005b},
+        {0x0000b568, 0x0000005b, 0x0000005b, 0x0000005b, 0x0000005b},
+        {0x0000b56c, 0x0000005b, 0x0000005b, 0x0000005b, 0x0000005b},
+        {0x0000b570, 0x0000005b, 0x0000005b, 0x0000005b, 0x0000005b},
+        {0x0000b574, 0x0000005b, 0x0000005b, 0x0000005b, 0x0000005b},
+        {0x0000b578, 0x0000005b, 0x0000005b, 0x0000005b, 0x0000005b},
+        {0x0000b57c, 0x0000005b, 0x0000005b, 0x0000005b, 0x0000005b},
+        {0x00016044, 0x05d6b2db, 0x05d6b2db, 0x05d6b2db, 0x05d6b2db},
+        {0x00016048, 0x6c924260, 0x6c924260, 0x6c924260, 0x6c924260},
+};
+
 static const u32 ar9485_1_1[][2] = {
         /* Addr      allmodes  */
         {0x0000a580, 0x00000000},
diff --git a/drivers/net/wireless/ath/ath9k/ar955x_1p0_initvals.h b/drivers/net/wireless/ath/ath9k/ar955x_1p0_initvals.h
index df97f21c52dc..ccc5b6c99add 100644
--- a/drivers/net/wireless/ath/ath9k/ar955x_1p0_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar955x_1p0_initvals.h
@@ -23,16 +23,16 @@
 static const u32 ar955x_1p0_radio_postamble[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
         {0x00016098, 0xd2dd5554, 0xd2dd5554, 0xd28b3330, 0xd28b3330},
-        {0x0001609c, 0x0a566f3a, 0x0a566f3a, 0x06345f2a, 0x06345f2a},
-        {0x000160ac, 0xa4647c00, 0xa4647c00, 0xa4646800, 0xa4646800},
-        {0x000160b0, 0x01885f52, 0x01885f52, 0x04accf3a, 0x04accf3a},
-        {0x00016104, 0xb7a00001, 0xb7a00001, 0xb7a00001, 0xb7a00001},
+        {0x0001609c, 0x0a566f3a, 0x0a566f3a, 0x0a566f3a, 0x0a566f3a},
+        {0x000160ac, 0xa4647c00, 0xa4647c00, 0x24647c00, 0x24647c00},
+        {0x000160b0, 0x01885f52, 0x01885f52, 0x01885f52, 0x01885f52},
+        {0x00016104, 0xb7a00000, 0xb7a00000, 0xb7a00001, 0xb7a00001},
         {0x0001610c, 0xc0000000, 0xc0000000, 0xc0000000, 0xc0000000},
         {0x00016140, 0x10804008, 0x10804008, 0x10804008, 0x10804008},
-        {0x00016504, 0xb7a00001, 0xb7a00001, 0xb7a00001, 0xb7a00001},
+        {0x00016504, 0xb7a00000, 0xb7a00000, 0xb7a00001, 0xb7a00001},
         {0x0001650c, 0xc0000000, 0xc0000000, 0xc0000000, 0xc0000000},
         {0x00016540, 0x10804008, 0x10804008, 0x10804008, 0x10804008},
-        {0x00016904, 0xb7a00001, 0xb7a00001, 0xb7a00001, 0xb7a00001},
+        {0x00016904, 0xb7a00000, 0xb7a00000, 0xb7a00001, 0xb7a00001},
         {0x0001690c, 0xc0000000, 0xc0000000, 0xc0000000, 0xc0000000},
         {0x00016940, 0x10804008, 0x10804008, 0x10804008, 0x10804008},
 };
@@ -69,15 +69,15 @@ static const u32 ar955x_1p0_baseband_postamble[][5] = {
         {0x0000a204, 0x005c0ec0, 0x005c0ec4, 0x005c0ec4, 0x005c0ec0},
         {0x0000a208, 0x00000104, 0x00000104, 0x00000004, 0x00000004},
         {0x0000a22c, 0x07e26a2f, 0x07e26a2f, 0x01026a2f, 0x01026a2f},
-        {0x0000a230, 0x0000000a, 0x00000014, 0x00000016, 0x0000000b},
+        {0x0000a230, 0x0000400a, 0x00004014, 0x00004016, 0x0000400b},
         {0x0000a234, 0x00000fff, 0x10000fff, 0x10000fff, 0x00000fff},
         {0x0000a238, 0xffb01018, 0xffb01018, 0xffb01018, 0xffb01018},
         {0x0000a250, 0x00000000, 0x00000000, 0x00000210, 0x00000108},
         {0x0000a254, 0x000007d0, 0x00000fa0, 0x00001130, 0x00000898},
         {0x0000a258, 0x02020002, 0x02020002, 0x02020002, 0x02020002},
-        {0x0000a25c, 0x01000e0e, 0x01000e0e, 0x01000e0e, 0x01000e0e},
+        {0x0000a25c, 0x01000e0e, 0x01000e0e, 0x01010e0e, 0x01010e0e},
         {0x0000a260, 0x0a021501, 0x0a021501, 0x3a021501, 0x3a021501},
-        {0x0000a264, 0x00000e0e, 0x00000e0e, 0x00000e0e, 0x00000e0e},
+        {0x0000a264, 0x00000e0e, 0x00000e0e, 0x01000e0e, 0x01000e0e},
         {0x0000a280, 0x00000007, 0x00000007, 0x0000000b, 0x0000000b},
         {0x0000a284, 0x00000000, 0x00000000, 0x00000010, 0x00000010},
         {0x0000a288, 0x00000110, 0x00000110, 0x00000110, 0x00000110},
@@ -125,7 +125,7 @@ static const u32 ar955x_1p0_radio_core[][2] = {
         {0x00016094, 0x00000000},
         {0x000160a0, 0x0a108ffe},
         {0x000160a4, 0x812fc370},
-        {0x000160a8, 0x423c8000},
+        {0x000160a8, 0x423c8100},
         {0x000160b4, 0x92480080},
         {0x000160c0, 0x006db6d0},
         {0x000160c4, 0x6db6db60},
@@ -134,7 +134,7 @@ static const u32 ar955x_1p0_radio_core[][2] = {
         {0x00016100, 0x11999601},
         {0x00016108, 0x00080010},
         {0x00016144, 0x02084080},
-        {0x00016148, 0x000080c0},
+        {0x00016148, 0x00008040},
         {0x00016280, 0x01800804},
         {0x00016284, 0x00038dc5},
         {0x00016288, 0x00000000},
@@ -178,7 +178,7 @@ static const u32 ar955x_1p0_radio_core[][2] = {
         {0x00016500, 0x11999601},
         {0x00016508, 0x00080010},
         {0x00016544, 0x02084080},
-        {0x00016548, 0x000080c0},
+        {0x00016548, 0x00008040},
         {0x00016780, 0x00000000},
         {0x00016784, 0x00000000},
         {0x00016788, 0x00400705},
@@ -218,7 +218,7 @@ static const u32 ar955x_1p0_radio_core[][2] = {
         {0x00016900, 0x11999601},
         {0x00016908, 0x00080010},
         {0x00016944, 0x02084080},
-        {0x00016948, 0x000080c0},
+        {0x00016948, 0x00008040},
         {0x00016b80, 0x00000000},
         {0x00016b84, 0x00000000},
         {0x00016b88, 0x00400705},
@@ -245,9 +245,9 @@ static const u32 ar955x_1p0_radio_core[][2] = {
 
 static const u32 ar955x_1p0_modes_xpa_tx_gain_table[][9] = {
         /* Addr      5G_HT20_L   5G_HT40_L   5G_HT20_M   5G_HT40_M   5G_HT20_H   5G_HT40_H   2G_HT40     2G_HT20  */
-        {0x0000a2dc, 0xffffaaaa, 0xffffaaaa, 0xffffaaaa, 0xffffaaaa, 0xffffaaaa, 0xffffaaaa, 0xfffd5aaa, 0xfffd5aaa},
-        {0x0000a2e0, 0xffffcccc, 0xffffcccc, 0xffffcccc, 0xffffcccc, 0xffffcccc, 0xffffcccc, 0xfffe9ccc, 0xfffe9ccc},
-        {0x0000a2e4, 0xfffff0f0, 0xfffff0f0, 0xfffff0f0, 0xfffff0f0, 0xfffff0f0, 0xfffff0f0, 0xffffe0f0, 0xffffe0f0},
+        {0x0000a2dc, 0xffff6aaa, 0xffff6aaa, 0xffff6aaa, 0xffff6aaa, 0xffff6aaa, 0xffff6aaa, 0xfffd5aaa, 0xfffd5aaa},
+        {0x0000a2e0, 0xfffdcccc, 0xfffdcccc, 0xfffdcccc, 0xfffdcccc, 0xfffdcccc, 0xfffdcccc, 0xfffe9ccc, 0xfffe9ccc},
+        {0x0000a2e4, 0xffe3b0f0, 0xffe3b0f0, 0xffe3b0f0, 0xffe3b0f0, 0xffe3b0f0, 0xffe3b0f0, 0xffffe0f0, 0xffffe0f0},
         {0x0000a2e8, 0xffffff00, 0xffffff00, 0xffffff00, 0xffffff00, 0xffffff00, 0xffffff00, 0xfffcff00, 0xfffcff00},
         {0x0000a410, 0x000050de, 0x000050de, 0x000050de, 0x000050de, 0x000050de, 0x000050de, 0x000050da, 0x000050da},
         {0x0000a500, 0x00000003, 0x00000003, 0x00000003, 0x00000003, 0x00000003, 0x00000003, 0x00000000, 0x00000000},
@@ -256,63 +256,63 @@ static const u32 ar955x_1p0_modes_xpa_tx_gain_table[][9] = {
         {0x0000a50c, 0x0c00000b, 0x0c00000b, 0x0c00000b, 0x0c00000b, 0x0c00000b, 0x0c00000b, 0x0c000006, 0x0c000006},
         {0x0000a510, 0x1000000d, 0x1000000d, 0x1000000d, 0x1000000d, 0x1000000d, 0x1000000d, 0x0f00000a, 0x0f00000a},
         {0x0000a514, 0x14000011, 0x14000011, 0x14000011, 0x14000011, 0x14000011, 0x14000011, 0x1300000c, 0x1300000c},
-        {0x0000a518, 0x19004008, 0x19004008, 0x19004008, 0x19004008, 0x18004008, 0x18004008, 0x1700000e, 0x1700000e},
-        {0x0000a51c, 0x1d00400a, 0x1d00400a, 0x1d00400a, 0x1d00400a, 0x1c00400a, 0x1c00400a, 0x1b000064, 0x1b000064},
-        {0x0000a520, 0x230020a2, 0x230020a2, 0x210020a2, 0x210020a2, 0x200020a2, 0x200020a2, 0x1f000242, 0x1f000242},
-        {0x0000a524, 0x2500006e, 0x2500006e, 0x2500006e, 0x2500006e, 0x2400006e, 0x2400006e, 0x23000229, 0x23000229},
-        {0x0000a528, 0x29022221, 0x29022221, 0x28022221, 0x28022221, 0x27022221, 0x27022221, 0x270002a2, 0x270002a2},
-        {0x0000a52c, 0x2d00062a, 0x2d00062a, 0x2c00062a, 0x2c00062a, 0x2a00062a, 0x2a00062a, 0x2c001203, 0x2c001203},
-        {0x0000a530, 0x340220a5, 0x340220a5, 0x320220a5, 0x320220a5, 0x2f0220a5, 0x2f0220a5, 0x30001803, 0x30001803},
-        {0x0000a534, 0x380022c5, 0x380022c5, 0x350022c5, 0x350022c5, 0x320022c5, 0x320022c5, 0x33000881, 0x33000881},
-        {0x0000a538, 0x3b002486, 0x3b002486, 0x39002486, 0x39002486, 0x36002486, 0x36002486, 0x38001809, 0x38001809},
-        {0x0000a53c, 0x3f00248a, 0x3f00248a, 0x3d00248a, 0x3d00248a, 0x3a00248a, 0x3a00248a, 0x3a000814, 0x3a000814},
-        {0x0000a540, 0x4202242c, 0x4202242c, 0x4102242c, 0x4102242c, 0x3f02242c, 0x3f02242c, 0x3f001a0c, 0x3f001a0c},
-        {0x0000a544, 0x490044c6, 0x490044c6, 0x460044c6, 0x460044c6, 0x420044c6, 0x420044c6, 0x43001a0e, 0x43001a0e},
-        {0x0000a548, 0x4d024485, 0x4d024485, 0x4a024485, 0x4a024485, 0x46024485, 0x46024485, 0x46001812, 0x46001812},
-        {0x0000a54c, 0x51044483, 0x51044483, 0x4e044483, 0x4e044483, 0x4a044483, 0x4a044483, 0x49001884, 0x49001884},
-        {0x0000a550, 0x5404a40c, 0x5404a40c, 0x5204a40c, 0x5204a40c, 0x4d04a40c, 0x4d04a40c, 0x4d001e84, 0x4d001e84},
-        {0x0000a554, 0x57024632, 0x57024632, 0x55024632, 0x55024632, 0x52024632, 0x52024632, 0x50001e69, 0x50001e69},
-        {0x0000a558, 0x5c00a634, 0x5c00a634, 0x5900a634, 0x5900a634, 0x5600a634, 0x5600a634, 0x550006f4, 0x550006f4},
-        {0x0000a55c, 0x5f026832, 0x5f026832, 0x5d026832, 0x5d026832, 0x5a026832, 0x5a026832, 0x59000ad3, 0x59000ad3},
-        {0x0000a560, 0x6602b012, 0x6602b012, 0x6202b012, 0x6202b012, 0x5d02b012, 0x5d02b012, 0x5e000ad5, 0x5e000ad5},
-        {0x0000a564, 0x6e02d0e1, 0x6e02d0e1, 0x6802d0e1, 0x6802d0e1, 0x6002d0e1, 0x6002d0e1, 0x61001ced, 0x61001ced},
-        {0x0000a568, 0x7202b4c4, 0x7202b4c4, 0x6c02b4c4, 0x6c02b4c4, 0x6502b4c4, 0x6502b4c4, 0x660018d4, 0x660018d4},
-        {0x0000a56c, 0x75007894, 0x75007894, 0x70007894, 0x70007894, 0x6b007894, 0x6b007894, 0x660018d4, 0x660018d4},
-        {0x0000a570, 0x7b025c74, 0x7b025c74, 0x75025c74, 0x75025c74, 0x70025c74, 0x70025c74, 0x660018d4, 0x660018d4},
-        {0x0000a574, 0x8300bcb5, 0x8300bcb5, 0x7a00bcb5, 0x7a00bcb5, 0x7600bcb5, 0x7600bcb5, 0x660018d4, 0x660018d4},
-        {0x0000a578, 0x8a04dc74, 0x8a04dc74, 0x7f04dc74, 0x7f04dc74, 0x7c04dc74, 0x7c04dc74, 0x660018d4, 0x660018d4},
-        {0x0000a57c, 0x8a04dc74, 0x8a04dc74, 0x7f04dc74, 0x7f04dc74, 0x7c04dc74, 0x7c04dc74, 0x660018d4, 0x660018d4},
+        {0x0000a518, 0x1700002b, 0x1700002b, 0x1700002b, 0x1700002b, 0x1600002b, 0x1600002b, 0x1700000e, 0x1700000e},
+        {0x0000a51c, 0x1b00002d, 0x1b00002d, 0x1b00002d, 0x1b00002d, 0x1a00002d, 0x1a00002d, 0x1b000064, 0x1b000064},
+        {0x0000a520, 0x20000031, 0x20000031, 0x1f000031, 0x1f000031, 0x1e000031, 0x1e000031, 0x1f000242, 0x1f000242},
+        {0x0000a524, 0x24000051, 0x24000051, 0x23000051, 0x23000051, 0x23000051, 0x23000051, 0x23000229, 0x23000229},
+        {0x0000a528, 0x27000071, 0x27000071, 0x27000071, 0x27000071, 0x26000071, 0x26000071, 0x270002a2, 0x270002a2},
+        {0x0000a52c, 0x2b000092, 0x2b000092, 0x2b000092, 0x2b000092, 0x2b000092, 0x2b000092, 0x2c001203, 0x2c001203},
+        {0x0000a530, 0x3000028c, 0x3000028c, 0x2f00028c, 0x2f00028c, 0x2e00028c, 0x2e00028c, 0x30001803, 0x30001803},
+        {0x0000a534, 0x34000290, 0x34000290, 0x33000290, 0x33000290, 0x32000290, 0x32000290, 0x33000881, 0x33000881},
+        {0x0000a538, 0x37000292, 0x37000292, 0x36000292, 0x36000292, 0x35000292, 0x35000292, 0x38001809, 0x38001809},
+        {0x0000a53c, 0x3b02028d, 0x3b02028d, 0x3a02028d, 0x3a02028d, 0x3902028d, 0x3902028d, 0x3a000814, 0x3a000814},
+        {0x0000a540, 0x3f020291, 0x3f020291, 0x3e020291, 0x3e020291, 0x3d020291, 0x3d020291, 0x3f001a0c, 0x3f001a0c},
+        {0x0000a544, 0x44020490, 0x44020490, 0x43020490, 0x43020490, 0x42020490, 0x42020490, 0x43001a0e, 0x43001a0e},
+        {0x0000a548, 0x48020492, 0x48020492, 0x47020492, 0x47020492, 0x46020492, 0x46020492, 0x46001812, 0x46001812},
+        {0x0000a54c, 0x4c020692, 0x4c020692, 0x4b020692, 0x4b020692, 0x4a020692, 0x4a020692, 0x49001884, 0x49001884},
+        {0x0000a550, 0x50020892, 0x50020892, 0x4f020892, 0x4f020892, 0x4e020892, 0x4e020892, 0x4d001e84, 0x4d001e84},
+        {0x0000a554, 0x53040891, 0x53040891, 0x53040891, 0x53040891, 0x52040891, 0x52040891, 0x50001e69, 0x50001e69},
+        {0x0000a558, 0x58040893, 0x58040893, 0x57040893, 0x57040893, 0x56040893, 0x56040893, 0x550006f4, 0x550006f4},
+        {0x0000a55c, 0x5c0408b4, 0x5c0408b4, 0x5a0408b4, 0x5a0408b4, 0x5a0408b4, 0x5a0408b4, 0x59000ad3, 0x59000ad3},
+        {0x0000a560, 0x610408b6, 0x610408b6, 0x5e0408b6, 0x5e0408b6, 0x5e0408b6, 0x5e0408b6, 0x5e000ad5, 0x5e000ad5},
+        {0x0000a564, 0x670408f6, 0x670408f6, 0x620408f6, 0x620408f6, 0x620408f6, 0x620408f6, 0x61001ced, 0x61001ced},
+        {0x0000a568, 0x6a040cf6, 0x6a040cf6, 0x66040cf6, 0x66040cf6, 0x66040cf6, 0x66040cf6, 0x660018d4, 0x660018d4},
+        {0x0000a56c, 0x6d040d76, 0x6d040d76, 0x6a040d76, 0x6a040d76, 0x6a040d76, 0x6a040d76, 0x660018d4, 0x660018d4},
+        {0x0000a570, 0x70060db6, 0x70060db6, 0x6e060db6, 0x6e060db6, 0x6e060db6, 0x6e060db6, 0x660018d4, 0x660018d4},
+        {0x0000a574, 0x730a0df6, 0x730a0df6, 0x720a0df6, 0x720a0df6, 0x720a0df6, 0x720a0df6, 0x660018d4, 0x660018d4},
+        {0x0000a578, 0x770a13f6, 0x770a13f6, 0x760a13f6, 0x760a13f6, 0x760a13f6, 0x760a13f6, 0x660018d4, 0x660018d4},
+        {0x0000a57c, 0x770a13f6, 0x770a13f6, 0x760a13f6, 0x760a13f6, 0x760a13f6, 0x760a13f6, 0x660018d4, 0x660018d4},
         {0x0000a600, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000a604, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000a608, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a60c, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x03804000, 0x03804000},
-        {0x0000a610, 0x04c08c01, 0x04c08c01, 0x04808b01, 0x04808b01, 0x04808a01, 0x04808a01, 0x0300ca02, 0x0300ca02},
-        {0x0000a614, 0x00c0c303, 0x00c0c303, 0x00c0c303, 0x00c0c303, 0x00c0c303, 0x00c0c303, 0x00000e04, 0x00000e04},
-        {0x0000a618, 0x04010c01, 0x04010c01, 0x03c10b01, 0x03c10b01, 0x03810a01, 0x03810a01, 0x03014000, 0x03014000},
-        {0x0000a61c, 0x03814e05, 0x03814e05, 0x03414d05, 0x03414d05, 0x03414d05, 0x03414d05, 0x00000000, 0x00000000},
-        {0x0000a620, 0x04010303, 0x04010303, 0x03c10303, 0x03c10303, 0x03810303, 0x03810303, 0x00000000, 0x00000000},
-        {0x0000a624, 0x03814e05, 0x03814e05, 0x03414d05, 0x03414d05, 0x03414d05, 0x03414d05, 0x03014000, 0x03014000},
-        {0x0000a628, 0x00c0c000, 0x00c0c000, 0x00c0c000, 0x00c0c000, 0x00c0c000, 0x00c0c000, 0x03804c05, 0x03804c05},
-        {0x0000a62c, 0x00c0c303, 0x00c0c303, 0x00c0c303, 0x00c0c303, 0x00c0c303, 0x00c0c303, 0x0701de06, 0x0701de06},
-        {0x0000a630, 0x03418000, 0x03418000, 0x03018000, 0x03018000, 0x02c18000, 0x02c18000, 0x07819c07, 0x07819c07},
-        {0x0000a634, 0x03815004, 0x03815004, 0x03414f04, 0x03414f04, 0x03414e04, 0x03414e04, 0x0701dc07, 0x0701dc07},
-        {0x0000a638, 0x03005302, 0x03005302, 0x02c05202, 0x02c05202, 0x02805202, 0x02805202, 0x0701dc07, 0x0701dc07},
-        {0x0000a63c, 0x04c09302, 0x04c09302, 0x04809202, 0x04809202, 0x04809202, 0x04809202, 0x0701dc07, 0x0701dc07},
-        {0x0000b2dc, 0xffffaaaa, 0xffffaaaa, 0xffffaaaa, 0xffffaaaa, 0xffffaaaa, 0xffffaaaa, 0xfffd5aaa, 0xfffd5aaa},
-        {0x0000b2e0, 0xffffcccc, 0xffffcccc, 0xffffcccc, 0xffffcccc, 0xffffcccc, 0xffffcccc, 0xfffe9ccc, 0xfffe9ccc},
-        {0x0000b2e4, 0xfffff0f0, 0xfffff0f0, 0xfffff0f0, 0xfffff0f0, 0xfffff0f0, 0xfffff0f0, 0xffffe0f0, 0xffffe0f0},
+        {0x0000a60c, 0x02c04b01, 0x02c04b01, 0x02c04b01, 0x02c04b01, 0x02c04b01, 0x02c04b01, 0x03804000, 0x03804000},
+        {0x0000a610, 0x04008b01, 0x04008b01, 0x04008b01, 0x04008b01, 0x03c08b01, 0x03c08b01, 0x0300ca02, 0x0300ca02},
+        {0x0000a614, 0x05811403, 0x05811403, 0x05411303, 0x05411303, 0x05411303, 0x05411303, 0x00000e04, 0x00000e04},
+        {0x0000a618, 0x05811604, 0x05811604, 0x05411504, 0x05411504, 0x05411504, 0x05411504, 0x03014000, 0x03014000},
+        {0x0000a61c, 0x05811604, 0x05811604, 0x05411504, 0x05411504, 0x05411504, 0x05411504, 0x00000000, 0x00000000},
+        {0x0000a620, 0x05811604, 0x05811604, 0x05411504, 0x05411504, 0x05411504, 0x05411504, 0x00000000, 0x00000000},
+        {0x0000a624, 0x05811604, 0x05811604, 0x05411504, 0x05411504, 0x05411504, 0x05411504, 0x03014000, 0x03014000},
+        {0x0000a628, 0x05811604, 0x05811604, 0x05411504, 0x05411504, 0x05411504, 0x05411504, 0x03804c05, 0x03804c05},
+        {0x0000a62c, 0x06815604, 0x06815604, 0x06415504, 0x06415504, 0x06015504, 0x06015504, 0x0701de06, 0x0701de06},
+        {0x0000a630, 0x07819a05, 0x07819a05, 0x07419905, 0x07419905, 0x07019805, 0x07019805, 0x07819c07, 0x07819c07},
+        {0x0000a634, 0x07819e06, 0x07819e06, 0x07419d06, 0x07419d06, 0x07019c06, 0x07019c06, 0x0701dc07, 0x0701dc07},
+        {0x0000a638, 0x07819e06, 0x07819e06, 0x07419d06, 0x07419d06, 0x07019c06, 0x07019c06, 0x0701dc07, 0x0701dc07},
+        {0x0000a63c, 0x07819e06, 0x07819e06, 0x07419d06, 0x07419d06, 0x07019c06, 0x07019c06, 0x0701dc07, 0x0701dc07},
+        {0x0000b2dc, 0xffff6aaa, 0xffff6aaa, 0xffff6aaa, 0xffff6aaa, 0xffff6aaa, 0xffff6aaa, 0xfffd5aaa, 0xfffd5aaa},
+        {0x0000b2e0, 0xfffdcccc, 0xfffdcccc, 0xfffdcccc, 0xfffdcccc, 0xfffdcccc, 0xfffdcccc, 0xfffe9ccc, 0xfffe9ccc},
+        {0x0000b2e4, 0xffe3b0f0, 0xffe3b0f0, 0xffe3b0f0, 0xffe3b0f0, 0xffe3b0f0, 0xffe3b0f0, 0xffffe0f0, 0xffffe0f0},
         {0x0000b2e8, 0xffffff00, 0xffffff00, 0xffffff00, 0xffffff00, 0xffffff00, 0xffffff00, 0xfffcff00, 0xfffcff00},
-        {0x0000c2dc, 0xffffaaaa, 0xffffaaaa, 0xffffaaaa, 0xffffaaaa, 0xffffaaaa, 0xffffaaaa, 0xfffd5aaa, 0xfffd5aaa},
-        {0x0000c2e0, 0xffffcccc, 0xffffcccc, 0xffffcccc, 0xffffcccc, 0xffffcccc, 0xffffcccc, 0xfffe9ccc, 0xfffe9ccc},
-        {0x0000c2e4, 0xfffff0f0, 0xfffff0f0, 0xfffff0f0, 0xfffff0f0, 0xfffff0f0, 0xfffff0f0, 0xffffe0f0, 0xffffe0f0},
+        {0x0000c2dc, 0xffff6aaa, 0xffff6aaa, 0xffff6aaa, 0xffff6aaa, 0xffff6aaa, 0xffff6aaa, 0xfffd5aaa, 0xfffd5aaa},
+        {0x0000c2e0, 0xfffdcccc, 0xfffdcccc, 0xfffdcccc, 0xfffdcccc, 0xfffdcccc, 0xfffdcccc, 0xfffe9ccc, 0xfffe9ccc},
+        {0x0000c2e4, 0xffe3b0f0, 0xffe3b0f0, 0xffe3b0f0, 0xffe3b0f0, 0xffe3b0f0, 0xffe3b0f0, 0xffffe0f0, 0xffffe0f0},
         {0x0000c2e8, 0xffffff00, 0xffffff00, 0xffffff00, 0xffffff00, 0xffffff00, 0xffffff00, 0xfffcff00, 0xfffcff00},
         {0x00016044, 0x056db2d4, 0x056db2d4, 0x056db2d4, 0x056db2d4, 0x056db2d4, 0x056db2d4, 0x010002d4, 0x010002d4},
-        {0x00016048, 0x62482401, 0x62482401, 0x62482401, 0x62482401, 0x62482401, 0x62482401, 0x66482401, 0x66482401},
+        {0x00016048, 0x66482401, 0x66482401, 0x66482401, 0x66482401, 0x66482401, 0x66482401, 0x66482401, 0x66482401},
         {0x00016280, 0x01801e84, 0x01801e84, 0x01801e84, 0x01801e84, 0x01801e84, 0x01801e84, 0x01808e84, 0x01808e84},
         {0x00016444, 0x056db2d4, 0x056db2d4, 0x056db2d4, 0x056db2d4, 0x056db2d4, 0x056db2d4, 0x010002d4, 0x010002d4},
-        {0x00016448, 0x62482401, 0x62482401, 0x62482401, 0x62482401, 0x62482401, 0x62482401, 0x66482401, 0x66482401},
+        {0x00016448, 0x66482401, 0x66482401, 0x66482401, 0x66482401, 0x66482401, 0x66482401, 0x66482401, 0x66482401},
         {0x00016844, 0x056db2d4, 0x056db2d4, 0x056db2d4, 0x056db2d4, 0x056db2d4, 0x056db2d4, 0x010002d4, 0x010002d4},
-        {0x00016848, 0x62482401, 0x62482401, 0x62482401, 0x62482401, 0x62482401, 0x62482401, 0x66482401, 0x66482401},
+        {0x00016848, 0x66482401, 0x66482401, 0x66482401, 0x66482401, 0x66482401, 0x66482401, 0x66482401, 0x66482401},
 };
 
 static const u32 ar955x_1p0_mac_core[][2] = {
@@ -846,7 +846,7 @@ static const u32 ar955x_1p0_baseband_core[][2] = {
         {0x0000a44c, 0x00000001},
         {0x0000a450, 0x00010000},
         {0x0000a458, 0x00000000},
-        {0x0000a644, 0x3fad9d74},
+        {0x0000a644, 0xbfad9d74},
         {0x0000a648, 0x0048060a},
         {0x0000a64c, 0x00003c37},
         {0x0000a670, 0x03020100},
@@ -1277,7 +1277,7 @@ static const u32 ar955x_1p0_modes_fast_clock[][3] = {
         {0x0000801c, 0x148ec02b, 0x148ec057},
         {0x00008318, 0x000044c0, 0x00008980},
         {0x00009e00, 0x0372131c, 0x0372131c},
-        {0x0000a230, 0x0000000b, 0x00000016},
+        {0x0000a230, 0x0000400b, 0x00004016},
         {0x0000a254, 0x00000898, 0x00001130},
 };
 
diff --git a/drivers/net/wireless/ath/ath9k/ar9580_1p0_initvals.h b/drivers/net/wireless/ath/ath9k/ar9580_1p0_initvals.h
index 6e1915aee712..28fd99203f64 100644
--- a/drivers/net/wireless/ath/ath9k/ar9580_1p0_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9580_1p0_initvals.h
@@ -685,6 +685,82 @@ static const u32 ar9580_1p0_mixed_ob_db_tx_gain_table[][5] = {
 
 #define ar9580_1p0_high_ob_db_tx_gain_table ar9300Modes_high_ob_db_tx_gain_table_2p2
 
+#define ar9580_1p0_type5_tx_gain_table ar9300Modes_type5_tx_gain_table_2p2
+
+static const u32 ar9580_1p0_type6_tx_gain_table[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x0000a2dc, 0x000cfff0, 0x000cfff0, 0x03aaa352, 0x03aaa352},
+        {0x0000a2e0, 0x000f0000, 0x000f0000, 0x03ccc584, 0x03ccc584},
+        {0x0000a2e4, 0x03f00000, 0x03f00000, 0x03f0f800, 0x03f0f800},
+        {0x0000a2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
+        {0x0000a410, 0x000050d9, 0x000050d9, 0x000050d9, 0x000050d9},
+        {0x0000a500, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a504, 0x06000003, 0x06000003, 0x04000002, 0x04000002},
+        {0x0000a508, 0x0a000020, 0x0a000020, 0x08000004, 0x08000004},
+        {0x0000a50c, 0x10000023, 0x10000023, 0x0b000200, 0x0b000200},
+        {0x0000a510, 0x15000028, 0x15000028, 0x0f000202, 0x0f000202},
+        {0x0000a514, 0x1b00002b, 0x1b00002b, 0x12000400, 0x12000400},
+        {0x0000a518, 0x1f020028, 0x1f020028, 0x16000402, 0x16000402},
+        {0x0000a51c, 0x2502002b, 0x2502002b, 0x19000404, 0x19000404},
+        {0x0000a520, 0x2a04002a, 0x2a04002a, 0x1c000603, 0x1c000603},
+        {0x0000a524, 0x2e06002a, 0x2e06002a, 0x21000a02, 0x21000a02},
+        {0x0000a528, 0x3302202d, 0x3302202d, 0x25000a04, 0x25000a04},
+        {0x0000a52c, 0x3804202c, 0x3804202c, 0x28000a20, 0x28000a20},
+        {0x0000a530, 0x3c06202c, 0x3c06202c, 0x2c000e20, 0x2c000e20},
+        {0x0000a534, 0x4108202d, 0x4108202d, 0x30000e22, 0x30000e22},
+        {0x0000a538, 0x4506402d, 0x4506402d, 0x34000e24, 0x34000e24},
+        {0x0000a53c, 0x4906222d, 0x4906222d, 0x38001640, 0x38001640},
+        {0x0000a540, 0x4d062231, 0x4d062231, 0x3c001660, 0x3c001660},
+        {0x0000a544, 0x50082231, 0x50082231, 0x3f001861, 0x3f001861},
+        {0x0000a548, 0x5608422e, 0x5608422e, 0x43001a81, 0x43001a81},
+        {0x0000a54c, 0x5e08442e, 0x5e08442e, 0x47001a83, 0x47001a83},
+        {0x0000a550, 0x620a4431, 0x620a4431, 0x4a001c84, 0x4a001c84},
+        {0x0000a554, 0x640a4432, 0x640a4432, 0x4e001ce3, 0x4e001ce3},
+        {0x0000a558, 0x680a4434, 0x680a4434, 0x52001ce5, 0x52001ce5},
+        {0x0000a55c, 0x6c0a6434, 0x6c0a6434, 0x56001ce9, 0x56001ce9},
+        {0x0000a560, 0x6f0a6633, 0x6f0a6633, 0x5a001ceb, 0x5a001ceb},
+        {0x0000a564, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
+        {0x0000a568, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
+        {0x0000a56c, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
+        {0x0000a570, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
+        {0x0000a574, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
+        {0x0000a578, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
+        {0x0000a57c, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
+        {0x0000a600, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a604, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a608, 0x01804601, 0x01804601, 0x00000000, 0x00000000},
+        {0x0000a60c, 0x01804601, 0x01804601, 0x00000000, 0x00000000},
+        {0x0000a610, 0x01804601, 0x01804601, 0x00000000, 0x00000000},
+        {0x0000a614, 0x01804601, 0x01804601, 0x01404000, 0x01404000},
+        {0x0000a618, 0x01804601, 0x01804601, 0x01404501, 0x01404501},
+        {0x0000a61c, 0x01804601, 0x01804601, 0x02008501, 0x02008501},
+        {0x0000a620, 0x03408d02, 0x03408d02, 0x0280ca03, 0x0280ca03},
+        {0x0000a624, 0x0300cc03, 0x0300cc03, 0x03010c04, 0x03010c04},
+        {0x0000a628, 0x03410d04, 0x03410d04, 0x04014c04, 0x04014c04},
+        {0x0000a62c, 0x03410d04, 0x03410d04, 0x04015005, 0x04015005},
+        {0x0000a630, 0x03410d04, 0x03410d04, 0x04015005, 0x04015005},
+        {0x0000a634, 0x03410d04, 0x03410d04, 0x04015005, 0x04015005},
+        {0x0000a638, 0x03410d04, 0x03410d04, 0x04015005, 0x04015005},
+        {0x0000a63c, 0x03410d04, 0x03410d04, 0x04015005, 0x04015005},
+        {0x0000b2dc, 0x000cfff0, 0x000cfff0, 0x03aaa352, 0x03aaa352},
+        {0x0000b2e0, 0x000f0000, 0x000f0000, 0x03ccc584, 0x03ccc584},
+        {0x0000b2e4, 0x03f00000, 0x03f00000, 0x03f0f800, 0x03f0f800},
+        {0x0000b2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
+        {0x0000c2dc, 0x000cfff0, 0x000cfff0, 0x03aaa352, 0x03aaa352},
+        {0x0000c2e0, 0x000f0000, 0x000f0000, 0x03ccc584, 0x03ccc584},
+        {0x0000c2e4, 0x03f00000, 0x03f00000, 0x03f0f800, 0x03f0f800},
+        {0x0000c2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
+        {0x00016044, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4},
+        {0x00016048, 0x61200001, 0x61200001, 0x66480001, 0x66480001},
+        {0x00016068, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
+        {0x00016444, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4},
+        {0x00016448, 0x61200001, 0x61200001, 0x66480001, 0x66480001},
+        {0x00016468, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
+        {0x00016844, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4},
+        {0x00016848, 0x61200001, 0x61200001, 0x66480001, 0x66480001},
+        {0x00016868, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
+};
+
 static const u32 ar9580_1p0_soc_preamble[][2] = {
         /* Addr      allmodes  */
         {0x000040a4, 0x00a0c1c9},
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index 86e26a19efda..67df8644fef6 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -109,14 +109,11 @@ struct ath_descdma {
         void *dd_desc;
         dma_addr_t dd_desc_paddr;
         u32 dd_desc_len;
-        struct ath_buf *dd_bufptr;
 };
 
 int ath_descdma_setup(struct ath_softc *sc, struct ath_descdma *dd,
                       struct list_head *head, const char *name,
                       int nbuf, int ndesc, bool is_tx);
-void ath_descdma_cleanup(struct ath_softc *sc, struct ath_descdma *dd,
-                         struct list_head *head);
 
 /***********/
 /* RX / TX */
@@ -317,10 +314,8 @@ struct ath_rx {
         u32 *rxlink;
         u32 num_pkts;
         unsigned int rxfilter;
-        spinlock_t rxbuflock;
         struct list_head rxbuf;
         struct ath_descdma rxdma;
-        struct ath_buf *rx_bufptr;
         struct ath_rx_edma rx_edma[ATH9K_RX_QUEUE_MAX];
 
         struct sk_buff *frag;
@@ -328,7 +323,6 @@ struct ath_rx {
 
 int ath_startrecv(struct ath_softc *sc);
 bool ath_stoprecv(struct ath_softc *sc);
-void ath_flushrecv(struct ath_softc *sc);
 u32 ath_calcrxfilter(struct ath_softc *sc);
 int ath_rx_init(struct ath_softc *sc, int nbufs);
 void ath_rx_cleanup(struct ath_softc *sc);
@@ -338,14 +332,12 @@ void ath_txq_lock(struct ath_softc *sc, struct ath_txq *txq);
 void ath_txq_unlock(struct ath_softc *sc, struct ath_txq *txq);
 void ath_txq_unlock_complete(struct ath_softc *sc, struct ath_txq *txq);
 void ath_tx_cleanupq(struct ath_softc *sc, struct ath_txq *txq);
-bool ath_drain_all_txq(struct ath_softc *sc, bool retry_tx);
-void ath_draintxq(struct ath_softc *sc,
-                     struct ath_txq *txq, bool retry_tx);
+bool ath_drain_all_txq(struct ath_softc *sc);
+void ath_draintxq(struct ath_softc *sc, struct ath_txq *txq);
 void ath_tx_node_init(struct ath_softc *sc, struct ath_node *an);
 void ath_tx_node_cleanup(struct ath_softc *sc, struct ath_node *an);
 void ath_txq_schedule(struct ath_softc *sc, struct ath_txq *txq);
 int ath_tx_init(struct ath_softc *sc, int nbufs);
-void ath_tx_cleanup(struct ath_softc *sc);
 int ath_txq_update(struct ath_softc *sc, int qnum,
                    struct ath9k_tx_queue_info *q);
 void ath_update_max_aggr_framelen(struct ath_softc *sc, int queue, int txop);
@@ -646,7 +638,6 @@ void ath_ant_comb_update(struct ath_softc *sc);
 enum sc_op_flags {
         SC_OP_INVALID,
         SC_OP_BEACONS,
-        SC_OP_RXFLUSH,
         SC_OP_ANI_RUN,
         SC_OP_PRIM_STA_VIF,
         SC_OP_HW_RESET,
@@ -675,6 +666,23 @@ struct ath9k_vif_iter_data {
         int nadhocs;   /* number of adhoc vifs */
 };
 
+/* enum spectral_mode:
+ *
+ * @SPECTRAL_DISABLED: spectral mode is disabled
+ * @SPECTRAL_BACKGROUND: hardware sends samples when it is not busy with
+ *      something else.
+ * @SPECTRAL_MANUAL: spectral scan is enabled, triggering for samples
+ *      is performed manually.
+ * @SPECTRAL_CHANSCAN: Like manual, but also triggered when changing channels
+ *      during a channel scan.
+ */
+enum spectral_mode {
+        SPECTRAL_DISABLED = 0,
+        SPECTRAL_BACKGROUND,
+        SPECTRAL_MANUAL,
+        SPECTRAL_CHANSCAN,
+};
+
 struct ath_softc {
         struct ieee80211_hw *hw;
         struct device *dev;
@@ -743,6 +751,11 @@ struct ath_softc {
         u8 ant_tx, ant_rx;
         struct dfs_pattern_detector *dfs_detector;
         u32 wow_enabled;
+        /* relay(fs) channel for spectral scan */
+        struct rchan *rfs_chan_spec_scan;
+        enum spectral_mode spectral_mode;
+        struct ath_spec_scan spec_config;
+        int scanning;
 
 #ifdef CONFIG_PM_SLEEP
         atomic_t wow_got_bmiss_intr;
@@ -751,6 +764,133 @@ struct ath_softc {
 #endif
 };
 
+#define SPECTRAL_SCAN_BITMASK           0x10
+/* Radar info packet format, used for DFS and spectral formats. */
+struct ath_radar_info {
+        u8 pulse_length_pri;
+        u8 pulse_length_ext;
+        u8 pulse_bw_info;
+} __packed;
+
+/* The HT20 spectral data has 4 bytes of additional information at it's end.
+ *
+ * [7:0]: all bins {max_magnitude[1:0], bitmap_weight[5:0]}
+ * [7:0]: all bins  max_magnitude[9:2]
+ * [7:0]: all bins {max_index[5:0], max_magnitude[11:10]}
+ * [3:0]: max_exp (shift amount to size max bin to 8-bit unsigned)
+ */
+struct ath_ht20_mag_info {
+        u8 all_bins[3];
+        u8 max_exp;
+} __packed;
+
+#define SPECTRAL_HT20_NUM_BINS          56
+
+/* WARNING: don't actually use this struct! MAC may vary the amount of
+ * data by -1/+2. This struct is for reference only.
+ */
+struct ath_ht20_fft_packet {
+        u8 data[SPECTRAL_HT20_NUM_BINS];
+        struct ath_ht20_mag_info mag_info;
+        struct ath_radar_info radar_info;
+} __packed;
+
+#define SPECTRAL_HT20_TOTAL_DATA_LEN    (sizeof(struct ath_ht20_fft_packet))
+
+/* Dynamic 20/40 mode:
+ *
+ * [7:0]: lower bins {max_magnitude[1:0], bitmap_weight[5:0]}
+ * [7:0]: lower bins  max_magnitude[9:2]
+ * [7:0]: lower bins {max_index[5:0], max_magnitude[11:10]}
+ * [7:0]: upper bins {max_magnitude[1:0], bitmap_weight[5:0]}
+ * [7:0]: upper bins  max_magnitude[9:2]
+ * [7:0]: upper bins {max_index[5:0], max_magnitude[11:10]}
+ * [3:0]: max_exp (shift amount to size max bin to 8-bit unsigned)
+ */
+struct ath_ht20_40_mag_info {
+        u8 lower_bins[3];
+        u8 upper_bins[3];
+        u8 max_exp;
+} __packed;
+
+#define SPECTRAL_HT20_40_NUM_BINS               128
+
+/* WARNING: don't actually use this struct! MAC may vary the amount of
+ * data. This struct is for reference only.
+ */
+struct ath_ht20_40_fft_packet {
+        u8 data[SPECTRAL_HT20_40_NUM_BINS];
+        struct ath_ht20_40_mag_info mag_info;
+        struct ath_radar_info radar_info;
+} __packed;
+
+
+#define SPECTRAL_HT20_40_TOTAL_DATA_LEN (sizeof(struct ath_ht20_40_fft_packet))
+
+/* grabs the max magnitude from the all/upper/lower bins */
+static inline u16 spectral_max_magnitude(u8 *bins)
+{
+        return (bins[0] & 0xc0) >> 6 |
+               (bins[1] & 0xff) << 2 |
+               (bins[2] & 0x03) << 10;
+}
+
+/* return the max magnitude from the all/upper/lower bins */
+static inline u8 spectral_max_index(u8 *bins)
+{
+        s8 m = (bins[2] & 0xfc) >> 2;
+
+        /* TODO: this still doesn't always report the right values ... */
+        if (m > 32)
+                m |= 0xe0;
+        else
+                m &= ~0xe0;
+
+        return m + 29;
+}
+
+/* return the bitmap weight from the all/upper/lower bins */
+static inline u8 spectral_bitmap_weight(u8 *bins)
+{
+        return bins[0] & 0x3f;
+}
+
+/* FFT sample format given to userspace via debugfs.
+ *
+ * Please keep the type/length at the front position and change
+ * other fields after adding another sample type
+ *
+ * TODO: this might need rework when switching to nl80211-based
+ * interface.
+ */
+enum ath_fft_sample_type {
+        ATH_FFT_SAMPLE_HT20 = 1,
+};
+
+struct fft_sample_tlv {
+        u8 type;        /* see ath_fft_sample */
+        u16 length;
+        /* type dependent data follows */
+} __packed;
+
+struct fft_sample_ht20 {
+        struct fft_sample_tlv tlv;
+
+        u8 max_exp;
+
+        u16 freq;
+        s8 rssi;
+        s8 noise;
+
+        u16 max_magnitude;
+        u8 max_index;
+        u8 bitmap_weight;
+
+        u64 tsf;
+
+        u8 data[SPECTRAL_HT20_NUM_BINS];
+} __packed;
+
 void ath9k_tasklet(unsigned long data);
 int ath_cabq_update(struct ath_softc *);
 
@@ -773,6 +913,10 @@ void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw);
 void ath9k_reload_chainmask_settings(struct ath_softc *sc);
 
 bool ath9k_uses_beacons(int type);
+void ath9k_spectral_scan_trigger(struct ieee80211_hw *hw);
+int ath9k_spectral_scan_config(struct ieee80211_hw *hw,
+                               enum spectral_mode spectral_mode);
+
 
 #ifdef CONFIG_ATH9K_PCI
 int ath_pci_init(void);
diff --git a/drivers/net/wireless/ath/ath9k/beacon.c b/drivers/net/wireless/ath/ath9k/beacon.c
index 531fffd801a3..dd3771954bd7 100644
--- a/drivers/net/wireless/ath/ath9k/beacon.c
+++ b/drivers/net/wireless/ath/ath9k/beacon.c
@@ -147,6 +147,7 @@ static struct ath_buf *ath9k_beacon_generate(struct ieee80211_hw *hw,
                                  skb->len, DMA_TO_DEVICE);
                 dev_kfree_skb_any(skb);
                 bf->bf_buf_addr = 0;
+                bf->bf_mpdu = NULL;
         }
 
         skb = ieee80211_beacon_get(hw, vif);
@@ -198,7 +199,7 @@ static struct ath_buf *ath9k_beacon_generate(struct ieee80211_hw *hw,
                 if (sc->nvifs > 1) {
                         ath_dbg(common, BEACON,
                                 "Flushing previous cabq traffic\n");
-                        ath_draintxq(sc, cabq, false);
+                        ath_draintxq(sc, cabq);
                 }
         }
 
@@ -359,7 +360,6 @@ void ath9k_beacon_tasklet(unsigned long data)
                 return;
 
         bf = ath9k_beacon_generate(sc->hw, vif);
-        WARN_ON(!bf);
 
         if (sc->beacon.bmisscnt != 0) {
                 ath_dbg(common, BSTUCK, "resume beacon xmit after %u misses\n",
diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
index 13ff9edc2401..3714b971d18e 100644
--- a/drivers/net/wireless/ath/ath9k/debug.c
+++ b/drivers/net/wireless/ath/ath9k/debug.c
@@ -17,6 +17,7 @@
 #include <linux/slab.h>
 #include <linux/vmalloc.h>
 #include <linux/export.h>
+#include <linux/relay.h>
 #include <asm/unaligned.h>
 
 #include "ath9k.h"
@@ -861,7 +862,6 @@ static ssize_t read_file_recv(struct file *file, char __user *user_buf,
         RXS_ERR("RX-LENGTH-ERR", rx_len_err);
         RXS_ERR("RX-OOM-ERR", rx_oom_err);
         RXS_ERR("RX-RATE-ERR", rx_rate_err);
-        RXS_ERR("RX-DROP-RXFLUSH", rx_drop_rxflush);
         RXS_ERR("RX-TOO-MANY-FRAGS", rx_too_many_frags_err);
 
         PHY_ERR("UNDERRUN ERR", ATH9K_PHYERR_UNDERRUN);
@@ -895,6 +895,7 @@ static ssize_t read_file_recv(struct file *file, char __user *user_buf,
         RXS_ERR("RX-Bytes-All", rx_bytes_all);
         RXS_ERR("RX-Beacons", rx_beacons);
         RXS_ERR("RX-Frags", rx_frags);
+        RXS_ERR("RX-Spectral", rx_spectral);
 
         if (len > size)
                 len = size;
@@ -966,6 +967,290 @@ static const struct file_operations fops_recv = {
         .llseek = default_llseek,
 };
 
+static ssize_t read_file_spec_scan_ctl(struct file *file, char __user *user_buf,
+                                       size_t count, loff_t *ppos)
+{
+        struct ath_softc *sc = file->private_data;
+        char *mode = "";
+        unsigned int len;
+
+        switch (sc->spectral_mode) {
+        case SPECTRAL_DISABLED:
+                mode = "disable";
+                break;
+        case SPECTRAL_BACKGROUND:
+                mode = "background";
+                break;
+        case SPECTRAL_CHANSCAN:
+                mode = "chanscan";
+                break;
+        case SPECTRAL_MANUAL:
+                mode = "manual";
+                break;
+        }
+        len = strlen(mode);
+        return simple_read_from_buffer(user_buf, count, ppos, mode, len);
+}
+
+static ssize_t write_file_spec_scan_ctl(struct file *file,
+                                        const char __user *user_buf,
+                                        size_t count, loff_t *ppos)
+{
+        struct ath_softc *sc = file->private_data;
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+        char buf[32];
+        ssize_t len;
+
+        len = min(count, sizeof(buf) - 1);
+        if (copy_from_user(buf, user_buf, len))
+                return -EFAULT;
+
+        buf[len] = '\0';
+
+        if (strncmp("trigger", buf, 7) == 0) {
+                ath9k_spectral_scan_trigger(sc->hw);
+        } else if (strncmp("background", buf, 9) == 0) {
+                ath9k_spectral_scan_config(sc->hw, SPECTRAL_BACKGROUND);
+                ath_dbg(common, CONFIG, "spectral scan: background mode enabled\n");
+        } else if (strncmp("chanscan", buf, 8) == 0) {
+                ath9k_spectral_scan_config(sc->hw, SPECTRAL_CHANSCAN);
+                ath_dbg(common, CONFIG, "spectral scan: channel scan mode enabled\n");
+        } else if (strncmp("manual", buf, 6) == 0) {
+                ath9k_spectral_scan_config(sc->hw, SPECTRAL_MANUAL);
+                ath_dbg(common, CONFIG, "spectral scan: manual mode enabled\n");
+        } else if (strncmp("disable", buf, 7) == 0) {
+                ath9k_spectral_scan_config(sc->hw, SPECTRAL_DISABLED);
+                ath_dbg(common, CONFIG, "spectral scan: disabled\n");
+        } else {
+                return -EINVAL;
+        }
+
+        return count;
+}
+
+static const struct file_operations fops_spec_scan_ctl = {
+        .read = read_file_spec_scan_ctl,
+        .write = write_file_spec_scan_ctl,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
+static ssize_t read_file_spectral_short_repeat(struct file *file,
+                                               char __user *user_buf,
+                                               size_t count, loff_t *ppos)
+{
+        struct ath_softc *sc = file->private_data;
+        char buf[32];
+        unsigned int len;
+
+        len = sprintf(buf, "%d\n", sc->spec_config.short_repeat);
+        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
+static ssize_t write_file_spectral_short_repeat(struct file *file,
+                                                const char __user *user_buf,
+                                                size_t count, loff_t *ppos)
+{
+        struct ath_softc *sc = file->private_data;
+        unsigned long val;
+        char buf[32];
+        ssize_t len;
+
+        len = min(count, sizeof(buf) - 1);
+        if (copy_from_user(buf, user_buf, len))
+                return -EFAULT;
+
+        buf[len] = '\0';
+        if (kstrtoul(buf, 0, &val))
+                return -EINVAL;
+
+        if (val < 0 || val > 1)
+                return -EINVAL;
+
+        sc->spec_config.short_repeat = val;
+        return count;
+}
+
+static const struct file_operations fops_spectral_short_repeat = {
+        .read = read_file_spectral_short_repeat,
+        .write = write_file_spectral_short_repeat,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
+static ssize_t read_file_spectral_count(struct file *file,
+                                        char __user *user_buf,
+                                        size_t count, loff_t *ppos)
+{
+        struct ath_softc *sc = file->private_data;
+        char buf[32];
+        unsigned int len;
+
+        len = sprintf(buf, "%d\n", sc->spec_config.count);
+        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
+static ssize_t write_file_spectral_count(struct file *file,
+                                         const char __user *user_buf,
+                                         size_t count, loff_t *ppos)
+{
+        struct ath_softc *sc = file->private_data;
+        unsigned long val;
+        char buf[32];
+        ssize_t len;
+
+        len = min(count, sizeof(buf) - 1);
+        if (copy_from_user(buf, user_buf, len))
+                return -EFAULT;
+
+        buf[len] = '\0';
+        if (kstrtoul(buf, 0, &val))
+                return -EINVAL;
+
+        if (val < 0 || val > 255)
+                return -EINVAL;
+
+        sc->spec_config.count = val;
+        return count;
+}
+
+static const struct file_operations fops_spectral_count = {
+        .read = read_file_spectral_count,
+        .write = write_file_spectral_count,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
+static ssize_t read_file_spectral_period(struct file *file,
+                                         char __user *user_buf,
+                                         size_t count, loff_t *ppos)
+{
+        struct ath_softc *sc = file->private_data;
+        char buf[32];
+        unsigned int len;
+
+        len = sprintf(buf, "%d\n", sc->spec_config.period);
+        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
+static ssize_t write_file_spectral_period(struct file *file,
+                                          const char __user *user_buf,
+                                          size_t count, loff_t *ppos)
+{
+        struct ath_softc *sc = file->private_data;
+        unsigned long val;
+        char buf[32];
+        ssize_t len;
+
+        len = min(count, sizeof(buf) - 1);
+        if (copy_from_user(buf, user_buf, len))
+                return -EFAULT;
+
+        buf[len] = '\0';
+        if (kstrtoul(buf, 0, &val))
+                return -EINVAL;
+
+        if (val < 0 || val > 255)
+                return -EINVAL;
+
+        sc->spec_config.period = val;
+        return count;
+}
+
+static const struct file_operations fops_spectral_period = {
+        .read = read_file_spectral_period,
+        .write = write_file_spectral_period,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
+static ssize_t read_file_spectral_fft_period(struct file *file,
+                                             char __user *user_buf,
+                                             size_t count, loff_t *ppos)
+{
+        struct ath_softc *sc = file->private_data;
+        char buf[32];
+        unsigned int len;
+
+        len = sprintf(buf, "%d\n", sc->spec_config.fft_period);
+        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
+static ssize_t write_file_spectral_fft_period(struct file *file,
+                                              const char __user *user_buf,
+                                              size_t count, loff_t *ppos)
+{
+        struct ath_softc *sc = file->private_data;
+        unsigned long val;
+        char buf[32];
+        ssize_t len;
+
+        len = min(count, sizeof(buf) - 1);
+        if (copy_from_user(buf, user_buf, len))
+                return -EFAULT;
+
+        buf[len] = '\0';
+        if (kstrtoul(buf, 0, &val))
+                return -EINVAL;
+
+        if (val < 0 || val > 15)
+                return -EINVAL;
+
+        sc->spec_config.fft_period = val;
+        return count;
+}
+
+static const struct file_operations fops_spectral_fft_period = {
+        .read = read_file_spectral_fft_period,
+        .write = write_file_spectral_fft_period,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
+static struct dentry *create_buf_file_handler(const char *filename,
+                                              struct dentry *parent,
+                                              umode_t mode,
+                                              struct rchan_buf *buf,
+                                              int *is_global)
+{
+        struct dentry *buf_file;
+
+        buf_file = debugfs_create_file(filename, mode, parent, buf,
+                                       &relay_file_operations);
+        *is_global = 1;
+        return buf_file;
+}
+
+static int remove_buf_file_handler(struct dentry *dentry)
+{
+        debugfs_remove(dentry);
+
+        return 0;
+}
+
+void ath_debug_send_fft_sample(struct ath_softc *sc,
+                               struct fft_sample_tlv *fft_sample_tlv)
+{
+        int length;
+        if (!sc->rfs_chan_spec_scan)
+                return;
+
+        length = __be16_to_cpu(fft_sample_tlv->length) +
+                 sizeof(*fft_sample_tlv);
+        relay_write(sc->rfs_chan_spec_scan, fft_sample_tlv, length);
+}
+
+static struct rchan_callbacks rfs_spec_scan_cb = {
+        .create_buf_file = create_buf_file_handler,
+        .remove_buf_file = remove_buf_file_handler,
+};
+
+
 static ssize_t read_file_regidx(struct file *file, char __user *user_buf,
                                 size_t count, loff_t *ppos)
 {
@@ -1780,6 +2065,24 @@ int ath9k_init_debug(struct ath_hw *ah)
                             &fops_base_eeprom);
         debugfs_create_file("modal_eeprom", S_IRUSR, sc->debug.debugfs_phy, sc,
                             &fops_modal_eeprom);
+        sc->rfs_chan_spec_scan = relay_open("spectral_scan",
+                                            sc->debug.debugfs_phy,
+                                            262144, 4, &rfs_spec_scan_cb,
+                                            NULL);
+        debugfs_create_file("spectral_scan_ctl", S_IRUSR | S_IWUSR,
+                            sc->debug.debugfs_phy, sc,
+                            &fops_spec_scan_ctl);
+        debugfs_create_file("spectral_short_repeat", S_IRUSR | S_IWUSR,
+                            sc->debug.debugfs_phy, sc,
+                            &fops_spectral_short_repeat);
+        debugfs_create_file("spectral_count", S_IRUSR | S_IWUSR,
+                            sc->debug.debugfs_phy, sc, &fops_spectral_count);
+        debugfs_create_file("spectral_period", S_IRUSR | S_IWUSR,
+                            sc->debug.debugfs_phy, sc, &fops_spectral_period);
+        debugfs_create_file("spectral_fft_period", S_IRUSR | S_IWUSR,
+                            sc->debug.debugfs_phy, sc,
+                            &fops_spectral_fft_period);
+
 #ifdef CONFIG_ATH9K_MAC_DEBUG
         debugfs_create_file("samples", S_IRUSR, sc->debug.debugfs_phy, sc,
                             &fops_samps);
diff --git a/drivers/net/wireless/ath/ath9k/debug.h b/drivers/net/wireless/ath/ath9k/debug.h
index 375c3b46411e..410d6d8f1aa7 100644
--- a/drivers/net/wireless/ath/ath9k/debug.h
+++ b/drivers/net/wireless/ath/ath9k/debug.h
@@ -23,6 +23,7 @@
 
 struct ath_txq;
 struct ath_buf;
+struct fft_sample_tlv;
 
 #ifdef CONFIG_ATH9K_DEBUGFS
 #define TX_STAT_INC(q, c) sc->debug.stats.txstats[q].c++
@@ -216,9 +217,9 @@ struct ath_tx_stats {
  * @rx_oom_err:  No. of frames dropped due to OOM issues.
  * @rx_rate_err:  No. of frames dropped due to rate errors.
  * @rx_too_many_frags_err:  Frames dropped due to too-many-frags received.
- * @rx_drop_rxflush: No. of frames dropped due to RX-FLUSH.
  * @rx_beacons:  No. of beacons received.
  * @rx_frags:  No. of rx-fragements received.
+ * @rx_spectral: No of spectral packets received.
  */
 struct ath_rx_stats {
         u32 rx_pkts_all;
@@ -235,9 +236,9 @@ struct ath_rx_stats {
         u32 rx_oom_err;
         u32 rx_rate_err;
         u32 rx_too_many_frags_err;
-        u32 rx_drop_rxflush;
         u32 rx_beacons;
         u32 rx_frags;
+        u32 rx_spectral;
 };
 
 struct ath_stats {
@@ -323,6 +324,10 @@ void ath9k_sta_remove_debugfs(struct ieee80211_hw *hw,
                               struct ieee80211_vif *vif,
                               struct ieee80211_sta *sta,
                               struct dentry *dir);
+
+void ath_debug_send_fft_sample(struct ath_softc *sc,
+                               struct fft_sample_tlv *fft_sample);
+
 #else
 
 #define RX_STAT_INC(c) /* NOP */
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
index 05d5ba66cac3..e5d7958ab948 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
@@ -280,14 +280,14 @@ err:
         return ret;
 }
 
-static int ath9k_reg_notifier(struct wiphy *wiphy,
-                              struct regulatory_request *request)
+static void ath9k_reg_notifier(struct wiphy *wiphy,
+                               struct regulatory_request *request)
 {
         struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
         struct ath9k_htc_priv *priv = hw->priv;
 
-        return ath_reg_notifier_apply(wiphy, request,
-                                      ath9k_hw_regulatory(priv->ah));
+        ath_reg_notifier_apply(wiphy, request,
+                               ath9k_hw_regulatory(priv->ah));
 }
 
 static unsigned int ath9k_regread(void *hw_priv, u32 reg_offset)
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_main.c b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
index 9c07a8fa5134..a8016d70088a 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
@@ -1628,7 +1628,9 @@ static int ath9k_htc_ampdu_action(struct ieee80211_hw *hw,
                 if (!ret)
                         ieee80211_start_tx_ba_cb_irqsafe(vif, sta->addr, tid);
                 break;
-        case IEEE80211_AMPDU_TX_STOP:
+        case IEEE80211_AMPDU_TX_STOP_CONT:
+        case IEEE80211_AMPDU_TX_STOP_FLUSH:
+        case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
                 ath9k_htc_tx_aggr_oper(priv, vif, sta, action, tid);
                 ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
                 break;
diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c
index 4a9570dfba72..aac4a406a513 100644
--- a/drivers/net/wireless/ath/ath9k/htc_hst.c
+++ b/drivers/net/wireless/ath/ath9k/htc_hst.c
@@ -344,6 +344,8 @@ void ath9k_htc_txcompletion_cb(struct htc_target *htc_handle,
                         endpoint->ep_callbacks.tx(endpoint->ep_callbacks.priv,
                                                   skb, htc_hdr->endpoint_id,
                                                   txok);
+                } else {
+                        kfree_skb(skb);
                 }
         }
 
diff --git a/drivers/net/wireless/ath/ath9k/hw-ops.h b/drivers/net/wireless/ath/ath9k/hw-ops.h
index 0f2b97f6b739..14b701140b49 100644
--- a/drivers/net/wireless/ath/ath9k/hw-ops.h
+++ b/drivers/net/wireless/ath/ath9k/hw-ops.h
@@ -101,22 +101,6 @@ static inline void ath9k_hw_spur_mitigate_freq(struct ath_hw *ah,
         ath9k_hw_private_ops(ah)->spur_mitigate_freq(ah, chan);
 }
 
-static inline int ath9k_hw_rf_alloc_ext_banks(struct ath_hw *ah)
-{
-        if (!ath9k_hw_private_ops(ah)->rf_alloc_ext_banks)
-                return 0;
-
-        return ath9k_hw_private_ops(ah)->rf_alloc_ext_banks(ah);
-}
-
-static inline void ath9k_hw_rf_free_ext_banks(struct ath_hw *ah)
-{
-        if (!ath9k_hw_private_ops(ah)->rf_free_ext_banks)
-                return;
-
-        ath9k_hw_private_ops(ah)->rf_free_ext_banks(ah);
-}
-
 static inline bool ath9k_hw_set_rf_regs(struct ath_hw *ah,
                                         struct ath9k_channel *chan,
                                         u16 modesIndex)
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 7cb787065913..42cf3c7f1e25 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -54,11 +54,6 @@ static void ath9k_hw_init_cal_settings(struct ath_hw *ah)
         ath9k_hw_private_ops(ah)->init_cal_settings(ah);
 }
 
-static void ath9k_hw_init_mode_regs(struct ath_hw *ah)
-{
-        ath9k_hw_private_ops(ah)->init_mode_regs(ah);
-}
-
 static u32 ath9k_hw_compute_pll_control(struct ath_hw *ah,
                                         struct ath9k_channel *chan)
 {
@@ -208,7 +203,7 @@ void ath9k_hw_synth_delay(struct ath_hw *ah, struct ath9k_channel *chan,
         udelay(hw_delay + BASE_ACTIVATE_DELAY);
 }
 
-void ath9k_hw_write_array(struct ath_hw *ah, struct ar5416IniArray *array,
+void ath9k_hw_write_array(struct ath_hw *ah, const struct ar5416IniArray *array,
                           int column, unsigned int *writecnt)
 {
         int r;
@@ -554,28 +549,19 @@ static int ath9k_hw_post_init(struct ath_hw *ah)
                 ah->eep_ops->get_eeprom_ver(ah),
                 ah->eep_ops->get_eeprom_rev(ah));
 
-        ecode = ath9k_hw_rf_alloc_ext_banks(ah);
-        if (ecode) {
-                ath_err(ath9k_hw_common(ah),
-                        "Failed allocating banks for external radio\n");
-                ath9k_hw_rf_free_ext_banks(ah);
-                return ecode;
-        }
-
-        if (ah->config.enable_ani) {
-                ath9k_hw_ani_setup(ah);
+        if (ah->config.enable_ani)
                 ath9k_hw_ani_init(ah);
-        }
 
         return 0;
 }
 
-static void ath9k_hw_attach_ops(struct ath_hw *ah)
+static int ath9k_hw_attach_ops(struct ath_hw *ah)
 {
-        if (AR_SREV_9300_20_OR_LATER(ah))
-                ar9003_hw_attach_ops(ah);
-        else
-                ar9002_hw_attach_ops(ah);
+        if (!AR_SREV_9300_20_OR_LATER(ah))
+                return ar9002_hw_attach_ops(ah);
+
+        ar9003_hw_attach_ops(ah);
+        return 0;
 }
 
 /* Called for all hardware families */
@@ -611,7 +597,9 @@ static int __ath9k_hw_init(struct ath_hw *ah)
         ath9k_hw_init_defaults(ah);
         ath9k_hw_init_config(ah);
 
-        ath9k_hw_attach_ops(ah);
+        r = ath9k_hw_attach_ops(ah);
+        if (r)
+                return r;
 
         if (!ath9k_hw_setpower(ah, ATH9K_PM_AWAKE)) {
                 ath_err(common, "Couldn't wakeup chip\n");
@@ -675,8 +663,6 @@ static int __ath9k_hw_init(struct ath_hw *ah)
         if (!AR_SREV_9300_20_OR_LATER(ah))
                 ah->ani_function &= ~ATH9K_ANI_MRC_CCK;
 
-        ath9k_hw_init_mode_regs(ah);
-
         if (!ah->is_pciexpress)
                 ath9k_hw_disablepcie(ah);
 
@@ -1153,12 +1139,9 @@ void ath9k_hw_deinit(struct ath_hw *ah)
         struct ath_common *common = ath9k_hw_common(ah);
 
         if (common->state < ATH_HW_INITIALIZED)
-                goto free_hw;
+                return;
 
         ath9k_hw_setpower(ah, ATH9K_PM_FULL_SLEEP);
-
-free_hw:
-        ath9k_hw_rf_free_ext_banks(ah);
 }
 EXPORT_SYMBOL(ath9k_hw_deinit);
 
@@ -2576,12 +2559,6 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
                 rx_chainmask >>= 1;
         }
 
-        if (AR_SREV_9300_20_OR_LATER(ah)) {
-                ah->enabled_cals |= TX_IQ_CAL;
-                if (AR_SREV_9485_OR_LATER(ah))
-                        ah->enabled_cals |= TX_IQ_ON_AGC_CAL;
-        }
-
         if (AR_SREV_9462(ah) || AR_SREV_9565(ah)) {
                 if (!(ah->ent_mode & AR_ENT_OTP_49GHZ_DISABLE))
                         pCap->hw_caps |= ATH9K_HW_CAP_MCI;
@@ -2590,7 +2567,6 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
                         pCap->hw_caps |= ATH9K_HW_CAP_RTT;
         }
 
-
         if (AR_SREV_9280_20_OR_LATER(ah)) {
                 pCap->hw_caps |= ATH9K_HW_WOW_DEVICE_CAPABLE |
                                  ATH9K_HW_WOW_PATTERN_MATCH_EXACT;
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index 7f1a8e91c908..784e81ccb903 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -397,6 +397,7 @@ enum ath9k_int {
 #define MAX_RTT_TABLE_ENTRY     6
 #define MAX_IQCAL_MEASUREMENT   8
 #define MAX_CL_TAB_ENTRY        16
+#define CL_TAB_ENTRY(reg_base)  (reg_base + (4 * j))
 
 struct ath9k_hw_cal_data {
         u16 channel;
@@ -599,13 +600,10 @@ struct ath_hw_radar_conf {
  * @init_cal_settings: setup types of calibrations supported
  * @init_cal: starts actual calibration
  *
- * @init_mode_regs: Initializes mode registers
  * @init_mode_gain_regs: Initialize TX/RX gain registers
  *
  * @rf_set_freq: change frequency
  * @spur_mitigate_freq: spur mitigation
- * @rf_alloc_ext_banks:
- * @rf_free_ext_banks:
  * @set_rf_regs:
  * @compute_pll_control: compute the PLL control value to use for
  *      AR_RTC_PLL_CONTROL for a given channel
@@ -620,7 +618,6 @@ struct ath_hw_private_ops {
         void (*init_cal_settings)(struct ath_hw *ah);
         bool (*init_cal)(struct ath_hw *ah, struct ath9k_channel *chan);
 
-        void (*init_mode_regs)(struct ath_hw *ah);
         void (*init_mode_gain_regs)(struct ath_hw *ah);
         void (*setup_calibration)(struct ath_hw *ah,
                                   struct ath9k_cal_list *currCal);
@@ -630,8 +627,6 @@ struct ath_hw_private_ops {
                            struct ath9k_channel *chan);
         void (*spur_mitigate_freq)(struct ath_hw *ah,
                                    struct ath9k_channel *chan);
-        int (*rf_alloc_ext_banks)(struct ath_hw *ah);
-        void (*rf_free_ext_banks)(struct ath_hw *ah);
         bool (*set_rf_regs)(struct ath_hw *ah,
                             struct ath9k_channel *chan,
                             u16 modesIndex);
@@ -661,6 +656,37 @@ struct ath_hw_private_ops {
 };
 
 /**
+ * struct ath_spec_scan - parameters for Atheros spectral scan
+ *
+ * @enabled: enable/disable spectral scan
+ * @short_repeat: controls whether the chip is in spectral scan mode
+ *                for 4 usec (enabled) or 204 usec (disabled)
+ * @count: number of scan results requested. There are special meanings
+ *         in some chip revisions:
+ *         AR92xx: highest bit set (>=128) for endless mode
+ *                 (spectral scan won't stopped until explicitly disabled)
+ *         AR9300 and newer: 0 for endless mode
+ * @endless: true if endless mode is intended. Otherwise, count value is
+ *           corrected to the next possible value.
+ * @period: time duration between successive spectral scan entry points
+ *          (period*256*Tclk). Tclk = ath_common->clockrate
+ * @fft_period: PHY passes FFT frames to MAC every (fft_period+1)*4uS
+ *
+ * Note: Tclk = 40MHz or 44MHz depending upon operating mode.
+ *       Typically it's 44MHz in 2/5GHz on later chips, but there's
+ *       a "fast clock" check for this in 5GHz.
+ *
+ */
+struct ath_spec_scan {
+        bool enabled;
+        bool short_repeat;
+        bool endless;
+        u8 count;
+        u8 period;
+        u8 fft_period;
+};
+
+/**
  * struct ath_hw_ops - callbacks used by hardware code and driver code
  *
  * This structure contains callbacks designed to to be used internally by
@@ -668,6 +694,10 @@ struct ath_hw_private_ops {
  *
  * @config_pci_powersave:
  * @calibrate: periodic calibration for NF, ANI, IQ, ADC gain, ADC-DC
+ *
+ * @spectral_scan_config: set parameters for spectral scan and enable/disable it
+ * @spectral_scan_trigger: trigger a spectral scan run
+ * @spectral_scan_wait: wait for a spectral scan run to finish
  */
 struct ath_hw_ops {
         void (*config_pci_powersave)(struct ath_hw *ah,
@@ -688,6 +718,10 @@ struct ath_hw_ops {
         void (*antdiv_comb_conf_set)(struct ath_hw *ah,
                         struct ath_hw_antcomb_conf *antconf);
         void (*antctrl_shared_chain_lnadiv)(struct ath_hw *hw, bool enable);
+        void (*spectral_scan_config)(struct ath_hw *ah,
+                                     struct ath_spec_scan *param);
+        void (*spectral_scan_trigger)(struct ath_hw *ah);
+        void (*spectral_scan_wait)(struct ath_hw *ah);
 };
 
 struct ath_nf_limits {
@@ -710,6 +744,7 @@ enum ath_cal_list {
 struct ath_hw {
         struct ath_ops reg_ops;
 
+        struct device *dev;
         struct ieee80211_hw *hw;
         struct ath_common common;
         struct ath9k_hw_version hw_version;
@@ -771,7 +806,6 @@ struct ath_hw {
         struct ath9k_cal_list iq_caldata;
         struct ath9k_cal_list adcgain_caldata;
         struct ath9k_cal_list adcdc_caldata;
-        struct ath9k_cal_list tempCompCalData;
         struct ath9k_cal_list *cal_list;
         struct ath9k_cal_list *cal_list_last;
         struct ath9k_cal_list *cal_list_curr;
@@ -830,10 +864,6 @@ struct ath_hw {
         /* ANI */
         u32 proc_phyerr;
         u32 aniperiod;
-        int totalSizeDesired[5];
-        int coarse_high[5];
-        int coarse_low[5];
-        int firpwr[5];
         enum ath9k_ani_cmd ani_function;
         u32 ani_skip_count;
 
@@ -979,7 +1009,7 @@ void ath9k_hw_setantenna(struct ath_hw *ah, u32 antenna);
 void ath9k_hw_synth_delay(struct ath_hw *ah, struct ath9k_channel *chan,
                           int hw_delay);
 bool ath9k_hw_wait(struct ath_hw *ah, u32 reg, u32 mask, u32 val, u32 timeout);
-void ath9k_hw_write_array(struct ath_hw *ah, struct ar5416IniArray *array,
+void ath9k_hw_write_array(struct ath_hw *ah, const struct ar5416IniArray *array,
                           int column, unsigned int *writecnt);
 u32 ath9k_hw_reverse_bits(u32 val, u32 n);
 u16 ath9k_hw_computetxtime(struct ath_hw *ah,
@@ -1066,16 +1096,17 @@ void ar9003_paprd_setup_gain_table(struct ath_hw *ah, int chain);
 int ar9003_paprd_init_table(struct ath_hw *ah);
 bool ar9003_paprd_is_done(struct ath_hw *ah);
 bool ar9003_is_paprd_enabled(struct ath_hw *ah);
+void ar9003_hw_set_chain_masks(struct ath_hw *ah, u8 rx, u8 tx);
 
 /* Hardware family op attach helpers */
-void ar5008_hw_attach_phy_ops(struct ath_hw *ah);
+int ar5008_hw_attach_phy_ops(struct ath_hw *ah);
 void ar9002_hw_attach_phy_ops(struct ath_hw *ah);
 void ar9003_hw_attach_phy_ops(struct ath_hw *ah);
 
 void ar9002_hw_attach_calib_ops(struct ath_hw *ah);
 void ar9003_hw_attach_calib_ops(struct ath_hw *ah);
 
-void ar9002_hw_attach_ops(struct ath_hw *ah);
+int ar9002_hw_attach_ops(struct ath_hw *ah);
 void ar9003_hw_attach_ops(struct ath_hw *ah);
 
 void ar9002_hw_load_ani_reg(struct ath_hw *ah, struct ath9k_channel *chan);
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index f69ef5d48c7b..c7d116c2c615 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -20,6 +20,7 @@
 #include <linux/slab.h>
 #include <linux/ath9k_platform.h>
 #include <linux/module.h>
+#include <linux/relay.h>
 
 #include "ath9k.h"
 
@@ -302,16 +303,15 @@ static void setup_ht_cap(struct ath_softc *sc,
         ht_info->mcs.tx_params |= IEEE80211_HT_MCS_TX_DEFINED;
 }
 
-static int ath9k_reg_notifier(struct wiphy *wiphy,
-                              struct regulatory_request *request)
+static void ath9k_reg_notifier(struct wiphy *wiphy,
+                               struct regulatory_request *request)
 {
         struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
         struct ath_softc *sc = hw->priv;
         struct ath_hw *ah = sc->sc_ah;
         struct ath_regulatory *reg = ath9k_hw_regulatory(ah);
-        int ret;
 
-        ret = ath_reg_notifier_apply(wiphy, request, reg);
+        ath_reg_notifier_apply(wiphy, request, reg);
 
         /* Set tx power */
         if (ah->curchan) {
@@ -321,8 +321,6 @@ static int ath9k_reg_notifier(struct wiphy *wiphy,
                 sc->curtxpow = ath9k_hw_regulatory(ah)->power_limit;
                 ath9k_ps_restore(sc);
         }
-
-        return ret;
 }
 
 /*
@@ -337,7 +335,7 @@ int ath_descdma_setup(struct ath_softc *sc, struct ath_descdma *dd,
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         u8 *ds;
         struct ath_buf *bf;
-        int i, bsize, error, desc_len;
+        int i, bsize, desc_len;
 
         ath_dbg(common, CONFIG, "%s DMA: %u buffers %u desc/buf\n",
                 name, nbuf, ndesc);
@@ -353,8 +351,7 @@ int ath_descdma_setup(struct ath_softc *sc, struct ath_descdma *dd,
         if ((desc_len % 4) != 0) {
                 ath_err(common, "ath_desc not DWORD aligned\n");
                 BUG_ON((desc_len % 4) != 0);
-                error = -ENOMEM;
-                goto fail;
+                return -ENOMEM;
         }
 
         dd->dd_desc_len = desc_len * nbuf * ndesc;
@@ -378,12 +375,11 @@ int ath_descdma_setup(struct ath_softc *sc, struct ath_descdma *dd,
         }
 
         /* allocate descriptors */
-        dd->dd_desc = dma_alloc_coherent(sc->dev, dd->dd_desc_len,
-                                         &dd->dd_desc_paddr, GFP_KERNEL);
-        if (dd->dd_desc == NULL) {
-                error = -ENOMEM;
-                goto fail;
-        }
+        dd->dd_desc = dmam_alloc_coherent(sc->dev, dd->dd_desc_len,
+                                          &dd->dd_desc_paddr, GFP_KERNEL);
+        if (!dd->dd_desc)
+                return -ENOMEM;
+
         ds = (u8 *) dd->dd_desc;
         ath_dbg(common, CONFIG, "%s DMA map: %p (%u) -> %llx (%u)\n",
                 name, ds, (u32) dd->dd_desc_len,
@@ -391,12 +387,9 @@ int ath_descdma_setup(struct ath_softc *sc, struct ath_descdma *dd,
 
         /* allocate buffers */
         bsize = sizeof(struct ath_buf) * nbuf;
-        bf = kzalloc(bsize, GFP_KERNEL);
-        if (bf == NULL) {
-                error = -ENOMEM;
-                goto fail2;
-        }
-        dd->dd_bufptr = bf;
+        bf = devm_kzalloc(sc->dev, bsize, GFP_KERNEL);
+        if (!bf)
+                return -ENOMEM;
 
         for (i = 0; i < nbuf; i++, bf++, ds += (desc_len * ndesc)) {
                 bf->bf_desc = ds;
@@ -422,12 +415,6 @@ int ath_descdma_setup(struct ath_softc *sc, struct ath_descdma *dd,
                 list_add_tail(&bf->list, head);
         }
         return 0;
-fail2:
-        dma_free_coherent(sc->dev, dd->dd_desc_len, dd->dd_desc,
-                          dd->dd_desc_paddr);
-fail:
-        memset(dd, 0, sizeof(*dd));
-        return error;
 }
 
 static int ath9k_init_queues(struct ath_softc *sc)
@@ -457,11 +444,13 @@ static int ath9k_init_channels_rates(struct ath_softc *sc)
                      ATH9K_NUM_CHANNELS);
 
         if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_2GHZ) {
-                channels = kmemdup(ath9k_2ghz_chantable,
+                channels = devm_kzalloc(sc->dev,
                         sizeof(ath9k_2ghz_chantable), GFP_KERNEL);
                 if (!channels)
                     return -ENOMEM;
 
+                memcpy(channels, ath9k_2ghz_chantable,
+                       sizeof(ath9k_2ghz_chantable));
                 sc->sbands[IEEE80211_BAND_2GHZ].channels = channels;
                 sc->sbands[IEEE80211_BAND_2GHZ].band = IEEE80211_BAND_2GHZ;
                 sc->sbands[IEEE80211_BAND_2GHZ].n_channels =
@@ -472,14 +461,13 @@ static int ath9k_init_channels_rates(struct ath_softc *sc)
         }
 
         if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_5GHZ) {
-                channels = kmemdup(ath9k_5ghz_chantable,
+                channels = devm_kzalloc(sc->dev,
                         sizeof(ath9k_5ghz_chantable), GFP_KERNEL);
-                if (!channels) {
-                        if (sc->sbands[IEEE80211_BAND_2GHZ].channels)
-                                kfree(sc->sbands[IEEE80211_BAND_2GHZ].channels);
+                if (!channels)
                         return -ENOMEM;
-                }
 
+                memcpy(channels, ath9k_5ghz_chantable,
+                       sizeof(ath9k_5ghz_chantable));
                 sc->sbands[IEEE80211_BAND_5GHZ].channels = channels;
                 sc->sbands[IEEE80211_BAND_5GHZ].band = IEEE80211_BAND_5GHZ;
                 sc->sbands[IEEE80211_BAND_5GHZ].n_channels =
@@ -509,6 +497,13 @@ static void ath9k_init_misc(struct ath_softc *sc)
 
         if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_ANT_DIV_COMB)
                 sc->ant_comb.count = ATH_ANT_DIV_COMB_INIT_COUNT;
+
+        sc->spec_config.enabled = 0;
+        sc->spec_config.short_repeat = true;
+        sc->spec_config.count = 8;
+        sc->spec_config.endless = false;
+        sc->spec_config.period = 0xFF;
+        sc->spec_config.fft_period = 0xF;
 }
 
 static void ath9k_eeprom_request_cb(const struct firmware *eeprom_blob,
@@ -565,10 +560,11 @@ static int ath9k_init_softc(u16 devid, struct ath_softc *sc,
         int ret = 0, i;
         int csz = 0;
 
-        ah = kzalloc(sizeof(struct ath_hw), GFP_KERNEL);
+        ah = devm_kzalloc(sc->dev, sizeof(struct ath_hw), GFP_KERNEL);
         if (!ah)
                 return -ENOMEM;
 
+        ah->dev = sc->dev;
         ah->hw = sc->hw;
         ah->hw_version.devid = devid;
         ah->reg_ops.read = ath9k_ioread32;
@@ -636,7 +632,7 @@ static int ath9k_init_softc(u16 devid, struct ath_softc *sc,
         if (pdata && pdata->eeprom_name) {
                 ret = ath9k_eeprom_request(sc, pdata->eeprom_name);
                 if (ret)
-                        goto err_eeprom;
+                        return ret;
         }
 
         /* Initializes the hardware for all supported chipsets */
@@ -676,10 +672,6 @@ err_queues:
         ath9k_hw_deinit(ah);
 err_hw:
         ath9k_eeprom_release(sc);
-err_eeprom:
-        kfree(ah);
-        sc->sc_ah = NULL;
-
         return ret;
 }
 
@@ -844,8 +836,8 @@ int ath9k_init_device(u16 devid, struct ath_softc *sc,
 
         /* Bring up device */
         error = ath9k_init_softc(devid, sc, bus_ops);
-        if (error != 0)
-                goto error_init;
+        if (error)
+                return error;
 
         ah = sc->sc_ah;
         common = ath9k_hw_common(ah);
@@ -855,19 +847,19 @@ int ath9k_init_device(u16 devid, struct ath_softc *sc,
         error = ath_regd_init(&common->regulatory, sc->hw->wiphy,
                               ath9k_reg_notifier);
         if (error)
-                goto error_regd;
+                goto deinit;
 
         reg = &common->regulatory;
 
         /* Setup TX DMA */
         error = ath_tx_init(sc, ATH_TXBUF);
         if (error != 0)
-                goto error_tx;
+                goto deinit;
 
         /* Setup RX DMA */
         error = ath_rx_init(sc, ATH_RXBUF);
         if (error != 0)
-                goto error_rx;
+                goto deinit;
 
         ath9k_init_txpower_limits(sc);
 
@@ -881,19 +873,19 @@ int ath9k_init_device(u16 devid, struct ath_softc *sc,
         /* Register with mac80211 */
         error = ieee80211_register_hw(hw);
         if (error)
-                goto error_register;
+                goto rx_cleanup;
 
         error = ath9k_init_debug(ah);
         if (error) {
                 ath_err(common, "Unable to create debugfs files\n");
-                goto error_world;
+                goto unregister;
         }
 
         /* Handle world regulatory */
         if (!ath_is_world_regd(reg)) {
                 error = regulatory_hint(hw->wiphy, reg->alpha2);
                 if (error)
-                        goto error_world;
+                        goto unregister;
         }
 
         ath_init_leds(sc);
@@ -901,17 +893,12 @@ int ath9k_init_device(u16 devid, struct ath_softc *sc,
 
         return 0;
 
-error_world:
+unregister:
         ieee80211_unregister_hw(hw);
-error_register:
+rx_cleanup:
         ath_rx_cleanup(sc);
-error_rx:
-        ath_tx_cleanup(sc);
-error_tx:
-        /* Nothing */
-error_regd:
+deinit:
         ath9k_deinit_softc(sc);
-error_init:
         return error;
 }
 
@@ -923,12 +910,6 @@ static void ath9k_deinit_softc(struct ath_softc *sc)
 {
         int i = 0;
 
-        if (sc->sbands[IEEE80211_BAND_2GHZ].channels)
-                kfree(sc->sbands[IEEE80211_BAND_2GHZ].channels);
-
-        if (sc->sbands[IEEE80211_BAND_5GHZ].channels)
-                kfree(sc->sbands[IEEE80211_BAND_5GHZ].channels);
-
         ath9k_deinit_btcoex(sc);
 
         for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++)
@@ -940,8 +921,11 @@ static void ath9k_deinit_softc(struct ath_softc *sc)
                 sc->dfs_detector->exit(sc->dfs_detector);
 
         ath9k_eeprom_release(sc);
-        kfree(sc->sc_ah);
-        sc->sc_ah = NULL;
+
+        if (sc->rfs_chan_spec_scan) {
+                relay_close(sc->rfs_chan_spec_scan);
+                sc->rfs_chan_spec_scan = NULL;
+        }
 }
 
 void ath9k_deinit_device(struct ath_softc *sc)
@@ -957,22 +941,9 @@ void ath9k_deinit_device(struct ath_softc *sc)
 
         ieee80211_unregister_hw(hw);
         ath_rx_cleanup(sc);
-        ath_tx_cleanup(sc);
         ath9k_deinit_softc(sc);
 }
 
-void ath_descdma_cleanup(struct ath_softc *sc,
-                         struct ath_descdma *dd,
-                         struct list_head *head)
-{
-        dma_free_coherent(sc->dev, dd->dd_desc_len, dd->dd_desc,
-                          dd->dd_desc_paddr);
-
-        INIT_LIST_HEAD(head);
-        kfree(dd->dd_bufptr);
-        memset(dd, 0, sizeof(*dd));
-}
-
 /************************/
 /*     Module Hooks     */
 /************************/
diff --git a/drivers/net/wireless/ath/ath9k/mac.c b/drivers/net/wireless/ath/ath9k/mac.c
index b42be910a83d..811007ec07a7 100644
--- a/drivers/net/wireless/ath/ath9k/mac.c
+++ b/drivers/net/wireless/ath/ath9k/mac.c
@@ -605,13 +605,13 @@ int ath9k_hw_rxprocdesc(struct ath_hw *ah, struct ath_desc *ds,
                  * reported, then decryption and MIC errors are irrelevant,
                  * the frame is going to be dropped either way
                  */
-                if (ads.ds_rxstatus8 & AR_CRCErr)
-                        rs->rs_status |= ATH9K_RXERR_CRC;
-                else if (ads.ds_rxstatus8 & AR_PHYErr) {
+                if (ads.ds_rxstatus8 & AR_PHYErr) {
                         rs->rs_status |= ATH9K_RXERR_PHY;
                         phyerr = MS(ads.ds_rxstatus8, AR_PHYErrCode);
                         rs->rs_phyerr = phyerr;
-                } else if (ads.ds_rxstatus8 & AR_DecryptCRCErr)
+                } else if (ads.ds_rxstatus8 & AR_CRCErr)
+                        rs->rs_status |= ATH9K_RXERR_CRC;
+                else if (ads.ds_rxstatus8 & AR_DecryptCRCErr)
                         rs->rs_status |= ATH9K_RXERR_DECRYPT;
                 else if (ads.ds_rxstatus8 & AR_MichaelErr)
                         rs->rs_status |= ATH9K_RXERR_MIC;
diff --git a/drivers/net/wireless/ath/ath9k/mac.h b/drivers/net/wireless/ath/ath9k/mac.h
index 4a745e68dd94..1ff817061ebc 100644
--- a/drivers/net/wireless/ath/ath9k/mac.h
+++ b/drivers/net/wireless/ath/ath9k/mac.h
@@ -226,7 +226,8 @@ enum ath9k_phyerr {
         ATH9K_PHYERR_HT_LENGTH_ILLEGAL    = 35,
         ATH9K_PHYERR_HT_RATE_ILLEGAL      = 36,
 
-        ATH9K_PHYERR_MAX                  = 37,
+        ATH9K_PHYERR_SPECTRAL             = 38,
+        ATH9K_PHYERR_MAX                  = 39,
 };
 
 struct ath_desc {
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index be30a9af1528..5432f1247e2e 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -182,7 +182,7 @@ static void ath_restart_work(struct ath_softc *sc)
         ath_start_ani(sc);
 }
 
-static bool ath_prepare_reset(struct ath_softc *sc, bool retry_tx, bool flush)
+static bool ath_prepare_reset(struct ath_softc *sc)
 {
         struct ath_hw *ah = sc->sc_ah;
         bool ret = true;
@@ -196,20 +196,12 @@ static bool ath_prepare_reset(struct ath_softc *sc, bool retry_tx, bool flush)
         ath9k_debug_samp_bb_mac(sc);
         ath9k_hw_disable_interrupts(ah);
 
-        if (!ath_stoprecv(sc))
+        if (!ath_drain_all_txq(sc))
                 ret = false;
 
-        if (!ath_drain_all_txq(sc, retry_tx))
+        if (!ath_stoprecv(sc))
                 ret = false;
 
-        if (!flush) {
-                if (ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)
-                        ath_rx_tasklet(sc, 1, true);
-                ath_rx_tasklet(sc, 1, false);
-        } else {
-                ath_flushrecv(sc);
-        }
-
         return ret;
 }
 
@@ -255,18 +247,17 @@ static bool ath_complete_reset(struct ath_softc *sc, bool start)
         return true;
 }
 
-static int ath_reset_internal(struct ath_softc *sc, struct ath9k_channel *hchan,
-                              bool retry_tx)
+static int ath_reset_internal(struct ath_softc *sc, struct ath9k_channel *hchan)
 {
         struct ath_hw *ah = sc->sc_ah;
         struct ath_common *common = ath9k_hw_common(ah);
         struct ath9k_hw_cal_data *caldata = NULL;
         bool fastcc = true;
-        bool flush = false;
         int r;
 
         __ath_cancel_work(sc);
 
+        tasklet_disable(&sc->intr_tq);
         spin_lock_bh(&sc->sc_pcu_lock);
 
         if (!(sc->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)) {
@@ -276,11 +267,10 @@ static int ath_reset_internal(struct ath_softc *sc, struct ath9k_channel *hchan,
 
         if (!hchan) {
                 fastcc = false;
-                flush = true;
                 hchan = ah->curchan;
         }
 
-        if (!ath_prepare_reset(sc, retry_tx, flush))
+        if (!ath_prepare_reset(sc))
                 fastcc = false;
 
         ath_dbg(common, CONFIG, "Reset to %u MHz, HT40: %d fastcc: %d\n",
@@ -302,6 +292,8 @@ static int ath_reset_internal(struct ath_softc *sc, struct ath9k_channel *hchan,
 
 out:
         spin_unlock_bh(&sc->sc_pcu_lock);
+        tasklet_enable(&sc->intr_tq);
+
         return r;
 }
 
@@ -319,7 +311,7 @@ static int ath_set_channel(struct ath_softc *sc, struct ieee80211_hw *hw,
         if (test_bit(SC_OP_INVALID, &sc->sc_flags))
                 return -EIO;
 
-        r = ath_reset_internal(sc, hchan, false);
+        r = ath_reset_internal(sc, hchan);
 
         return r;
 }
@@ -549,23 +541,21 @@ chip_reset:
 #undef SCHED_INTR
 }
 
-static int ath_reset(struct ath_softc *sc, bool retry_tx)
+static int ath_reset(struct ath_softc *sc)
 {
-        int r;
+        int i, r;
 
         ath9k_ps_wakeup(sc);
 
-        r = ath_reset_internal(sc, NULL, retry_tx);
+        r = ath_reset_internal(sc, NULL);
 
-        if (retry_tx) {
-                int i;
-                for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++) {
-                        if (ATH_TXQ_SETUP(sc, i)) {
-                                spin_lock_bh(&sc->tx.txq[i].axq_lock);
-                                ath_txq_schedule(sc, &sc->tx.txq[i]);
-                                spin_unlock_bh(&sc->tx.txq[i].axq_lock);
-                        }
-                }
+        for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++) {
+                if (!ATH_TXQ_SETUP(sc, i))
+                        continue;
+
+                spin_lock_bh(&sc->tx.txq[i].axq_lock);
+                ath_txq_schedule(sc, &sc->tx.txq[i]);
+                spin_unlock_bh(&sc->tx.txq[i].axq_lock);
         }
 
         ath9k_ps_restore(sc);
@@ -586,7 +576,7 @@ void ath_reset_work(struct work_struct *work)
 {
         struct ath_softc *sc = container_of(work, struct ath_softc, hw_reset_work);
 
-        ath_reset(sc, true);
+        ath_reset(sc);
 }
 
 /**********************/
@@ -804,7 +794,7 @@ static void ath9k_stop(struct ieee80211_hw *hw)
                 ath9k_hw_cfg_gpio_input(ah, ah->led_pin);
         }
 
-        ath_prepare_reset(sc, false, true);
+        ath_prepare_reset(sc);
 
         if (sc->rx.frag) {
                 dev_kfree_skb_any(sc->rx.frag);
@@ -1075,6 +1065,75 @@ static void ath9k_disable_ps(struct ath_softc *sc)
         ath_dbg(common, PS, "PowerSave disabled\n");
 }
 
+void ath9k_spectral_scan_trigger(struct ieee80211_hw *hw)
+{
+        struct ath_softc *sc = hw->priv;
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
+        u32 rxfilter;
+
+        if (!ath9k_hw_ops(ah)->spectral_scan_trigger) {
+                ath_err(common, "spectrum analyzer not implemented on this hardware\n");
+                return;
+        }
+
+        ath9k_ps_wakeup(sc);
+        rxfilter = ath9k_hw_getrxfilter(ah);
+        ath9k_hw_setrxfilter(ah, rxfilter |
+                                 ATH9K_RX_FILTER_PHYRADAR |
+                                 ATH9K_RX_FILTER_PHYERR);
+
+        /* TODO: usually this should not be neccesary, but for some reason
+         * (or in some mode?) the trigger must be called after the
+         * configuration, otherwise the register will have its values reset
+         * (on my ar9220 to value 0x01002310)
+         */
+        ath9k_spectral_scan_config(hw, sc->spectral_mode);
+        ath9k_hw_ops(ah)->spectral_scan_trigger(ah);
+        ath9k_ps_restore(sc);
+}
+
+int ath9k_spectral_scan_config(struct ieee80211_hw *hw,
+                               enum spectral_mode spectral_mode)
+{
+        struct ath_softc *sc = hw->priv;
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
+
+        if (!ath9k_hw_ops(ah)->spectral_scan_trigger) {
+                ath_err(common, "spectrum analyzer not implemented on this hardware\n");
+                return -1;
+        }
+
+        switch (spectral_mode) {
+        case SPECTRAL_DISABLED:
+                sc->spec_config.enabled = 0;
+                break;
+        case SPECTRAL_BACKGROUND:
+                /* send endless samples.
+                 * TODO: is this really useful for "background"?
+                 */
+                sc->spec_config.endless = 1;
+                sc->spec_config.enabled = 1;
+                break;
+        case SPECTRAL_CHANSCAN:
+        case SPECTRAL_MANUAL:
+                sc->spec_config.endless = 0;
+                sc->spec_config.enabled = 1;
+                break;
+        default:
+                return -1;
+        }
+
+        ath9k_ps_wakeup(sc);
+        ath9k_hw_ops(ah)->spectral_scan_config(ah, &sc->spec_config);
+        ath9k_ps_restore(sc);
+
+        sc->spectral_mode = spectral_mode;
+
+        return 0;
+}
+
 static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
 {
         struct ath_softc *sc = hw->priv;
@@ -1188,6 +1247,11 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
                  */
                 if (old_pos >= 0)
                         ath_update_survey_nf(sc, old_pos);
+
+                /* perform spectral scan if requested. */
+                if (sc->scanning && sc->spectral_mode == SPECTRAL_CHANSCAN)
+                        ath9k_spectral_scan_trigger(hw);
+
         }
 
         if (changed & IEEE80211_CONF_CHANGE_POWER) {
@@ -1610,7 +1674,9 @@ static int ath9k_ampdu_action(struct ieee80211_hw *hw,
                         ieee80211_start_tx_ba_cb_irqsafe(vif, sta->addr, tid);
                 ath9k_ps_restore(sc);
                 break;
-        case IEEE80211_AMPDU_TX_STOP:
+        case IEEE80211_AMPDU_TX_STOP_CONT:
+        case IEEE80211_AMPDU_TX_STOP_FLUSH:
+        case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
                 ath9k_ps_wakeup(sc);
                 ath_tx_aggr_stop(sc, sta, tid);
                 ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
@@ -1729,11 +1795,11 @@ static void ath9k_flush(struct ieee80211_hw *hw, bool drop)
         if (drop) {
                 ath9k_ps_wakeup(sc);
                 spin_lock_bh(&sc->sc_pcu_lock);
-                drain_txq = ath_drain_all_txq(sc, false);
+                drain_txq = ath_drain_all_txq(sc);
                 spin_unlock_bh(&sc->sc_pcu_lock);
 
                 if (!drain_txq)
-                        ath_reset(sc, false);
+                        ath_reset(sc);
 
                 ath9k_ps_restore(sc);
                 ieee80211_wake_queues(hw);
@@ -1833,6 +1899,9 @@ static u32 fill_chainmask(u32 cap, u32 new)
 
 static bool validate_antenna_mask(struct ath_hw *ah, u32 val)
 {
+        if (AR_SREV_9300_20_OR_LATER(ah))
+                return true;
+
         switch (val & 0x7) {
         case 0x1:
         case 0x3:
@@ -2238,6 +2307,19 @@ static void ath9k_set_wakeup(struct ieee80211_hw *hw, bool enabled)
 }
 
 #endif
+static void ath9k_sw_scan_start(struct ieee80211_hw *hw)
+{
+        struct ath_softc *sc = hw->priv;
+
+        sc->scanning = 1;
+}
+
+static void ath9k_sw_scan_complete(struct ieee80211_hw *hw)
+{
+        struct ath_softc *sc = hw->priv;
+
+        sc->scanning = 0;
+}
 
 struct ieee80211_ops ath9k_ops = {
         .tx                 = ath9k_tx,
@@ -2284,4 +2366,6 @@ struct ieee80211_ops ath9k_ops = {
         .sta_add_debugfs    = ath9k_sta_add_debugfs,
         .sta_remove_debugfs = ath9k_sta_remove_debugfs,
 #endif
+        .sw_scan_start      = ath9k_sw_scan_start,
+        .sw_scan_complete   = ath9k_sw_scan_complete,
 };
diff --git a/drivers/net/wireless/ath/ath9k/mci.c b/drivers/net/wireless/ath/ath9k/mci.c
index 5c02702f21e7..d2074334ec9b 100644
--- a/drivers/net/wireless/ath/ath9k/mci.c
+++ b/drivers/net/wireless/ath/ath9k/mci.c
@@ -438,7 +438,7 @@ int ath_mci_setup(struct ath_softc *sc)
         struct ath_mci_buf *buf = &mci->sched_buf;
         int ret;
 
-        buf->bf_addr = dma_alloc_coherent(sc->dev,
+        buf->bf_addr = dmam_alloc_coherent(sc->dev,
                                   ATH_MCI_SCHED_BUF_SIZE + ATH_MCI_GPM_BUF_SIZE,
                                   &buf->bf_paddr, GFP_KERNEL);
 
@@ -477,11 +477,6 @@ void ath_mci_cleanup(struct ath_softc *sc)
         struct ath_mci_coex *mci = &sc->mci_coex;
         struct ath_mci_buf *buf = &mci->sched_buf;
 
-        if (buf->bf_addr)
-                dma_free_coherent(sc->dev,
-                                  ATH_MCI_SCHED_BUF_SIZE + ATH_MCI_GPM_BUF_SIZE,
-                                  buf->bf_addr, buf->bf_paddr);
-
         ar9003_mci_cleanup(ah);
 
         ath_dbg(common, MCI, "MCI De-Initialized\n");
diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c
index 7ae73fbd9136..0e0d39583837 100644
--- a/drivers/net/wireless/ath/ath9k/pci.c
+++ b/drivers/net/wireless/ath/ath9k/pci.c
@@ -147,7 +147,6 @@ static const struct ath_bus_ops ath_pci_bus_ops = {
 
 static int ath_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 {
-        void __iomem *mem;
         struct ath_softc *sc;
         struct ieee80211_hw *hw;
         u8 csz;
@@ -155,19 +154,19 @@ static int ath_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         int ret = 0;
         char hw_name[64];
 
-        if (pci_enable_device(pdev))
+        if (pcim_enable_device(pdev))
                 return -EIO;
 
         ret =  pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
         if (ret) {
                 pr_err("32-bit DMA not available\n");
-                goto err_dma;
+                return ret;
         }
 
         ret = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32));
         if (ret) {
                 pr_err("32-bit DMA consistent DMA enable failed\n");
-                goto err_dma;
+                return ret;
         }
 
         /*
@@ -203,25 +202,16 @@ static int ath_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         if ((val & 0x0000ff00) != 0)
                 pci_write_config_dword(pdev, 0x40, val & 0xffff00ff);
 
-        ret = pci_request_region(pdev, 0, "ath9k");
+        ret = pcim_iomap_regions(pdev, BIT(0), "ath9k");
         if (ret) {
                 dev_err(&pdev->dev, "PCI memory region reserve error\n");
-                ret = -ENODEV;
-                goto err_region;
-        }
-
-        mem = pci_iomap(pdev, 0, 0);
-        if (!mem) {
-                pr_err("PCI memory map error\n") ;
-                ret = -EIO;
-                goto err_iomap;
+                return -ENODEV;
         }
 
         hw = ieee80211_alloc_hw(sizeof(struct ath_softc), &ath9k_ops);
         if (!hw) {
                 dev_err(&pdev->dev, "No memory for ieee80211_hw\n");
-                ret = -ENOMEM;
-                goto err_alloc_hw;
+                return -ENOMEM;
         }
 
         SET_IEEE80211_DEV(hw, &pdev->dev);
@@ -230,7 +220,7 @@ static int ath_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         sc = hw->priv;
         sc->hw = hw;
         sc->dev = &pdev->dev;
-        sc->mem = mem;
+        sc->mem = pcim_iomap_table(pdev)[0];
 
         /* Will be cleared in ath9k_start() */
         set_bit(SC_OP_INVALID, &sc->sc_flags);
@@ -251,7 +241,7 @@ static int ath_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 
         ath9k_hw_name(sc->sc_ah, hw_name, sizeof(hw_name));
         wiphy_info(hw->wiphy, "%s mem=0x%lx, irq=%d\n",
-                   hw_name, (unsigned long)mem, pdev->irq);
+                   hw_name, (unsigned long)sc->mem, pdev->irq);
 
         return 0;
 
@@ -259,14 +249,6 @@ err_init:
         free_irq(sc->irq, sc);
 err_irq:
         ieee80211_free_hw(hw);
-err_alloc_hw:
-        pci_iounmap(pdev, mem);
-err_iomap:
-        pci_release_region(pdev, 0);
-err_region:
-        /* Nothing */
-err_dma:
-        pci_disable_device(pdev);
         return ret;
 }
 
@@ -274,17 +256,12 @@ static void ath_pci_remove(struct pci_dev *pdev)
 {
         struct ieee80211_hw *hw = pci_get_drvdata(pdev);
         struct ath_softc *sc = hw->priv;
-        void __iomem *mem = sc->mem;
 
         if (!is_ath9k_unloaded)
                 sc->sc_ah->ah_flags |= AH_UNPLUGGED;
         ath9k_deinit_device(sc);
         free_irq(sc->irq, sc);
         ieee80211_free_hw(sc->hw);
-
-        pci_iounmap(pdev, mem);
-        pci_disable_device(pdev);
-        pci_release_region(pdev, 0);
 }
 
 #ifdef CONFIG_PM_SLEEP
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index d4df98a938bf..2af6f19d2d2a 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -15,6 +15,7 @@
  */
 
 #include <linux/dma-mapping.h>
+#include <linux/relay.h>
 #include "ath9k.h"
 #include "ar9003_mac.h"
 
@@ -180,11 +181,6 @@ static void ath_rx_edma_cleanup(struct ath_softc *sc)
                         bf->bf_mpdu = NULL;
                 }
         }
-
-        INIT_LIST_HEAD(&sc->rx.rxbuf);
-
-        kfree(sc->rx.rx_bufptr);
-        sc->rx.rx_bufptr = NULL;
 }
 
 static void ath_rx_edma_init_queue(struct ath_rx_edma *rx_edma, int size)
@@ -211,12 +207,11 @@ static int ath_rx_edma_init(struct ath_softc *sc, int nbufs)
                                ah->caps.rx_hp_qdepth);
 
         size = sizeof(struct ath_buf) * nbufs;
-        bf = kzalloc(size, GFP_KERNEL);
+        bf = devm_kzalloc(sc->dev, size, GFP_KERNEL);
         if (!bf)
                 return -ENOMEM;
 
         INIT_LIST_HEAD(&sc->rx.rxbuf);
-        sc->rx.rx_bufptr = bf;
 
         for (i = 0; i < nbufs; i++, bf++) {
                 skb = ath_rxbuf_alloc(common, common->rx_bufsize, GFP_KERNEL);
@@ -254,8 +249,6 @@ rx_init_fail:
 
 static void ath_edma_start_recv(struct ath_softc *sc)
 {
-        spin_lock_bh(&sc->rx.rxbuflock);
-
         ath9k_hw_rxena(sc->sc_ah);
 
         ath_rx_addbuffer_edma(sc, ATH9K_RX_QUEUE_HP,
@@ -267,8 +260,6 @@ static void ath_edma_start_recv(struct ath_softc *sc)
         ath_opmode_init(sc);
 
         ath9k_hw_startpcureceive(sc->sc_ah, !!(sc->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL));
-
-        spin_unlock_bh(&sc->rx.rxbuflock);
 }
 
 static void ath_edma_stop_recv(struct ath_softc *sc)
@@ -285,8 +276,6 @@ int ath_rx_init(struct ath_softc *sc, int nbufs)
         int error = 0;
 
         spin_lock_init(&sc->sc_pcu_lock);
-        spin_lock_init(&sc->rx.rxbuflock);
-        clear_bit(SC_OP_RXFLUSH, &sc->sc_flags);
 
         common->rx_bufsize = IEEE80211_MAX_MPDU_LEN / 2 +
                              sc->sc_ah->caps.rx_status_len;
@@ -363,9 +352,6 @@ void ath_rx_cleanup(struct ath_softc *sc)
                                 bf->bf_mpdu = NULL;
                         }
                 }
-
-                if (sc->rx.rxdma.dd_desc_len != 0)
-                        ath_descdma_cleanup(sc, &sc->rx.rxdma, &sc->rx.rxbuf);
         }
 }
 
@@ -447,7 +433,6 @@ int ath_startrecv(struct ath_softc *sc)
                 return 0;
         }
 
-        spin_lock_bh(&sc->rx.rxbuflock);
         if (list_empty(&sc->rx.rxbuf))
                 goto start_recv;
 
@@ -468,26 +453,31 @@ start_recv:
         ath_opmode_init(sc);
         ath9k_hw_startpcureceive(ah, !!(sc->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL));
 
-        spin_unlock_bh(&sc->rx.rxbuflock);
-
         return 0;
 }
 
+static void ath_flushrecv(struct ath_softc *sc)
+{
+        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)
+                ath_rx_tasklet(sc, 1, true);
+        ath_rx_tasklet(sc, 1, false);
+}
+
 bool ath_stoprecv(struct ath_softc *sc)
 {
         struct ath_hw *ah = sc->sc_ah;
         bool stopped, reset = false;
 
-        spin_lock_bh(&sc->rx.rxbuflock);
         ath9k_hw_abortpcurecv(ah);
         ath9k_hw_setrxfilter(ah, 0);
         stopped = ath9k_hw_stopdmarecv(ah, &reset);
 
+        ath_flushrecv(sc);
+
         if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)
                 ath_edma_stop_recv(sc);
         else
                 sc->rx.rxlink = NULL;
-        spin_unlock_bh(&sc->rx.rxbuflock);
 
         if (!(ah->ah_flags & AH_UNPLUGGED) &&
             unlikely(!stopped)) {
@@ -499,15 +489,6 @@ bool ath_stoprecv(struct ath_softc *sc)
         return stopped && !reset;
 }
 
-void ath_flushrecv(struct ath_softc *sc)
-{
-        set_bit(SC_OP_RXFLUSH, &sc->sc_flags);
-        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)
-                ath_rx_tasklet(sc, 1, true);
-        ath_rx_tasklet(sc, 1, false);
-        clear_bit(SC_OP_RXFLUSH, &sc->sc_flags);
-}
-
 static bool ath_beacon_dtim_pending_cab(struct sk_buff *skb)
 {
         /* Check whether the Beacon frame has DTIM indicating buffered bc/mc */
@@ -744,6 +725,7 @@ static struct ath_buf *ath_get_next_rx_buf(struct ath_softc *sc,
                         return NULL;
         }
 
+        list_del(&bf->list);
         if (!bf->bf_mpdu)
                 return bf;
 
@@ -1034,6 +1016,113 @@ static void ath9k_rx_skb_postprocess(struct ath_common *common,
                 rxs->flag &= ~RX_FLAG_DECRYPTED;
 }
 
+static s8 fix_rssi_inv_only(u8 rssi_val)
+{
+        if (rssi_val == 128)
+                rssi_val = 0;
+        return (s8) rssi_val;
+}
+
+/* returns 1 if this was a spectral frame, even if not handled. */
+static int ath_process_fft(struct ath_softc *sc, struct ieee80211_hdr *hdr,
+                           struct ath_rx_status *rs, u64 tsf)
+{
+#ifdef CONFIG_ATH_DEBUG
+        struct ath_hw *ah = sc->sc_ah;
+        u8 bins[SPECTRAL_HT20_NUM_BINS];
+        u8 *vdata = (u8 *)hdr;
+        struct fft_sample_ht20 fft_sample;
+        struct ath_radar_info *radar_info;
+        struct ath_ht20_mag_info *mag_info;
+        int len = rs->rs_datalen;
+        int dc_pos;
+
+        /* AR9280 and before report via ATH9K_PHYERR_RADAR, AR93xx and newer
+         * via ATH9K_PHYERR_SPECTRAL. Haven't seen ATH9K_PHYERR_FALSE_RADAR_EXT
+         * yet, but this is supposed to be possible as well.
+         */
+        if (rs->rs_phyerr != ATH9K_PHYERR_RADAR &&
+            rs->rs_phyerr != ATH9K_PHYERR_FALSE_RADAR_EXT &&
+            rs->rs_phyerr != ATH9K_PHYERR_SPECTRAL)
+                return 0;
+
+        /* check if spectral scan bit is set. This does not have to be checked
+         * if received through a SPECTRAL phy error, but shouldn't hurt.
+         */
+        radar_info = ((struct ath_radar_info *)&vdata[len]) - 1;
+        if (!(radar_info->pulse_bw_info & SPECTRAL_SCAN_BITMASK))
+                return 0;
+
+        /* Variation in the data length is possible and will be fixed later.
+         * Note that we only support HT20 for now.
+         *
+         * TODO: add HT20_40 support as well.
+         */
+        if ((len > SPECTRAL_HT20_TOTAL_DATA_LEN + 2) ||
+            (len < SPECTRAL_HT20_TOTAL_DATA_LEN - 1))
+                return 1;
+
+        fft_sample.tlv.type = ATH_FFT_SAMPLE_HT20;
+        fft_sample.tlv.length = sizeof(fft_sample) - sizeof(fft_sample.tlv);
+        fft_sample.tlv.length = __cpu_to_be16(fft_sample.tlv.length);
+
+        fft_sample.freq = __cpu_to_be16(ah->curchan->chan->center_freq);
+        fft_sample.rssi = fix_rssi_inv_only(rs->rs_rssi_ctl0);
+        fft_sample.noise = ah->noise;
+
+        switch (len - SPECTRAL_HT20_TOTAL_DATA_LEN) {
+        case 0:
+                /* length correct, nothing to do. */
+                memcpy(bins, vdata, SPECTRAL_HT20_NUM_BINS);
+                break;
+        case -1:
+                /* first byte missing, duplicate it. */
+                memcpy(&bins[1], vdata, SPECTRAL_HT20_NUM_BINS - 1);
+                bins[0] = vdata[0];
+                break;
+        case 2:
+                /* MAC added 2 extra bytes at bin 30 and 32, remove them. */
+                memcpy(bins, vdata, 30);
+                bins[30] = vdata[31];
+                memcpy(&bins[31], &vdata[33], SPECTRAL_HT20_NUM_BINS - 31);
+                break;
+        case 1:
+                /* MAC added 2 extra bytes AND first byte is missing. */
+                bins[0] = vdata[0];
+                memcpy(&bins[0], vdata, 30);
+                bins[31] = vdata[31];
+                memcpy(&bins[32], &vdata[33], SPECTRAL_HT20_NUM_BINS - 32);
+                break;
+        default:
+                return 1;
+        }
+
+        /* DC value (value in the middle) is the blind spot of the spectral
+         * sample and invalid, interpolate it.
+         */
+        dc_pos = SPECTRAL_HT20_NUM_BINS / 2;
+        bins[dc_pos] = (bins[dc_pos + 1] + bins[dc_pos - 1]) / 2;
+
+        /* mag data is at the end of the frame, in front of radar_info */
+        mag_info = ((struct ath_ht20_mag_info *)radar_info) - 1;
+
+        /* copy raw bins without scaling them */
+        memcpy(fft_sample.data, bins, SPECTRAL_HT20_NUM_BINS);
+        fft_sample.max_exp = mag_info->max_exp & 0xf;
+
+        fft_sample.max_magnitude = spectral_max_magnitude(mag_info->all_bins);
+        fft_sample.max_magnitude = __cpu_to_be16(fft_sample.max_magnitude);
+        fft_sample.max_index = spectral_max_index(mag_info->all_bins);
+        fft_sample.bitmap_weight = spectral_bitmap_weight(mag_info->all_bins);
+        fft_sample.tsf = __cpu_to_be64(tsf);
+
+        ath_debug_send_fft_sample(sc, &fft_sample.tlv);
+        return 1;
+#else
+        return 0;
+#endif
+}
+
 int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
 {
         struct ath_buf *bf;
@@ -1059,16 +1148,12 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
                 dma_type = DMA_FROM_DEVICE;
 
         qtype = hp ? ATH9K_RX_QUEUE_HP : ATH9K_RX_QUEUE_LP;
-        spin_lock_bh(&sc->rx.rxbuflock);
 
         tsf = ath9k_hw_gettsf64(ah);
         tsf_lower = tsf & 0xffffffff;
 
         do {
                 bool decrypt_error = false;
-                /* If handling rx interrupt and flush is in progress => exit */
-                if (test_bit(SC_OP_RXFLUSH, &sc->sc_flags) && (flush == 0))
-                        break;
 
                 memset(&rs, 0, sizeof(rs));
                 if (edma)
@@ -1111,15 +1196,6 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
 
                 ath_debug_stat_rx(sc, &rs);
 
-                /*
-                 * If we're asked to flush receive queue, directly
-                 * chain it back at the queue without processing it.
-                 */
-                if (test_bit(SC_OP_RXFLUSH, &sc->sc_flags)) {
-                        RX_STAT_INC(rx_drop_rxflush);
-                        goto requeue_drop_frag;
-                }
-
                 memset(rxs, 0, sizeof(struct ieee80211_rx_status));
 
                 rxs->mactime = (tsf & ~0xffffffffULL) | rs.rs_tstamp;
@@ -1131,6 +1207,13 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
                     unlikely(tsf_lower - rs.rs_tstamp > 0x10000000))
                         rxs->mactime += 0x100000000ULL;
 
+                if (rs.rs_status & ATH9K_RXERR_PHY) {
+                        if (ath_process_fft(sc, hdr, &rs, rxs->mactime)) {
+                                RX_STAT_INC(rx_spectral);
+                                goto requeue_drop_frag;
+                        }
+                }
+
                 retval = ath9k_rx_skb_preprocess(common, hw, hdr, &rs,
                                                  rxs, &decrypt_error);
                 if (retval)
@@ -1254,19 +1337,18 @@ requeue_drop_frag:
                         sc->rx.frag = NULL;
                 }
 requeue:
+                list_add_tail(&bf->list, &sc->rx.rxbuf);
+                if (flush)
+                        continue;
+
                 if (edma) {
-                        list_add_tail(&bf->list, &sc->rx.rxbuf);
                         ath_rx_edma_buf_link(sc, qtype);
                 } else {
-                        list_move_tail(&bf->list, &sc->rx.rxbuf);
                         ath_rx_buf_link(sc, bf);
-                        if (!flush)
-                                ath9k_hw_rxena(ah);
+                        ath9k_hw_rxena(ah);
                 }
         } while (1);
 
-        spin_unlock_bh(&sc->rx.rxbuflock);
-
         if (!(ah->imask & ATH9K_INT_RXEOL)) {
                 ah->imask |= (ATH9K_INT_RXEOL | ATH9K_INT_RXORN);
                 ath9k_hw_set_interrupts(ah);
diff --git a/drivers/net/wireless/ath/ath9k/reg.h b/drivers/net/wireless/ath/ath9k/reg.h
index ad3c82c09177..5929850649f0 100644
--- a/drivers/net/wireless/ath/ath9k/reg.h
+++ b/drivers/net/wireless/ath/ath9k/reg.h
@@ -789,6 +789,7 @@
 #define AR_SREV_REVISION_9271_11        1
 #define AR_SREV_VERSION_9300            0x1c0
 #define AR_SREV_REVISION_9300_20        2 /* 2.0 and 2.1 */
+#define AR_SREV_REVISION_9300_22        3
 #define AR_SREV_VERSION_9330            0x200
 #define AR_SREV_REVISION_9330_10        0
 #define AR_SREV_REVISION_9330_11        1
@@ -869,6 +870,9 @@
         (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9300))
 #define AR_SREV_9300_20_OR_LATER(_ah) \
         ((_ah)->hw_version.macVersion >= AR_SREV_VERSION_9300)
+#define AR_SREV_9300_22(_ah) \
+        (AR_SREV_9300(ah) && \
+         ((_ah)->hw_version.macRev == AR_SREV_REVISION_9300_22))
 
 #define AR_SREV_9330(_ah) \
         (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9330))
@@ -884,9 +888,6 @@
 
 #define AR_SREV_9485(_ah) \
         (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9485))
-#define AR_SREV_9485_10(_ah) \
-        (AR_SREV_9485(_ah) && \
-         ((_ah)->hw_version.macRev == AR_SREV_REVISION_9485_10))
 #define AR_SREV_9485_11(_ah) \
         (AR_SREV_9485(_ah) && \
          ((_ah)->hw_version.macRev == AR_SREV_REVISION_9485_11))
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 90e48a0fafe5..feacaafee959 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -378,7 +378,7 @@ static void ath_tx_count_frames(struct ath_softc *sc, struct ath_buf *bf,
 
 static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
                                  struct ath_buf *bf, struct list_head *bf_q,
-                                 struct ath_tx_status *ts, int txok, bool retry)
+                                 struct ath_tx_status *ts, int txok)
 {
         struct ath_node *an = NULL;
         struct sk_buff *skb;
@@ -490,7 +490,7 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
                 } else if (!isaggr && txok) {
                         /* transmit completion */
                         acked_cnt++;
-                } else if ((tid->state & AGGR_CLEANUP) || !retry) {
+                } else if (tid->state & AGGR_CLEANUP) {
                         /*
                          * cleanup in progress, just fail
                          * the un-acked sub-frames
@@ -604,6 +604,37 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
                 ath9k_queue_reset(sc, RESET_TYPE_TX_ERROR);
 }
 
+static bool bf_is_ampdu_not_probing(struct ath_buf *bf)
+{
+    struct ieee80211_tx_info *info = IEEE80211_SKB_CB(bf->bf_mpdu);
+    return bf_isampdu(bf) && !(info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE);
+}
+
+static void ath_tx_process_buffer(struct ath_softc *sc, struct ath_txq *txq,
+                                  struct ath_tx_status *ts, struct ath_buf *bf,
+                                  struct list_head *bf_head)
+{
+        bool txok, flush;
+
+        txok = !(ts->ts_status & ATH9K_TXERR_MASK);
+        flush = !!(ts->ts_status & ATH9K_TX_FLUSH);
+        txq->axq_tx_inprogress = false;
+
+        txq->axq_depth--;
+        if (bf_is_ampdu_not_probing(bf))
+                txq->axq_ampdu_depth--;
+
+        if (!bf_isampdu(bf)) {
+                if (!flush)
+                        ath_tx_rc_status(sc, bf, ts, 1, txok ? 0 : 1, txok);
+                ath_tx_complete_buf(sc, bf, txq, bf_head, ts, txok);
+        } else
+                ath_tx_complete_aggr(sc, txq, bf, bf_head, ts, txok);
+
+        if ((sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_HT) && !flush)
+                ath_txq_schedule(sc, txq);
+}
+
 static bool ath_lookup_legacy(struct ath_buf *bf)
 {
         struct sk_buff *skb;
@@ -1331,23 +1362,6 @@ void ath_tx_aggr_resume(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid
 /* Queue Management */
 /********************/
 
-static void ath_txq_drain_pending_buffers(struct ath_softc *sc,
-                                          struct ath_txq *txq)
-{
-        struct ath_atx_ac *ac, *ac_tmp;
-        struct ath_atx_tid *tid, *tid_tmp;
-
-        list_for_each_entry_safe(ac, ac_tmp, &txq->axq_acq, list) {
-                list_del(&ac->list);
-                ac->sched = false;
-                list_for_each_entry_safe(tid, tid_tmp, &ac->tid_q, list) {
-                        list_del(&tid->list);
-                        tid->sched = false;
-                        ath_tid_drain(sc, txq, tid);
-                }
-        }
-}
-
 struct ath_txq *ath_txq_setup(struct ath_softc *sc, int qtype, int subtype)
 {
         struct ath_hw *ah = sc->sc_ah;
@@ -1470,14 +1484,8 @@ int ath_cabq_update(struct ath_softc *sc)
         return 0;
 }
 
-static bool bf_is_ampdu_not_probing(struct ath_buf *bf)
-{
-    struct ieee80211_tx_info *info = IEEE80211_SKB_CB(bf->bf_mpdu);
-    return bf_isampdu(bf) && !(info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE);
-}
-
 static void ath_drain_txq_list(struct ath_softc *sc, struct ath_txq *txq,
-                               struct list_head *list, bool retry_tx)
+                               struct list_head *list)
 {
         struct ath_buf *bf, *lastbf;
         struct list_head bf_head;
@@ -1499,16 +1507,7 @@ static void ath_drain_txq_list(struct ath_softc *sc, struct ath_txq *txq,
 
                 lastbf = bf->bf_lastbf;
                 list_cut_position(&bf_head, list, &lastbf->list);
-
-                txq->axq_depth--;
-                if (bf_is_ampdu_not_probing(bf))
-                        txq->axq_ampdu_depth--;
-
-                if (bf_isampdu(bf))
-                        ath_tx_complete_aggr(sc, txq, bf, &bf_head, &ts, 0,
-                                             retry_tx);
-                else
-                        ath_tx_complete_buf(sc, bf, txq, &bf_head, &ts, 0);
+                ath_tx_process_buffer(sc, txq, &ts, bf, &bf_head);
         }
 }
 
@@ -1518,7 +1517,7 @@ static void ath_drain_txq_list(struct ath_softc *sc, struct ath_txq *txq,
  * This assumes output has been stopped and
  * we do not need to block ath_tx_tasklet.
  */
-void ath_draintxq(struct ath_softc *sc, struct ath_txq *txq, bool retry_tx)
+void ath_draintxq(struct ath_softc *sc, struct ath_txq *txq)
 {
         ath_txq_lock(sc, txq);
 
@@ -1526,8 +1525,7 @@ void ath_draintxq(struct ath_softc *sc, struct ath_txq *txq, bool retry_tx)
                 int idx = txq->txq_tailidx;
 
                 while (!list_empty(&txq->txq_fifo[idx])) {
-                        ath_drain_txq_list(sc, txq, &txq->txq_fifo[idx],
-                                           retry_tx);
+                        ath_drain_txq_list(sc, txq, &txq->txq_fifo[idx]);
 
                         INCR(idx, ATH_TXFIFO_DEPTH);
                 }
@@ -1536,16 +1534,12 @@ void ath_draintxq(struct ath_softc *sc, struct ath_txq *txq, bool retry_tx)
 
         txq->axq_link = NULL;
         txq->axq_tx_inprogress = false;
-        ath_drain_txq_list(sc, txq, &txq->axq_q, retry_tx);
-
-        /* flush any pending frames if aggregation is enabled */
-        if ((sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_HT) && !retry_tx)
-                ath_txq_drain_pending_buffers(sc, txq);
+        ath_drain_txq_list(sc, txq, &txq->axq_q);
 
         ath_txq_unlock_complete(sc, txq);
 }
 
-bool ath_drain_all_txq(struct ath_softc *sc, bool retry_tx)
+bool ath_drain_all_txq(struct ath_softc *sc)
 {
         struct ath_hw *ah = sc->sc_ah;
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
@@ -1581,7 +1575,7 @@ bool ath_drain_all_txq(struct ath_softc *sc, bool retry_tx)
                  */
                 txq = &sc->tx.txq[i];
                 txq->stopped = false;
-                ath_draintxq(sc, txq, retry_tx);
+                ath_draintxq(sc, txq);
         }
 
         return !npend;
@@ -2175,28 +2169,6 @@ static void ath_tx_rc_status(struct ath_softc *sc, struct ath_buf *bf,
         tx_info->status.rates[tx_rateindex].count = ts->ts_longretry + 1;
 }
 
-static void ath_tx_process_buffer(struct ath_softc *sc, struct ath_txq *txq,
-                                  struct ath_tx_status *ts, struct ath_buf *bf,
-                                  struct list_head *bf_head)
-{
-        int txok;
-
-        txq->axq_depth--;
-        txok = !(ts->ts_status & ATH9K_TXERR_MASK);
-        txq->axq_tx_inprogress = false;
-        if (bf_is_ampdu_not_probing(bf))
-                txq->axq_ampdu_depth--;
-
-        if (!bf_isampdu(bf)) {
-                ath_tx_rc_status(sc, bf, ts, 1, txok ? 0 : 1, txok);
-                ath_tx_complete_buf(sc, bf, txq, bf_head, ts, txok);
-        } else
-                ath_tx_complete_aggr(sc, txq, bf, bf_head, ts, txok, true);
-
-        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_HT)
-                ath_txq_schedule(sc, txq);
-}
-
 static void ath_tx_processq(struct ath_softc *sc, struct ath_txq *txq)
 {
         struct ath_hw *ah = sc->sc_ah;
@@ -2361,8 +2333,8 @@ static int ath_txstatus_setup(struct ath_softc *sc, int size)
         u8 txs_len = sc->sc_ah->caps.txs_len;
 
         dd->dd_desc_len = size * txs_len;
-        dd->dd_desc = dma_alloc_coherent(sc->dev, dd->dd_desc_len,
-                                         &dd->dd_desc_paddr, GFP_KERNEL);
+        dd->dd_desc = dmam_alloc_coherent(sc->dev, dd->dd_desc_len,
+                                          &dd->dd_desc_paddr, GFP_KERNEL);
         if (!dd->dd_desc)
                 return -ENOMEM;
 
@@ -2382,14 +2354,6 @@ static int ath_tx_edma_init(struct ath_softc *sc)
         return err;
 }
 
-static void ath_tx_edma_cleanup(struct ath_softc *sc)
-{
-        struct ath_descdma *dd = &sc->txsdma;
-
-        dma_free_coherent(sc->dev, dd->dd_desc_len, dd->dd_desc,
-                          dd->dd_desc_paddr);
-}
-
 int ath_tx_init(struct ath_softc *sc, int nbufs)
 {
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
@@ -2402,7 +2366,7 @@ int ath_tx_init(struct ath_softc *sc, int nbufs)
         if (error != 0) {
                 ath_err(common,
                         "Failed to allocate tx descriptors: %d\n", error);
-                goto err;
+                return error;
         }
 
         error = ath_descdma_setup(sc, &sc->beacon.bdma, &sc->beacon.bbuf,
@@ -2410,36 +2374,17 @@ int ath_tx_init(struct ath_softc *sc, int nbufs)
         if (error != 0) {
                 ath_err(common,
                         "Failed to allocate beacon descriptors: %d\n", error);
-                goto err;
+                return error;
         }
 
         INIT_DELAYED_WORK(&sc->tx_complete_work, ath_tx_complete_poll_work);
 
-        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) {
+        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)
                 error = ath_tx_edma_init(sc);
-                if (error)
-                        goto err;
-        }
-
-err:
-        if (error != 0)
-                ath_tx_cleanup(sc);
 
         return error;
 }
 
-void ath_tx_cleanup(struct ath_softc *sc)
-{
-        if (sc->beacon.bdma.dd_desc_len != 0)
-                ath_descdma_cleanup(sc, &sc->beacon.bdma, &sc->beacon.bbuf);
-
-        if (sc->tx.txdma.dd_desc_len != 0)
-                ath_descdma_cleanup(sc, &sc->tx.txdma, &sc->tx.txbuf);
-
-        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)
-                ath_tx_edma_cleanup(sc);
-}
-
 void ath_tx_node_init(struct ath_softc *sc, struct ath_node *an)
 {
         struct ath_atx_tid *tid;
diff --git a/drivers/net/wireless/ath/carl9170/carl9170.h b/drivers/net/wireless/ath/carl9170/carl9170.h
index 2df17f1e49ef..25599741cd8a 100644
--- a/drivers/net/wireless/ath/carl9170/carl9170.h
+++ b/drivers/net/wireless/ath/carl9170/carl9170.h
@@ -85,20 +85,14 @@ enum carl9170_device_state {
         CARL9170_STARTED,
 };
 
-#define CARL9170_NUM_TID                16
 #define WME_BA_BMP_SIZE                 64
 #define CARL9170_TX_USER_RATE_TRIES     3
 
-#define WME_AC_BE   2
-#define WME_AC_BK   3
-#define WME_AC_VI   1
-#define WME_AC_VO   0
-
 #define TID_TO_WME_AC(_tid)                             \
-        ((((_tid) == 0) || ((_tid) == 3)) ? WME_AC_BE : \
-         (((_tid) == 1) || ((_tid) == 2)) ? WME_AC_BK : \
-         (((_tid) == 4) || ((_tid) == 5)) ? WME_AC_VI : \
-         WME_AC_VO)
+        ((((_tid) == 0) || ((_tid) == 3)) ? IEEE80211_AC_BE :   \
+         (((_tid) == 1) || ((_tid) == 2)) ? IEEE80211_AC_BK :   \
+         (((_tid) == 4) || ((_tid) == 5)) ? IEEE80211_AC_VI :   \
+         IEEE80211_AC_VO)
 
 #define SEQ_DIFF(_start, _seq) \
         (((_start) - (_seq)) & 0x0fff)
@@ -290,6 +284,7 @@ struct ar9170 {
                 unsigned int rx_size;
                 unsigned int tx_seq_table;
                 bool ba_filter;
+                bool disable_offload_fw;
         } fw;
 
         /* interface configuration combinations */
@@ -493,8 +488,8 @@ struct carl9170_sta_info {
         bool sleeping;
         atomic_t pending_frames;
         unsigned int ampdu_max_len;
-        struct carl9170_sta_tid __rcu *agg[CARL9170_NUM_TID];
-        struct carl9170_ba_stats stats[CARL9170_NUM_TID];
+        struct carl9170_sta_tid __rcu *agg[IEEE80211_NUM_TIDS];
+        struct carl9170_ba_stats stats[IEEE80211_NUM_TIDS];
 };
 
 struct carl9170_tx_info {
diff --git a/drivers/net/wireless/ath/carl9170/fw.c b/drivers/net/wireless/ath/carl9170/fw.c
index aaebecd19e59..47d5c2e910ad 100644
--- a/drivers/net/wireless/ath/carl9170/fw.c
+++ b/drivers/net/wireless/ath/carl9170/fw.c
@@ -215,6 +215,24 @@ static int carl9170_fw_tx_sequence(struct ar9170 *ar)
         return 0;
 }
 
+static void carl9170_fw_set_if_combinations(struct ar9170 *ar,
+                                            u16 if_comb_types)
+{
+        if (ar->fw.vif_num < 2)
+                return;
+
+        ar->if_comb_limits[0].max = ar->fw.vif_num;
+        ar->if_comb_limits[0].types = if_comb_types;
+
+        ar->if_combs[0].num_different_channels = 1;
+        ar->if_combs[0].max_interfaces = ar->fw.vif_num;
+        ar->if_combs[0].limits = ar->if_comb_limits;
+        ar->if_combs[0].n_limits = ARRAY_SIZE(ar->if_comb_limits);
+
+        ar->hw->wiphy->iface_combinations = ar->if_combs;
+        ar->hw->wiphy->n_iface_combinations = ARRAY_SIZE(ar->if_combs);
+}
+
 static int carl9170_fw(struct ar9170 *ar, const __u8 *data, size_t len)
 {
         const struct carl9170fw_otus_desc *otus_desc;
@@ -264,7 +282,7 @@ static int carl9170_fw(struct ar9170 *ar, const __u8 *data, size_t len)
         if (!SUPP(CARL9170FW_COMMAND_CAM)) {
                 dev_info(&ar->udev->dev, "crypto offloading is disabled "
                          "by firmware.\n");
-                ar->disable_offload = true;
+                ar->fw.disable_offload_fw = true;
         }
 
         if (SUPP(CARL9170FW_PSM) && SUPP(CARL9170FW_FIXED_5GHZ_PSM))
@@ -336,25 +354,24 @@ static int carl9170_fw(struct ar9170 *ar, const __u8 *data, size_t len)
                 if (SUPP(CARL9170FW_WLANTX_CAB)) {
                         if_comb_types |=
                                 BIT(NL80211_IFTYPE_AP) |
-                                BIT(NL80211_IFTYPE_MESH_POINT) |
                                 BIT(NL80211_IFTYPE_P2P_GO);
+
+#ifdef CONFIG_MAC80211_MESH
+                        if_comb_types |=
+                                BIT(NL80211_IFTYPE_MESH_POINT);
+#endif /* CONFIG_MAC80211_MESH */
                 }
         }
 
-        ar->if_comb_limits[0].max = ar->fw.vif_num;
-        ar->if_comb_limits[0].types = if_comb_types;
-
-        ar->if_combs[0].num_different_channels = 1;
-        ar->if_combs[0].max_interfaces = ar->fw.vif_num;
-        ar->if_combs[0].limits = ar->if_comb_limits;
-        ar->if_combs[0].n_limits = ARRAY_SIZE(ar->if_comb_limits);
-
-        ar->hw->wiphy->iface_combinations = ar->if_combs;
-        ar->hw->wiphy->n_iface_combinations = ARRAY_SIZE(ar->if_combs);
+        carl9170_fw_set_if_combinations(ar, if_comb_types);
 
         ar->hw->wiphy->interface_modes |= if_comb_types;
 
-        ar->hw->wiphy->flags |= WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
+        ar->hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
+
+        /* As IBSS Encryption is software-based, IBSS RSN is supported. */
+        ar->hw->wiphy->flags |= WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL |
+                 WIPHY_FLAG_IBSS_RSN | WIPHY_FLAG_SUPPORTS_TDLS;
 
 #undef SUPPORTED
         return carl9170_fw_tx_sequence(ar);
diff --git a/drivers/net/wireless/ath/carl9170/fwcmd.h b/drivers/net/wireless/ath/carl9170/fwcmd.h
index 9443c802b25b..9111d4ffc1b3 100644
--- a/drivers/net/wireless/ath/carl9170/fwcmd.h
+++ b/drivers/net/wireless/ath/carl9170/fwcmd.h
@@ -156,6 +156,14 @@ struct carl9170_psm {
 } __packed;
 #define CARL9170_PSM_SIZE               4
 
+/*
+ * Note: If a bit in rx_filter is set, then it
+ * means that the particular frames which matches
+ * the condition are FILTERED/REMOVED/DISCARDED!
+ * (This is can be a bit confusing, especially
+ * because someone people think it's the exact
+ * opposite way, so watch out!)
+ */
 struct carl9170_rx_filter_cmd {
         __le32          rx_filter;
 } __packed;
diff --git a/drivers/net/wireless/ath/carl9170/hw.h b/drivers/net/wireless/ath/carl9170/hw.h
index fa834c1460f0..0db874abde50 100644
--- a/drivers/net/wireless/ath/carl9170/hw.h
+++ b/drivers/net/wireless/ath/carl9170/hw.h
@@ -384,7 +384,7 @@
 
 #define AR9170_MAC_REG_BCN_ADDR                 (AR9170_MAC_REG_BASE + 0xd84)
 #define AR9170_MAC_REG_BCN_LENGTH               (AR9170_MAC_REG_BASE + 0xd88)
-#define         AR9170_MAC_BCN_LENGTH_MAX               256
+#define         AR9170_MAC_BCN_LENGTH_MAX               (512 - 32)
 
 #define AR9170_MAC_REG_BCN_STATUS               (AR9170_MAC_REG_BASE + 0xd8c)
 
diff --git a/drivers/net/wireless/ath/carl9170/main.c b/drivers/net/wireless/ath/carl9170/main.c
index 25a1e2f4f738..ef82751722e0 100644
--- a/drivers/net/wireless/ath/carl9170/main.c
+++ b/drivers/net/wireless/ath/carl9170/main.c
@@ -358,8 +358,13 @@ static int carl9170_op_start(struct ieee80211_hw *hw)
         ar->ps.last_action = jiffies;
         ar->ps.last_slept = jiffies;
         ar->erp_mode = CARL9170_ERP_AUTO;
-        ar->rx_software_decryption = false;
-        ar->disable_offload = false;
+
+        /* Set "disable hw crypto offload" whenever the module parameter
+         * nohwcrypt is true or if the firmware does not support it.
+         */
+        ar->disable_offload = modparam_nohwcrypt |
+                ar->fw.disable_offload_fw;
+        ar->rx_software_decryption = ar->disable_offload;
 
         for (i = 0; i < ar->hw->queues; i++) {
                 ar->queue_stop_timeout[i] = jiffies;
@@ -565,12 +570,28 @@ static int carl9170_init_interface(struct ar9170 *ar,
 
         memcpy(common->macaddr, vif->addr, ETH_ALEN);
 
-        if (modparam_nohwcrypt ||
-            ((vif->type != NL80211_IFTYPE_STATION) &&
-             (vif->type != NL80211_IFTYPE_AP))) {
-                ar->rx_software_decryption = true;
-                ar->disable_offload = true;
-        }
+        /* We have to fall back to software crypto, whenever
+         * the user choose to participates in an IBSS. HW
+         * offload for IBSS RSN is not supported by this driver.
+         *
+         * NOTE: If the previous main interface has already
+         * disabled hw crypto offload, we have to keep this
+         * previous disable_offload setting as it was.
+         * Altough ideally, we should notify mac80211 and tell
+         * it to forget about any HW crypto offload for now.
+         */
+        ar->disable_offload |= ((vif->type != NL80211_IFTYPE_STATION) &&
+            (vif->type != NL80211_IFTYPE_AP));
+
+        /* While the driver supports HW offload in a single
+         * P2P client configuration, it doesn't support HW
+         * offload in the favourit, concurrent P2P GO+CLIENT
+         * configuration. Hence, HW offload will always be
+         * disabled for P2P.
+         */
+        ar->disable_offload |= vif->p2p;
+
+        ar->rx_software_decryption = ar->disable_offload;
 
         err = carl9170_set_operating_mode(ar);
         return err;
@@ -580,7 +601,7 @@ static int carl9170_op_add_interface(struct ieee80211_hw *hw,
                                      struct ieee80211_vif *vif)
 {
         struct carl9170_vif_info *vif_priv = (void *) vif->drv_priv;
-        struct ieee80211_vif *main_vif;
+        struct ieee80211_vif *main_vif, *old_main = NULL;
         struct ar9170 *ar = hw->priv;
         int vif_id = -1, err = 0;
 
@@ -602,6 +623,15 @@ static int carl9170_op_add_interface(struct ieee80211_hw *hw,
                 goto init;
         }
 
+        /* Because the AR9170 HW's MAC doesn't provide full support for
+         * multiple, independent interfaces [of different operation modes].
+         * We have to select ONE main interface [main mode of HW], but we
+         * can have multiple slaves [AKA: entry in the ACK-table].
+         *
+         * The first (from HEAD/TOP) interface in the ar->vif_list is
+         * always the main intf. All following intfs in this list
+         * are considered to be slave intfs.
+         */
         main_vif = carl9170_get_main_vif(ar);
 
         if (main_vif) {
@@ -610,6 +640,18 @@ static int carl9170_op_add_interface(struct ieee80211_hw *hw,
                         if (vif->type == NL80211_IFTYPE_STATION)
                                 break;
 
+                        /* P2P GO [master] use-case
+                         * Because the P2P GO station is selected dynamically
+                         * by all participating peers of a WIFI Direct network,
+                         * the driver has be able to change the main interface
+                         * operating mode on the fly.
+                         */
+                        if (main_vif->p2p && vif->p2p &&
+                            vif->type == NL80211_IFTYPE_AP) {
+                                old_main = main_vif;
+                                break;
+                        }
+
                         err = -EBUSY;
                         rcu_read_unlock();
 
@@ -648,14 +690,41 @@ static int carl9170_op_add_interface(struct ieee80211_hw *hw,
         vif_priv->id = vif_id;
         vif_priv->enable_beacon = false;
         ar->vifs++;
-        list_add_tail_rcu(&vif_priv->list, &ar->vif_list);
+        if (old_main) {
+                /* We end up in here, if the main interface is being replaced.
+                 * Put the new main interface at the HEAD of the list and the
+                 * previous inteface will automatically become second in line.
+                 */
+                list_add_rcu(&vif_priv->list, &ar->vif_list);
+        } else {
+                /* Add new inteface. If the list is empty, it will become the
+                 * main inteface, otherwise it will be slave.
+                 */
+                list_add_tail_rcu(&vif_priv->list, &ar->vif_list);
+        }
         rcu_assign_pointer(ar->vif_priv[vif_id].vif, vif);
 
 init:
-        if (carl9170_get_main_vif(ar) == vif) {
+        main_vif = carl9170_get_main_vif(ar);
+
+        if (main_vif == vif) {
                 rcu_assign_pointer(ar->beacon_iter, vif_priv);
                 rcu_read_unlock();
 
+                if (old_main) {
+                        struct carl9170_vif_info *old_main_priv =
+                                (void *) old_main->drv_priv;
+                        /* downgrade old main intf to slave intf.
+                         * NOTE: We are no longer under rcu_read_lock.
+                         * But we are still holding ar->mutex, so the
+                         * vif data [id, addr] is safe.
+                         */
+                        err = carl9170_mod_virtual_mac(ar, old_main_priv->id,
+                                                       old_main->addr);
+                        if (err)
+                                goto unlock;
+                }
+
                 err = carl9170_init_interface(ar, vif);
                 if (err)
                         goto unlock;
@@ -1112,9 +1181,7 @@ static int carl9170_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
         if (ar->disable_offload || !vif)
                 return -EOPNOTSUPP;
 
-        /*
-         * We have to fall back to software encryption, whenever
-         * the user choose to participates in an IBSS or is connected
+        /* Fall back to software encryption whenever the driver is connected
          * to more than one network.
          *
          * This is very unfortunate, because some machines cannot handle
@@ -1263,7 +1330,7 @@ static int carl9170_op_sta_add(struct ieee80211_hw *hw,
                         return 0;
                 }
 
-                for (i = 0; i < CARL9170_NUM_TID; i++)
+                for (i = 0; i < ARRAY_SIZE(sta_info->agg); i++)
                         RCU_INIT_POINTER(sta_info->agg[i], NULL);
 
                 sta_info->ampdu_max_len = 1 << (3 + sta->ht_cap.ampdu_factor);
@@ -1287,7 +1354,7 @@ static int carl9170_op_sta_remove(struct ieee80211_hw *hw,
                 sta_info->ht_sta = false;
 
                 rcu_read_lock();
-                for (i = 0; i < CARL9170_NUM_TID; i++) {
+                for (i = 0; i < ARRAY_SIZE(sta_info->agg); i++) {
                         struct carl9170_sta_tid *tid_info;
 
                         tid_info = rcu_dereference(sta_info->agg[i]);
@@ -1394,7 +1461,9 @@ static int carl9170_op_ampdu_action(struct ieee80211_hw *hw,
                 ieee80211_start_tx_ba_cb_irqsafe(vif, sta->addr, tid);
                 break;
 
-        case IEEE80211_AMPDU_TX_STOP:
+        case IEEE80211_AMPDU_TX_STOP_CONT:
+        case IEEE80211_AMPDU_TX_STOP_FLUSH:
+        case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
                 rcu_read_lock();
                 tid_info = rcu_dereference(sta_info->agg[tid]);
                 if (tid_info) {
@@ -1805,10 +1874,6 @@ void *carl9170_alloc(size_t priv_size)
         for (i = 0; i < ARRAY_SIZE(ar->noise); i++)
                 ar->noise[i] = -95; /* ATH_DEFAULT_NOISE_FLOOR */
 
-        hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
-
-        /* As IBSS Encryption is software-based, IBSS RSN is supported. */
-        hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
         return ar;
 
 err_nomem:
@@ -1916,13 +1981,13 @@ static int carl9170_parse_eeprom(struct ar9170 *ar)
         return 0;
 }
 
-static int carl9170_reg_notifier(struct wiphy *wiphy,
-                                 struct regulatory_request *request)
+static void carl9170_reg_notifier(struct wiphy *wiphy,
+                                  struct regulatory_request *request)
 {
         struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
         struct ar9170 *ar = hw->priv;
 
-        return ath_reg_notifier_apply(wiphy, request, &ar->common.regulatory);
+        ath_reg_notifier_apply(wiphy, request, &ar->common.regulatory);
 }
 
 int carl9170_register(struct ar9170 *ar)
diff --git a/drivers/net/wireless/ath/carl9170/tx.c b/drivers/net/wireless/ath/carl9170/tx.c
index ef4ec0da6e49..9c0b150d5b8e 100644
--- a/drivers/net/wireless/ath/carl9170/tx.c
+++ b/drivers/net/wireless/ath/carl9170/tx.c
@@ -1520,35 +1520,92 @@ void carl9170_tx_scheduler(struct ar9170 *ar)
                 carl9170_tx(ar);
 }
 
-int carl9170_update_beacon(struct ar9170 *ar, const bool submit)
+/* caller has to take rcu_read_lock */
+static struct carl9170_vif_info *carl9170_pick_beaconing_vif(struct ar9170 *ar)
 {
-        struct sk_buff *skb = NULL;
         struct carl9170_vif_info *cvif;
+        int i = 1;
+
+        /* The AR9170 hardware has no fancy beacon queue or some
+         * other scheduling mechanism. So, the driver has to make
+         * due by setting the two beacon timers (pretbtt and tbtt)
+         * once and then swapping the beacon address in the HW's
+         * register file each time the pretbtt fires.
+         */
+
+        cvif = rcu_dereference(ar->beacon_iter);
+        if (ar->vifs > 0 && cvif) {
+                do {
+                        list_for_each_entry_continue_rcu(cvif, &ar->vif_list,
+                                                         list) {
+                                if (cvif->active && cvif->enable_beacon)
+                                        goto out;
+                        }
+                } while (ar->beacon_enabled && i--);
+        }
+
+out:
+        rcu_assign_pointer(ar->beacon_iter, cvif);
+        return cvif;
+}
+
+static bool carl9170_tx_beacon_physet(struct ar9170 *ar, struct sk_buff *skb,
+                                      u32 *ht1, u32 *plcp)
+{
         struct ieee80211_tx_info *txinfo;
         struct ieee80211_tx_rate *rate;
-        __le32 *data, *old = NULL;
-        unsigned int plcp, power, chains;
-        u32 word, ht1, off, addr, len;
-        int i = 0, err = 0;
+        unsigned int power, chains;
+        bool ht_rate;
 
-        rcu_read_lock();
-        cvif = rcu_dereference(ar->beacon_iter);
-retry:
-        if (ar->vifs == 0 || !cvif)
-                goto out_unlock;
+        txinfo = IEEE80211_SKB_CB(skb);
+        rate = &txinfo->control.rates[0];
+        ht_rate = !!(txinfo->control.rates[0].flags & IEEE80211_TX_RC_MCS);
+        carl9170_tx_rate_tpc_chains(ar, txinfo, rate, plcp, &power, &chains);
 
-        list_for_each_entry_continue_rcu(cvif, &ar->vif_list, list) {
-                if (cvif->active && cvif->enable_beacon)
-                        goto found;
+        *ht1 = AR9170_MAC_BCN_HT1_TX_ANT0;
+        if (chains == AR9170_TX_PHY_TXCHAIN_2)
+                *ht1 |= AR9170_MAC_BCN_HT1_TX_ANT1;
+        SET_VAL(AR9170_MAC_BCN_HT1_PWR_CTRL, *ht1, 7);
+        SET_VAL(AR9170_MAC_BCN_HT1_TPC, *ht1, power);
+        SET_VAL(AR9170_MAC_BCN_HT1_CHAIN_MASK, *ht1, chains);
+
+        if (ht_rate) {
+                *ht1 |= AR9170_MAC_BCN_HT1_HT_EN;
+                if (rate->flags & IEEE80211_TX_RC_SHORT_GI)
+                        *plcp |= AR9170_MAC_BCN_HT2_SGI;
+
+                if (rate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH) {
+                        *ht1 |= AR9170_MAC_BCN_HT1_BWC_40M_SHARED;
+                        *plcp |= AR9170_MAC_BCN_HT2_BW40;
+                } else if (rate->flags & IEEE80211_TX_RC_DUP_DATA) {
+                        *ht1 |= AR9170_MAC_BCN_HT1_BWC_40M_DUP;
+                        *plcp |= AR9170_MAC_BCN_HT2_BW40;
+                }
+
+                SET_VAL(AR9170_MAC_BCN_HT2_LEN, *plcp, skb->len + FCS_LEN);
+        } else {
+                if (*plcp <= AR9170_TX_PHY_RATE_CCK_11M)
+                        *plcp |= ((skb->len + FCS_LEN) << (3 + 16)) + 0x0400;
+                else
+                        *plcp |= ((skb->len + FCS_LEN) << 16) + 0x0010;
         }
 
-        if (!ar->beacon_enabled || i++)
-                goto out_unlock;
+        return ht_rate;
+}
 
-        goto retry;
+int carl9170_update_beacon(struct ar9170 *ar, const bool submit)
+{
+        struct sk_buff *skb = NULL;
+        struct carl9170_vif_info *cvif;
+        __le32 *data, *old = NULL;
+        u32 word, ht1, plcp, off, addr, len;
+        int i = 0, err = 0;
+        bool ht_rate;
 
-found:
-        rcu_assign_pointer(ar->beacon_iter, cvif);
+        rcu_read_lock();
+        cvif = carl9170_pick_beaconing_vif(ar);
+        if (!cvif)
+                goto out_unlock;
 
         skb = ieee80211_beacon_get_tim(ar->hw, carl9170_get_vif(cvif),
                 NULL, NULL);
@@ -1558,7 +1615,6 @@ found:
                 goto err_free;
         }
 
-        txinfo = IEEE80211_SKB_CB(skb);
         spin_lock_bh(&ar->beacon_lock);
         data = (__le32 *)skb->data;
         if (cvif->beacon)
@@ -1588,43 +1644,14 @@ found:
                 goto err_unlock;
         }
 
-        ht1 = AR9170_MAC_BCN_HT1_TX_ANT0;
-        rate = &txinfo->control.rates[0];
-        carl9170_tx_rate_tpc_chains(ar, txinfo, rate, &plcp, &power, &chains);
-        if (!(txinfo->control.rates[0].flags & IEEE80211_TX_RC_MCS)) {
-                if (plcp <= AR9170_TX_PHY_RATE_CCK_11M)
-                        plcp |= ((skb->len + FCS_LEN) << (3 + 16)) + 0x0400;
-                else
-                        plcp |= ((skb->len + FCS_LEN) << 16) + 0x0010;
-        } else {
-                ht1 |= AR9170_MAC_BCN_HT1_HT_EN;
-                if (rate->flags & IEEE80211_TX_RC_SHORT_GI)
-                        plcp |= AR9170_MAC_BCN_HT2_SGI;
-
-                if (rate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH) {
-                        ht1 |= AR9170_MAC_BCN_HT1_BWC_40M_SHARED;
-                        plcp |= AR9170_MAC_BCN_HT2_BW40;
-                }
-                if (rate->flags & IEEE80211_TX_RC_DUP_DATA) {
-                        ht1 |= AR9170_MAC_BCN_HT1_BWC_40M_DUP;
-                        plcp |= AR9170_MAC_BCN_HT2_BW40;
-                }
-
-                SET_VAL(AR9170_MAC_BCN_HT2_LEN, plcp, skb->len + FCS_LEN);
-        }
-
-        SET_VAL(AR9170_MAC_BCN_HT1_PWR_CTRL, ht1, 7);
-        SET_VAL(AR9170_MAC_BCN_HT1_TPC, ht1, power);
-        SET_VAL(AR9170_MAC_BCN_HT1_CHAIN_MASK, ht1, chains);
-        if (chains == AR9170_TX_PHY_TXCHAIN_2)
-                ht1 |= AR9170_MAC_BCN_HT1_TX_ANT1;
+        ht_rate = carl9170_tx_beacon_physet(ar, skb, &ht1, &plcp);
 
         carl9170_async_regwrite_begin(ar);
         carl9170_async_regwrite(AR9170_MAC_REG_BCN_HT1, ht1);
-        if (!(txinfo->control.rates[0].flags & IEEE80211_TX_RC_MCS))
-                carl9170_async_regwrite(AR9170_MAC_REG_BCN_PLCP, plcp);
-        else
+        if (ht_rate)
                 carl9170_async_regwrite(AR9170_MAC_REG_BCN_HT2, plcp);
+        else
+                carl9170_async_regwrite(AR9170_MAC_REG_BCN_PLCP, plcp);
 
         for (i = 0; i < DIV_ROUND_UP(skb->len, 4); i++) {
                 /*
diff --git a/drivers/net/wireless/ath/carl9170/version.h b/drivers/net/wireless/ath/carl9170/version.h
index 2ec3e9191e4d..2282847d4bb8 100644
--- a/drivers/net/wireless/ath/carl9170/version.h
+++ b/drivers/net/wireless/ath/carl9170/version.h
@@ -1,7 +1,7 @@
 #ifndef __CARL9170_SHARED_VERSION_H
 #define __CARL9170_SHARED_VERSION_H
 #define CARL9170FW_VERSION_YEAR 12
-#define CARL9170FW_VERSION_MONTH 7
-#define CARL9170FW_VERSION_DAY 7
-#define CARL9170FW_VERSION_GIT "1.9.6"
+#define CARL9170FW_VERSION_MONTH 12
+#define CARL9170FW_VERSION_DAY 15
+#define CARL9170FW_VERSION_GIT "1.9.7"
 #endif /* __CARL9170_SHARED_VERSION_H */
diff --git a/drivers/net/wireless/ath/regd.c b/drivers/net/wireless/ath/regd.c
index d81698015bf7..ccc4c718f124 100644
--- a/drivers/net/wireless/ath/regd.c
+++ b/drivers/net/wireless/ath/regd.c
@@ -195,8 +195,6 @@ ath_reg_apply_beaconing_flags(struct wiphy *wiphy,
         const struct ieee80211_reg_rule *reg_rule;
         struct ieee80211_channel *ch;
         unsigned int i;
-        u32 bandwidth = 0;
-        int r;
 
         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 
@@ -214,11 +212,8 @@ ath_reg_apply_beaconing_flags(struct wiphy *wiphy,
                                 continue;
 
                         if (initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE) {
-                                r = freq_reg_info(wiphy,
-                                                  ch->center_freq,
-                                                  bandwidth,
-                                                  &reg_rule);
-                                if (r)
+                                reg_rule = freq_reg_info(wiphy, ch->center_freq);
+                                if (IS_ERR(reg_rule))
                                         continue;
                                 /*
                                  * If 11d had a rule for this channel ensure
@@ -254,8 +249,6 @@ ath_reg_apply_active_scan_flags(struct wiphy *wiphy,
         struct ieee80211_supported_band *sband;
         struct ieee80211_channel *ch;
         const struct ieee80211_reg_rule *reg_rule;
-        u32 bandwidth = 0;
-        int r;
 
         sband = wiphy->bands[IEEE80211_BAND_2GHZ];
         if (!sband)
@@ -283,16 +276,16 @@ ath_reg_apply_active_scan_flags(struct wiphy *wiphy,
          */
 
         ch = &sband->channels[11]; /* CH 12 */
-        r = freq_reg_info(wiphy, ch->center_freq, bandwidth, &reg_rule);
-        if (!r) {
+        reg_rule = freq_reg_info(wiphy, ch->center_freq);
+        if (!IS_ERR(reg_rule)) {
                 if (!(reg_rule->flags & NL80211_RRF_PASSIVE_SCAN))
                         if (ch->flags & IEEE80211_CHAN_PASSIVE_SCAN)
                                 ch->flags &= ~IEEE80211_CHAN_PASSIVE_SCAN;
         }
 
         ch = &sband->channels[12]; /* CH 13 */
-        r = freq_reg_info(wiphy, ch->center_freq, bandwidth, &reg_rule);
-        if (!r) {
+        reg_rule = freq_reg_info(wiphy, ch->center_freq);
+        if (!IS_ERR(reg_rule)) {
                 if (!(reg_rule->flags & NL80211_RRF_PASSIVE_SCAN))
                         if (ch->flags & IEEE80211_CHAN_PASSIVE_SCAN)
                                 ch->flags &= ~IEEE80211_CHAN_PASSIVE_SCAN;
@@ -363,9 +356,9 @@ static u16 ath_regd_find_country_by_name(char *alpha2)
         return -1;
 }
 
-int ath_reg_notifier_apply(struct wiphy *wiphy,
-                           struct regulatory_request *request,
-                           struct ath_regulatory *reg)
+void ath_reg_notifier_apply(struct wiphy *wiphy,
+                            struct regulatory_request *request,
+                            struct ath_regulatory *reg)
 {
         struct ath_common *common = container_of(reg, struct ath_common,
                                                  regulatory);
@@ -380,7 +373,7 @@ int ath_reg_notifier_apply(struct wiphy *wiphy,
          * any pending requests in the queue.
          */
         if (!request)
-                return 0;
+                return;
 
         switch (request->initiator) {
         case NL80211_REGDOM_SET_BY_CORE:
@@ -416,8 +409,6 @@ int ath_reg_notifier_apply(struct wiphy *wiphy,
 
                 break;
         }
-
-        return 0;
 }
 EXPORT_SYMBOL(ath_reg_notifier_apply);
 
@@ -507,8 +498,8 @@ ath_get_regpair(int regdmn)
 static int
 ath_regd_init_wiphy(struct ath_regulatory *reg,
                     struct wiphy *wiphy,
-                    int (*reg_notifier)(struct wiphy *wiphy,
-                                        struct regulatory_request *request))
+                    void (*reg_notifier)(struct wiphy *wiphy,
+                                         struct regulatory_request *request))
 {
         const struct ieee80211_regdomain *regd;
 
@@ -628,8 +619,8 @@ static int __ath_regd_init(struct ath_regulatory *reg)
 int
 ath_regd_init(struct ath_regulatory *reg,
               struct wiphy *wiphy,
-              int (*reg_notifier)(struct wiphy *wiphy,
-                                  struct regulatory_request *request))
+              void (*reg_notifier)(struct wiphy *wiphy,
+                                   struct regulatory_request *request))
 {
         struct ath_common *common = container_of(reg, struct ath_common,
                                                  regulatory);
diff --git a/drivers/net/wireless/ath/regd.h b/drivers/net/wireless/ath/regd.h
index 03a8268ccf21..37f53bd8fcb1 100644
--- a/drivers/net/wireless/ath/regd.h
+++ b/drivers/net/wireless/ath/regd.h
@@ -252,12 +252,12 @@ enum CountryCode {
 bool ath_is_world_regd(struct ath_regulatory *reg);
 bool ath_is_49ghz_allowed(u16 redomain);
 int ath_regd_init(struct ath_regulatory *reg, struct wiphy *wiphy,
-                  int (*reg_notifier)(struct wiphy *wiphy,
-                  struct regulatory_request *request));
+                  void (*reg_notifier)(struct wiphy *wiphy,
+                                       struct regulatory_request *request));
 u32 ath_regd_get_band_ctl(struct ath_regulatory *reg,
                           enum ieee80211_band band);
-int ath_reg_notifier_apply(struct wiphy *wiphy,
-                           struct regulatory_request *request,
-                           struct ath_regulatory *reg);
+void ath_reg_notifier_apply(struct wiphy *wiphy,
+                            struct regulatory_request *request,
+                            struct ath_regulatory *reg);
 
 #endif
diff --git a/drivers/net/wireless/ath/wil6210/Kconfig b/drivers/net/wireless/ath/wil6210/Kconfig
new file mode 100644
index 000000000000..bac3d98a0cfb
--- /dev/null
+++ b/drivers/net/wireless/ath/wil6210/Kconfig
@@ -0,0 +1,29 @@
+config WIL6210
+        tristate "Wilocity 60g WiFi card wil6210 support"
+        depends on CFG80211
+        depends on PCI
+        default n
+        ---help---
+          This module adds support for wireless adapter based on
+          wil6210 chip by Wilocity. It supports operation on the
+          60 GHz band, covered by the IEEE802.11ad standard.
+
+          http://wireless.kernel.org/en/users/Drivers/wil6210
+
+          If you choose to build it as a module, it will be called
+          wil6210
+
+config WIL6210_ISR_COR
+        bool "Use Clear-On-Read mode for ISR registers for wil6210"
+        depends on WIL6210
+        default y
+        ---help---
+          ISR registers on wil6210 chip may operate in either
+          COR (Clear-On-Read) or W1C (Write-1-to-Clear) mode.
+          For production code, use COR (say y); is default since
+          it saves extra target transaction;
+          For ISR debug, use W1C (say n); is allows to monitor ISR
+          registers with debugfs. If COR were used, ISR would
+          self-clear when accessed for debug purposes, it makes
+          such monitoring impossible.
+          Say y unless you debug interrupts
diff --git a/drivers/net/wireless/ath/wil6210/Makefile b/drivers/net/wireless/ath/wil6210/Makefile
new file mode 100644
index 000000000000..9396dc9fe3c5
--- /dev/null
+++ b/drivers/net/wireless/ath/wil6210/Makefile
@@ -0,0 +1,13 @@
+obj-$(CONFIG_WIL6210) += wil6210.o
+
+wil6210-objs := main.o
+wil6210-objs += netdev.o
+wil6210-objs += cfg80211.o
+wil6210-objs += pcie_bus.o
+wil6210-objs += debugfs.o
+wil6210-objs += wmi.o
+wil6210-objs += interrupt.o
+wil6210-objs += txrx.o
+
+subdir-ccflags-y += -Werror
+subdir-ccflags-y += -D__CHECK_ENDIAN__
diff --git a/drivers/net/wireless/ath/wil6210/cfg80211.c b/drivers/net/wireless/ath/wil6210/cfg80211.c
new file mode 100644
index 000000000000..002851fceb2f
--- /dev/null
+++ b/drivers/net/wireless/ath/wil6210/cfg80211.c
@@ -0,0 +1,572 @@
+/*
+ * Copyright (c) 2012 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/kernel.h>
+#include <linux/netdevice.h>
+#include <linux/sched.h>
+#include <linux/etherdevice.h>
+#include <linux/wireless.h>
+#include <linux/ieee80211.h>
+#include <linux/slab.h>
+#include <linux/version.h>
+#include <net/cfg80211.h>
+
+#include "wil6210.h"
+#include "wmi.h"
+
+#define CHAN60G(_channel, _flags) {                             \
+        .band                   = IEEE80211_BAND_60GHZ,         \
+        .center_freq            = 56160 + (2160 * (_channel)),  \
+        .hw_value               = (_channel),                   \
+        .flags                  = (_flags),                     \
+        .max_antenna_gain       = 0,                            \
+        .max_power              = 40,                           \
+}
+
+static struct ieee80211_channel wil_60ghz_channels[] = {
+        CHAN60G(1, 0),
+        CHAN60G(2, 0),
+        CHAN60G(3, 0),
+/* channel 4 not supported yet */
+};
+
+static struct ieee80211_supported_band wil_band_60ghz = {
+        .channels = wil_60ghz_channels,
+        .n_channels = ARRAY_SIZE(wil_60ghz_channels),
+        .ht_cap = {
+                .ht_supported = true,
+                .cap = 0, /* TODO */
+                .ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K, /* TODO */
+                .ampdu_density = IEEE80211_HT_MPDU_DENSITY_8, /* TODO */
+                .mcs = {
+                                /* MCS 1..12 - SC PHY */
+                        .rx_mask = {0xfe, 0x1f}, /* 1..12 */
+                        .tx_params = IEEE80211_HT_MCS_TX_DEFINED, /* TODO */
+                },
+        },
+};
+
+static const struct ieee80211_txrx_stypes
+wil_mgmt_stypes[NUM_NL80211_IFTYPES] = {
+        [NL80211_IFTYPE_STATION] = {
+                .tx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+                BIT(IEEE80211_STYPE_PROBE_RESP >> 4),
+                .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+                BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
+        },
+        [NL80211_IFTYPE_AP] = {
+                .tx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+                BIT(IEEE80211_STYPE_PROBE_RESP >> 4),
+                .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+                BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
+        },
+        [NL80211_IFTYPE_P2P_CLIENT] = {
+                .tx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+                BIT(IEEE80211_STYPE_PROBE_RESP >> 4),
+                .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+                BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
+        },
+        [NL80211_IFTYPE_P2P_GO] = {
+                .tx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+                BIT(IEEE80211_STYPE_PROBE_RESP >> 4),
+                .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+                BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
+        },
+};
+
+static const u32 wil_cipher_suites[] = {
+        WLAN_CIPHER_SUITE_GCMP,
+};
+
+int wil_iftype_nl2wmi(enum nl80211_iftype type)
+{
+        static const struct {
+                enum nl80211_iftype nl;
+                enum wmi_network_type wmi;
+        } __nl2wmi[] = {
+                {NL80211_IFTYPE_ADHOC,          WMI_NETTYPE_ADHOC},
+                {NL80211_IFTYPE_STATION,        WMI_NETTYPE_INFRA},
+                {NL80211_IFTYPE_AP,             WMI_NETTYPE_AP},
+                {NL80211_IFTYPE_P2P_CLIENT,     WMI_NETTYPE_P2P},
+                {NL80211_IFTYPE_P2P_GO,         WMI_NETTYPE_P2P},
+                {NL80211_IFTYPE_MONITOR,        WMI_NETTYPE_ADHOC}, /* FIXME */
+        };
+        uint i;
+
+        for (i = 0; i < ARRAY_SIZE(__nl2wmi); i++) {
+                if (__nl2wmi[i].nl == type)
+                        return __nl2wmi[i].wmi;
+        }
+
+        return -EOPNOTSUPP;
+}
+
+static int wil_cfg80211_get_station(struct wiphy *wiphy,
+                                    struct net_device *ndev,
+                                    u8 *mac, struct station_info *sinfo)
+{
+        struct wil6210_priv *wil = wiphy_to_wil(wiphy);
+        int rc;
+        struct wmi_notify_req_cmd cmd = {
+                .cid = 0,
+                .interval_usec = 0,
+        };
+
+        if (memcmp(mac, wil->dst_addr[0], ETH_ALEN))
+                return -ENOENT;
+
+        /* WMI_NOTIFY_REQ_DONE_EVENTID handler fills wil->stats.bf_mcs */
+        rc = wmi_call(wil, WMI_NOTIFY_REQ_CMDID, &cmd, sizeof(cmd),
+                      WMI_NOTIFY_REQ_DONE_EVENTID, NULL, 0, 20);
+        if (rc)
+                return rc;
+
+        sinfo->generation = wil->sinfo_gen;
+
+        sinfo->filled |= STATION_INFO_TX_BITRATE;
+        sinfo->txrate.flags = RATE_INFO_FLAGS_MCS | RATE_INFO_FLAGS_60G;
+        sinfo->txrate.mcs = wil->stats.bf_mcs;
+        sinfo->filled |= STATION_INFO_RX_BITRATE;
+        sinfo->rxrate.flags = RATE_INFO_FLAGS_MCS | RATE_INFO_FLAGS_60G;
+        sinfo->rxrate.mcs = wil->stats.last_mcs_rx;
+
+        if (test_bit(wil_status_fwconnected, &wil->status)) {
+                sinfo->filled |= STATION_INFO_SIGNAL;
+                sinfo->signal = 12; /* TODO: provide real value */
+        }
+
+        return 0;
+}
+
+static int wil_cfg80211_change_iface(struct wiphy *wiphy,
+                                     struct net_device *ndev,
+                                     enum nl80211_iftype type, u32 *flags,
+                                     struct vif_params *params)
+{
+        struct wil6210_priv *wil = wiphy_to_wil(wiphy);
+        struct wireless_dev *wdev = wil->wdev;
+
+        switch (type) {
+        case NL80211_IFTYPE_STATION:
+        case NL80211_IFTYPE_AP:
+        case NL80211_IFTYPE_P2P_CLIENT:
+        case NL80211_IFTYPE_P2P_GO:
+                break;
+        case NL80211_IFTYPE_MONITOR:
+                if (flags)
+                        wil->monitor_flags = *flags;
+                else
+                        wil->monitor_flags = 0;
+
+                break;
+        default:
+                return -EOPNOTSUPP;
+        }
+
+        wdev->iftype = type;
+
+        return 0;
+}
+
+static int wil_cfg80211_scan(struct wiphy *wiphy,
+                             struct cfg80211_scan_request *request)
+{
+        struct wil6210_priv *wil = wiphy_to_wil(wiphy);
+        struct wireless_dev *wdev = wil->wdev;
+        struct {
+                struct wmi_start_scan_cmd cmd;
+                u16 chnl[4];
+        } __packed cmd;
+        uint i, n;
+
+        if (wil->scan_request) {
+                wil_err(wil, "Already scanning\n");
+                return -EAGAIN;
+        }
+
+        /* check we are client side */
+        switch (wdev->iftype) {
+        case NL80211_IFTYPE_STATION:
+        case NL80211_IFTYPE_P2P_CLIENT:
+                break;
+        default:
+                return -EOPNOTSUPP;
+        }
+
+        /* FW don't support scan after connection attempt */
+        if (test_bit(wil_status_dontscan, &wil->status)) {
+                wil_err(wil, "Scan after connect attempt not supported\n");
+                return -EBUSY;
+        }
+
+        wil->scan_request = request;
+
+        memset(&cmd, 0, sizeof(cmd));
+        cmd.cmd.num_channels = 0;
+        n = min(request->n_channels, 4U);
+        for (i = 0; i < n; i++) {
+                int ch = request->channels[i]->hw_value;
+                if (ch == 0) {
+                        wil_err(wil,
+                                "Scan requested for unknown frequency %dMhz\n",
+                                request->channels[i]->center_freq);
+                        continue;
+                }
+                /* 0-based channel indexes */
+                cmd.cmd.channel_list[cmd.cmd.num_channels++].channel = ch - 1;
+                wil_dbg_misc(wil, "Scan for ch %d  : %d MHz\n", ch,
+                             request->channels[i]->center_freq);
+        }
+
+        return wmi_send(wil, WMI_START_SCAN_CMDID, &cmd, sizeof(cmd.cmd) +
+                        cmd.cmd.num_channels * sizeof(cmd.cmd.channel_list[0]));
+}
+
+static int wil_cfg80211_connect(struct wiphy *wiphy,
+                                struct net_device *ndev,
+                                struct cfg80211_connect_params *sme)
+{
+        struct wil6210_priv *wil = wiphy_to_wil(wiphy);
+        struct cfg80211_bss *bss;
+        struct wmi_connect_cmd conn;
+        const u8 *ssid_eid;
+        const u8 *rsn_eid;
+        int ch;
+        int rc = 0;
+
+        bss = cfg80211_get_bss(wiphy, sme->channel, sme->bssid,
+                               sme->ssid, sme->ssid_len,
+                               WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
+        if (!bss) {
+                wil_err(wil, "Unable to find BSS\n");
+                return -ENOENT;
+        }
+
+        ssid_eid = ieee80211_bss_get_ie(bss, WLAN_EID_SSID);
+        if (!ssid_eid) {
+                wil_err(wil, "No SSID\n");
+                rc = -ENOENT;
+                goto out;
+        }
+
+        rsn_eid = sme->ie ?
+                        cfg80211_find_ie(WLAN_EID_RSN, sme->ie, sme->ie_len) :
+                        NULL;
+        if (rsn_eid) {
+                if (sme->ie_len > WMI_MAX_IE_LEN) {
+                        rc = -ERANGE;
+                        wil_err(wil, "IE too large (%td bytes)\n",
+                                sme->ie_len);
+                        goto out;
+                }
+                /*
+                 * For secure assoc, send:
+                 * (1) WMI_DELETE_CIPHER_KEY_CMD
+                 * (2) WMI_SET_APPIE_CMD
+                 */
+                rc = wmi_del_cipher_key(wil, 0, bss->bssid);
+                if (rc) {
+                        wil_err(wil, "WMI_DELETE_CIPHER_KEY_CMD failed\n");
+                        goto out;
+                }
+                /* WMI_SET_APPIE_CMD */
+                rc = wmi_set_ie(wil, WMI_FRAME_ASSOC_REQ, sme->ie_len, sme->ie);
+                if (rc) {
+                        wil_err(wil, "WMI_SET_APPIE_CMD failed\n");
+                        goto out;
+                }
+        }
+
+        /* WMI_CONNECT_CMD */
+        memset(&conn, 0, sizeof(conn));
+        switch (bss->capability & 0x03) {
+        case WLAN_CAPABILITY_DMG_TYPE_AP:
+                conn.network_type = WMI_NETTYPE_INFRA;
+                break;
+        case WLAN_CAPABILITY_DMG_TYPE_PBSS:
+                conn.network_type = WMI_NETTYPE_P2P;
+                break;
+        default:
+                wil_err(wil, "Unsupported BSS type, capability= 0x%04x\n",
+                        bss->capability);
+                goto out;
+        }
+        if (rsn_eid) {
+                conn.dot11_auth_mode = WMI_AUTH11_SHARED;
+                conn.auth_mode = WMI_AUTH_WPA2_PSK;
+                conn.pairwise_crypto_type = WMI_CRYPT_AES_GCMP;
+                conn.pairwise_crypto_len = 16;
+        } else {
+                conn.dot11_auth_mode = WMI_AUTH11_OPEN;
+                conn.auth_mode = WMI_AUTH_NONE;
+        }
+
+        conn.ssid_len = min_t(u8, ssid_eid[1], 32);
+        memcpy(conn.ssid, ssid_eid+2, conn.ssid_len);
+
+        ch = bss->channel->hw_value;
+        if (ch == 0) {
+                wil_err(wil, "BSS at unknown frequency %dMhz\n",
+                        bss->channel->center_freq);
+                rc = -EOPNOTSUPP;
+                goto out;
+        }
+        conn.channel = ch - 1;
+
+        memcpy(conn.bssid, bss->bssid, 6);
+        memcpy(conn.dst_mac, bss->bssid, 6);
+        /*
+         * FW don't support scan after connection attempt
+         */
+        set_bit(wil_status_dontscan, &wil->status);
+
+        rc = wmi_send(wil, WMI_CONNECT_CMDID, &conn, sizeof(conn));
+        if (rc == 0) {
+                /* Connect can take lots of time */
+                mod_timer(&wil->connect_timer,
+                          jiffies + msecs_to_jiffies(2000));
+        }
+
+ out:
+        cfg80211_put_bss(bss);
+
+        return rc;
+}
+
+static int wil_cfg80211_disconnect(struct wiphy *wiphy,
+                                   struct net_device *ndev,
+                                   u16 reason_code)
+{
+        int rc;
+        struct wil6210_priv *wil = wiphy_to_wil(wiphy);
+
+        rc = wmi_send(wil, WMI_DISCONNECT_CMDID, NULL, 0);
+
+        return rc;
+}
+
+static int wil_cfg80211_set_channel(struct wiphy *wiphy,
+                                    struct cfg80211_chan_def *chandef)
+{
+        struct wil6210_priv *wil = wiphy_to_wil(wiphy);
+        struct wireless_dev *wdev = wil->wdev;
+
+        wdev->preset_chandef = *chandef;
+
+        return 0;
+}
+
+static int wil_cfg80211_add_key(struct wiphy *wiphy,
+                                struct net_device *ndev,
+                                u8 key_index, bool pairwise,
+                                const u8 *mac_addr,
+                                struct key_params *params)
+{
+        struct wil6210_priv *wil = wiphy_to_wil(wiphy);
+
+        /* group key is not used */
+        if (!pairwise)
+                return 0;
+
+        return wmi_add_cipher_key(wil, key_index, mac_addr,
+                                  params->key_len, params->key);
+}
+
+static int wil_cfg80211_del_key(struct wiphy *wiphy,
+                                struct net_device *ndev,
+                                u8 key_index, bool pairwise,
+                                const u8 *mac_addr)
+{
+        struct wil6210_priv *wil = wiphy_to_wil(wiphy);
+
+        /* group key is not used */
+        if (!pairwise)
+                return 0;
+
+        return wmi_del_cipher_key(wil, key_index, mac_addr);
+}
+
+/* Need to be present or wiphy_new() will WARN */
+static int wil_cfg80211_set_default_key(struct wiphy *wiphy,
+                                        struct net_device *ndev,
+                                        u8 key_index, bool unicast,
+                                        bool multicast)
+{
+        return 0;
+}
+
+static int wil_cfg80211_start_ap(struct wiphy *wiphy,
+                                 struct net_device *ndev,
+                                 struct cfg80211_ap_settings *info)
+{
+        int rc = 0;
+        struct wil6210_priv *wil = wiphy_to_wil(wiphy);
+        struct wireless_dev *wdev = ndev->ieee80211_ptr;
+        struct ieee80211_channel *channel = info->chandef.chan;
+        struct cfg80211_beacon_data *bcon = &info->beacon;
+        u8 wmi_nettype = wil_iftype_nl2wmi(wdev->iftype);
+
+        if (!channel) {
+                wil_err(wil, "AP: No channel???\n");
+                return -EINVAL;
+        }
+
+        wil_dbg_misc(wil, "AP on Channel %d %d MHz, %s\n", channel->hw_value,
+                     channel->center_freq, info->privacy ? "secure" : "open");
+        print_hex_dump_bytes("SSID ", DUMP_PREFIX_OFFSET,
+                             info->ssid, info->ssid_len);
+
+        rc = wil_reset(wil);
+        if (rc)
+                return rc;
+
+        rc = wmi_set_ssid(wil, info->ssid_len, info->ssid);
+        if (rc)
+                return rc;
+
+        rc = wmi_set_channel(wil, channel->hw_value);
+        if (rc)
+                return rc;
+
+        /* MAC address - pre-requisite for other commands */
+        wmi_set_mac_address(wil, ndev->dev_addr);
+
+        /* IE's */
+        /* bcon 'head IE's are not relevant for 60g band */
+        wmi_set_ie(wil, WMI_FRAME_BEACON, bcon->beacon_ies_len,
+                   bcon->beacon_ies);
+        wmi_set_ie(wil, WMI_FRAME_PROBE_RESP, bcon->proberesp_ies_len,
+                   bcon->proberesp_ies);
+        wmi_set_ie(wil, WMI_FRAME_ASSOC_RESP, bcon->assocresp_ies_len,
+                   bcon->assocresp_ies);
+
+        wil->secure_pcp = info->privacy;
+
+        rc = wmi_set_bcon(wil, info->beacon_interval, wmi_nettype);
+        if (rc)
+                return rc;
+
+        /* Rx VRING. After MAC and beacon */
+        rc = wil_rx_init(wil);
+
+        netif_carrier_on(ndev);
+
+        return rc;
+}
+
+static int wil_cfg80211_stop_ap(struct wiphy *wiphy,
+                                struct net_device *ndev)
+{
+        int rc = 0;
+        struct wil6210_priv *wil = wiphy_to_wil(wiphy);
+        struct wireless_dev *wdev = ndev->ieee80211_ptr;
+        u8 wmi_nettype = wil_iftype_nl2wmi(wdev->iftype);
+
+        /* To stop beaconing, set BI to 0 */
+        rc = wmi_set_bcon(wil, 0, wmi_nettype);
+
+        return rc;
+}
+
+static struct cfg80211_ops wil_cfg80211_ops = {
+        .scan = wil_cfg80211_scan,
+        .connect = wil_cfg80211_connect,
+        .disconnect = wil_cfg80211_disconnect,
+        .change_virtual_intf = wil_cfg80211_change_iface,
+        .get_station = wil_cfg80211_get_station,
+        .set_monitor_channel = wil_cfg80211_set_channel,
+        .add_key = wil_cfg80211_add_key,
+        .del_key = wil_cfg80211_del_key,
+        .set_default_key = wil_cfg80211_set_default_key,
+        /* AP mode */
+        .start_ap = wil_cfg80211_start_ap,
+        .stop_ap = wil_cfg80211_stop_ap,
+};
+
+static void wil_wiphy_init(struct wiphy *wiphy)
+{
+        /* TODO: set real value */
+        wiphy->max_scan_ssids = 10;
+        wiphy->max_num_pmkids = 0 /* TODO: */;
+        wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
+                                 BIT(NL80211_IFTYPE_AP) |
+                                 BIT(NL80211_IFTYPE_MONITOR);
+        /* TODO: enable P2P when integrated with supplicant:
+         * BIT(NL80211_IFTYPE_P2P_CLIENT) | BIT(NL80211_IFTYPE_P2P_GO)
+         */
+        wiphy->flags |= WIPHY_FLAG_HAVE_AP_SME |
+                        WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD;
+        dev_warn(wiphy_dev(wiphy), "%s : flags = 0x%08x\n",
+                 __func__, wiphy->flags);
+        wiphy->probe_resp_offload =
+                NL80211_PROBE_RESP_OFFLOAD_SUPPORT_WPS |
+                NL80211_PROBE_RESP_OFFLOAD_SUPPORT_WPS2 |
+                NL80211_PROBE_RESP_OFFLOAD_SUPPORT_P2P;
+
+        wiphy->bands[IEEE80211_BAND_60GHZ] = &wil_band_60ghz;
+
+        /* TODO: figure this out */
+        wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
+
+        wiphy->cipher_suites = wil_cipher_suites;
+        wiphy->n_cipher_suites = ARRAY_SIZE(wil_cipher_suites);
+        wiphy->mgmt_stypes = wil_mgmt_stypes;
+}
+
+struct wireless_dev *wil_cfg80211_init(struct device *dev)
+{
+        int rc = 0;
+        struct wireless_dev *wdev;
+
+        wdev = kzalloc(sizeof(struct wireless_dev), GFP_KERNEL);
+        if (!wdev)
+                return ERR_PTR(-ENOMEM);
+
+        wdev->wiphy = wiphy_new(&wil_cfg80211_ops,
+                                sizeof(struct wil6210_priv));
+        if (!wdev->wiphy) {
+                rc = -ENOMEM;
+                goto out;
+        }
+
+        set_wiphy_dev(wdev->wiphy, dev);
+        wil_wiphy_init(wdev->wiphy);
+
+        rc = wiphy_register(wdev->wiphy);
+        if (rc < 0)
+                goto out_failed_reg;
+
+        return wdev;
+
+out_failed_reg:
+        wiphy_free(wdev->wiphy);
+out:
+        kfree(wdev);
+
+        return ERR_PTR(rc);
+}
+
+void wil_wdev_free(struct wil6210_priv *wil)
+{
+        struct wireless_dev *wdev = wil_to_wdev(wil);
+
+        if (!wdev)
+                return;
+
+        wiphy_unregister(wdev->wiphy);
+        wiphy_free(wdev->wiphy);
+        kfree(wdev);
+}
diff --git a/drivers/net/wireless/ath/wil6210/dbg_hexdump.h b/drivers/net/wireless/ath/wil6210/dbg_hexdump.h
new file mode 100644
index 000000000000..6a315ba5aa7d
--- /dev/null
+++ b/drivers/net/wireless/ath/wil6210/dbg_hexdump.h
@@ -0,0 +1,30 @@
+#ifndef WIL_DBG_HEXDUMP_H_
+#define WIL_DBG_HEXDUMP_H_
+
+#if defined(CONFIG_DYNAMIC_DEBUG)
+#define wil_dynamic_hex_dump(prefix_str, prefix_type, rowsize,  \
+                             groupsize, buf, len, ascii)        \
+do {                                                            \
+        DEFINE_DYNAMIC_DEBUG_METADATA(descriptor,               \
+                __builtin_constant_p(prefix_str) ? prefix_str : "hexdump");\
+        if (unlikely(descriptor.flags & _DPRINTK_FLAGS_PRINT))  \
+                print_hex_dump(KERN_DEBUG, prefix_str,          \
+                               prefix_type, rowsize, groupsize, \
+                               buf, len, ascii);                \
+} while (0)
+
+#define wil_print_hex_dump_debug(prefix_str, prefix_type, rowsize,      \
+                                 groupsize, buf, len, ascii)            \
+        wil_dynamic_hex_dump(prefix_str, prefix_type, rowsize,          \
+                             groupsize, buf, len, ascii)
+
+#define print_hex_dump_bytes(prefix_str, prefix_type, buf, len) \
+        wil_dynamic_hex_dump(prefix_str, prefix_type, 16, 1, buf, len, true)
+#else /* defined(CONFIG_DYNAMIC_DEBUG) */
+#define wil_print_hex_dump_debug(prefix_str, prefix_type, rowsize,      \
+                                 groupsize, buf, len, ascii)            \
+        print_hex_dump(KERN_DEBUG, prefix_str, prefix_type, rowsize,    \
+                       groupsize, buf, len, ascii)
+#endif /* defined(CONFIG_DYNAMIC_DEBUG) */
+
+#endif /* WIL_DBG_HEXDUMP_H_ */
diff --git a/drivers/net/wireless/ath/wil6210/debugfs.c b/drivers/net/wireless/ath/wil6210/debugfs.c
new file mode 100644
index 000000000000..65fc9683bfd8
--- /dev/null
+++ b/drivers/net/wireless/ath/wil6210/debugfs.c
@@ -0,0 +1,603 @@
+/*
+ * Copyright (c) 2012 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/module.h>
+#include <linux/debugfs.h>
+#include <linux/seq_file.h>
+#include <linux/pci.h>
+#include <linux/rtnetlink.h>
+
+#include "wil6210.h"
+#include "txrx.h"
+
+/* Nasty hack. Better have per device instances */
+static u32 mem_addr;
+static u32 dbg_txdesc_index;
+
+static void wil_print_vring(struct seq_file *s, struct wil6210_priv *wil,
+                            const char *name, struct vring *vring)
+{
+        void __iomem *x = wmi_addr(wil, vring->hwtail);
+
+        seq_printf(s, "VRING %s = {\n", name);
+        seq_printf(s, "  pa     = 0x%016llx\n", (unsigned long long)vring->pa);
+        seq_printf(s, "  va     = 0x%p\n", vring->va);
+        seq_printf(s, "  size   = %d\n", vring->size);
+        seq_printf(s, "  swtail = %d\n", vring->swtail);
+        seq_printf(s, "  swhead = %d\n", vring->swhead);
+        seq_printf(s, "  hwtail = [0x%08x] -> ", vring->hwtail);
+        if (x)
+                seq_printf(s, "0x%08x\n", ioread32(x));
+        else
+                seq_printf(s, "???\n");
+
+        if (vring->va && (vring->size < 1025)) {
+                uint i;
+                for (i = 0; i < vring->size; i++) {
+                        volatile struct vring_tx_desc *d = &vring->va[i].tx;
+                        if ((i % 64) == 0 && (i != 0))
+                                seq_printf(s, "\n");
+                        seq_printf(s, "%s", (d->dma.status & BIT(0)) ?
+                                        "S" : (vring->ctx[i] ? "H" : "h"));
+                }
+                seq_printf(s, "\n");
+        }
+        seq_printf(s, "}\n");
+}
+
+static int wil_vring_debugfs_show(struct seq_file *s, void *data)
+{
+        uint i;
+        struct wil6210_priv *wil = s->private;
+
+        wil_print_vring(s, wil, "rx", &wil->vring_rx);
+
+        for (i = 0; i < ARRAY_SIZE(wil->vring_tx); i++) {
+                struct vring *vring = &(wil->vring_tx[i]);
+                if (vring->va) {
+                        char name[10];
+                        snprintf(name, sizeof(name), "tx_%2d", i);
+                        wil_print_vring(s, wil, name, vring);
+                }
+        }
+
+        return 0;
+}
+
+static int wil_vring_seq_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, wil_vring_debugfs_show, inode->i_private);
+}
+
+static const struct file_operations fops_vring = {
+        .open           = wil_vring_seq_open,
+        .release        = single_release,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+};
+
+static void wil_print_ring(struct seq_file *s, const char *prefix,
+                           void __iomem *off)
+{
+        struct wil6210_priv *wil = s->private;
+        struct wil6210_mbox_ring r;
+        int rsize;
+        uint i;
+
+        wil_memcpy_fromio_32(&r, off, sizeof(r));
+        wil_mbox_ring_le2cpus(&r);
+        /*
+         * we just read memory block from NIC. This memory may be
+         * garbage. Check validity before using it.
+         */
+        rsize = r.size / sizeof(struct wil6210_mbox_ring_desc);
+
+        seq_printf(s, "ring %s = {\n", prefix);
+        seq_printf(s, "  base = 0x%08x\n", r.base);
+        seq_printf(s, "  size = 0x%04x bytes -> %d entries\n", r.size, rsize);
+        seq_printf(s, "  tail = 0x%08x\n", r.tail);
+        seq_printf(s, "  head = 0x%08x\n", r.head);
+        seq_printf(s, "  entry size = %d\n", r.entry_size);
+
+        if (r.size % sizeof(struct wil6210_mbox_ring_desc)) {
+                seq_printf(s, "  ??? size is not multiple of %zd, garbage?\n",
+                           sizeof(struct wil6210_mbox_ring_desc));
+                goto out;
+        }
+
+        if (!wmi_addr(wil, r.base) ||
+            !wmi_addr(wil, r.tail) ||
+            !wmi_addr(wil, r.head)) {
+                seq_printf(s, "  ??? pointers are garbage?\n");
+                goto out;
+        }
+
+        for (i = 0; i < rsize; i++) {
+                struct wil6210_mbox_ring_desc d;
+                struct wil6210_mbox_hdr hdr;
+                size_t delta = i * sizeof(d);
+                void __iomem *x = wil->csr + HOSTADDR(r.base) + delta;
+
+                wil_memcpy_fromio_32(&d, x, sizeof(d));
+
+                seq_printf(s, "  [%2x] %s %s%s 0x%08x", i,
+                           d.sync ? "F" : "E",
+                           (r.tail - r.base == delta) ? "t" : " ",
+                           (r.head - r.base == delta) ? "h" : " ",
+                           le32_to_cpu(d.addr));
+                if (0 == wmi_read_hdr(wil, d.addr, &hdr)) {
+                        u16 len = le16_to_cpu(hdr.len);
+                        seq_printf(s, " -> %04x %04x %04x %02x\n",
+                                   le16_to_cpu(hdr.seq), len,
+                                   le16_to_cpu(hdr.type), hdr.flags);
+                        if (len <= MAX_MBOXITEM_SIZE) {
+                                int n = 0;
+                                unsigned char printbuf[16 * 3 + 2];
+                                unsigned char databuf[MAX_MBOXITEM_SIZE];
+                                void __iomem *src = wmi_buffer(wil, d.addr) +
+                                        sizeof(struct wil6210_mbox_hdr);
+                                /*
+                                 * No need to check @src for validity -
+                                 * we already validated @d.addr while
+                                 * reading header
+                                 */
+                                wil_memcpy_fromio_32(databuf, src, len);
+                                while (n < len) {
+                                        int l = min(len - n, 16);
+                                        hex_dump_to_buffer(databuf + n, l,
+                                                           16, 1, printbuf,
+                                                           sizeof(printbuf),
+                                                           false);
+                                        seq_printf(s, "      : %s\n", printbuf);
+                                        n += l;
+                                }
+                        }
+                } else {
+                        seq_printf(s, "\n");
+                }
+        }
+ out:
+        seq_printf(s, "}\n");
+}
+
+static int wil_mbox_debugfs_show(struct seq_file *s, void *data)
+{
+        struct wil6210_priv *wil = s->private;
+
+        wil_print_ring(s, "tx", wil->csr + HOST_MBOX +
+                       offsetof(struct wil6210_mbox_ctl, tx));
+        wil_print_ring(s, "rx", wil->csr + HOST_MBOX +
+                       offsetof(struct wil6210_mbox_ctl, rx));
+
+        return 0;
+}
+
+static int wil_mbox_seq_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, wil_mbox_debugfs_show, inode->i_private);
+}
+
+static const struct file_operations fops_mbox = {
+        .open           = wil_mbox_seq_open,
+        .release        = single_release,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+};
+
+static int wil_debugfs_iomem_x32_set(void *data, u64 val)
+{
+        iowrite32(val, (void __iomem *)data);
+        wmb(); /* make sure write propagated to HW */
+
+        return 0;
+}
+
+static int wil_debugfs_iomem_x32_get(void *data, u64 *val)
+{
+        *val = ioread32((void __iomem *)data);
+
+        return 0;
+}
+
+DEFINE_SIMPLE_ATTRIBUTE(fops_iomem_x32, wil_debugfs_iomem_x32_get,
+                        wil_debugfs_iomem_x32_set, "0x%08llx\n");
+
+static struct dentry *wil_debugfs_create_iomem_x32(const char *name,
+                                                   mode_t mode,
+                                                   struct dentry *parent,
+                                                   void __iomem *value)
+{
+        return debugfs_create_file(name, mode, parent, (void * __force)value,
+                                   &fops_iomem_x32);
+}
+
+static int wil6210_debugfs_create_ISR(struct wil6210_priv *wil,
+                                      const char *name,
+                                      struct dentry *parent, u32 off)
+{
+        struct dentry *d = debugfs_create_dir(name, parent);
+
+        if (IS_ERR_OR_NULL(d))
+                return -ENODEV;
+
+        wil_debugfs_create_iomem_x32("ICC", S_IRUGO | S_IWUSR, d,
+                                     wil->csr + off);
+        wil_debugfs_create_iomem_x32("ICR", S_IRUGO | S_IWUSR, d,
+                                     wil->csr + off + 4);
+        wil_debugfs_create_iomem_x32("ICM", S_IRUGO | S_IWUSR, d,
+                                     wil->csr + off + 8);
+        wil_debugfs_create_iomem_x32("ICS", S_IWUSR, d,
+                                     wil->csr + off + 12);
+        wil_debugfs_create_iomem_x32("IMV", S_IRUGO | S_IWUSR, d,
+                                     wil->csr + off + 16);
+        wil_debugfs_create_iomem_x32("IMS", S_IWUSR, d,
+                                     wil->csr + off + 20);
+        wil_debugfs_create_iomem_x32("IMC", S_IWUSR, d,
+                                     wil->csr + off + 24);
+
+        return 0;
+}
+
+static int wil6210_debugfs_create_pseudo_ISR(struct wil6210_priv *wil,
+                                             struct dentry *parent)
+{
+        struct dentry *d = debugfs_create_dir("PSEUDO_ISR", parent);
+
+        if (IS_ERR_OR_NULL(d))
+                return -ENODEV;
+
+        wil_debugfs_create_iomem_x32("CAUSE", S_IRUGO, d, wil->csr +
+                                     HOSTADDR(RGF_DMA_PSEUDO_CAUSE));
+        wil_debugfs_create_iomem_x32("MASK_SW", S_IRUGO, d, wil->csr +
+                                     HOSTADDR(RGF_DMA_PSEUDO_CAUSE_MASK_SW));
+        wil_debugfs_create_iomem_x32("MASK_FW", S_IRUGO, d, wil->csr +
+                                     HOSTADDR(RGF_DMA_PSEUDO_CAUSE_MASK_FW));
+
+        return 0;
+}
+
+static int wil6210_debugfs_create_ITR_CNT(struct wil6210_priv *wil,
+                                          struct dentry *parent)
+{
+        struct dentry *d = debugfs_create_dir("ITR_CNT", parent);
+
+        if (IS_ERR_OR_NULL(d))
+                return -ENODEV;
+
+        wil_debugfs_create_iomem_x32("TRSH", S_IRUGO, d, wil->csr +
+                                     HOSTADDR(RGF_DMA_ITR_CNT_TRSH));
+        wil_debugfs_create_iomem_x32("DATA", S_IRUGO, d, wil->csr +
+                                     HOSTADDR(RGF_DMA_ITR_CNT_DATA));
+        wil_debugfs_create_iomem_x32("CTL", S_IRUGO, d, wil->csr +
+                                     HOSTADDR(RGF_DMA_ITR_CNT_CRL));
+
+        return 0;
+}
+
+static int wil_memread_debugfs_show(struct seq_file *s, void *data)
+{
+        struct wil6210_priv *wil = s->private;
+        void __iomem *a = wmi_buffer(wil, cpu_to_le32(mem_addr));
+
+        if (a)
+                seq_printf(s, "[0x%08x] = 0x%08x\n", mem_addr, ioread32(a));
+        else
+                seq_printf(s, "[0x%08x] = INVALID\n", mem_addr);
+
+        return 0;
+}
+
+static int wil_memread_seq_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, wil_memread_debugfs_show, inode->i_private);
+}
+
+static const struct file_operations fops_memread = {
+        .open           = wil_memread_seq_open,
+        .release        = single_release,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+};
+
+static int wil_default_open(struct inode *inode, struct file *file)
+{
+        if (inode->i_private)
+                file->private_data = inode->i_private;
+
+        return 0;
+}
+
+static ssize_t wil_read_file_ioblob(struct file *file, char __user *user_buf,
+                                size_t count, loff_t *ppos)
+{
+        enum { max_count = 4096 };
+        struct debugfs_blob_wrapper *blob = file->private_data;
+        loff_t pos = *ppos;
+        size_t available = blob->size;
+        void *buf;
+        size_t ret;
+
+        if (pos < 0)
+                return -EINVAL;
+
+        if (pos >= available || !count)
+                return 0;
+
+        if (count > available - pos)
+                count = available - pos;
+        if (count > max_count)
+                count = max_count;
+
+        buf = kmalloc(count, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
+        wil_memcpy_fromio_32(buf, (const volatile void __iomem *)blob->data +
+                             pos, count);
+
+        ret = copy_to_user(user_buf, buf, count);
+        kfree(buf);
+        if (ret == count)
+                return -EFAULT;
+
+        count -= ret;
+        *ppos = pos + count;
+
+        return count;
+}
+
+static const struct file_operations fops_ioblob = {
+        .read =         wil_read_file_ioblob,
+        .open =         wil_default_open,
+        .llseek =       default_llseek,
+};
+
+static
+struct dentry *wil_debugfs_create_ioblob(const char *name,
+                                         mode_t mode,
+                                         struct dentry *parent,
+                                         struct debugfs_blob_wrapper *blob)
+{
+        return debugfs_create_file(name, mode, parent, blob, &fops_ioblob);
+}
+/*---reset---*/
+static ssize_t wil_write_file_reset(struct file *file, const char __user *buf,
+                                    size_t len, loff_t *ppos)
+{
+        struct wil6210_priv *wil = file->private_data;
+        struct net_device *ndev = wil_to_ndev(wil);
+
+        /**
+         * BUG:
+         * this code does NOT sync device state with the rest of system
+         * use with care, debug only!!!
+         */
+        rtnl_lock();
+        dev_close(ndev);
+        ndev->flags &= ~IFF_UP;
+        rtnl_unlock();
+        wil_reset(wil);
+
+        return len;
+}
+
+static const struct file_operations fops_reset = {
+        .write = wil_write_file_reset,
+        .open  = wil_default_open,
+};
+/*---------Tx descriptor------------*/
+
+static int wil_txdesc_debugfs_show(struct seq_file *s, void *data)
+{
+        struct wil6210_priv *wil = s->private;
+        struct vring *vring = &(wil->vring_tx[0]);
+
+        if (!vring->va) {
+                seq_printf(s, "No Tx VRING\n");
+                return 0;
+        }
+
+        if (dbg_txdesc_index < vring->size) {
+                volatile struct vring_tx_desc *d =
+                                &(vring->va[dbg_txdesc_index].tx);
+                volatile u32 *u = (volatile u32 *)d;
+                struct sk_buff *skb = vring->ctx[dbg_txdesc_index];
+
+                seq_printf(s, "Tx[%3d] = {\n", dbg_txdesc_index);
+                seq_printf(s, "  MAC = 0x%08x 0x%08x 0x%08x 0x%08x\n",
+                           u[0], u[1], u[2], u[3]);
+                seq_printf(s, "  DMA = 0x%08x 0x%08x 0x%08x 0x%08x\n",
+                           u[4], u[5], u[6], u[7]);
+                seq_printf(s, "  SKB = %p\n", skb);
+
+                if (skb) {
+                        unsigned char printbuf[16 * 3 + 2];
+                        int i = 0;
+                        int len = skb_headlen(skb);
+                        void *p = skb->data;
+
+                        seq_printf(s, "    len = %d\n", len);
+
+                        while (i < len) {
+                                int l = min(len - i, 16);
+                                hex_dump_to_buffer(p + i, l, 16, 1, printbuf,
+                                                   sizeof(printbuf), false);
+                                seq_printf(s, "      : %s\n", printbuf);
+                                i += l;
+                        }
+                }
+                seq_printf(s, "}\n");
+        } else {
+                seq_printf(s, "TxDesc index (%d) >= size (%d)\n",
+                           dbg_txdesc_index, vring->size);
+        }
+
+        return 0;
+}
+
+static int wil_txdesc_seq_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, wil_txdesc_debugfs_show, inode->i_private);
+}
+
+static const struct file_operations fops_txdesc = {
+        .open           = wil_txdesc_seq_open,
+        .release        = single_release,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+};
+
+/*---------beamforming------------*/
+static int wil_bf_debugfs_show(struct seq_file *s, void *data)
+{
+        struct wil6210_priv *wil = s->private;
+        seq_printf(s,
+                   "TSF : 0x%016llx\n"
+                   "TxMCS : %d\n"
+                   "Sectors(rx:tx) my %2d:%2d peer %2d:%2d\n",
+                   wil->stats.tsf, wil->stats.bf_mcs,
+                   wil->stats.my_rx_sector, wil->stats.my_tx_sector,
+                   wil->stats.peer_rx_sector, wil->stats.peer_tx_sector);
+        return 0;
+}
+
+static int wil_bf_seq_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, wil_bf_debugfs_show, inode->i_private);
+}
+
+static const struct file_operations fops_bf = {
+        .open           = wil_bf_seq_open,
+        .release        = single_release,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+};
+/*---------SSID------------*/
+static ssize_t wil_read_file_ssid(struct file *file, char __user *user_buf,
+                                  size_t count, loff_t *ppos)
+{
+        struct wil6210_priv *wil = file->private_data;
+        struct wireless_dev *wdev = wil_to_wdev(wil);
+
+        return simple_read_from_buffer(user_buf, count, ppos,
+                                       wdev->ssid, wdev->ssid_len);
+}
+
+static ssize_t wil_write_file_ssid(struct file *file, const char __user *buf,
+                                   size_t count, loff_t *ppos)
+{
+        struct wil6210_priv *wil = file->private_data;
+        struct wireless_dev *wdev = wil_to_wdev(wil);
+        struct net_device *ndev = wil_to_ndev(wil);
+
+        if (*ppos != 0) {
+                wil_err(wil, "Unable to set SSID substring from [%d]\n",
+                        (int)*ppos);
+                return -EINVAL;
+        }
+
+        if (count > sizeof(wdev->ssid)) {
+                wil_err(wil, "SSID too long, len = %d\n", (int)count);
+                return -EINVAL;
+        }
+        if (netif_running(ndev)) {
+                wil_err(wil, "Unable to change SSID on running interface\n");
+                return -EINVAL;
+        }
+
+        wdev->ssid_len = count;
+        return simple_write_to_buffer(wdev->ssid, wdev->ssid_len, ppos,
+                                      buf, count);
+}
+
+static const struct file_operations fops_ssid = {
+        .read = wil_read_file_ssid,
+        .write = wil_write_file_ssid,
+        .open  = wil_default_open,
+};
+
+/*----------------*/
+int wil6210_debugfs_init(struct wil6210_priv *wil)
+{
+        struct dentry *dbg = wil->debug = debugfs_create_dir(WIL_NAME,
+                        wil_to_wiphy(wil)->debugfsdir);
+
+        if (IS_ERR_OR_NULL(dbg))
+                return -ENODEV;
+
+        debugfs_create_file("mbox", S_IRUGO, dbg, wil, &fops_mbox);
+        debugfs_create_file("vrings", S_IRUGO, dbg, wil, &fops_vring);
+        debugfs_create_file("txdesc", S_IRUGO, dbg, wil, &fops_txdesc);
+        debugfs_create_u32("txdesc_index", S_IRUGO | S_IWUSR, dbg,
+                           &dbg_txdesc_index);
+        debugfs_create_file("bf", S_IRUGO, dbg, wil, &fops_bf);
+        debugfs_create_file("ssid", S_IRUGO | S_IWUSR, dbg, wil, &fops_ssid);
+        debugfs_create_u32("secure_pcp", S_IRUGO | S_IWUSR, dbg,
+                           &wil->secure_pcp);
+
+        wil6210_debugfs_create_ISR(wil, "USER_ICR", dbg,
+                                   HOSTADDR(RGF_USER_USER_ICR));
+        wil6210_debugfs_create_ISR(wil, "DMA_EP_TX_ICR", dbg,
+                                   HOSTADDR(RGF_DMA_EP_TX_ICR));
+        wil6210_debugfs_create_ISR(wil, "DMA_EP_RX_ICR", dbg,
+                                   HOSTADDR(RGF_DMA_EP_RX_ICR));
+        wil6210_debugfs_create_ISR(wil, "DMA_EP_MISC_ICR", dbg,
+                                   HOSTADDR(RGF_DMA_EP_MISC_ICR));
+        wil6210_debugfs_create_pseudo_ISR(wil, dbg);
+        wil6210_debugfs_create_ITR_CNT(wil, dbg);
+
+        debugfs_create_u32("mem_addr", S_IRUGO | S_IWUSR, dbg, &mem_addr);
+        debugfs_create_file("mem_val", S_IRUGO, dbg, wil, &fops_memread);
+
+        debugfs_create_file("reset", S_IWUSR, dbg, wil, &fops_reset);
+
+        wil->rgf_blob.data = (void * __force)wil->csr + 0;
+        wil->rgf_blob.size = 0xa000;
+        wil_debugfs_create_ioblob("blob_rgf", S_IRUGO, dbg, &wil->rgf_blob);
+
+        wil->fw_code_blob.data = (void * __force)wil->csr + 0x40000;
+        wil->fw_code_blob.size = 0x40000;
+        wil_debugfs_create_ioblob("blob_fw_code", S_IRUGO, dbg,
+                                  &wil->fw_code_blob);
+
+        wil->fw_data_blob.data = (void * __force)wil->csr + 0x80000;
+        wil->fw_data_blob.size = 0x8000;
+        wil_debugfs_create_ioblob("blob_fw_data", S_IRUGO, dbg,
+                                  &wil->fw_data_blob);
+
+        wil->fw_peri_blob.data = (void * __force)wil->csr + 0x88000;
+        wil->fw_peri_blob.size = 0x18000;
+        wil_debugfs_create_ioblob("blob_fw_peri", S_IRUGO, dbg,
+                                  &wil->fw_peri_blob);
+
+        wil->uc_code_blob.data = (void * __force)wil->csr + 0xa0000;
+        wil->uc_code_blob.size = 0x10000;
+        wil_debugfs_create_ioblob("blob_uc_code", S_IRUGO, dbg,
+                                  &wil->uc_code_blob);
+
+        wil->uc_data_blob.data = (void * __force)wil->csr + 0xb0000;
+        wil->uc_data_blob.size = 0x4000;
+        wil_debugfs_create_ioblob("blob_uc_data", S_IRUGO, dbg,
+                                  &wil->uc_data_blob);
+
+        return 0;
+}
+
+void wil6210_debugfs_remove(struct wil6210_priv *wil)
+{
+        debugfs_remove_recursive(wil->debug);
+        wil->debug = NULL;
+}
diff --git a/drivers/net/wireless/ath/wil6210/interrupt.c b/drivers/net/wireless/ath/wil6210/interrupt.c
new file mode 100644
index 000000000000..dc97e7b2609c
--- /dev/null
+++ b/drivers/net/wireless/ath/wil6210/interrupt.c
@@ -0,0 +1,490 @@
+/*
+ * Copyright (c) 2012 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/interrupt.h>
+
+#include "wil6210.h"
+
+/**
+ * Theory of operation:
+ *
+ * There is ISR pseudo-cause register,
+ * dma_rgf->DMA_RGF.PSEUDO_CAUSE.PSEUDO_CAUSE
+ * Its bits represents OR'ed bits from 3 real ISR registers:
+ * TX, RX, and MISC.
+ *
+ * Registers may be configured to either "write 1 to clear" or
+ * "clear on read" mode
+ *
+ * When handling interrupt, one have to mask/unmask interrupts for the
+ * real ISR registers, or hardware may malfunction.
+ *
+ */
+
+#define WIL6210_IRQ_DISABLE     (0xFFFFFFFFUL)
+#define WIL6210_IMC_RX          BIT_DMA_EP_RX_ICR_RX_DONE
+#define WIL6210_IMC_TX          (BIT_DMA_EP_TX_ICR_TX_DONE | \
+                                BIT_DMA_EP_TX_ICR_TX_DONE_N(0))
+#define WIL6210_IMC_MISC        (ISR_MISC_FW_READY | \
+                                 ISR_MISC_MBOX_EVT | \
+                                 ISR_MISC_FW_ERROR)
+
+#define WIL6210_IRQ_PSEUDO_MASK (u32)(~(BIT_DMA_PSEUDO_CAUSE_RX | \
+                                        BIT_DMA_PSEUDO_CAUSE_TX | \
+                                        BIT_DMA_PSEUDO_CAUSE_MISC))
+
+#if defined(CONFIG_WIL6210_ISR_COR)
+/* configure to Clear-On-Read mode */
+#define WIL_ICR_ICC_VALUE       (0xFFFFFFFFUL)
+
+static inline void wil_icr_clear(u32 x, void __iomem *addr)
+{
+}
+#else /* defined(CONFIG_WIL6210_ISR_COR) */
+/* configure to Write-1-to-Clear mode */
+#define WIL_ICR_ICC_VALUE       (0UL)
+
+static inline void wil_icr_clear(u32 x, void __iomem *addr)
+{
+        iowrite32(x, addr);
+}
+#endif /* defined(CONFIG_WIL6210_ISR_COR) */
+
+static inline u32 wil_ioread32_and_clear(void __iomem *addr)
+{
+        u32 x = ioread32(addr);
+
+        wil_icr_clear(x, addr);
+
+        return x;
+}
+
+static void wil6210_mask_irq_tx(struct wil6210_priv *wil)
+{
+        iowrite32(WIL6210_IRQ_DISABLE, wil->csr +
+                  HOSTADDR(RGF_DMA_EP_TX_ICR) +
+                  offsetof(struct RGF_ICR, IMS));
+}
+
+static void wil6210_mask_irq_rx(struct wil6210_priv *wil)
+{
+        iowrite32(WIL6210_IRQ_DISABLE, wil->csr +
+                  HOSTADDR(RGF_DMA_EP_RX_ICR) +
+                  offsetof(struct RGF_ICR, IMS));
+}
+
+static void wil6210_mask_irq_misc(struct wil6210_priv *wil)
+{
+        iowrite32(WIL6210_IRQ_DISABLE, wil->csr +
+                  HOSTADDR(RGF_DMA_EP_MISC_ICR) +
+                  offsetof(struct RGF_ICR, IMS));
+}
+
+static void wil6210_mask_irq_pseudo(struct wil6210_priv *wil)
+{
+        wil_dbg_irq(wil, "%s()\n", __func__);
+
+        iowrite32(WIL6210_IRQ_DISABLE, wil->csr +
+                  HOSTADDR(RGF_DMA_PSEUDO_CAUSE_MASK_SW));
+
+        clear_bit(wil_status_irqen, &wil->status);
+}
+
+static void wil6210_unmask_irq_tx(struct wil6210_priv *wil)
+{
+        iowrite32(WIL6210_IMC_TX, wil->csr +
+                  HOSTADDR(RGF_DMA_EP_TX_ICR) +
+                  offsetof(struct RGF_ICR, IMC));
+}
+
+static void wil6210_unmask_irq_rx(struct wil6210_priv *wil)
+{
+        iowrite32(WIL6210_IMC_RX, wil->csr +
+                  HOSTADDR(RGF_DMA_EP_RX_ICR) +
+                  offsetof(struct RGF_ICR, IMC));
+}
+
+static void wil6210_unmask_irq_misc(struct wil6210_priv *wil)
+{
+        iowrite32(WIL6210_IMC_MISC, wil->csr +
+                  HOSTADDR(RGF_DMA_EP_MISC_ICR) +
+                  offsetof(struct RGF_ICR, IMC));
+}
+
+static void wil6210_unmask_irq_pseudo(struct wil6210_priv *wil)
+{
+        wil_dbg_irq(wil, "%s()\n", __func__);
+
+        set_bit(wil_status_irqen, &wil->status);
+
+        iowrite32(WIL6210_IRQ_PSEUDO_MASK, wil->csr +
+                  HOSTADDR(RGF_DMA_PSEUDO_CAUSE_MASK_SW));
+}
+
+void wil6210_disable_irq(struct wil6210_priv *wil)
+{
+        wil_dbg_irq(wil, "%s()\n", __func__);
+
+        wil6210_mask_irq_tx(wil);
+        wil6210_mask_irq_rx(wil);
+        wil6210_mask_irq_misc(wil);
+        wil6210_mask_irq_pseudo(wil);
+}
+
+void wil6210_enable_irq(struct wil6210_priv *wil)
+{
+        wil_dbg_irq(wil, "%s()\n", __func__);
+
+        iowrite32(WIL_ICR_ICC_VALUE, wil->csr + HOSTADDR(RGF_DMA_EP_RX_ICR) +
+                  offsetof(struct RGF_ICR, ICC));
+        iowrite32(WIL_ICR_ICC_VALUE, wil->csr + HOSTADDR(RGF_DMA_EP_TX_ICR) +
+                  offsetof(struct RGF_ICR, ICC));
+        iowrite32(WIL_ICR_ICC_VALUE, wil->csr + HOSTADDR(RGF_DMA_EP_MISC_ICR) +
+                  offsetof(struct RGF_ICR, ICC));
+
+        wil6210_unmask_irq_pseudo(wil);
+        wil6210_unmask_irq_tx(wil);
+        wil6210_unmask_irq_rx(wil);
+        wil6210_unmask_irq_misc(wil);
+}
+
+static irqreturn_t wil6210_irq_rx(int irq, void *cookie)
+{
+        struct wil6210_priv *wil = cookie;
+        u32 isr = wil_ioread32_and_clear(wil->csr +
+                                         HOSTADDR(RGF_DMA_EP_RX_ICR) +
+                                         offsetof(struct RGF_ICR, ICR));
+
+        wil_dbg_irq(wil, "ISR RX 0x%08x\n", isr);
+
+        if (!isr) {
+                wil_err(wil, "spurious IRQ: RX\n");
+                return IRQ_NONE;
+        }
+
+        wil6210_mask_irq_rx(wil);
+
+        if (isr & BIT_DMA_EP_RX_ICR_RX_DONE) {
+                wil_dbg_irq(wil, "RX done\n");
+                isr &= ~BIT_DMA_EP_RX_ICR_RX_DONE;
+                wil_rx_handle(wil);
+        }
+
+        if (isr)
+                wil_err(wil, "un-handled RX ISR bits 0x%08x\n", isr);
+
+        wil6210_unmask_irq_rx(wil);
+
+        return IRQ_HANDLED;
+}
+
+static irqreturn_t wil6210_irq_tx(int irq, void *cookie)
+{
+        struct wil6210_priv *wil = cookie;
+        u32 isr = wil_ioread32_and_clear(wil->csr +
+                                         HOSTADDR(RGF_DMA_EP_TX_ICR) +
+                                         offsetof(struct RGF_ICR, ICR));
+
+        wil_dbg_irq(wil, "ISR TX 0x%08x\n", isr);
+
+        if (!isr) {
+                wil_err(wil, "spurious IRQ: TX\n");
+                return IRQ_NONE;
+        }
+
+        wil6210_mask_irq_tx(wil);
+
+        if (isr & BIT_DMA_EP_TX_ICR_TX_DONE) {
+                uint i;
+                wil_dbg_irq(wil, "TX done\n");
+                isr &= ~BIT_DMA_EP_TX_ICR_TX_DONE;
+                for (i = 0; i < 24; i++) {
+                        u32 mask = BIT_DMA_EP_TX_ICR_TX_DONE_N(i);
+                        if (isr & mask) {
+                                isr &= ~mask;
+                                wil_dbg_irq(wil, "TX done(%i)\n", i);
+                                wil_tx_complete(wil, i);
+                        }
+                }
+        }
+
+        if (isr)
+                wil_err(wil, "un-handled TX ISR bits 0x%08x\n", isr);
+
+        wil6210_unmask_irq_tx(wil);
+
+        return IRQ_HANDLED;
+}
+
+static void wil_notify_fw_error(struct wil6210_priv *wil)
+{
+        struct device *dev = &wil_to_ndev(wil)->dev;
+        char *envp[3] = {
+                [0] = "SOURCE=wil6210",
+                [1] = "EVENT=FW_ERROR",
+                [2] = NULL,
+        };
+        kobject_uevent_env(&dev->kobj, KOBJ_CHANGE, envp);
+}
+
+static irqreturn_t wil6210_irq_misc(int irq, void *cookie)
+{
+        struct wil6210_priv *wil = cookie;
+        u32 isr = wil_ioread32_and_clear(wil->csr +
+                                         HOSTADDR(RGF_DMA_EP_MISC_ICR) +
+                                         offsetof(struct RGF_ICR, ICR));
+
+        wil_dbg_irq(wil, "ISR MISC 0x%08x\n", isr);
+
+        if (!isr) {
+                wil_err(wil, "spurious IRQ: MISC\n");
+                return IRQ_NONE;
+        }
+
+        wil6210_mask_irq_misc(wil);
+
+        if (isr & ISR_MISC_FW_ERROR) {
+                wil_dbg_irq(wil, "IRQ: Firmware error\n");
+                clear_bit(wil_status_fwready, &wil->status);
+                wil_notify_fw_error(wil);
+                isr &= ~ISR_MISC_FW_ERROR;
+        }
+
+        if (isr & ISR_MISC_FW_READY) {
+                wil_dbg_irq(wil, "IRQ: FW ready\n");
+                /**
+                 * Actual FW ready indicated by the
+                 * WMI_FW_READY_EVENTID
+                 */
+                isr &= ~ISR_MISC_FW_READY;
+        }
+
+        wil->isr_misc = isr;
+
+        if (isr) {
+                return IRQ_WAKE_THREAD;
+        } else {
+                wil6210_unmask_irq_misc(wil);
+                return IRQ_HANDLED;
+        }
+}
+
+static irqreturn_t wil6210_irq_misc_thread(int irq, void *cookie)
+{
+        struct wil6210_priv *wil = cookie;
+        u32 isr = wil->isr_misc;
+
+        wil_dbg_irq(wil, "Thread ISR MISC 0x%08x\n", isr);
+
+        if (isr & ISR_MISC_MBOX_EVT) {
+                wil_dbg_irq(wil, "MBOX event\n");
+                wmi_recv_cmd(wil);
+                isr &= ~ISR_MISC_MBOX_EVT;
+        }
+
+        if (isr)
+                wil_err(wil, "un-handled MISC ISR bits 0x%08x\n", isr);
+
+        wil->isr_misc = 0;
+
+        wil6210_unmask_irq_misc(wil);
+
+        return IRQ_HANDLED;
+}
+
+/**
+ * thread IRQ handler
+ */
+static irqreturn_t wil6210_thread_irq(int irq, void *cookie)
+{
+        struct wil6210_priv *wil = cookie;
+
+        wil_dbg_irq(wil, "Thread IRQ\n");
+        /* Discover real IRQ cause */
+        if (wil->isr_misc)
+                wil6210_irq_misc_thread(irq, cookie);
+
+        wil6210_unmask_irq_pseudo(wil);
+
+        return IRQ_HANDLED;
+}
+
+/* DEBUG
+ * There is subtle bug in hardware that causes IRQ to raise when it should be
+ * masked. It is quite rare and hard to debug.
+ *
+ * Catch irq issue if it happens and print all I can.
+ */
+static int wil6210_debug_irq_mask(struct wil6210_priv *wil, u32 pseudo_cause)
+{
+        if (!test_bit(wil_status_irqen, &wil->status)) {
+                u32 icm_rx = wil_ioread32_and_clear(wil->csr +
+                                HOSTADDR(RGF_DMA_EP_RX_ICR) +
+                                offsetof(struct RGF_ICR, ICM));
+                u32 icr_rx = wil_ioread32_and_clear(wil->csr +
+                                HOSTADDR(RGF_DMA_EP_RX_ICR) +
+                                offsetof(struct RGF_ICR, ICR));
+                u32 imv_rx = ioread32(wil->csr +
+                                HOSTADDR(RGF_DMA_EP_RX_ICR) +
+                                offsetof(struct RGF_ICR, IMV));
+                u32 icm_tx = wil_ioread32_and_clear(wil->csr +
+                                HOSTADDR(RGF_DMA_EP_TX_ICR) +
+                                offsetof(struct RGF_ICR, ICM));
+                u32 icr_tx = wil_ioread32_and_clear(wil->csr +
+                                HOSTADDR(RGF_DMA_EP_TX_ICR) +
+                                offsetof(struct RGF_ICR, ICR));
+                u32 imv_tx = ioread32(wil->csr +
+                                HOSTADDR(RGF_DMA_EP_TX_ICR) +
+                                offsetof(struct RGF_ICR, IMV));
+                u32 icm_misc = wil_ioread32_and_clear(wil->csr +
+                                HOSTADDR(RGF_DMA_EP_MISC_ICR) +
+                                offsetof(struct RGF_ICR, ICM));
+                u32 icr_misc = wil_ioread32_and_clear(wil->csr +
+                                HOSTADDR(RGF_DMA_EP_MISC_ICR) +
+                                offsetof(struct RGF_ICR, ICR));
+                u32 imv_misc = ioread32(wil->csr +
+                                HOSTADDR(RGF_DMA_EP_MISC_ICR) +
+                                offsetof(struct RGF_ICR, IMV));
+                wil_err(wil, "IRQ when it should be masked: pseudo 0x%08x\n"
+                                "Rx   icm:icr:imv 0x%08x 0x%08x 0x%08x\n"
+                                "Tx   icm:icr:imv 0x%08x 0x%08x 0x%08x\n"
+                                "Misc icm:icr:imv 0x%08x 0x%08x 0x%08x\n",
+                                pseudo_cause,
+                                icm_rx, icr_rx, imv_rx,
+                                icm_tx, icr_tx, imv_tx,
+                                icm_misc, icr_misc, imv_misc);
+
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+static irqreturn_t wil6210_hardirq(int irq, void *cookie)
+{
+        irqreturn_t rc = IRQ_HANDLED;
+        struct wil6210_priv *wil = cookie;
+        u32 pseudo_cause = ioread32(wil->csr + HOSTADDR(RGF_DMA_PSEUDO_CAUSE));
+
+        /**
+         * pseudo_cause is Clear-On-Read, no need to ACK
+         */
+        if ((pseudo_cause == 0) || ((pseudo_cause & 0xff) == 0xff))
+                return IRQ_NONE;
+
+        /* FIXME: IRQ mask debug */
+        if (wil6210_debug_irq_mask(wil, pseudo_cause))
+                return IRQ_NONE;
+
+        wil_dbg_irq(wil, "Pseudo IRQ 0x%08x\n", pseudo_cause);
+
+        wil6210_mask_irq_pseudo(wil);
+
+        /* Discover real IRQ cause
+         * There are 2 possible phases for every IRQ:
+         * - hard IRQ handler called right here
+         * - threaded handler called later
+         *
+         * Hard IRQ handler reads and clears ISR.
+         *
+         * If threaded handler requested, hard IRQ handler
+         * returns IRQ_WAKE_THREAD and saves ISR register value
+         * for the threaded handler use.
+         *
+         * voting for wake thread - need at least 1 vote
+         */
+        if ((pseudo_cause & BIT_DMA_PSEUDO_CAUSE_RX) &&
+            (wil6210_irq_rx(irq, cookie) == IRQ_WAKE_THREAD))
+                rc = IRQ_WAKE_THREAD;
+
+        if ((pseudo_cause & BIT_DMA_PSEUDO_CAUSE_TX) &&
+            (wil6210_irq_tx(irq, cookie) == IRQ_WAKE_THREAD))
+                rc = IRQ_WAKE_THREAD;
+
+        if ((pseudo_cause & BIT_DMA_PSEUDO_CAUSE_MISC) &&
+            (wil6210_irq_misc(irq, cookie) == IRQ_WAKE_THREAD))
+                rc = IRQ_WAKE_THREAD;
+
+        /* if thread is requested, it will unmask IRQ */
+        if (rc != IRQ_WAKE_THREAD)
+                wil6210_unmask_irq_pseudo(wil);
+
+        return rc;
+}
+
+static int wil6210_request_3msi(struct wil6210_priv *wil, int irq)
+{
+        int rc;
+        /*
+         * IRQ's are in the following order:
+         * - Tx
+         * - Rx
+         * - Misc
+         */
+
+        rc = request_irq(irq, wil6210_irq_tx, IRQF_SHARED,
+                         WIL_NAME"_tx", wil);
+        if (rc)
+                return rc;
+
+        rc = request_irq(irq + 1, wil6210_irq_rx, IRQF_SHARED,
+                         WIL_NAME"_rx", wil);
+        if (rc)
+                goto free0;
+
+        rc = request_threaded_irq(irq + 2, wil6210_irq_misc,
+                                  wil6210_irq_misc_thread,
+                                  IRQF_SHARED, WIL_NAME"_misc", wil);
+        if (rc)
+                goto free1;
+
+        return 0;
+        /* error branch */
+free1:
+        free_irq(irq + 1, wil);
+free0:
+        free_irq(irq, wil);
+
+        return rc;
+}
+
+int wil6210_init_irq(struct wil6210_priv *wil, int irq)
+{
+        int rc;
+        if (wil->n_msi == 3)
+                rc = wil6210_request_3msi(wil, irq);
+        else
+                rc = request_threaded_irq(irq, wil6210_hardirq,
+                                          wil6210_thread_irq,
+                                          wil->n_msi ? 0 : IRQF_SHARED,
+                                          WIL_NAME, wil);
+        if (rc)
+                return rc;
+
+        wil6210_enable_irq(wil);
+
+        return 0;
+}
+
+void wil6210_fini_irq(struct wil6210_priv *wil, int irq)
+{
+        wil6210_disable_irq(wil);
+        free_irq(irq, wil);
+        if (wil->n_msi == 3) {
+                free_irq(irq + 1, wil);
+                free_irq(irq + 2, wil);
+        }
+}
diff --git a/drivers/net/wireless/ath/wil6210/main.c b/drivers/net/wireless/ath/wil6210/main.c
new file mode 100644
index 000000000000..761c389586d4
--- /dev/null
+++ b/drivers/net/wireless/ath/wil6210/main.c
@@ -0,0 +1,410 @@
+/*
+ * Copyright (c) 2012 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/kernel.h>
+#include <linux/netdevice.h>
+#include <linux/sched.h>
+#include <linux/ieee80211.h>
+#include <linux/wireless.h>
+#include <linux/slab.h>
+#include <linux/moduleparam.h>
+#include <linux/if_arp.h>
+
+#include "wil6210.h"
+
+/*
+ * Due to a hardware issue,
+ * one has to read/write to/from NIC in 32-bit chunks;
+ * regular memcpy_fromio and siblings will
+ * not work on 64-bit platform - it uses 64-bit transactions
+ *
+ * Force 32-bit transactions to enable NIC on 64-bit platforms
+ *
+ * To avoid byte swap on big endian host, __raw_{read|write}l
+ * should be used - {read|write}l would swap bytes to provide
+ * little endian on PCI value in host endianness.
+ */
+void wil_memcpy_fromio_32(void *dst, const volatile void __iomem *src,
+                          size_t count)
+{
+        u32 *d = dst;
+        const volatile u32 __iomem *s = src;
+
+        /* size_t is unsigned, if (count%4 != 0) it will wrap */
+        for (count += 4; count > 4; count -= 4)
+                *d++ = __raw_readl(s++);
+}
+
+void wil_memcpy_toio_32(volatile void __iomem *dst, const void *src,
+                        size_t count)
+{
+        volatile u32 __iomem *d = dst;
+        const u32 *s = src;
+
+        for (count += 4; count > 4; count -= 4)
+                __raw_writel(*s++, d++);
+}
+
+static void _wil6210_disconnect(struct wil6210_priv *wil, void *bssid)
+{
+        uint i;
+        struct net_device *ndev = wil_to_ndev(wil);
+        struct wireless_dev *wdev = wil->wdev;
+
+        wil_dbg_misc(wil, "%s()\n", __func__);
+
+        wil_link_off(wil);
+        clear_bit(wil_status_fwconnected, &wil->status);
+
+        switch (wdev->sme_state) {
+        case CFG80211_SME_CONNECTED:
+                cfg80211_disconnected(ndev, WLAN_STATUS_UNSPECIFIED_FAILURE,
+                                      NULL, 0, GFP_KERNEL);
+                break;
+        case CFG80211_SME_CONNECTING:
+                cfg80211_connect_result(ndev, bssid, NULL, 0, NULL, 0,
+                                        WLAN_STATUS_UNSPECIFIED_FAILURE,
+                                        GFP_KERNEL);
+                break;
+        default:
+                break;
+        }
+
+        for (i = 0; i < ARRAY_SIZE(wil->vring_tx); i++)
+                wil_vring_fini_tx(wil, i);
+
+        clear_bit(wil_status_dontscan, &wil->status);
+}
+
+static void wil_disconnect_worker(struct work_struct *work)
+{
+        struct wil6210_priv *wil = container_of(work,
+                        struct wil6210_priv, disconnect_worker);
+
+        _wil6210_disconnect(wil, NULL);
+}
+
+static void wil_connect_timer_fn(ulong x)
+{
+        struct wil6210_priv *wil = (void *)x;
+
+        wil_dbg_misc(wil, "Connect timeout\n");
+
+        /* reschedule to thread context - disconnect won't
+         * run from atomic context
+         */
+        schedule_work(&wil->disconnect_worker);
+}
+
+static void wil_cache_mbox_regs(struct wil6210_priv *wil)
+{
+        /* make shadow copy of registers that should not change on run time */
+        wil_memcpy_fromio_32(&wil->mbox_ctl, wil->csr + HOST_MBOX,
+                             sizeof(struct wil6210_mbox_ctl));
+        wil_mbox_ring_le2cpus(&wil->mbox_ctl.rx);
+        wil_mbox_ring_le2cpus(&wil->mbox_ctl.tx);
+}
+
+int wil_priv_init(struct wil6210_priv *wil)
+{
+        wil_dbg_misc(wil, "%s()\n", __func__);
+
+        mutex_init(&wil->mutex);
+        mutex_init(&wil->wmi_mutex);
+
+        init_completion(&wil->wmi_ready);
+
+        wil->pending_connect_cid = -1;
+        setup_timer(&wil->connect_timer, wil_connect_timer_fn, (ulong)wil);
+
+        INIT_WORK(&wil->wmi_connect_worker, wmi_connect_worker);
+        INIT_WORK(&wil->disconnect_worker, wil_disconnect_worker);
+        INIT_WORK(&wil->wmi_event_worker, wmi_event_worker);
+
+        INIT_LIST_HEAD(&wil->pending_wmi_ev);
+        spin_lock_init(&wil->wmi_ev_lock);
+
+        wil->wmi_wq = create_singlethread_workqueue(WIL_NAME"_wmi");
+        if (!wil->wmi_wq)
+                return -EAGAIN;
+
+        wil->wmi_wq_conn = create_singlethread_workqueue(WIL_NAME"_connect");
+        if (!wil->wmi_wq_conn) {
+                destroy_workqueue(wil->wmi_wq);
+                return -EAGAIN;
+        }
+
+        wil_cache_mbox_regs(wil);
+
+        return 0;
+}
+
+void wil6210_disconnect(struct wil6210_priv *wil, void *bssid)
+{
+        del_timer_sync(&wil->connect_timer);
+        _wil6210_disconnect(wil, bssid);
+}
+
+void wil_priv_deinit(struct wil6210_priv *wil)
+{
+        cancel_work_sync(&wil->disconnect_worker);
+        wil6210_disconnect(wil, NULL);
+        wmi_event_flush(wil);
+        destroy_workqueue(wil->wmi_wq_conn);
+        destroy_workqueue(wil->wmi_wq);
+}
+
+static void wil_target_reset(struct wil6210_priv *wil)
+{
+        wil_dbg_misc(wil, "Resetting...\n");
+
+        /* register write */
+#define W(a, v) iowrite32(v, wil->csr + HOSTADDR(a))
+        /* register set = read, OR, write */
+#define S(a, v) iowrite32(ioread32(wil->csr + HOSTADDR(a)) | v, \
+                wil->csr + HOSTADDR(a))
+
+        /* hpal_perst_from_pad_src_n_mask */
+        S(RGF_USER_CLKS_CTL_SW_RST_MASK_0, BIT(6));
+        /* car_perst_rst_src_n_mask */
+        S(RGF_USER_CLKS_CTL_SW_RST_MASK_0, BIT(7));
+
+        W(RGF_USER_MAC_CPU_0,  BIT(1)); /* mac_cpu_man_rst */
+        W(RGF_USER_USER_CPU_0, BIT(1)); /* user_cpu_man_rst */
+
+        msleep(100);
+
+        W(RGF_USER_CLKS_CTL_SW_RST_VEC_2, 0xFE000000);
+        W(RGF_USER_CLKS_CTL_SW_RST_VEC_1, 0x0000003F);
+        W(RGF_USER_CLKS_CTL_SW_RST_VEC_3, 0x00000170);
+        W(RGF_USER_CLKS_CTL_SW_RST_VEC_0, 0xFFE7FC00);
+
+        msleep(100);
+
+        W(RGF_USER_CLKS_CTL_SW_RST_VEC_3, 0);
+        W(RGF_USER_CLKS_CTL_SW_RST_VEC_2, 0);
+        W(RGF_USER_CLKS_CTL_SW_RST_VEC_1, 0);
+        W(RGF_USER_CLKS_CTL_SW_RST_VEC_0, 0);
+
+        W(RGF_USER_CLKS_CTL_SW_RST_VEC_3, 0x00000001);
+        W(RGF_USER_CLKS_CTL_SW_RST_VEC_2, 0x00000080);
+        W(RGF_USER_CLKS_CTL_SW_RST_VEC_0, 0);
+
+        msleep(2000);
+
+        W(RGF_USER_USER_CPU_0, BIT(0)); /* user_cpu_man_de_rst */
+
+        msleep(2000);
+
+        wil_dbg_misc(wil, "Reset completed\n");
+
+#undef W
+#undef S
+}
+
+void wil_mbox_ring_le2cpus(struct wil6210_mbox_ring *r)
+{
+        le32_to_cpus(&r->base);
+        le16_to_cpus(&r->entry_size);
+        le16_to_cpus(&r->size);
+        le32_to_cpus(&r->tail);
+        le32_to_cpus(&r->head);
+}
+
+static int wil_wait_for_fw_ready(struct wil6210_priv *wil)
+{
+        ulong to = msecs_to_jiffies(1000);
+        ulong left = wait_for_completion_timeout(&wil->wmi_ready, to);
+        if (0 == left) {
+                wil_err(wil, "Firmware not ready\n");
+                return -ETIME;
+        } else {
+                wil_dbg_misc(wil, "FW ready after %d ms\n",
+                             jiffies_to_msecs(to-left));
+        }
+        return 0;
+}
+
+/*
+ * We reset all the structures, and we reset the UMAC.
+ * After calling this routine, you're expected to reload
+ * the firmware.
+ */
+int wil_reset(struct wil6210_priv *wil)
+{
+        int rc;
+
+        cancel_work_sync(&wil->disconnect_worker);
+        wil6210_disconnect(wil, NULL);
+
+        wil6210_disable_irq(wil);
+        wil->status = 0;
+
+        wmi_event_flush(wil);
+
+        flush_workqueue(wil->wmi_wq_conn);
+        flush_workqueue(wil->wmi_wq);
+
+        /* TODO: put MAC in reset */
+        wil_target_reset(wil);
+
+        /* init after reset */
+        wil->pending_connect_cid = -1;
+        INIT_COMPLETION(wil->wmi_ready);
+
+        wil_cache_mbox_regs(wil);
+
+        /* TODO: release MAC reset */
+        wil6210_enable_irq(wil);
+
+        /* we just started MAC, wait for FW ready */
+        rc = wil_wait_for_fw_ready(wil);
+
+        return rc;
+}
+
+
+void wil_link_on(struct wil6210_priv *wil)
+{
+        struct net_device *ndev = wil_to_ndev(wil);
+
+        wil_dbg_misc(wil, "%s()\n", __func__);
+
+        netif_carrier_on(ndev);
+        netif_tx_wake_all_queues(ndev);
+}
+
+void wil_link_off(struct wil6210_priv *wil)
+{
+        struct net_device *ndev = wil_to_ndev(wil);
+
+        wil_dbg_misc(wil, "%s()\n", __func__);
+
+        netif_tx_stop_all_queues(ndev);
+        netif_carrier_off(ndev);
+}
+
+static int __wil_up(struct wil6210_priv *wil)
+{
+        struct net_device *ndev = wil_to_ndev(wil);
+        struct wireless_dev *wdev = wil->wdev;
+        struct ieee80211_channel *channel = wdev->preset_chandef.chan;
+        int rc;
+        int bi;
+        u16 wmi_nettype = wil_iftype_nl2wmi(wdev->iftype);
+
+        rc = wil_reset(wil);
+        if (rc)
+                return rc;
+
+        /* FIXME Firmware works now in PBSS mode(ToDS=0, FromDS=0) */
+        wmi_nettype = wil_iftype_nl2wmi(NL80211_IFTYPE_ADHOC);
+        switch (wdev->iftype) {
+        case NL80211_IFTYPE_STATION:
+                wil_dbg_misc(wil, "type: STATION\n");
+                bi = 0;
+                ndev->type = ARPHRD_ETHER;
+                break;
+        case NL80211_IFTYPE_AP:
+                wil_dbg_misc(wil, "type: AP\n");
+                bi = 100;
+                ndev->type = ARPHRD_ETHER;
+                break;
+        case NL80211_IFTYPE_P2P_CLIENT:
+                wil_dbg_misc(wil, "type: P2P_CLIENT\n");
+                bi = 0;
+                ndev->type = ARPHRD_ETHER;
+                break;
+        case NL80211_IFTYPE_P2P_GO:
+                wil_dbg_misc(wil, "type: P2P_GO\n");
+                bi = 100;
+                ndev->type = ARPHRD_ETHER;
+                break;
+        case NL80211_IFTYPE_MONITOR:
+                wil_dbg_misc(wil, "type: Monitor\n");
+                bi = 0;
+                ndev->type = ARPHRD_IEEE80211_RADIOTAP;
+                /* ARPHRD_IEEE80211 or ARPHRD_IEEE80211_RADIOTAP ? */
+                break;
+        default:
+                return -EOPNOTSUPP;
+        }
+
+        /* Apply profile in the following order: */
+        /* SSID and channel for the AP */
+        switch (wdev->iftype) {
+        case NL80211_IFTYPE_AP:
+        case NL80211_IFTYPE_P2P_GO:
+                if (wdev->ssid_len == 0) {
+                        wil_err(wil, "SSID not set\n");
+                        return -EINVAL;
+                }
+                wmi_set_ssid(wil, wdev->ssid_len, wdev->ssid);
+                if (channel)
+                        wmi_set_channel(wil, channel->hw_value);
+                break;
+        default:
+                break;
+        }
+
+        /* MAC address - pre-requisite for other commands */
+        wmi_set_mac_address(wil, ndev->dev_addr);
+
+        /* Set up beaconing if required. */
+        rc = wmi_set_bcon(wil, bi, wmi_nettype);
+        if (rc)
+                return rc;
+
+        /* Rx VRING. After MAC and beacon */
+        wil_rx_init(wil);
+
+        return 0;
+}
+
+int wil_up(struct wil6210_priv *wil)
+{
+        int rc;
+
+        mutex_lock(&wil->mutex);
+        rc = __wil_up(wil);
+        mutex_unlock(&wil->mutex);
+
+        return rc;
+}
+
+static int __wil_down(struct wil6210_priv *wil)
+{
+        if (wil->scan_request) {
+                cfg80211_scan_done(wil->scan_request, true);
+                wil->scan_request = NULL;
+        }
+
+        wil6210_disconnect(wil, NULL);
+        wil_rx_fini(wil);
+
+        return 0;
+}
+
+int wil_down(struct wil6210_priv *wil)
+{
+        int rc;
+
+        mutex_lock(&wil->mutex);
+        rc = __wil_down(wil);
+        mutex_unlock(&wil->mutex);
+
+        return rc;
+}
diff --git a/drivers/net/wireless/ath/wil6210/netdev.c b/drivers/net/wireless/ath/wil6210/netdev.c
new file mode 100644
index 000000000000..8ce2e33dce20
--- /dev/null
+++ b/drivers/net/wireless/ath/wil6210/netdev.c
@@ -0,0 +1,132 @@
+/*
+ * Copyright (c) 2012 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/module.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/slab.h>
+
+#include "wil6210.h"
+
+static int wil_open(struct net_device *ndev)
+{
+        struct wil6210_priv *wil = ndev_to_wil(ndev);
+
+        return wil_up(wil);
+}
+
+static int wil_stop(struct net_device *ndev)
+{
+        struct wil6210_priv *wil = ndev_to_wil(ndev);
+
+        return wil_down(wil);
+}
+
+static const struct net_device_ops wil_netdev_ops = {
+        .ndo_open               = wil_open,
+        .ndo_stop               = wil_stop,
+        .ndo_start_xmit         = wil_start_xmit,
+        .ndo_set_mac_address    = eth_mac_addr,
+        .ndo_validate_addr      = eth_validate_addr,
+};
+
+void *wil_if_alloc(struct device *dev, void __iomem *csr)
+{
+        struct net_device *ndev;
+        struct wireless_dev *wdev;
+        struct wil6210_priv *wil;
+        struct ieee80211_channel *ch;
+        int rc = 0;
+
+        wdev = wil_cfg80211_init(dev);
+        if (IS_ERR(wdev)) {
+                dev_err(dev, "wil_cfg80211_init failed\n");
+                return wdev;
+        }
+
+        wil = wdev_to_wil(wdev);
+        wil->csr = csr;
+        wil->wdev = wdev;
+
+        rc = wil_priv_init(wil);
+        if (rc) {
+                dev_err(dev, "wil_priv_init failed\n");
+                goto out_wdev;
+        }
+
+        wdev->iftype = NL80211_IFTYPE_STATION; /* TODO */
+        /* default monitor channel */
+        ch = wdev->wiphy->bands[IEEE80211_BAND_60GHZ]->channels;
+        cfg80211_chandef_create(&wdev->preset_chandef, ch, NL80211_CHAN_NO_HT);
+
+        ndev = alloc_netdev(0, "wlan%d", ether_setup);
+        if (!ndev) {
+                dev_err(dev, "alloc_netdev_mqs failed\n");
+                rc = -ENOMEM;
+                goto out_priv;
+        }
+
+        ndev->netdev_ops = &wil_netdev_ops;
+        ndev->ieee80211_ptr = wdev;
+        SET_NETDEV_DEV(ndev, wiphy_dev(wdev->wiphy));
+        wdev->netdev = ndev;
+
+        wil_link_off(wil);
+
+        return wil;
+
+ out_priv:
+        wil_priv_deinit(wil);
+
+ out_wdev:
+        wil_wdev_free(wil);
+
+        return ERR_PTR(rc);
+}
+
+void wil_if_free(struct wil6210_priv *wil)
+{
+        struct net_device *ndev = wil_to_ndev(wil);
+        if (!ndev)
+                return;
+
+        free_netdev(ndev);
+        wil_priv_deinit(wil);
+        wil_wdev_free(wil);
+}
+
+int wil_if_add(struct wil6210_priv *wil)
+{
+        struct net_device *ndev = wil_to_ndev(wil);
+        int rc;
+
+        rc = register_netdev(ndev);
+        if (rc < 0) {
+                dev_err(&ndev->dev, "Failed to register netdev: %d\n", rc);
+                return rc;
+        }
+
+        wil_link_off(wil);
+
+        return 0;
+}
+
+void wil_if_remove(struct wil6210_priv *wil)
+{
+        struct net_device *ndev = wil_to_ndev(wil);
+
+        unregister_netdev(ndev);
+}
diff --git a/drivers/net/wireless/ath/wil6210/pcie_bus.c b/drivers/net/wireless/ath/wil6210/pcie_bus.c
new file mode 100644
index 000000000000..81c35c6e3832
--- /dev/null
+++ b/drivers/net/wireless/ath/wil6210/pcie_bus.c
@@ -0,0 +1,223 @@
+/*
+ * Copyright (c) 2012 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/netdevice.h>
+#include <linux/debugfs.h>
+#include <linux/pci.h>
+#include <linux/moduleparam.h>
+
+#include "wil6210.h"
+
+static int use_msi = 1;
+module_param(use_msi, int, S_IRUGO);
+MODULE_PARM_DESC(use_msi,
+                 " Use MSI interrupt: "
+                 "0 - don't, 1 - (default) - single, or 3");
+
+/* Bus ops */
+static int wil_if_pcie_enable(struct wil6210_priv *wil)
+{
+        struct pci_dev *pdev = wil->pdev;
+        int rc;
+
+        pci_set_master(pdev);
+
+        /*
+         * how many MSI interrupts to request?
+         */
+        switch (use_msi) {
+        case 3:
+        case 1:
+        case 0:
+                break;
+        default:
+                wil_err(wil, "Invalid use_msi=%d, default to 1\n",
+                        use_msi);
+                use_msi = 1;
+        }
+        wil->n_msi = use_msi;
+        if (wil->n_msi) {
+                wil_dbg_misc(wil, "Setup %d MSI interrupts\n", use_msi);
+                rc = pci_enable_msi_block(pdev, wil->n_msi);
+                if (rc && (wil->n_msi == 3)) {
+                        wil_err(wil, "3 MSI mode failed, try 1 MSI\n");
+                        wil->n_msi = 1;
+                        rc = pci_enable_msi_block(pdev, wil->n_msi);
+                }
+                if (rc) {
+                        wil_err(wil, "pci_enable_msi failed, use INTx\n");
+                        wil->n_msi = 0;
+                }
+        } else {
+                wil_dbg_misc(wil, "MSI interrupts disabled, use INTx\n");
+        }
+
+        rc = wil6210_init_irq(wil, pdev->irq);
+        if (rc)
+                goto stop_master;
+
+        /* need reset here to obtain MAC */
+        rc = wil_reset(wil);
+        if (rc)
+                goto release_irq;
+
+        return 0;
+
+ release_irq:
+        wil6210_fini_irq(wil, pdev->irq);
+        /* safe to call if no MSI */
+        pci_disable_msi(pdev);
+ stop_master:
+        pci_clear_master(pdev);
+        return rc;
+}
+
+static int wil_if_pcie_disable(struct wil6210_priv *wil)
+{
+        struct pci_dev *pdev = wil->pdev;
+
+        pci_clear_master(pdev);
+        /* disable and release IRQ */
+        wil6210_fini_irq(wil, pdev->irq);
+        /* safe to call if no MSI */
+        pci_disable_msi(pdev);
+        /* TODO: disable HW */
+
+        return 0;
+}
+
+static int wil_pcie_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+{
+        struct wil6210_priv *wil;
+        struct device *dev = &pdev->dev;
+        void __iomem *csr;
+        int rc;
+
+        /* check HW */
+        dev_info(&pdev->dev, WIL_NAME " device found [%04x:%04x] (rev %x)\n",
+                 (int)pdev->vendor, (int)pdev->device, (int)pdev->revision);
+
+        if (pci_resource_len(pdev, 0) != WIL6210_MEM_SIZE) {
+                dev_err(&pdev->dev, "Not " WIL_NAME "? "
+                        "BAR0 size is %lu while expecting %lu\n",
+                        (ulong)pci_resource_len(pdev, 0), WIL6210_MEM_SIZE);
+                return -ENODEV;
+        }
+
+        rc = pci_enable_device(pdev);
+        if (rc) {
+                dev_err(&pdev->dev, "pci_enable_device failed\n");
+                return -ENODEV;
+        }
+        /* rollback to err_disable_pdev */
+
+        rc = pci_request_region(pdev, 0, WIL_NAME);
+        if (rc) {
+                dev_err(&pdev->dev, "pci_request_region failed\n");
+                goto err_disable_pdev;
+        }
+        /* rollback to err_release_reg */
+
+        csr = pci_ioremap_bar(pdev, 0);
+        if (!csr) {
+                dev_err(&pdev->dev, "pci_ioremap_bar failed\n");
+                rc = -ENODEV;
+                goto err_release_reg;
+        }
+        /* rollback to err_iounmap */
+        dev_info(&pdev->dev, "CSR at %pR -> %p\n", &pdev->resource[0], csr);
+
+        wil = wil_if_alloc(dev, csr);
+        if (IS_ERR(wil)) {
+                rc = (int)PTR_ERR(wil);
+                dev_err(dev, "wil_if_alloc failed: %d\n", rc);
+                goto err_iounmap;
+        }
+        /* rollback to if_free */
+
+        pci_set_drvdata(pdev, wil);
+        wil->pdev = pdev;
+
+        /* FW should raise IRQ when ready */
+        rc = wil_if_pcie_enable(wil);
+        if (rc) {
+                wil_err(wil, "Enable device failed\n");
+                goto if_free;
+        }
+        /* rollback to bus_disable */
+
+        rc = wil_if_add(wil);
+        if (rc) {
+                wil_err(wil, "wil_if_add failed: %d\n", rc);
+                goto bus_disable;
+        }
+
+        wil6210_debugfs_init(wil);
+
+        /* check FW is alive */
+        wmi_echo(wil);
+
+        return 0;
+
+ bus_disable:
+        wil_if_pcie_disable(wil);
+ if_free:
+        wil_if_free(wil);
+ err_iounmap:
+        pci_iounmap(pdev, csr);
+ err_release_reg:
+        pci_release_region(pdev, 0);
+ err_disable_pdev:
+        pci_disable_device(pdev);
+
+        return rc;
+}
+
+static void wil_pcie_remove(struct pci_dev *pdev)
+{
+        struct wil6210_priv *wil = pci_get_drvdata(pdev);
+
+        wil6210_debugfs_remove(wil);
+        wil_if_pcie_disable(wil);
+        wil_if_remove(wil);
+        wil_if_free(wil);
+        pci_iounmap(pdev, wil->csr);
+        pci_release_region(pdev, 0);
+        pci_disable_device(pdev);
+        pci_set_drvdata(pdev, NULL);
+}
+
+static DEFINE_PCI_DEVICE_TABLE(wil6210_pcie_ids) = {
+        { PCI_DEVICE(0x1ae9, 0x0301) },
+        { /* end: all zeroes */ },
+};
+MODULE_DEVICE_TABLE(pci, wil6210_pcie_ids);
+
+static struct pci_driver wil6210_driver = {
+        .probe          = wil_pcie_probe,
+        .remove         = wil_pcie_remove,
+        .id_table       = wil6210_pcie_ids,
+        .name           = WIL_NAME,
+};
+
+module_pci_driver(wil6210_driver);
+
+MODULE_LICENSE("Dual BSD/GPL");
+MODULE_AUTHOR("Qualcomm Atheros <wil6210@qca.qualcomm.com>");
+MODULE_DESCRIPTION("Driver for 60g WiFi WIL6210 card");
diff --git a/drivers/net/wireless/ath/wil6210/txrx.c b/drivers/net/wireless/ath/wil6210/txrx.c
new file mode 100644
index 000000000000..64b971fdc3cc
--- /dev/null
+++ b/drivers/net/wireless/ath/wil6210/txrx.c
@@ -0,0 +1,826 @@
+/*
+ * Copyright (c) 2012 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/kernel.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/hardirq.h>
+#include <net/ieee80211_radiotap.h>
+#include <linux/if_arp.h>
+#include <linux/moduleparam.h>
+
+#include "wil6210.h"
+#include "wmi.h"
+#include "txrx.h"
+
+static bool rtap_include_phy_info;
+module_param(rtap_include_phy_info, bool, S_IRUGO);
+MODULE_PARM_DESC(rtap_include_phy_info,
+                 " Include PHY info in the radiotap header, default - no");
+
+static inline int wil_vring_is_empty(struct vring *vring)
+{
+        return vring->swhead == vring->swtail;
+}
+
+static inline u32 wil_vring_next_tail(struct vring *vring)
+{
+        return (vring->swtail + 1) % vring->size;
+}
+
+static inline void wil_vring_advance_head(struct vring *vring, int n)
+{
+        vring->swhead = (vring->swhead + n) % vring->size;
+}
+
+static inline int wil_vring_is_full(struct vring *vring)
+{
+        return wil_vring_next_tail(vring) == vring->swhead;
+}
+/*
+ * Available space in Tx Vring
+ */
+static inline int wil_vring_avail_tx(struct vring *vring)
+{
+        u32 swhead = vring->swhead;
+        u32 swtail = vring->swtail;
+        int used = (vring->size + swhead - swtail) % vring->size;
+
+        return vring->size - used - 1;
+}
+
+static int wil_vring_alloc(struct wil6210_priv *wil, struct vring *vring)
+{
+        struct device *dev = wil_to_dev(wil);
+        size_t sz = vring->size * sizeof(vring->va[0]);
+        uint i;
+
+        BUILD_BUG_ON(sizeof(vring->va[0]) != 32);
+
+        vring->swhead = 0;
+        vring->swtail = 0;
+        vring->ctx = kzalloc(vring->size * sizeof(vring->ctx[0]), GFP_KERNEL);
+        if (!vring->ctx) {
+                wil_err(wil, "vring_alloc [%d] failed to alloc ctx mem\n",
+                        vring->size);
+                vring->va = NULL;
+                return -ENOMEM;
+        }
+        /*
+         * vring->va should be aligned on its size rounded up to power of 2
+         * This is granted by the dma_alloc_coherent
+         */
+        vring->va = dma_alloc_coherent(dev, sz, &vring->pa, GFP_KERNEL);
+        if (!vring->va) {
+                wil_err(wil, "vring_alloc [%d] failed to alloc DMA mem\n",
+                        vring->size);
+                kfree(vring->ctx);
+                vring->ctx = NULL;
+                return -ENOMEM;
+        }
+        /* initially, all descriptors are SW owned
+         * For Tx and Rx, ownership bit is at the same location, thus
+         * we can use any
+         */
+        for (i = 0; i < vring->size; i++) {
+                volatile struct vring_tx_desc *d = &(vring->va[i].tx);
+                d->dma.status = TX_DMA_STATUS_DU;
+        }
+
+        wil_dbg_misc(wil, "vring[%d] 0x%p:0x%016llx 0x%p\n", vring->size,
+                     vring->va, (unsigned long long)vring->pa, vring->ctx);
+
+        return 0;
+}
+
+static void wil_vring_free(struct wil6210_priv *wil, struct vring *vring,
+                           int tx)
+{
+        struct device *dev = wil_to_dev(wil);
+        size_t sz = vring->size * sizeof(vring->va[0]);
+
+        while (!wil_vring_is_empty(vring)) {
+                if (tx) {
+                        volatile struct vring_tx_desc *d =
+                                        &vring->va[vring->swtail].tx;
+                        dma_addr_t pa = d->dma.addr_low |
+                                        ((u64)d->dma.addr_high << 32);
+                        struct sk_buff *skb = vring->ctx[vring->swtail];
+                        if (skb) {
+                                dma_unmap_single(dev, pa, d->dma.length,
+                                                 DMA_TO_DEVICE);
+                                dev_kfree_skb_any(skb);
+                                vring->ctx[vring->swtail] = NULL;
+                        } else {
+                                dma_unmap_page(dev, pa, d->dma.length,
+                                               DMA_TO_DEVICE);
+                        }
+                        vring->swtail = wil_vring_next_tail(vring);
+                } else { /* rx */
+                        volatile struct vring_rx_desc *d =
+                                        &vring->va[vring->swtail].rx;
+                        dma_addr_t pa = d->dma.addr_low |
+                                        ((u64)d->dma.addr_high << 32);
+                        struct sk_buff *skb = vring->ctx[vring->swhead];
+                        dma_unmap_single(dev, pa, d->dma.length,
+                                         DMA_FROM_DEVICE);
+                        kfree_skb(skb);
+                        wil_vring_advance_head(vring, 1);
+                }
+        }
+        dma_free_coherent(dev, sz, (void *)vring->va, vring->pa);
+        kfree(vring->ctx);
+        vring->pa = 0;
+        vring->va = NULL;
+        vring->ctx = NULL;
+}
+
+/**
+ * Allocate one skb for Rx VRING
+ *
+ * Safe to call from IRQ
+ */
+static int wil_vring_alloc_skb(struct wil6210_priv *wil, struct vring *vring,
+                               u32 i, int headroom)
+{
+        struct device *dev = wil_to_dev(wil);
+        unsigned int sz = RX_BUF_LEN;
+        volatile struct vring_rx_desc *d = &(vring->va[i].rx);
+        dma_addr_t pa;
+
+        /* TODO align */
+        struct sk_buff *skb = dev_alloc_skb(sz + headroom);
+        if (unlikely(!skb))
+                return -ENOMEM;
+
+        skb_reserve(skb, headroom);
+        skb_put(skb, sz);
+
+        pa = dma_map_single(dev, skb->data, skb->len, DMA_FROM_DEVICE);
+        if (unlikely(dma_mapping_error(dev, pa))) {
+                kfree_skb(skb);
+                return -ENOMEM;
+        }
+
+        d->dma.d0 = BIT(9) | RX_DMA_D0_CMD_DMA_IT;
+        d->dma.addr_low = lower_32_bits(pa);
+        d->dma.addr_high = (u16)upper_32_bits(pa);
+        /* ip_length don't care */
+        /* b11 don't care */
+        /* error don't care */
+        d->dma.status = 0; /* BIT(0) should be 0 for HW_OWNED */
+        d->dma.length = sz;
+        vring->ctx[i] = skb;
+
+        return 0;
+}
+
+/**
+ * Adds radiotap header
+ *
+ * Any error indicated as "Bad FCS"
+ *
+ * Vendor data for 04:ce:14-1 (Wilocity-1) consists of:
+ *  - Rx descriptor: 32 bytes
+ *  - Phy info
+ */
+static void wil_rx_add_radiotap_header(struct wil6210_priv *wil,
+                                       struct sk_buff *skb,
+                                       volatile struct vring_rx_desc *d)
+{
+        struct wireless_dev *wdev = wil->wdev;
+        struct wil6210_rtap {
+                struct ieee80211_radiotap_header rthdr;
+                /* fields should be in the order of bits in rthdr.it_present */
+                /* flags */
+                u8 flags;
+                /* channel */
+                __le16 chnl_freq __aligned(2);
+                __le16 chnl_flags;
+                /* MCS */
+                u8 mcs_present;
+                u8 mcs_flags;
+                u8 mcs_index;
+        } __packed;
+        struct wil6210_rtap_vendor {
+                struct wil6210_rtap rtap;
+                /* vendor */
+                u8 vendor_oui[3] __aligned(2);
+                u8 vendor_ns;
+                __le16 vendor_skip;
+                u8 vendor_data[0];
+        } __packed;
+        struct wil6210_rtap_vendor *rtap_vendor;
+        int rtap_len = sizeof(struct wil6210_rtap);
+        int phy_length = 0; /* phy info header size, bytes */
+        static char phy_data[128];
+        struct ieee80211_channel *ch = wdev->preset_chandef.chan;
+
+        if (rtap_include_phy_info) {
+                rtap_len = sizeof(*rtap_vendor) + sizeof(*d);
+                /* calculate additional length */
+                if (d->dma.status & RX_DMA_STATUS_PHY_INFO) {
+                        /**
+                         * PHY info starts from 8-byte boundary
+                         * there are 8-byte lines, last line may be partially
+                         * written (HW bug), thus FW configures for last line
+                         * to be excessive. Driver skips this last line.
+                         */
+                        int len = min_t(int, 8 + sizeof(phy_data),
+                                        wil_rxdesc_phy_length(d));
+                        if (len > 8) {
+                                void *p = skb_tail_pointer(skb);
+                                void *pa = PTR_ALIGN(p, 8);
+                                if (skb_tailroom(skb) >= len + (pa - p)) {
+                                        phy_length = len - 8;
+                                        memcpy(phy_data, pa, phy_length);
+                                }
+                        }
+                }
+                rtap_len += phy_length;
+        }
+
+        if (skb_headroom(skb) < rtap_len &&
+            pskb_expand_head(skb, rtap_len, 0, GFP_ATOMIC)) {
+                wil_err(wil, "Unable to expand headrom to %d\n", rtap_len);
+                return;
+        }
+
+        rtap_vendor = (void *)skb_push(skb, rtap_len);
+        memset(rtap_vendor, 0, rtap_len);
+
+        rtap_vendor->rtap.rthdr.it_version = PKTHDR_RADIOTAP_VERSION;
+        rtap_vendor->rtap.rthdr.it_len = cpu_to_le16(rtap_len);
+        rtap_vendor->rtap.rthdr.it_present = cpu_to_le32(
+                        (1 << IEEE80211_RADIOTAP_FLAGS) |
+                        (1 << IEEE80211_RADIOTAP_CHANNEL) |
+                        (1 << IEEE80211_RADIOTAP_MCS));
+        if (d->dma.status & RX_DMA_STATUS_ERROR)
+                rtap_vendor->rtap.flags |= IEEE80211_RADIOTAP_F_BADFCS;
+
+        rtap_vendor->rtap.chnl_freq = cpu_to_le16(ch ? ch->center_freq : 58320);
+        rtap_vendor->rtap.chnl_flags = cpu_to_le16(0);
+
+        rtap_vendor->rtap.mcs_present = IEEE80211_RADIOTAP_MCS_HAVE_MCS;
+        rtap_vendor->rtap.mcs_flags = 0;
+        rtap_vendor->rtap.mcs_index = wil_rxdesc_mcs(d);
+
+        if (rtap_include_phy_info) {
+                rtap_vendor->rtap.rthdr.it_present |= cpu_to_le32(1 <<
+                                IEEE80211_RADIOTAP_VENDOR_NAMESPACE);
+                /* OUI for Wilocity 04:ce:14 */
+                rtap_vendor->vendor_oui[0] = 0x04;
+                rtap_vendor->vendor_oui[1] = 0xce;
+                rtap_vendor->vendor_oui[2] = 0x14;
+                rtap_vendor->vendor_ns = 1;
+                /* Rx descriptor + PHY data  */
+                rtap_vendor->vendor_skip = cpu_to_le16(sizeof(*d) +
+                                                       phy_length);
+                memcpy(rtap_vendor->vendor_data, (void *)d, sizeof(*d));
+                memcpy(rtap_vendor->vendor_data + sizeof(*d), phy_data,
+                       phy_length);
+        }
+}
+
+/*
+ * Fast swap in place between 2 registers
+ */
+static void wil_swap_u16(u16 *a, u16 *b)
+{
+        *a ^= *b;
+        *b ^= *a;
+        *a ^= *b;
+}
+
+static void wil_swap_ethaddr(void *data)
+{
+        struct ethhdr *eth = data;
+        u16 *s = (u16 *)eth->h_source;
+        u16 *d = (u16 *)eth->h_dest;
+
+        wil_swap_u16(s++, d++);
+        wil_swap_u16(s++, d++);
+        wil_swap_u16(s, d);
+}
+
+/**
+ * reap 1 frame from @swhead
+ *
+ * Safe to call from IRQ
+ */
+static struct sk_buff *wil_vring_reap_rx(struct wil6210_priv *wil,
+                                         struct vring *vring)
+{
+        struct device *dev = wil_to_dev(wil);
+        struct net_device *ndev = wil_to_ndev(wil);
+        volatile struct vring_rx_desc *d;
+        struct sk_buff *skb;
+        dma_addr_t pa;
+        unsigned int sz = RX_BUF_LEN;
+        u8 ftype;
+        u8 ds_bits;
+
+        if (wil_vring_is_empty(vring))
+                return NULL;
+
+        d = &(vring->va[vring->swhead].rx);
+        if (!(d->dma.status & RX_DMA_STATUS_DU)) {
+                /* it is not error, we just reached end of Rx done area */
+                return NULL;
+        }
+
+        pa = d->dma.addr_low | ((u64)d->dma.addr_high << 32);
+        skb = vring->ctx[vring->swhead];
+        dma_unmap_single(dev, pa, sz, DMA_FROM_DEVICE);
+        skb_trim(skb, d->dma.length);
+
+        wil->stats.last_mcs_rx = wil_rxdesc_mcs(d);
+
+        /* use radiotap header only if required */
+        if (ndev->type == ARPHRD_IEEE80211_RADIOTAP)
+                wil_rx_add_radiotap_header(wil, skb, d);
+
+        wil_dbg_txrx(wil, "Rx[%3d] : %d bytes\n", vring->swhead, d->dma.length);
+        wil_hex_dump_txrx("Rx ", DUMP_PREFIX_NONE, 32, 4,
+                          (const void *)d, sizeof(*d), false);
+
+        wil_vring_advance_head(vring, 1);
+
+        /* no extra checks if in sniffer mode */
+        if (ndev->type != ARPHRD_ETHER)
+                return skb;
+        /*
+         * Non-data frames may be delivered through Rx DMA channel (ex: BAR)
+         * Driver should recognize it by frame type, that is found
+         * in Rx descriptor. If type is not data, it is 802.11 frame as is
+         */
+        ftype = wil_rxdesc_ftype(d) << 2;
+        if (ftype != IEEE80211_FTYPE_DATA) {
+                wil_dbg_txrx(wil, "Non-data frame ftype 0x%08x\n", ftype);
+                /* TODO: process it */
+                kfree_skb(skb);
+                return NULL;
+        }
+
+        if (skb->len < ETH_HLEN) {
+                wil_err(wil, "Short frame, len = %d\n", skb->len);
+                /* TODO: process it (i.e. BAR) */
+                kfree_skb(skb);
+                return NULL;
+        }
+
+        ds_bits = wil_rxdesc_ds_bits(d);
+        if (ds_bits == 1) {
+                /*
+                 * HW bug - in ToDS mode, i.e. Rx on AP side,
+                 * addresses get swapped
+                 */
+                wil_swap_ethaddr(skb->data);
+        }
+
+        return skb;
+}
+
+/**
+ * allocate and fill up to @count buffers in rx ring
+ * buffers posted at @swtail
+ */
+static int wil_rx_refill(struct wil6210_priv *wil, int count)
+{
+        struct net_device *ndev = wil_to_ndev(wil);
+        struct vring *v = &wil->vring_rx;
+        u32 next_tail;
+        int rc = 0;
+        int headroom = ndev->type == ARPHRD_IEEE80211_RADIOTAP ?
+                        WIL6210_RTAP_SIZE : 0;
+
+        for (; next_tail = wil_vring_next_tail(v),
+                        (next_tail != v->swhead) && (count-- > 0);
+                        v->swtail = next_tail) {
+                rc = wil_vring_alloc_skb(wil, v, v->swtail, headroom);
+                if (rc) {
+                        wil_err(wil, "Error %d in wil_rx_refill[%d]\n",
+                                rc, v->swtail);
+                        break;
+                }
+        }
+        iowrite32(v->swtail, wil->csr + HOSTADDR(v->hwtail));
+
+        return rc;
+}
+
+/*
+ * Pass Rx packet to the netif. Update statistics.
+ */
+static void wil_netif_rx_any(struct sk_buff *skb, struct net_device *ndev)
+{
+        int rc;
+        unsigned int len = skb->len;
+
+        skb_orphan(skb);
+
+        if (in_interrupt())
+                rc = netif_rx(skb);
+        else
+                rc = netif_rx_ni(skb);
+
+        if (likely(rc == NET_RX_SUCCESS)) {
+                ndev->stats.rx_packets++;
+                ndev->stats.rx_bytes += len;
+
+        } else {
+                ndev->stats.rx_dropped++;
+        }
+}
+
+/**
+ * Proceed all completed skb's from Rx VRING
+ *
+ * Safe to call from IRQ
+ */
+void wil_rx_handle(struct wil6210_priv *wil)
+{
+        struct net_device *ndev = wil_to_ndev(wil);
+        struct vring *v = &wil->vring_rx;
+        struct sk_buff *skb;
+
+        if (!v->va) {
+                wil_err(wil, "Rx IRQ while Rx not yet initialized\n");
+                return;
+        }
+        wil_dbg_txrx(wil, "%s()\n", __func__);
+        while (NULL != (skb = wil_vring_reap_rx(wil, v))) {
+                wil_hex_dump_txrx("Rx ", DUMP_PREFIX_OFFSET, 16, 1,
+                                  skb->data, skb_headlen(skb), false);
+
+                if (wil->wdev->iftype == NL80211_IFTYPE_MONITOR) {
+                        skb->dev = ndev;
+                        skb_reset_mac_header(skb);
+                        skb->ip_summed = CHECKSUM_UNNECESSARY;
+                        skb->pkt_type = PACKET_OTHERHOST;
+                        skb->protocol = htons(ETH_P_802_2);
+
+                } else {
+                        skb->protocol = eth_type_trans(skb, ndev);
+                }
+
+                wil_netif_rx_any(skb, ndev);
+        }
+        wil_rx_refill(wil, v->size);
+}
+
+int wil_rx_init(struct wil6210_priv *wil)
+{
+        struct vring *vring = &wil->vring_rx;
+        int rc;
+
+        vring->size = WIL6210_RX_RING_SIZE;
+        rc = wil_vring_alloc(wil, vring);
+        if (rc)
+                return rc;
+
+        rc = wmi_rx_chain_add(wil, vring);
+        if (rc)
+                goto err_free;
+
+        rc = wil_rx_refill(wil, vring->size);
+        if (rc)
+                goto err_free;
+
+        return 0;
+ err_free:
+        wil_vring_free(wil, vring, 0);
+
+        return rc;
+}
+
+void wil_rx_fini(struct wil6210_priv *wil)
+{
+        struct vring *vring = &wil->vring_rx;
+
+        if (vring->va)
+                wil_vring_free(wil, vring, 0);
+}
+
+int wil_vring_init_tx(struct wil6210_priv *wil, int id, int size,
+                      int cid, int tid)
+{
+        int rc;
+        struct wmi_vring_cfg_cmd cmd = {
+                .action = cpu_to_le32(WMI_VRING_CMD_ADD),
+                .vring_cfg = {
+                        .tx_sw_ring = {
+                                .max_mpdu_size = cpu_to_le16(TX_BUF_LEN),
+                        },
+                        .ringid = id,
+                        .cidxtid = (cid & 0xf) | ((tid & 0xf) << 4),
+                        .encap_trans_type = WMI_VRING_ENC_TYPE_802_3,
+                        .mac_ctrl = 0,
+                        .to_resolution = 0,
+                        .agg_max_wsize = 16,
+                        .schd_params = {
+                                .priority = cpu_to_le16(0),
+                                .timeslot_us = cpu_to_le16(0xfff),
+                        },
+                },
+        };
+        struct {
+                struct wil6210_mbox_hdr_wmi wmi;
+                struct wmi_vring_cfg_done_event cmd;
+        } __packed reply;
+        struct vring *vring = &wil->vring_tx[id];
+
+        if (vring->va) {
+                wil_err(wil, "Tx ring [%d] already allocated\n", id);
+                rc = -EINVAL;
+                goto out;
+        }
+
+        vring->size = size;
+        rc = wil_vring_alloc(wil, vring);
+        if (rc)
+                goto out;
+
+        cmd.vring_cfg.tx_sw_ring.ring_mem_base = cpu_to_le64(vring->pa);
+        cmd.vring_cfg.tx_sw_ring.ring_size = cpu_to_le16(vring->size);
+
+        rc = wmi_call(wil, WMI_VRING_CFG_CMDID, &cmd, sizeof(cmd),
+                      WMI_VRING_CFG_DONE_EVENTID, &reply, sizeof(reply), 100);
+        if (rc)
+                goto out_free;
+
+        if (reply.cmd.status != WMI_VRING_CFG_SUCCESS) {
+                wil_err(wil, "Tx config failed, status 0x%02x\n",
+                        reply.cmd.status);
+                rc = -EINVAL;
+                goto out_free;
+        }
+        vring->hwtail = le32_to_cpu(reply.cmd.tx_vring_tail_ptr);
+
+        return 0;
+ out_free:
+        wil_vring_free(wil, vring, 1);
+ out:
+
+        return rc;
+}
+
+void wil_vring_fini_tx(struct wil6210_priv *wil, int id)
+{
+        struct vring *vring = &wil->vring_tx[id];
+
+        if (!vring->va)
+                return;
+
+        wil_vring_free(wil, vring, 1);
+}
+
+static struct vring *wil_find_tx_vring(struct wil6210_priv *wil,
+                                       struct sk_buff *skb)
+{
+        struct vring *v = &wil->vring_tx[0];
+
+        if (v->va)
+                return v;
+
+        return NULL;
+}
+
+static int wil_tx_desc_map(volatile struct vring_tx_desc *d,
+                           dma_addr_t pa, u32 len)
+{
+        d->dma.addr_low = lower_32_bits(pa);
+        d->dma.addr_high = (u16)upper_32_bits(pa);
+        d->dma.ip_length = 0;
+        /* 0..6: mac_length; 7:ip_version 0-IP6 1-IP4*/
+        d->dma.b11 = 0/*14 | BIT(7)*/;
+        d->dma.error = 0;
+        d->dma.status = 0; /* BIT(0) should be 0 for HW_OWNED */
+        d->dma.length = len;
+        d->dma.d0 = 0;
+        d->mac.d[0] = 0;
+        d->mac.d[1] = 0;
+        d->mac.d[2] = 0;
+        d->mac.ucode_cmd = 0;
+        /* use dst index 0 */
+        d->mac.d[1] |= BIT(MAC_CFG_DESC_TX_1_DST_INDEX_EN_POS) |
+                       (0 << MAC_CFG_DESC_TX_1_DST_INDEX_POS);
+        /* translation type:  0 - bypass; 1 - 802.3; 2 - native wifi */
+        d->mac.d[2] = BIT(MAC_CFG_DESC_TX_2_SNAP_HDR_INSERTION_EN_POS) |
+                      (1 << MAC_CFG_DESC_TX_2_L2_TRANSLATION_TYPE_POS);
+
+        return 0;
+}
+
+static int wil_tx_vring(struct wil6210_priv *wil, struct vring *vring,
+                        struct sk_buff *skb)
+{
+        struct device *dev = wil_to_dev(wil);
+        volatile struct vring_tx_desc *d;
+        u32 swhead = vring->swhead;
+        int avail = wil_vring_avail_tx(vring);
+        int nr_frags = skb_shinfo(skb)->nr_frags;
+        uint f;
+        int vring_index = vring - wil->vring_tx;
+        uint i = swhead;
+        dma_addr_t pa;
+
+        wil_dbg_txrx(wil, "%s()\n", __func__);
+
+        if (avail < vring->size/8)
+                netif_tx_stop_all_queues(wil_to_ndev(wil));
+        if (avail < 1 + nr_frags) {
+                wil_err(wil, "Tx ring full. No space for %d fragments\n",
+                        1 + nr_frags);
+                return -ENOMEM;
+        }
+        d = &(vring->va[i].tx);
+
+        /* FIXME FW can accept only unicast frames for the peer */
+        memcpy(skb->data, wil->dst_addr[vring_index], ETH_ALEN);
+
+        pa = dma_map_single(dev, skb->data,
+                        skb_headlen(skb), DMA_TO_DEVICE);
+
+        wil_dbg_txrx(wil, "Tx skb %d bytes %p -> %#08llx\n", skb_headlen(skb),
+                     skb->data, (unsigned long long)pa);
+        wil_hex_dump_txrx("Tx ", DUMP_PREFIX_OFFSET, 16, 1,
+                          skb->data, skb_headlen(skb), false);
+
+        if (unlikely(dma_mapping_error(dev, pa)))
+                return -EINVAL;
+        /* 1-st segment */
+        wil_tx_desc_map(d, pa, skb_headlen(skb));
+        d->mac.d[2] |= ((nr_frags + 1) <<
+                       MAC_CFG_DESC_TX_2_NUM_OF_DESCRIPTORS_POS);
+        /* middle segments */
+        for (f = 0; f < nr_frags; f++) {
+                const struct skb_frag_struct *frag =
+                                &skb_shinfo(skb)->frags[f];
+                int len = skb_frag_size(frag);
+                i = (swhead + f + 1) % vring->size;
+                d = &(vring->va[i].tx);
+                pa = skb_frag_dma_map(dev, frag, 0, skb_frag_size(frag),
+                                DMA_TO_DEVICE);
+                if (unlikely(dma_mapping_error(dev, pa)))
+                        goto dma_error;
+                wil_tx_desc_map(d, pa, len);
+                vring->ctx[i] = NULL;
+        }
+        /* for the last seg only */
+        d->dma.d0 |= BIT(DMA_CFG_DESC_TX_0_CMD_EOP_POS);
+        d->dma.d0 |= BIT(9); /* BUG: undocumented bit */
+        d->dma.d0 |= BIT(DMA_CFG_DESC_TX_0_CMD_DMA_IT_POS);
+        d->dma.d0 |= (vring_index << DMA_CFG_DESC_TX_0_QID_POS);
+
+        wil_hex_dump_txrx("Tx ", DUMP_PREFIX_NONE, 32, 4,
+                          (const void *)d, sizeof(*d), false);
+
+        /* advance swhead */
+        wil_vring_advance_head(vring, nr_frags + 1);
+        wil_dbg_txrx(wil, "Tx swhead %d -> %d\n", swhead, vring->swhead);
+        iowrite32(vring->swhead, wil->csr + HOSTADDR(vring->hwtail));
+        /* hold reference to skb
+         * to prevent skb release before accounting
+         * in case of immediate "tx done"
+         */
+        vring->ctx[i] = skb_get(skb);
+
+        return 0;
+ dma_error:
+        /* unmap what we have mapped */
+        /* Note: increment @f to operate with positive index */
+        for (f++; f > 0; f--) {
+                i = (swhead + f) % vring->size;
+                d = &(vring->va[i].tx);
+                d->dma.status = TX_DMA_STATUS_DU;
+                pa = d->dma.addr_low | ((u64)d->dma.addr_high << 32);
+                if (vring->ctx[i])
+                        dma_unmap_single(dev, pa, d->dma.length, DMA_TO_DEVICE);
+                else
+                        dma_unmap_page(dev, pa, d->dma.length, DMA_TO_DEVICE);
+        }
+
+        return -EINVAL;
+}
+
+
+netdev_tx_t wil_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+{
+        struct wil6210_priv *wil = ndev_to_wil(ndev);
+        struct vring *vring;
+        int rc;
+
+        wil_dbg_txrx(wil, "%s()\n", __func__);
+        if (!test_bit(wil_status_fwready, &wil->status)) {
+                wil_err(wil, "FW not ready\n");
+                goto drop;
+        }
+        if (!test_bit(wil_status_fwconnected, &wil->status)) {
+                wil_err(wil, "FW not connected\n");
+                goto drop;
+        }
+        if (wil->wdev->iftype == NL80211_IFTYPE_MONITOR) {
+                wil_err(wil, "Xmit in monitor mode not supported\n");
+                goto drop;
+        }
+        if (skb->protocol == cpu_to_be16(ETH_P_PAE)) {
+                rc = wmi_tx_eapol(wil, skb);
+        } else {
+                /* find vring */
+                vring = wil_find_tx_vring(wil, skb);
+                if (!vring) {
+                        wil_err(wil, "No Tx VRING available\n");
+                        goto drop;
+                }
+                /* set up vring entry */
+                rc = wil_tx_vring(wil, vring, skb);
+        }
+        switch (rc) {
+        case 0:
+                /* statistics will be updated on the tx_complete */
+                dev_kfree_skb_any(skb);
+                return NETDEV_TX_OK;
+        case -ENOMEM:
+                return NETDEV_TX_BUSY;
+        default:
+                break; /* goto drop; */
+        }
+ drop:
+        netif_tx_stop_all_queues(ndev);
+        ndev->stats.tx_dropped++;
+        dev_kfree_skb_any(skb);
+
+        return NET_XMIT_DROP;
+}
+
+/**
+ * Clean up transmitted skb's from the Tx VRING
+ *
+ * Safe to call from IRQ
+ */
+void wil_tx_complete(struct wil6210_priv *wil, int ringid)
+{
+        struct net_device *ndev = wil_to_ndev(wil);
+        struct device *dev = wil_to_dev(wil);
+        struct vring *vring = &wil->vring_tx[ringid];
+
+        if (!vring->va) {
+                wil_err(wil, "Tx irq[%d]: vring not initialized\n", ringid);
+                return;
+        }
+
+        wil_dbg_txrx(wil, "%s(%d)\n", __func__, ringid);
+
+        while (!wil_vring_is_empty(vring)) {
+                volatile struct vring_tx_desc *d = &vring->va[vring->swtail].tx;
+                dma_addr_t pa;
+                struct sk_buff *skb;
+                if (!(d->dma.status & TX_DMA_STATUS_DU))
+                        break;
+
+                wil_dbg_txrx(wil,
+                             "Tx[%3d] : %d bytes, status 0x%02x err 0x%02x\n",
+                             vring->swtail, d->dma.length, d->dma.status,
+                             d->dma.error);
+                wil_hex_dump_txrx("TxC ", DUMP_PREFIX_NONE, 32, 4,
+                                  (const void *)d, sizeof(*d), false);
+
+                pa = d->dma.addr_low | ((u64)d->dma.addr_high << 32);
+                skb = vring->ctx[vring->swtail];
+                if (skb) {
+                        if (d->dma.error == 0) {
+                                ndev->stats.tx_packets++;
+                                ndev->stats.tx_bytes += skb->len;
+                        } else {
+                                ndev->stats.tx_errors++;
+                        }
+
+                        dma_unmap_single(dev, pa, d->dma.length, DMA_TO_DEVICE);
+                        dev_kfree_skb_any(skb);
+                        vring->ctx[vring->swtail] = NULL;
+                } else {
+                        dma_unmap_page(dev, pa, d->dma.length, DMA_TO_DEVICE);
+                }
+                d->dma.addr_low = 0;
+                d->dma.addr_high = 0;
+                d->dma.length = 0;
+                d->dma.status = TX_DMA_STATUS_DU;
+                vring->swtail = wil_vring_next_tail(vring);
+        }
+        if (wil_vring_avail_tx(vring) > vring->size/4)
+                netif_tx_wake_all_queues(wil_to_ndev(wil));
+}
diff --git a/drivers/net/wireless/ath/wil6210/txrx.h b/drivers/net/wireless/ath/wil6210/txrx.h
new file mode 100644
index 000000000000..45a61f597c5c
--- /dev/null
+++ b/drivers/net/wireless/ath/wil6210/txrx.h
@@ -0,0 +1,362 @@
+/*
+ * Copyright (c) 2012 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef WIL6210_TXRX_H
+#define WIL6210_TXRX_H
+
+#define BUF_SW_OWNED    (1)
+#define BUF_HW_OWNED    (0)
+
+/* size of max. Rx packet */
+#define RX_BUF_LEN      (2048)
+#define TX_BUF_LEN      (2048)
+/* how many bytes to reserve for rtap header? */
+#define WIL6210_RTAP_SIZE (128)
+
+/* Tx/Rx path */
+/*
+ * Tx descriptor - MAC part
+ * [dword 0]
+ * bit  0.. 9 : lifetime_expiry_value:10
+ * bit     10 : interrup_en:1
+ * bit     11 : status_en:1
+ * bit 12..13 : txss_override:2
+ * bit     14 : timestamp_insertion:1
+ * bit     15 : duration_preserve:1
+ * bit 16..21 : reserved0:6
+ * bit 22..26 : mcs_index:5
+ * bit     27 : mcs_en:1
+ * bit 28..29 : reserved1:2
+ * bit     30 : reserved2:1
+ * bit     31 : sn_preserved:1
+ * [dword 1]
+ * bit  0.. 3 : pkt_mode:4
+ * bit      4 : pkt_mode_en:1
+ * bit  5.. 7 : reserved0:3
+ * bit  8..13 : reserved1:6
+ * bit     14 : reserved2:1
+ * bit     15 : ack_policy_en:1
+ * bit 16..19 : dst_index:4
+ * bit     20 : dst_index_en:1
+ * bit 21..22 : ack_policy:2
+ * bit     23 : lifetime_en:1
+ * bit 24..30 : max_retry:7
+ * bit     31 : max_retry_en:1
+ * [dword 2]
+ * bit  0.. 7 : num_of_descriptors:8
+ * bit  8..17 : reserved:10
+ * bit 18..19 : l2_translation_type:2
+ * bit     20 : snap_hdr_insertion_en:1
+ * bit     21 : vlan_removal_en:1
+ * bit 22..31 : reserved0:10
+ * [dword 3]
+ * bit  0.. 31: ucode_cmd:32
+ */
+struct vring_tx_mac {
+        u32 d[3];
+        u32 ucode_cmd;
+} __packed;
+
+/* TX MAC Dword 0 */
+#define MAC_CFG_DESC_TX_0_LIFETIME_EXPIRY_VALUE_POS 0
+#define MAC_CFG_DESC_TX_0_LIFETIME_EXPIRY_VALUE_LEN 10
+#define MAC_CFG_DESC_TX_0_LIFETIME_EXPIRY_VALUE_MSK 0x3FF
+
+#define MAC_CFG_DESC_TX_0_INTERRUP_EN_POS 10
+#define MAC_CFG_DESC_TX_0_INTERRUP_EN_LEN 1
+#define MAC_CFG_DESC_TX_0_INTERRUP_EN_MSK 0x400
+
+#define MAC_CFG_DESC_TX_0_STATUS_EN_POS 11
+#define MAC_CFG_DESC_TX_0_STATUS_EN_LEN 1
+#define MAC_CFG_DESC_TX_0_STATUS_EN_MSK 0x800
+
+#define MAC_CFG_DESC_TX_0_TXSS_OVERRIDE_POS 12
+#define MAC_CFG_DESC_TX_0_TXSS_OVERRIDE_LEN 2
+#define MAC_CFG_DESC_TX_0_TXSS_OVERRIDE_MSK 0x3000
+
+#define MAC_CFG_DESC_TX_0_TIMESTAMP_INSERTION_POS 14
+#define MAC_CFG_DESC_TX_0_TIMESTAMP_INSERTION_LEN 1
+#define MAC_CFG_DESC_TX_0_TIMESTAMP_INSERTION_MSK 0x4000
+
+#define MAC_CFG_DESC_TX_0_DURATION_PRESERVE_POS 15
+#define MAC_CFG_DESC_TX_0_DURATION_PRESERVE_LEN 1
+#define MAC_CFG_DESC_TX_0_DURATION_PRESERVE_MSK 0x8000
+
+#define MAC_CFG_DESC_TX_0_MCS_INDEX_POS 22
+#define MAC_CFG_DESC_TX_0_MCS_INDEX_LEN 5
+#define MAC_CFG_DESC_TX_0_MCS_INDEX_MSK 0x7C00000
+
+#define MAC_CFG_DESC_TX_0_MCS_EN_POS 27
+#define MAC_CFG_DESC_TX_0_MCS_EN_LEN 1
+#define MAC_CFG_DESC_TX_0_MCS_EN_MSK 0x8000000
+
+#define MAC_CFG_DESC_TX_0_SN_PRESERVED_POS 31
+#define MAC_CFG_DESC_TX_0_SN_PRESERVED_LEN 1
+#define MAC_CFG_DESC_TX_0_SN_PRESERVED_MSK 0x80000000
+
+/* TX MAC Dword 1 */
+#define MAC_CFG_DESC_TX_1_PKT_MODE_POS 0
+#define MAC_CFG_DESC_TX_1_PKT_MODE_LEN 4
+#define MAC_CFG_DESC_TX_1_PKT_MODE_MSK 0xF
+
+#define MAC_CFG_DESC_TX_1_PKT_MODE_EN_POS 4
+#define MAC_CFG_DESC_TX_1_PKT_MODE_EN_LEN 1
+#define MAC_CFG_DESC_TX_1_PKT_MODE_EN_MSK 0x10
+
+#define MAC_CFG_DESC_TX_1_ACK_POLICY_EN_POS 15
+#define MAC_CFG_DESC_TX_1_ACK_POLICY_EN_LEN 1
+#define MAC_CFG_DESC_TX_1_ACK_POLICY_EN_MSK 0x8000
+
+#define MAC_CFG_DESC_TX_1_DST_INDEX_POS 16
+#define MAC_CFG_DESC_TX_1_DST_INDEX_LEN 4
+#define MAC_CFG_DESC_TX_1_DST_INDEX_MSK 0xF0000
+
+#define MAC_CFG_DESC_TX_1_DST_INDEX_EN_POS 20
+#define MAC_CFG_DESC_TX_1_DST_INDEX_EN_LEN 1
+#define MAC_CFG_DESC_TX_1_DST_INDEX_EN_MSK 0x100000
+
+#define MAC_CFG_DESC_TX_1_ACK_POLICY_POS 21
+#define MAC_CFG_DESC_TX_1_ACK_POLICY_LEN 2
+#define MAC_CFG_DESC_TX_1_ACK_POLICY_MSK 0x600000
+
+#define MAC_CFG_DESC_TX_1_LIFETIME_EN_POS 23
+#define MAC_CFG_DESC_TX_1_LIFETIME_EN_LEN 1
+#define MAC_CFG_DESC_TX_1_LIFETIME_EN_MSK 0x800000
+
+#define MAC_CFG_DESC_TX_1_MAX_RETRY_POS 24
+#define MAC_CFG_DESC_TX_1_MAX_RETRY_LEN 7
+#define MAC_CFG_DESC_TX_1_MAX_RETRY_MSK 0x7F000000
+
+#define MAC_CFG_DESC_TX_1_MAX_RETRY_EN_POS 31
+#define MAC_CFG_DESC_TX_1_MAX_RETRY_EN_LEN 1
+#define MAC_CFG_DESC_TX_1_MAX_RETRY_EN_MSK 0x80000000
+
+/* TX MAC Dword 2 */
+#define MAC_CFG_DESC_TX_2_NUM_OF_DESCRIPTORS_POS 0
+#define MAC_CFG_DESC_TX_2_NUM_OF_DESCRIPTORS_LEN 8
+#define MAC_CFG_DESC_TX_2_NUM_OF_DESCRIPTORS_MSK 0xFF
+
+#define MAC_CFG_DESC_TX_2_RESERVED_POS 8
+#define MAC_CFG_DESC_TX_2_RESERVED_LEN 10
+#define MAC_CFG_DESC_TX_2_RESERVED_MSK 0x3FF00
+
+#define MAC_CFG_DESC_TX_2_L2_TRANSLATION_TYPE_POS 18
+#define MAC_CFG_DESC_TX_2_L2_TRANSLATION_TYPE_LEN 2
+#define MAC_CFG_DESC_TX_2_L2_TRANSLATION_TYPE_MSK 0xC0000
+
+#define MAC_CFG_DESC_TX_2_SNAP_HDR_INSERTION_EN_POS 20
+#define MAC_CFG_DESC_TX_2_SNAP_HDR_INSERTION_EN_LEN 1
+#define MAC_CFG_DESC_TX_2_SNAP_HDR_INSERTION_EN_MSK 0x100000
+
+#define MAC_CFG_DESC_TX_2_VLAN_REMOVAL_EN_POS 21
+#define MAC_CFG_DESC_TX_2_VLAN_REMOVAL_EN_LEN 1
+#define MAC_CFG_DESC_TX_2_VLAN_REMOVAL_EN_MSK 0x200000
+
+/* TX MAC Dword 3 */
+#define MAC_CFG_DESC_TX_3_UCODE_CMD_POS 0
+#define MAC_CFG_DESC_TX_3_UCODE_CMD_LEN 32
+#define MAC_CFG_DESC_TX_3_UCODE_CMD_MSK 0xFFFFFFFF
+
+/* TX DMA Dword 0 */
+#define DMA_CFG_DESC_TX_0_L4_LENGTH_POS 0
+#define DMA_CFG_DESC_TX_0_L4_LENGTH_LEN 8
+#define DMA_CFG_DESC_TX_0_L4_LENGTH_MSK 0xFF
+
+#define DMA_CFG_DESC_TX_0_CMD_EOP_POS 8
+#define DMA_CFG_DESC_TX_0_CMD_EOP_LEN 1
+#define DMA_CFG_DESC_TX_0_CMD_EOP_MSK 0x100
+
+#define DMA_CFG_DESC_TX_0_CMD_DMA_IT_POS 10
+#define DMA_CFG_DESC_TX_0_CMD_DMA_IT_LEN 1
+#define DMA_CFG_DESC_TX_0_CMD_DMA_IT_MSK 0x400
+
+#define DMA_CFG_DESC_TX_0_SEGMENT_BUF_DETAILS_POS 11
+#define DMA_CFG_DESC_TX_0_SEGMENT_BUF_DETAILS_LEN 2
+#define DMA_CFG_DESC_TX_0_SEGMENT_BUF_DETAILS_MSK 0x1800
+
+#define DMA_CFG_DESC_TX_0_TCP_SEG_EN_POS 13
+#define DMA_CFG_DESC_TX_0_TCP_SEG_EN_LEN 1
+#define DMA_CFG_DESC_TX_0_TCP_SEG_EN_MSK 0x2000
+
+#define DMA_CFG_DESC_TX_0_IPV4_CHECKSUM_EN_POS 14
+#define DMA_CFG_DESC_TX_0_IPV4_CHECKSUM_EN_LEN 1
+#define DMA_CFG_DESC_TX_0_IPV4_CHECKSUM_EN_MSK 0x4000
+
+#define DMA_CFG_DESC_TX_0_TCP_UDP_CHECKSUM_EN_POS 15
+#define DMA_CFG_DESC_TX_0_TCP_UDP_CHECKSUM_EN_LEN 1
+#define DMA_CFG_DESC_TX_0_TCP_UDP_CHECKSUM_EN_MSK 0x8000
+
+#define DMA_CFG_DESC_TX_0_QID_POS 16
+#define DMA_CFG_DESC_TX_0_QID_LEN 5
+#define DMA_CFG_DESC_TX_0_QID_MSK 0x1F0000
+
+#define DMA_CFG_DESC_TX_0_PSEUDO_HEADER_CALC_EN_POS 21
+#define DMA_CFG_DESC_TX_0_PSEUDO_HEADER_CALC_EN_LEN 1
+#define DMA_CFG_DESC_TX_0_PSEUDO_HEADER_CALC_EN_MSK 0x200000
+
+#define DMA_CFG_DESC_TX_0_L4_TYPE_POS 30
+#define DMA_CFG_DESC_TX_0_L4_TYPE_LEN 2
+#define DMA_CFG_DESC_TX_0_L4_TYPE_MSK 0xC0000000
+
+
+#define TX_DMA_STATUS_DU         BIT(0)
+
+struct vring_tx_dma {
+        u32 d0;
+        u32 addr_low;
+        u16 addr_high;
+        u8  ip_length;
+        u8  b11;       /* 0..6: mac_length; 7:ip_version */
+        u8  error;     /* 0..2: err; 3..7: reserved; */
+        u8  status;    /* 0: used; 1..7; reserved */
+        u16 length;
+} __packed;
+
+/*
+ * Rx descriptor - MAC part
+ * [dword 0]
+ * bit  0.. 3 : tid:4 The QoS (b3-0) TID Field
+ * bit  4.. 6 : connection_id:3 :The Source index that  was found during
+ *  Parsing the TA.  This field is used to  define the source of the packet
+ * bit      7 : reserved:1
+ * bit  8.. 9 : mac_id:2 : The MAC virtual  Ring number (always zero)
+ * bit 10..11 : frame_type:2 : The FC Control  (b3-2) -  MPDU Type
+ *              (management, data, control  and extension)
+ * bit 12..15 : frame_subtype:4 : The FC Control  (b7-4) -  Frame Subtype
+ * bit 16..27 : seq_number:12 The received Sequence number field
+ * bit 28..31 : extended:4 extended subtype
+ * [dword 1]
+ * bit  0.. 3 : reserved
+ * bit  4.. 5 : key_id:2
+ * bit      6 : decrypt_bypass:1
+ * bit      7 : security:1
+ * bit  8.. 9 : ds_bits:2
+ * bit     10 : a_msdu_present:1  from qos header
+ * bit     11 : a_msdu_type:1  from qos header
+ * bit     12 : a_mpdu:1  part of AMPDU aggregation
+ * bit     13 : broadcast:1
+ * bit     14 : mutlicast:1
+ * bit     15 : reserved:1
+ * bit 16..20 : rx_mac_qid:5   The Queue Identifier that the packet
+ *                             is received from
+ * bit 21..24 : mcs:4
+ * bit 25..28 : mic_icr:4
+ * bit 29..31 : reserved:3
+ * [dword 2]
+ * bit  0.. 2 : time_slot:3 The timeslot that the MPDU is received
+ * bit      3 : fc_protocol_ver:1 The FC Control  (b0) - Protocol  Version
+ * bit      4 : fc_order:1 The FC Control (b15) -Order
+ * bit  5.. 7 : qos_ack_policy:3  The QoS (b6-5) ack policy Field
+ * bit      8 : esop:1 The QoS (b4) ESOP field
+ * bit      9 : qos_rdg_more_ppdu:1 The QoS (b9) RDG  field
+ * bit 10..14 : qos_reserved:5 The QoS (b14-10) Reserved  field
+ * bit     15 : qos_ac_constraint:1
+ * bit 16..31 : pn_15_0:16 low 2 bytes of PN
+ * [dword 3]
+ * bit  0..31 : pn_47_16:32 high 4 bytes of PN
+ */
+struct vring_rx_mac {
+        u32 d0;
+        u32 d1;
+        u16 w4;
+        u16 pn_15_0;
+        u32 pn_47_16;
+} __packed;
+
+/*
+ * Rx descriptor - DMA part
+ * [dword 0]
+ * bit  0.. 7 : l4_length:8 layer 4 length
+ * bit  8.. 9 : reserved:2
+ * bit     10 : cmd_dma_it:1
+ * bit 11..15 : reserved:5
+ * bit 16..29 : phy_info_length:14
+ * bit 30..31 : l4_type:2 valid if the L4I bit is set in the status field
+ * [dword 1]
+ * bit  0..31 : addr_low:32 The payload buffer low address
+ * [dword 2]
+ * bit  0..15 : addr_high:16 The payload buffer high address
+ * bit 16..23 : ip_length:8
+ * bit 24..30 : mac_length:7
+ * bit     31 : ip_version:1
+ * [dword 3]
+ *  [byte 12] error
+ *  [byte 13] status
+ * bit      0 : du:1
+ * bit      1 : eop:1
+ * bit      2 : error:1
+ * bit      3 : mi:1
+ * bit      4 : l3_identified:1
+ * bit      5 : l4_identified:1
+ * bit      6 : phy_info_included:1
+ * bit      7 : reserved:1
+ *  [word 7] length
+ *
+ */
+
+#define RX_DMA_D0_CMD_DMA_IT     BIT(10)
+
+#define RX_DMA_STATUS_DU         BIT(0)
+#define RX_DMA_STATUS_ERROR      BIT(2)
+#define RX_DMA_STATUS_PHY_INFO   BIT(6)
+
+struct vring_rx_dma {
+        u32 d0;
+        u32 addr_low;
+        u16 addr_high;
+        u8  ip_length;
+        u8  b11;
+        u8  error;
+        u8  status;
+        u16 length;
+} __packed;
+
+struct vring_tx_desc {
+        struct vring_tx_mac mac;
+        struct vring_tx_dma dma;
+} __packed;
+
+struct vring_rx_desc {
+        struct vring_rx_mac mac;
+        struct vring_rx_dma dma;
+} __packed;
+
+union vring_desc {
+        struct vring_tx_desc tx;
+        struct vring_rx_desc rx;
+} __packed;
+
+static inline int wil_rxdesc_phy_length(volatile struct vring_rx_desc *d)
+{
+        return WIL_GET_BITS(d->dma.d0, 16, 29);
+}
+
+static inline int wil_rxdesc_mcs(volatile struct vring_rx_desc *d)
+{
+        return WIL_GET_BITS(d->mac.d1, 21, 24);
+}
+
+static inline int wil_rxdesc_ds_bits(volatile struct vring_rx_desc *d)
+{
+        return WIL_GET_BITS(d->mac.d1, 8, 9);
+}
+
+static inline int wil_rxdesc_ftype(volatile struct vring_rx_desc *d)
+{
+        return WIL_GET_BITS(d->mac.d0, 10, 11);
+}
+
+#endif /* WIL6210_TXRX_H */
diff --git a/drivers/net/wireless/ath/wil6210/wil6210.h b/drivers/net/wireless/ath/wil6210/wil6210.h
new file mode 100644
index 000000000000..aea961ff8f08
--- /dev/null
+++ b/drivers/net/wireless/ath/wil6210/wil6210.h
@@ -0,0 +1,363 @@
+/*
+ * Copyright (c) 2012 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef __WIL6210_H__
+#define __WIL6210_H__
+
+#include <linux/netdevice.h>
+#include <linux/wireless.h>
+#include <net/cfg80211.h>
+
+#include "dbg_hexdump.h"
+
+#define WIL_NAME "wil6210"
+
+/**
+ * extract bits [@b0:@b1] (inclusive) from the value @x
+ * it should be @b0 <= @b1, or result is incorrect
+ */
+static inline u32 WIL_GET_BITS(u32 x, int b0, int b1)
+{
+        return (x >> b0) & ((1 << (b1 - b0 + 1)) - 1);
+}
+
+#define WIL6210_MEM_SIZE (2*1024*1024UL)
+
+#define WIL6210_RX_RING_SIZE (128)
+#define WIL6210_TX_RING_SIZE (128)
+#define WIL6210_MAX_TX_RINGS (24)
+
+/* Hardware definitions begin */
+
+/*
+ * Mapping
+ * RGF File      | Host addr    |  FW addr
+ *               |              |
+ * user_rgf      | 0x000000     | 0x880000
+ *  dma_rgf      | 0x001000     | 0x881000
+ * pcie_rgf      | 0x002000     | 0x882000
+ *               |              |
+ */
+
+/* Where various structures placed in host address space */
+#define WIL6210_FW_HOST_OFF      (0x880000UL)
+
+#define HOSTADDR(fwaddr)        (fwaddr - WIL6210_FW_HOST_OFF)
+
+/*
+ * Interrupt control registers block
+ *
+ * each interrupt controlled by the same bit in all registers
+ */
+struct RGF_ICR {
+        u32 ICC; /* Cause Control, RW: 0 - W1C, 1 - COR */
+        u32 ICR; /* Cause, W1C/COR depending on ICC */
+        u32 ICM; /* Cause masked (ICR & ~IMV), W1C/COR depending on ICC */
+        u32 ICS; /* Cause Set, WO */
+        u32 IMV; /* Mask, RW+S/C */
+        u32 IMS; /* Mask Set, write 1 to set */
+        u32 IMC; /* Mask Clear, write 1 to clear */
+} __packed;
+
+/* registers - FW addresses */
+#define RGF_USER_USER_SCRATCH_PAD       (0x8802bc)
+#define RGF_USER_USER_ICR               (0x880b4c) /* struct RGF_ICR */
+        #define BIT_USER_USER_ICR_SW_INT_2      BIT(18)
+#define RGF_USER_CLKS_CTL_SW_RST_MASK_0 (0x880b14)
+#define RGF_USER_MAC_CPU_0              (0x8801fc)
+#define RGF_USER_USER_CPU_0             (0x8801e0)
+#define RGF_USER_CLKS_CTL_SW_RST_VEC_0  (0x880b04)
+#define RGF_USER_CLKS_CTL_SW_RST_VEC_1  (0x880b08)
+#define RGF_USER_CLKS_CTL_SW_RST_VEC_2  (0x880b0c)
+#define RGF_USER_CLKS_CTL_SW_RST_VEC_3  (0x880b10)
+
+#define RGF_DMA_PSEUDO_CAUSE            (0x881c68)
+#define RGF_DMA_PSEUDO_CAUSE_MASK_SW    (0x881c6c)
+#define RGF_DMA_PSEUDO_CAUSE_MASK_FW    (0x881c70)
+        #define BIT_DMA_PSEUDO_CAUSE_RX         BIT(0)
+        #define BIT_DMA_PSEUDO_CAUSE_TX         BIT(1)
+        #define BIT_DMA_PSEUDO_CAUSE_MISC       BIT(2)
+
+#define RGF_DMA_EP_TX_ICR               (0x881bb4) /* struct RGF_ICR */
+        #define BIT_DMA_EP_TX_ICR_TX_DONE       BIT(0)
+        #define BIT_DMA_EP_TX_ICR_TX_DONE_N(n)  BIT(n+1) /* n = [0..23] */
+#define RGF_DMA_EP_RX_ICR               (0x881bd0) /* struct RGF_ICR */
+        #define BIT_DMA_EP_RX_ICR_RX_DONE       BIT(0)
+#define RGF_DMA_EP_MISC_ICR             (0x881bec) /* struct RGF_ICR */
+        #define BIT_DMA_EP_MISC_ICR_RX_HTRSH    BIT(0)
+        #define BIT_DMA_EP_MISC_ICR_TX_NO_ACT   BIT(1)
+        #define BIT_DMA_EP_MISC_ICR_FW_INT(n)   BIT(28+n) /* n = [0..3] */
+
+/* Interrupt moderation control */
+#define RGF_DMA_ITR_CNT_TRSH            (0x881c5c)
+#define RGF_DMA_ITR_CNT_DATA            (0x881c60)
+#define RGF_DMA_ITR_CNT_CRL             (0x881C64)
+        #define BIT_DMA_ITR_CNT_CRL_EN          BIT(0)
+        #define BIT_DMA_ITR_CNT_CRL_EXT_TICK    BIT(1)
+        #define BIT_DMA_ITR_CNT_CRL_FOREVER     BIT(2)
+        #define BIT_DMA_ITR_CNT_CRL_CLR         BIT(3)
+        #define BIT_DMA_ITR_CNT_CRL_REACH_TRSH  BIT(4)
+
+/* popular locations */
+#define HOST_MBOX   HOSTADDR(RGF_USER_USER_SCRATCH_PAD)
+#define HOST_SW_INT (HOSTADDR(RGF_USER_USER_ICR) + \
+        offsetof(struct RGF_ICR, ICS))
+#define SW_INT_MBOX BIT_USER_USER_ICR_SW_INT_2
+
+/* ISR register bits */
+#define ISR_MISC_FW_READY       BIT_DMA_EP_MISC_ICR_FW_INT(0)
+#define ISR_MISC_MBOX_EVT       BIT_DMA_EP_MISC_ICR_FW_INT(1)
+#define ISR_MISC_FW_ERROR       BIT_DMA_EP_MISC_ICR_FW_INT(3)
+
+/* Hardware definitions end */
+
+struct wil6210_mbox_ring {
+        u32 base;
+        u16 entry_size; /* max. size of mbox entry, incl. all headers */
+        u16 size;
+        u32 tail;
+        u32 head;
+} __packed;
+
+struct wil6210_mbox_ring_desc {
+        __le32 sync;
+        __le32 addr;
+} __packed;
+
+/* at HOST_OFF_WIL6210_MBOX_CTL */
+struct wil6210_mbox_ctl {
+        struct wil6210_mbox_ring tx;
+        struct wil6210_mbox_ring rx;
+} __packed;
+
+struct wil6210_mbox_hdr {
+        __le16 seq;
+        __le16 len; /* payload, bytes after this header */
+        __le16 type;
+        u8 flags;
+        u8 reserved;
+} __packed;
+
+#define WIL_MBOX_HDR_TYPE_WMI (0)
+
+/* max. value for wil6210_mbox_hdr.len */
+#define MAX_MBOXITEM_SIZE   (240)
+
+struct wil6210_mbox_hdr_wmi {
+        u8 reserved0[2];
+        __le16 id;
+        __le16 info1; /* bits [0..3] - device_id, rest - unused */
+        u8 reserved1[2];
+} __packed;
+
+struct pending_wmi_event {
+        struct list_head list;
+        struct {
+                struct wil6210_mbox_hdr hdr;
+                struct wil6210_mbox_hdr_wmi wmi;
+                u8 data[0];
+        } __packed event;
+};
+
+union vring_desc;
+
+struct vring {
+        dma_addr_t pa;
+        volatile union vring_desc *va; /* vring_desc[size], WriteBack by DMA */
+        u16 size; /* number of vring_desc elements */
+        u32 swtail;
+        u32 swhead;
+        u32 hwtail; /* write here to inform hw */
+        void **ctx; /* void *ctx[size] - software context */
+};
+
+enum { /* for wil6210_priv.status */
+        wil_status_fwready = 0,
+        wil_status_fwconnected,
+        wil_status_dontscan,
+        wil_status_irqen, /* FIXME: interrupts enabled - for debug */
+};
+
+struct pci_dev;
+
+struct wil6210_stats {
+        u64 tsf;
+        u32 snr;
+        u16 last_mcs_rx;
+        u16 bf_mcs; /* last BF, used for Tx */
+        u16 my_rx_sector;
+        u16 my_tx_sector;
+        u16 peer_rx_sector;
+        u16 peer_tx_sector;
+};
+
+struct wil6210_priv {
+        struct pci_dev *pdev;
+        int n_msi;
+        struct wireless_dev *wdev;
+        void __iomem *csr;
+        ulong status;
+        /* profile */
+        u32 monitor_flags;
+        u32 secure_pcp; /* create secure PCP? */
+        int sinfo_gen;
+        /* cached ISR registers */
+        u32 isr_misc;
+        /* mailbox related */
+        struct mutex wmi_mutex;
+        struct wil6210_mbox_ctl mbox_ctl;
+        struct completion wmi_ready;
+        u16 wmi_seq;
+        u16 reply_id; /**< wait for this WMI event */
+        void *reply_buf;
+        u16 reply_size;
+        struct workqueue_struct *wmi_wq; /* for deferred calls */
+        struct work_struct wmi_event_worker;
+        struct workqueue_struct *wmi_wq_conn; /* for connect worker */
+        struct work_struct wmi_connect_worker;
+        struct work_struct disconnect_worker;
+        struct timer_list connect_timer;
+        int pending_connect_cid;
+        struct list_head pending_wmi_ev;
+        /*
+         * protect pending_wmi_ev
+         * - fill in IRQ from wil6210_irq_misc,
+         * - consumed in thread by wmi_event_worker
+         */
+        spinlock_t wmi_ev_lock;
+        /* DMA related */
+        struct vring vring_rx;
+        struct vring vring_tx[WIL6210_MAX_TX_RINGS];
+        u8 dst_addr[WIL6210_MAX_TX_RINGS][ETH_ALEN];
+        /* scan */
+        struct cfg80211_scan_request *scan_request;
+
+        struct mutex mutex; /* for wil6210_priv access in wil_{up|down} */
+        /* statistics */
+        struct wil6210_stats stats;
+        /* debugfs */
+        struct dentry *debug;
+        struct debugfs_blob_wrapper fw_code_blob;
+        struct debugfs_blob_wrapper fw_data_blob;
+        struct debugfs_blob_wrapper fw_peri_blob;
+        struct debugfs_blob_wrapper uc_code_blob;
+        struct debugfs_blob_wrapper uc_data_blob;
+        struct debugfs_blob_wrapper rgf_blob;
+};
+
+#define wil_to_wiphy(i) (i->wdev->wiphy)
+#define wil_to_dev(i) (wiphy_dev(wil_to_wiphy(i)))
+#define wiphy_to_wil(w) (struct wil6210_priv *)(wiphy_priv(w))
+#define wil_to_wdev(i) (i->wdev)
+#define wdev_to_wil(w) (struct wil6210_priv *)(wdev_priv(w))
+#define wil_to_ndev(i) (wil_to_wdev(i)->netdev)
+#define ndev_to_wil(n) (wdev_to_wil(n->ieee80211_ptr))
+
+#define wil_dbg(wil, fmt, arg...) netdev_dbg(wil_to_ndev(wil), fmt, ##arg)
+#define wil_info(wil, fmt, arg...) netdev_info(wil_to_ndev(wil), fmt, ##arg)
+#define wil_err(wil, fmt, arg...) netdev_err(wil_to_ndev(wil), fmt, ##arg)
+
+#define wil_dbg_irq(wil, fmt, arg...) wil_dbg(wil, "DBG[ IRQ]" fmt, ##arg)
+#define wil_dbg_txrx(wil, fmt, arg...) wil_dbg(wil, "DBG[TXRX]" fmt, ##arg)
+#define wil_dbg_wmi(wil, fmt, arg...) wil_dbg(wil, "DBG[ WMI]" fmt, ##arg)
+#define wil_dbg_misc(wil, fmt, arg...) wil_dbg(wil, "DBG[MISC]" fmt, ##arg)
+
+#define wil_hex_dump_txrx(prefix_str, prefix_type, rowsize,     \
+                          groupsize, buf, len, ascii)           \
+                          wil_print_hex_dump_debug("DBG[TXRX]" prefix_str,\
+                                         prefix_type, rowsize,  \
+                                         groupsize, buf, len, ascii)
+
+#define wil_hex_dump_wmi(prefix_str, prefix_type, rowsize,      \
+                         groupsize, buf, len, ascii)            \
+                         wil_print_hex_dump_debug("DBG[ WMI]" prefix_str,\
+                                        prefix_type, rowsize,   \
+                                        groupsize, buf, len, ascii)
+
+void wil_memcpy_fromio_32(void *dst, const volatile void __iomem *src,
+                          size_t count);
+void wil_memcpy_toio_32(volatile void __iomem *dst, const void *src,
+                        size_t count);
+
+void *wil_if_alloc(struct device *dev, void __iomem *csr);
+void wil_if_free(struct wil6210_priv *wil);
+int wil_if_add(struct wil6210_priv *wil);
+void wil_if_remove(struct wil6210_priv *wil);
+int wil_priv_init(struct wil6210_priv *wil);
+void wil_priv_deinit(struct wil6210_priv *wil);
+int wil_reset(struct wil6210_priv *wil);
+void wil_link_on(struct wil6210_priv *wil);
+void wil_link_off(struct wil6210_priv *wil);
+int wil_up(struct wil6210_priv *wil);
+int wil_down(struct wil6210_priv *wil);
+void wil_mbox_ring_le2cpus(struct wil6210_mbox_ring *r);
+
+void __iomem *wmi_buffer(struct wil6210_priv *wil, __le32 ptr);
+void __iomem *wmi_addr(struct wil6210_priv *wil, u32 ptr);
+int wmi_read_hdr(struct wil6210_priv *wil, __le32 ptr,
+                 struct wil6210_mbox_hdr *hdr);
+int wmi_send(struct wil6210_priv *wil, u16 cmdid, void *buf, u16 len);
+void wmi_recv_cmd(struct wil6210_priv *wil);
+int wmi_call(struct wil6210_priv *wil, u16 cmdid, void *buf, u16 len,
+             u16 reply_id, void *reply, u8 reply_size, int to_msec);
+void wmi_connect_worker(struct work_struct *work);
+void wmi_event_worker(struct work_struct *work);
+void wmi_event_flush(struct wil6210_priv *wil);
+int wmi_set_ssid(struct wil6210_priv *wil, u8 ssid_len, const void *ssid);
+int wmi_get_ssid(struct wil6210_priv *wil, u8 *ssid_len, void *ssid);
+int wmi_set_channel(struct wil6210_priv *wil, int channel);
+int wmi_get_channel(struct wil6210_priv *wil, int *channel);
+int wmi_tx_eapol(struct wil6210_priv *wil, struct sk_buff *skb);
+int wmi_del_cipher_key(struct wil6210_priv *wil, u8 key_index,
+                       const void *mac_addr);
+int wmi_add_cipher_key(struct wil6210_priv *wil, u8 key_index,
+                       const void *mac_addr, int key_len, const void *key);
+int wmi_echo(struct wil6210_priv *wil);
+int wmi_set_ie(struct wil6210_priv *wil, u8 type, u16 ie_len, const void *ie);
+int wmi_rx_chain_add(struct wil6210_priv *wil, struct vring *vring);
+
+int wil6210_init_irq(struct wil6210_priv *wil, int irq);
+void wil6210_fini_irq(struct wil6210_priv *wil, int irq);
+void wil6210_disable_irq(struct wil6210_priv *wil);
+void wil6210_enable_irq(struct wil6210_priv *wil);
+
+int wil6210_debugfs_init(struct wil6210_priv *wil);
+void wil6210_debugfs_remove(struct wil6210_priv *wil);
+
+struct wireless_dev *wil_cfg80211_init(struct device *dev);
+void wil_wdev_free(struct wil6210_priv *wil);
+
+int wmi_set_mac_address(struct wil6210_priv *wil, void *addr);
+int wmi_set_bcon(struct wil6210_priv *wil, int bi, u8 wmi_nettype);
+void wil6210_disconnect(struct wil6210_priv *wil, void *bssid);
+
+int wil_rx_init(struct wil6210_priv *wil);
+void wil_rx_fini(struct wil6210_priv *wil);
+
+/* TX API */
+int wil_vring_init_tx(struct wil6210_priv *wil, int id, int size,
+                      int cid, int tid);
+void wil_vring_fini_tx(struct wil6210_priv *wil, int id);
+
+netdev_tx_t wil_start_xmit(struct sk_buff *skb, struct net_device *ndev);
+void wil_tx_complete(struct wil6210_priv *wil, int ringid);
+
+/* RX API */
+void wil_rx_handle(struct wil6210_priv *wil);
+
+int wil_iftype_nl2wmi(enum nl80211_iftype type);
+
+#endif /* __WIL6210_H__ */
diff --git a/drivers/net/wireless/ath/wil6210/wmi.c b/drivers/net/wireless/ath/wil6210/wmi.c
new file mode 100644
index 000000000000..0b70e17cd1fb
--- /dev/null
+++ b/drivers/net/wireless/ath/wil6210/wmi.c
@@ -0,0 +1,1024 @@
+/*
+ * Copyright (c) 2012 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/pci.h>
+#include <linux/io.h>
+#include <linux/list.h>
+#include <linux/etherdevice.h>
+#include <linux/if_arp.h>
+
+#include "wil6210.h"
+#include "txrx.h"
+#include "wmi.h"
+
+/**
+ * WMI event receiving - theory of operations
+ *
+ * When firmware about to report WMI event, it fills memory area
+ * in the mailbox and raises misc. IRQ. Thread interrupt handler invoked for
+ * the misc IRQ, function @wmi_recv_cmd called by thread IRQ handler.
+ *
+ * @wmi_recv_cmd reads event, allocates memory chunk  and attaches it to the
+ * event list @wil->pending_wmi_ev. Then, work queue @wil->wmi_wq wakes up
+ * and handles events within the @wmi_event_worker. Every event get detached
+ * from list, processed and deleted.
+ *
+ * Purpose for this mechanism is to release IRQ thread; otherwise,
+ * if WMI event handling involves another WMI command flow, this 2-nd flow
+ * won't be completed because of blocked IRQ thread.
+ */
+
+/**
+ * Addressing - theory of operations
+ *
+ * There are several buses present on the WIL6210 card.
+ * Same memory areas are visible at different address on
+ * the different busses. There are 3 main bus masters:
+ *  - MAC CPU (ucode)
+ *  - User CPU (firmware)
+ *  - AHB (host)
+ *
+ * On the PCI bus, there is one BAR (BAR0) of 2Mb size, exposing
+ * AHB addresses starting from 0x880000
+ *
+ * Internally, firmware uses addresses that allows faster access but
+ * are invisible from the host. To read from these addresses, alternative
+ * AHB address must be used.
+ *
+ * Memory mapping
+ * Linker address         PCI/Host address
+ *                        0x880000 .. 0xa80000  2Mb BAR0
+ * 0x800000 .. 0x807000   0x900000 .. 0x907000  28k DCCM
+ * 0x840000 .. 0x857000   0x908000 .. 0x91f000  92k PERIPH
+ */
+
+/**
+ * @fw_mapping provides memory remapping table
+ */
+static const struct {
+        u32 from; /* linker address - from, inclusive */
+        u32 to;   /* linker address - to, exclusive */
+        u32 host; /* PCI/Host address - BAR0 + 0x880000 */
+} fw_mapping[] = {
+        {0x000000, 0x040000, 0x8c0000}, /* FW code RAM 256k */
+        {0x800000, 0x808000, 0x900000}, /* FW data RAM 32k */
+        {0x840000, 0x860000, 0x908000}, /* peripheral data RAM 128k/96k used */
+        {0x880000, 0x88a000, 0x880000}, /* various RGF */
+        {0x8c0000, 0x932000, 0x8c0000}, /* trivial mapping for upper area */
+        /*
+         * 920000..930000 ucode code RAM
+         * 930000..932000 ucode data RAM
+         */
+};
+
+/**
+ * return AHB address for given firmware/ucode internal (linker) address
+ * @x - internal address
+ * If address have no valid AHB mapping, return 0
+ */
+static u32 wmi_addr_remap(u32 x)
+{
+        uint i;
+
+        for (i = 0; i < ARRAY_SIZE(fw_mapping); i++) {
+                if ((x >= fw_mapping[i].from) && (x < fw_mapping[i].to))
+                        return x + fw_mapping[i].host - fw_mapping[i].from;
+        }
+
+        return 0;
+}
+
+/**
+ * Check address validity for WMI buffer; remap if needed
+ * @ptr - internal (linker) fw/ucode address
+ *
+ * Valid buffer should be DWORD aligned
+ *
+ * return address for accessing buffer from the host;
+ * if buffer is not valid, return NULL.
+ */
+void __iomem *wmi_buffer(struct wil6210_priv *wil, __le32 ptr_)
+{
+        u32 off;
+        u32 ptr = le32_to_cpu(ptr_);
+
+        if (ptr % 4)
+                return NULL;
+
+        ptr = wmi_addr_remap(ptr);
+        if (ptr < WIL6210_FW_HOST_OFF)
+                return NULL;
+
+        off = HOSTADDR(ptr);
+        if (off > WIL6210_MEM_SIZE - 4)
+                return NULL;
+
+        return wil->csr + off;
+}
+
+/**
+ * Check address validity
+ */
+void __iomem *wmi_addr(struct wil6210_priv *wil, u32 ptr)
+{
+        u32 off;
+
+        if (ptr % 4)
+                return NULL;
+
+        if (ptr < WIL6210_FW_HOST_OFF)
+                return NULL;
+
+        off = HOSTADDR(ptr);
+        if (off > WIL6210_MEM_SIZE - 4)
+                return NULL;
+
+        return wil->csr + off;
+}
+
+int wmi_read_hdr(struct wil6210_priv *wil, __le32 ptr,
+                 struct wil6210_mbox_hdr *hdr)
+{
+        void __iomem *src = wmi_buffer(wil, ptr);
+        if (!src)
+                return -EINVAL;
+
+        wil_memcpy_fromio_32(hdr, src, sizeof(*hdr));
+
+        return 0;
+}
+
+static int __wmi_send(struct wil6210_priv *wil, u16 cmdid, void *buf, u16 len)
+{
+        struct {
+                struct wil6210_mbox_hdr hdr;
+                struct wil6210_mbox_hdr_wmi wmi;
+        } __packed cmd = {
+                .hdr = {
+                        .type = WIL_MBOX_HDR_TYPE_WMI,
+                        .flags = 0,
+                        .len = cpu_to_le16(sizeof(cmd.wmi) + len),
+                },
+                .wmi = {
+                        .id = cpu_to_le16(cmdid),
+                        .info1 = 0,
+                },
+        };
+        struct wil6210_mbox_ring *r = &wil->mbox_ctl.tx;
+        struct wil6210_mbox_ring_desc d_head;
+        u32 next_head;
+        void __iomem *dst;
+        void __iomem *head = wmi_addr(wil, r->head);
+        uint retry;
+
+        if (sizeof(cmd) + len > r->entry_size) {
+                wil_err(wil, "WMI size too large: %d bytes, max is %d\n",
+                        (int)(sizeof(cmd) + len), r->entry_size);
+                return -ERANGE;
+        }
+
+        might_sleep();
+
+        if (!test_bit(wil_status_fwready, &wil->status)) {
+                wil_err(wil, "FW not ready\n");
+                return -EAGAIN;
+        }
+
+        if (!head) {
+                wil_err(wil, "WMI head is garbage: 0x%08x\n", r->head);
+                return -EINVAL;
+        }
+        /* read Tx head till it is not busy */
+        for (retry = 5; retry > 0; retry--) {
+                wil_memcpy_fromio_32(&d_head, head, sizeof(d_head));
+                if (d_head.sync == 0)
+                        break;
+                msleep(20);
+        }
+        if (d_head.sync != 0) {
+                wil_err(wil, "WMI head busy\n");
+                return -EBUSY;
+        }
+        /* next head */
+        next_head = r->base + ((r->head - r->base + sizeof(d_head)) % r->size);
+        wil_dbg_wmi(wil, "Head 0x%08x -> 0x%08x\n", r->head, next_head);
+        /* wait till FW finish with previous command */
+        for (retry = 5; retry > 0; retry--) {
+                r->tail = ioread32(wil->csr + HOST_MBOX +
+                                   offsetof(struct wil6210_mbox_ctl, tx.tail));
+                if (next_head != r->tail)
+                        break;
+                msleep(20);
+        }
+        if (next_head == r->tail) {
+                wil_err(wil, "WMI ring full\n");
+                return -EBUSY;
+        }
+        dst = wmi_buffer(wil, d_head.addr);
+        if (!dst) {
+                wil_err(wil, "invalid WMI buffer: 0x%08x\n",
+                        le32_to_cpu(d_head.addr));
+                return -EINVAL;
+        }
+        cmd.hdr.seq = cpu_to_le16(++wil->wmi_seq);
+        /* set command */
+        wil_dbg_wmi(wil, "WMI command 0x%04x [%d]\n", cmdid, len);
+        wil_hex_dump_wmi("Cmd ", DUMP_PREFIX_OFFSET, 16, 1, &cmd,
+                         sizeof(cmd), true);
+        wil_hex_dump_wmi("cmd ", DUMP_PREFIX_OFFSET, 16, 1, buf,
+                         len, true);
+        wil_memcpy_toio_32(dst, &cmd, sizeof(cmd));
+        wil_memcpy_toio_32(dst + sizeof(cmd), buf, len);
+        /* mark entry as full */
+        iowrite32(1, wil->csr + HOSTADDR(r->head) +
+                  offsetof(struct wil6210_mbox_ring_desc, sync));
+        /* advance next ptr */
+        iowrite32(r->head = next_head, wil->csr + HOST_MBOX +
+                  offsetof(struct wil6210_mbox_ctl, tx.head));
+
+        /* interrupt to FW */
+        iowrite32(SW_INT_MBOX, wil->csr + HOST_SW_INT);
+
+        return 0;
+}
+
+int wmi_send(struct wil6210_priv *wil, u16 cmdid, void *buf, u16 len)
+{
+        int rc;
+
+        mutex_lock(&wil->wmi_mutex);
+        rc = __wmi_send(wil, cmdid, buf, len);
+        mutex_unlock(&wil->wmi_mutex);
+
+        return rc;
+}
+
+/*=== Event handlers ===*/
+static void wmi_evt_ready(struct wil6210_priv *wil, int id, void *d, int len)
+{
+        struct net_device *ndev = wil_to_ndev(wil);
+        struct wireless_dev *wdev = wil->wdev;
+        struct wmi_ready_event *evt = d;
+        u32 ver = le32_to_cpu(evt->sw_version);
+
+        wil_dbg_wmi(wil, "FW ver. %d; MAC %pM\n", ver, evt->mac);
+
+        if (!is_valid_ether_addr(ndev->dev_addr)) {
+                memcpy(ndev->dev_addr, evt->mac, ETH_ALEN);
+                memcpy(ndev->perm_addr, evt->mac, ETH_ALEN);
+        }
+        snprintf(wdev->wiphy->fw_version, sizeof(wdev->wiphy->fw_version),
+                 "%d", ver);
+}
+
+static void wmi_evt_fw_ready(struct wil6210_priv *wil, int id, void *d,
+                             int len)
+{
+        wil_dbg_wmi(wil, "WMI: FW ready\n");
+
+        set_bit(wil_status_fwready, &wil->status);
+        /* reuse wmi_ready for the firmware ready indication */
+        complete(&wil->wmi_ready);
+}
+
+static void wmi_evt_rx_mgmt(struct wil6210_priv *wil, int id, void *d, int len)
+{
+        struct wmi_rx_mgmt_packet_event *data = d;
+        struct wiphy *wiphy = wil_to_wiphy(wil);
+        struct ieee80211_mgmt *rx_mgmt_frame =
+                        (struct ieee80211_mgmt *)data->payload;
+        int ch_no = data->info.channel+1;
+        u32 freq = ieee80211_channel_to_frequency(ch_no,
+                        IEEE80211_BAND_60GHZ);
+        struct ieee80211_channel *channel = ieee80211_get_channel(wiphy, freq);
+        /* TODO convert LE to CPU */
+        s32 signal = 0; /* TODO */
+        __le16 fc = rx_mgmt_frame->frame_control;
+        u32 d_len = le32_to_cpu(data->info.len);
+        u16 d_status = le16_to_cpu(data->info.status);
+
+        wil_dbg_wmi(wil, "MGMT: channel %d MCS %d SNR %d\n",
+                    data->info.channel, data->info.mcs, data->info.snr);
+        wil_dbg_wmi(wil, "status 0x%04x len %d stype %04x\n", d_status, d_len,
+                    le16_to_cpu(data->info.stype));
+        wil_dbg_wmi(wil, "qid %d mid %d cid %d\n",
+                    data->info.qid, data->info.mid, data->info.cid);
+
+        if (!channel) {
+                wil_err(wil, "Frame on unsupported channel\n");
+                return;
+        }
+
+        if (ieee80211_is_beacon(fc) || ieee80211_is_probe_resp(fc)) {
+                struct cfg80211_bss *bss;
+                u64 tsf = le64_to_cpu(rx_mgmt_frame->u.beacon.timestamp);
+                u16 cap = le16_to_cpu(rx_mgmt_frame->u.beacon.capab_info);
+                u16 bi = le16_to_cpu(rx_mgmt_frame->u.beacon.beacon_int);
+                const u8 *ie_buf = rx_mgmt_frame->u.beacon.variable;
+                size_t ie_len = d_len - offsetof(struct ieee80211_mgmt,
+                                                 u.beacon.variable);
+                wil_dbg_wmi(wil, "Capability info : 0x%04x\n", cap);
+
+                bss = cfg80211_inform_bss(wiphy, channel, rx_mgmt_frame->bssid,
+                                          tsf, cap, bi, ie_buf, ie_len,
+                                          signal, GFP_KERNEL);
+                if (bss) {
+                        wil_dbg_wmi(wil, "Added BSS %pM\n",
+                                    rx_mgmt_frame->bssid);
+                        cfg80211_put_bss(bss);
+                } else {
+                        wil_err(wil, "cfg80211_inform_bss() failed\n");
+                }
+        }
+}
+
+static void wmi_evt_scan_complete(struct wil6210_priv *wil, int id,
+                                  void *d, int len)
+{
+        if (wil->scan_request) {
+                struct wmi_scan_complete_event *data = d;
+                bool aborted = (data->status != 0);
+
+                wil_dbg_wmi(wil, "SCAN_COMPLETE(0x%08x)\n", data->status);
+                cfg80211_scan_done(wil->scan_request, aborted);
+                wil->scan_request = NULL;
+        } else {
+                wil_err(wil, "SCAN_COMPLETE while not scanning\n");
+        }
+}
+
+static void wmi_evt_connect(struct wil6210_priv *wil, int id, void *d, int len)
+{
+        struct net_device *ndev = wil_to_ndev(wil);
+        struct wireless_dev *wdev = wil->wdev;
+        struct wmi_connect_event *evt = d;
+        int ch; /* channel number */
+        struct station_info sinfo;
+        u8 *assoc_req_ie, *assoc_resp_ie;
+        size_t assoc_req_ielen, assoc_resp_ielen;
+        /* capinfo(u16) + listen_interval(u16) + IEs */
+        const size_t assoc_req_ie_offset = sizeof(u16) * 2;
+        /* capinfo(u16) + status_code(u16) + associd(u16) + IEs */
+        const size_t assoc_resp_ie_offset = sizeof(u16) * 3;
+
+        if (len < sizeof(*evt)) {
+                wil_err(wil, "Connect event too short : %d bytes\n", len);
+                return;
+        }
+        if (len != sizeof(*evt) + evt->beacon_ie_len + evt->assoc_req_len +
+                   evt->assoc_resp_len) {
+                wil_err(wil,
+                        "Connect event corrupted : %d != %d + %d + %d + %d\n",
+                        len, (int)sizeof(*evt), evt->beacon_ie_len,
+                        evt->assoc_req_len, evt->assoc_resp_len);
+                return;
+        }
+        ch = evt->channel + 1;
+        wil_dbg_wmi(wil, "Connect %pM channel [%d] cid %d\n",
+                    evt->bssid, ch, evt->cid);
+        wil_hex_dump_wmi("connect AI : ", DUMP_PREFIX_OFFSET, 16, 1,
+                         evt->assoc_info, len - sizeof(*evt), true);
+
+        /* figure out IE's */
+        assoc_req_ie = &evt->assoc_info[evt->beacon_ie_len +
+                                        assoc_req_ie_offset];
+        assoc_req_ielen = evt->assoc_req_len - assoc_req_ie_offset;
+        if (evt->assoc_req_len <= assoc_req_ie_offset) {
+                assoc_req_ie = NULL;
+                assoc_req_ielen = 0;
+        }
+
+        assoc_resp_ie = &evt->assoc_info[evt->beacon_ie_len +
+                                         evt->assoc_req_len +
+                                         assoc_resp_ie_offset];
+        assoc_resp_ielen = evt->assoc_resp_len - assoc_resp_ie_offset;
+        if (evt->assoc_resp_len <= assoc_resp_ie_offset) {
+                assoc_resp_ie = NULL;
+                assoc_resp_ielen = 0;
+        }
+
+        if ((wdev->iftype == NL80211_IFTYPE_STATION) ||
+            (wdev->iftype == NL80211_IFTYPE_P2P_CLIENT)) {
+                if (wdev->sme_state != CFG80211_SME_CONNECTING) {
+                        wil_err(wil, "Not in connecting state\n");
+                        return;
+                }
+                del_timer_sync(&wil->connect_timer);
+                cfg80211_connect_result(ndev, evt->bssid,
+                                        assoc_req_ie, assoc_req_ielen,
+                                        assoc_resp_ie, assoc_resp_ielen,
+                                        WLAN_STATUS_SUCCESS, GFP_KERNEL);
+
+        } else if ((wdev->iftype == NL80211_IFTYPE_AP) ||
+                   (wdev->iftype == NL80211_IFTYPE_P2P_GO)) {
+                memset(&sinfo, 0, sizeof(sinfo));
+
+                sinfo.generation = wil->sinfo_gen++;
+
+                if (assoc_req_ie) {
+                        sinfo.assoc_req_ies = assoc_req_ie;
+                        sinfo.assoc_req_ies_len = assoc_req_ielen;
+                        sinfo.filled |= STATION_INFO_ASSOC_REQ_IES;
+                }
+
+                cfg80211_new_sta(ndev, evt->bssid, &sinfo, GFP_KERNEL);
+        }
+        set_bit(wil_status_fwconnected, &wil->status);
+
+        /* FIXME FW can transmit only ucast frames to peer */
+        /* FIXME real ring_id instead of hard coded 0 */
+        memcpy(wil->dst_addr[0], evt->bssid, ETH_ALEN);
+
+        wil->pending_connect_cid = evt->cid;
+        queue_work(wil->wmi_wq_conn, &wil->wmi_connect_worker);
+}
+
+static void wmi_evt_disconnect(struct wil6210_priv *wil, int id,
+                               void *d, int len)
+{
+        struct wmi_disconnect_event *evt = d;
+
+        wil_dbg_wmi(wil, "Disconnect %pM reason %d proto %d wmi\n",
+                    evt->bssid,
+                    evt->protocol_reason_status, evt->disconnect_reason);
+
+        wil->sinfo_gen++;
+
+        wil6210_disconnect(wil, evt->bssid);
+}
+
+static void wmi_evt_notify(struct wil6210_priv *wil, int id, void *d, int len)
+{
+        struct wmi_notify_req_done_event *evt = d;
+
+        if (len < sizeof(*evt)) {
+                wil_err(wil, "Short NOTIFY event\n");
+                return;
+        }
+
+        wil->stats.tsf = le64_to_cpu(evt->tsf);
+        wil->stats.snr = le32_to_cpu(evt->snr_val);
+        wil->stats.bf_mcs = le16_to_cpu(evt->bf_mcs);
+        wil->stats.my_rx_sector = le16_to_cpu(evt->my_rx_sector);
+        wil->stats.my_tx_sector = le16_to_cpu(evt->my_tx_sector);
+        wil->stats.peer_rx_sector = le16_to_cpu(evt->other_rx_sector);
+        wil->stats.peer_tx_sector = le16_to_cpu(evt->other_tx_sector);
+        wil_dbg_wmi(wil, "Link status, MCS %d TSF 0x%016llx\n"
+                    "BF status 0x%08x SNR 0x%08x\n"
+                    "Tx Tpt %d goodput %d Rx goodput %d\n"
+                    "Sectors(rx:tx) my %d:%d peer %d:%d\n",
+                    wil->stats.bf_mcs, wil->stats.tsf, evt->status,
+                    wil->stats.snr, le32_to_cpu(evt->tx_tpt),
+                    le32_to_cpu(evt->tx_goodput), le32_to_cpu(evt->rx_goodput),
+                    wil->stats.my_rx_sector, wil->stats.my_tx_sector,
+                    wil->stats.peer_rx_sector, wil->stats.peer_tx_sector);
+}
+
+/*
+ * Firmware reports EAPOL frame using WME event.
+ * Reconstruct Ethernet frame and deliver it via normal Rx
+ */
+static void wmi_evt_eapol_rx(struct wil6210_priv *wil, int id,
+                             void *d, int len)
+{
+        struct net_device *ndev = wil_to_ndev(wil);
+        struct wmi_eapol_rx_event *evt = d;
+        u16 eapol_len = le16_to_cpu(evt->eapol_len);
+        int sz = eapol_len + ETH_HLEN;
+        struct sk_buff *skb;
+        struct ethhdr *eth;
+
+        wil_dbg_wmi(wil, "EAPOL len %d from %pM\n", eapol_len,
+                    evt->src_mac);
+
+        if (eapol_len > 196) { /* TODO: revisit size limit */
+                wil_err(wil, "EAPOL too large\n");
+                return;
+        }
+
+        skb = alloc_skb(sz, GFP_KERNEL);
+        if (!skb) {
+                wil_err(wil, "Failed to allocate skb\n");
+                return;
+        }
+        eth = (struct ethhdr *)skb_put(skb, ETH_HLEN);
+        memcpy(eth->h_dest, ndev->dev_addr, ETH_ALEN);
+        memcpy(eth->h_source, evt->src_mac, ETH_ALEN);
+        eth->h_proto = cpu_to_be16(ETH_P_PAE);
+        memcpy(skb_put(skb, eapol_len), evt->eapol, eapol_len);
+        skb->protocol = eth_type_trans(skb, ndev);
+        if (likely(netif_rx_ni(skb) == NET_RX_SUCCESS)) {
+                ndev->stats.rx_packets++;
+                ndev->stats.rx_bytes += skb->len;
+        } else {
+                ndev->stats.rx_dropped++;
+        }
+}
+
+static const struct {
+        int eventid;
+        void (*handler)(struct wil6210_priv *wil, int eventid,
+                        void *data, int data_len);
+} wmi_evt_handlers[] = {
+        {WMI_READY_EVENTID,             wmi_evt_ready},
+        {WMI_FW_READY_EVENTID,          wmi_evt_fw_ready},
+        {WMI_RX_MGMT_PACKET_EVENTID,    wmi_evt_rx_mgmt},
+        {WMI_SCAN_COMPLETE_EVENTID,     wmi_evt_scan_complete},
+        {WMI_CONNECT_EVENTID,           wmi_evt_connect},
+        {WMI_DISCONNECT_EVENTID,        wmi_evt_disconnect},
+        {WMI_NOTIFY_REQ_DONE_EVENTID,   wmi_evt_notify},
+        {WMI_EAPOL_RX_EVENTID,          wmi_evt_eapol_rx},
+};
+
+/*
+ * Run in IRQ context
+ * Extract WMI command from mailbox. Queue it to the @wil->pending_wmi_ev
+ * that will be eventually handled by the @wmi_event_worker in the thread
+ * context of thread "wil6210_wmi"
+ */
+void wmi_recv_cmd(struct wil6210_priv *wil)
+{
+        struct wil6210_mbox_ring_desc d_tail;
+        struct wil6210_mbox_hdr hdr;
+        struct wil6210_mbox_ring *r = &wil->mbox_ctl.rx;
+        struct pending_wmi_event *evt;
+        u8 *cmd;
+        void __iomem *src;
+        ulong flags;
+
+        for (;;) {
+                u16 len;
+
+                r->head = ioread32(wil->csr + HOST_MBOX +
+                                   offsetof(struct wil6210_mbox_ctl, rx.head));
+                if (r->tail == r->head)
+                        return;
+
+                /* read cmd from tail */
+                wil_memcpy_fromio_32(&d_tail, wil->csr + HOSTADDR(r->tail),
+                                     sizeof(struct wil6210_mbox_ring_desc));
+                if (d_tail.sync == 0) {
+                        wil_err(wil, "Mbox evt not owned by FW?\n");
+                        return;
+                }
+
+                if (0 != wmi_read_hdr(wil, d_tail.addr, &hdr)) {
+                        wil_err(wil, "Mbox evt at 0x%08x?\n",
+                                le32_to_cpu(d_tail.addr));
+                        return;
+                }
+
+                len = le16_to_cpu(hdr.len);
+                src = wmi_buffer(wil, d_tail.addr) +
+                      sizeof(struct wil6210_mbox_hdr);
+                evt = kmalloc(ALIGN(offsetof(struct pending_wmi_event,
+                                             event.wmi) + len, 4),
+                              GFP_KERNEL);
+                if (!evt) {
+                        wil_err(wil, "kmalloc for WMI event (%d) failed\n",
+                                len);
+                        return;
+                }
+                evt->event.hdr = hdr;
+                cmd = (void *)&evt->event.wmi;
+                wil_memcpy_fromio_32(cmd, src, len);
+                /* mark entry as empty */
+                iowrite32(0, wil->csr + HOSTADDR(r->tail) +
+                          offsetof(struct wil6210_mbox_ring_desc, sync));
+                /* indicate */
+                wil_dbg_wmi(wil, "Mbox evt %04x %04x %04x %02x\n",
+                            le16_to_cpu(hdr.seq), len, le16_to_cpu(hdr.type),
+                            hdr.flags);
+                if ((hdr.type == WIL_MBOX_HDR_TYPE_WMI) &&
+                    (len >= sizeof(struct wil6210_mbox_hdr_wmi))) {
+                        wil_dbg_wmi(wil, "WMI event 0x%04x\n",
+                                    evt->event.wmi.id);
+                }
+                wil_hex_dump_wmi("evt ", DUMP_PREFIX_OFFSET, 16, 1,
+                                 &evt->event.hdr, sizeof(hdr) + len, true);
+
+                /* advance tail */
+                r->tail = r->base + ((r->tail - r->base +
+                          sizeof(struct wil6210_mbox_ring_desc)) % r->size);
+                iowrite32(r->tail, wil->csr + HOST_MBOX +
+                          offsetof(struct wil6210_mbox_ctl, rx.tail));
+
+                /* add to the pending list */
+                spin_lock_irqsave(&wil->wmi_ev_lock, flags);
+                list_add_tail(&evt->list, &wil->pending_wmi_ev);
+                spin_unlock_irqrestore(&wil->wmi_ev_lock, flags);
+                {
+                        int q = queue_work(wil->wmi_wq,
+                                           &wil->wmi_event_worker);
+                        wil_dbg_wmi(wil, "queue_work -> %d\n", q);
+                }
+        }
+}
+
+int wmi_call(struct wil6210_priv *wil, u16 cmdid, void *buf, u16 len,
+             u16 reply_id, void *reply, u8 reply_size, int to_msec)
+{
+        int rc;
+        int remain;
+
+        mutex_lock(&wil->wmi_mutex);
+
+        rc = __wmi_send(wil, cmdid, buf, len);
+        if (rc)
+                goto out;
+
+        wil->reply_id = reply_id;
+        wil->reply_buf = reply;
+        wil->reply_size = reply_size;
+        remain = wait_for_completion_timeout(&wil->wmi_ready,
+                        msecs_to_jiffies(to_msec));
+        if (0 == remain) {
+                wil_err(wil, "wmi_call(0x%04x->0x%04x) timeout %d msec\n",
+                        cmdid, reply_id, to_msec);
+                rc = -ETIME;
+        } else {
+                wil_dbg_wmi(wil,
+                            "wmi_call(0x%04x->0x%04x) completed in %d msec\n",
+                            cmdid, reply_id,
+                            to_msec - jiffies_to_msecs(remain));
+        }
+        wil->reply_id = 0;
+        wil->reply_buf = NULL;
+        wil->reply_size = 0;
+ out:
+        mutex_unlock(&wil->wmi_mutex);
+
+        return rc;
+}
+
+int wmi_echo(struct wil6210_priv *wil)
+{
+        struct wmi_echo_cmd cmd = {
+                .value = cpu_to_le32(0x12345678),
+        };
+
+        return wmi_call(wil, WMI_ECHO_CMDID, &cmd, sizeof(cmd),
+                         WMI_ECHO_RSP_EVENTID, NULL, 0, 20);
+}
+
+int wmi_set_mac_address(struct wil6210_priv *wil, void *addr)
+{
+        struct wmi_set_mac_address_cmd cmd;
+
+        memcpy(cmd.mac, addr, ETH_ALEN);
+
+        wil_dbg_wmi(wil, "Set MAC %pM\n", addr);
+
+        return wmi_send(wil, WMI_SET_MAC_ADDRESS_CMDID, &cmd, sizeof(cmd));
+}
+
+int wmi_set_bcon(struct wil6210_priv *wil, int bi, u8 wmi_nettype)
+{
+        struct wmi_bcon_ctrl_cmd cmd = {
+                .bcon_interval = cpu_to_le16(bi),
+                .network_type = wmi_nettype,
+                .disable_sec_offload = 1,
+        };
+
+        if (!wil->secure_pcp)
+                cmd.disable_sec = 1;
+
+        return wmi_send(wil, WMI_BCON_CTRL_CMDID, &cmd, sizeof(cmd));
+}
+
+int wmi_set_ssid(struct wil6210_priv *wil, u8 ssid_len, const void *ssid)
+{
+        struct wmi_set_ssid_cmd cmd = {
+                .ssid_len = cpu_to_le32(ssid_len),
+        };
+
+        if (ssid_len > sizeof(cmd.ssid))
+                return -EINVAL;
+
+        memcpy(cmd.ssid, ssid, ssid_len);
+
+        return wmi_send(wil, WMI_SET_SSID_CMDID, &cmd, sizeof(cmd));
+}
+
+int wmi_get_ssid(struct wil6210_priv *wil, u8 *ssid_len, void *ssid)
+{
+        int rc;
+        struct {
+                struct wil6210_mbox_hdr_wmi wmi;
+                struct wmi_set_ssid_cmd cmd;
+        } __packed reply;
+        int len; /* reply.cmd.ssid_len in CPU order */
+
+        rc = wmi_call(wil, WMI_GET_SSID_CMDID, NULL, 0, WMI_GET_SSID_EVENTID,
+                      &reply, sizeof(reply), 20);
+        if (rc)
+                return rc;
+
+        len = le32_to_cpu(reply.cmd.ssid_len);
+        if (len > sizeof(reply.cmd.ssid))
+                return -EINVAL;
+
+        *ssid_len = len;
+        memcpy(ssid, reply.cmd.ssid, len);
+
+        return 0;
+}
+
+int wmi_set_channel(struct wil6210_priv *wil, int channel)
+{
+        struct wmi_set_pcp_channel_cmd cmd = {
+                .channel = channel - 1,
+        };
+
+        return wmi_send(wil, WMI_SET_PCP_CHANNEL_CMDID, &cmd, sizeof(cmd));
+}
+
+int wmi_get_channel(struct wil6210_priv *wil, int *channel)
+{
+        int rc;
+        struct {
+                struct wil6210_mbox_hdr_wmi wmi;
+                struct wmi_set_pcp_channel_cmd cmd;
+        } __packed reply;
+
+        rc = wmi_call(wil, WMI_GET_PCP_CHANNEL_CMDID, NULL, 0,
+                      WMI_GET_PCP_CHANNEL_EVENTID, &reply, sizeof(reply), 20);
+        if (rc)
+                return rc;
+
+        if (reply.cmd.channel > 3)
+                return -EINVAL;
+
+        *channel = reply.cmd.channel + 1;
+
+        return 0;
+}
+
+int wmi_tx_eapol(struct wil6210_priv *wil, struct sk_buff *skb)
+{
+        struct wmi_eapol_tx_cmd *cmd;
+        struct ethhdr *eth;
+        u16 eapol_len = skb->len - ETH_HLEN;
+        void *eapol = skb->data + ETH_HLEN;
+        uint i;
+        int rc;
+
+        skb_set_mac_header(skb, 0);
+        eth = eth_hdr(skb);
+        wil_dbg_wmi(wil, "EAPOL %d bytes to %pM\n", eapol_len, eth->h_dest);
+        for (i = 0; i < ARRAY_SIZE(wil->vring_tx); i++) {
+                if (memcmp(wil->dst_addr[i], eth->h_dest, ETH_ALEN) == 0)
+                        goto found_dest;
+        }
+
+        return -EINVAL;
+
+ found_dest:
+        /* find out eapol data & len */
+        cmd = kzalloc(sizeof(*cmd) + eapol_len, GFP_KERNEL);
+        if (!cmd)
+                return -EINVAL;
+
+        memcpy(cmd->dst_mac, eth->h_dest, ETH_ALEN);
+        cmd->eapol_len = cpu_to_le16(eapol_len);
+        memcpy(cmd->eapol, eapol, eapol_len);
+        rc = wmi_send(wil, WMI_EAPOL_TX_CMDID, cmd, sizeof(*cmd) + eapol_len);
+        kfree(cmd);
+
+        return rc;
+}
+
+int wmi_del_cipher_key(struct wil6210_priv *wil, u8 key_index,
+                       const void *mac_addr)
+{
+        struct wmi_delete_cipher_key_cmd cmd = {
+                .key_index = key_index,
+        };
+
+        if (mac_addr)
+                memcpy(cmd.mac, mac_addr, WMI_MAC_LEN);
+
+        return wmi_send(wil, WMI_DELETE_CIPHER_KEY_CMDID, &cmd, sizeof(cmd));
+}
+
+int wmi_add_cipher_key(struct wil6210_priv *wil, u8 key_index,
+                       const void *mac_addr, int key_len, const void *key)
+{
+        struct wmi_add_cipher_key_cmd cmd = {
+                .key_index = key_index,
+                .key_usage = WMI_KEY_USE_PAIRWISE,
+                .key_len = key_len,
+        };
+
+        if (!key || (key_len > sizeof(cmd.key)))
+                return -EINVAL;
+
+        memcpy(cmd.key, key, key_len);
+        if (mac_addr)
+                memcpy(cmd.mac, mac_addr, WMI_MAC_LEN);
+
+        return wmi_send(wil, WMI_ADD_CIPHER_KEY_CMDID, &cmd, sizeof(cmd));
+}
+
+int wmi_set_ie(struct wil6210_priv *wil, u8 type, u16 ie_len, const void *ie)
+{
+        int rc;
+        u16 len = sizeof(struct wmi_set_appie_cmd) + ie_len;
+        struct wmi_set_appie_cmd *cmd = kzalloc(len, GFP_KERNEL);
+        if (!cmd) {
+                wil_err(wil, "kmalloc(%d) failed\n", len);
+                return -ENOMEM;
+        }
+
+        cmd->mgmt_frm_type = type;
+        /* BUG: FW API define ieLen as u8. Will fix FW */
+        cmd->ie_len = cpu_to_le16(ie_len);
+        memcpy(cmd->ie_info, ie, ie_len);
+        rc = wmi_send(wil, WMI_SET_APPIE_CMDID, &cmd, len);
+        kfree(cmd);
+
+        return rc;
+}
+
+int wmi_rx_chain_add(struct wil6210_priv *wil, struct vring *vring)
+{
+        struct wireless_dev *wdev = wil->wdev;
+        struct net_device *ndev = wil_to_ndev(wil);
+        struct wmi_cfg_rx_chain_cmd cmd = {
+                .action = WMI_RX_CHAIN_ADD,
+                .rx_sw_ring = {
+                        .max_mpdu_size = cpu_to_le16(RX_BUF_LEN),
+                        .ring_mem_base = cpu_to_le64(vring->pa),
+                        .ring_size = cpu_to_le16(vring->size),
+                },
+                .mid = 0, /* TODO - what is it? */
+                .decap_trans_type = WMI_DECAP_TYPE_802_3,
+        };
+        struct {
+                struct wil6210_mbox_hdr_wmi wmi;
+                struct wmi_cfg_rx_chain_done_event evt;
+        } __packed evt;
+        int rc;
+
+        if (wdev->iftype == NL80211_IFTYPE_MONITOR) {
+                struct ieee80211_channel *ch = wdev->preset_chandef.chan;
+
+                cmd.sniffer_cfg.mode = cpu_to_le32(WMI_SNIFFER_ON);
+                if (ch)
+                        cmd.sniffer_cfg.channel = ch->hw_value - 1;
+                cmd.sniffer_cfg.phy_info_mode =
+                        cpu_to_le32(ndev->type == ARPHRD_IEEE80211_RADIOTAP);
+                cmd.sniffer_cfg.phy_support =
+                        cpu_to_le32((wil->monitor_flags & MONITOR_FLAG_CONTROL)
+                                    ? WMI_SNIFFER_CP : WMI_SNIFFER_DP);
+        }
+        /* typical time for secure PCP is 840ms */
+        rc = wmi_call(wil, WMI_CFG_RX_CHAIN_CMDID, &cmd, sizeof(cmd),
+                      WMI_CFG_RX_CHAIN_DONE_EVENTID, &evt, sizeof(evt), 2000);
+        if (rc)
+                return rc;
+
+        vring->hwtail = le32_to_cpu(evt.evt.rx_ring_tail_ptr);
+
+        wil_dbg_misc(wil, "Rx init: status %d tail 0x%08x\n",
+                     le32_to_cpu(evt.evt.status), vring->hwtail);
+
+        if (le32_to_cpu(evt.evt.status) != WMI_CFG_RX_CHAIN_SUCCESS)
+                rc = -EINVAL;
+
+        return rc;
+}
+
+void wmi_event_flush(struct wil6210_priv *wil)
+{
+        struct pending_wmi_event *evt, *t;
+
+        wil_dbg_wmi(wil, "%s()\n", __func__);
+
+        list_for_each_entry_safe(evt, t, &wil->pending_wmi_ev, list) {
+                list_del(&evt->list);
+                kfree(evt);
+        }
+}
+
+static bool wmi_evt_call_handler(struct wil6210_priv *wil, int id,
+                                 void *d, int len)
+{
+        uint i;
+
+        for (i = 0; i < ARRAY_SIZE(wmi_evt_handlers); i++) {
+                if (wmi_evt_handlers[i].eventid == id) {
+                        wmi_evt_handlers[i].handler(wil, id, d, len);
+                        return true;
+                }
+        }
+
+        return false;
+}
+
+static void wmi_event_handle(struct wil6210_priv *wil,
+                             struct wil6210_mbox_hdr *hdr)
+{
+        u16 len = le16_to_cpu(hdr->len);
+
+        if ((hdr->type == WIL_MBOX_HDR_TYPE_WMI) &&
+            (len >= sizeof(struct wil6210_mbox_hdr_wmi))) {
+                struct wil6210_mbox_hdr_wmi *wmi = (void *)(&hdr[1]);
+                void *evt_data = (void *)(&wmi[1]);
+                u16 id = le16_to_cpu(wmi->id);
+                /* check if someone waits for this event */
+                if (wil->reply_id && wil->reply_id == id) {
+                        if (wil->reply_buf) {
+                                memcpy(wil->reply_buf, wmi,
+                                       min(len, wil->reply_size));
+                        } else {
+                                wmi_evt_call_handler(wil, id, evt_data,
+                                                     len - sizeof(*wmi));
+                        }
+                        wil_dbg_wmi(wil, "Complete WMI 0x%04x\n", id);
+                        complete(&wil->wmi_ready);
+                        return;
+                }
+                /* unsolicited event */
+                /* search for handler */
+                if (!wmi_evt_call_handler(wil, id, evt_data,
+                                          len - sizeof(*wmi))) {
+                        wil_err(wil, "Unhandled event 0x%04x\n", id);
+                }
+        } else {
+                wil_err(wil, "Unknown event type\n");
+                print_hex_dump(KERN_ERR, "evt?? ", DUMP_PREFIX_OFFSET, 16, 1,
+                               hdr, sizeof(*hdr) + len, true);
+        }
+}
+
+/*
+ * Retrieve next WMI event from the pending list
+ */
+static struct list_head *next_wmi_ev(struct wil6210_priv *wil)
+{
+        ulong flags;
+        struct list_head *ret = NULL;
+
+        spin_lock_irqsave(&wil->wmi_ev_lock, flags);
+
+        if (!list_empty(&wil->pending_wmi_ev)) {
+                ret = wil->pending_wmi_ev.next;
+                list_del(ret);
+        }
+
+        spin_unlock_irqrestore(&wil->wmi_ev_lock, flags);
+
+        return ret;
+}
+
+/*
+ * Handler for the WMI events
+ */
+void wmi_event_worker(struct work_struct *work)
+{
+        struct wil6210_priv *wil = container_of(work, struct wil6210_priv,
+                                                 wmi_event_worker);
+        struct pending_wmi_event *evt;
+        struct list_head *lh;
+
+        while ((lh = next_wmi_ev(wil)) != NULL) {
+                evt = list_entry(lh, struct pending_wmi_event, list);
+                wmi_event_handle(wil, &evt->event.hdr);
+                kfree(evt);
+        }
+}
+
+void wmi_connect_worker(struct work_struct *work)
+{
+        int rc;
+        struct wil6210_priv *wil = container_of(work, struct wil6210_priv,
+                                                wmi_connect_worker);
+
+        if (wil->pending_connect_cid < 0) {
+                wil_err(wil, "No connection pending\n");
+                return;
+        }
+
+        wil_dbg_wmi(wil, "Configure for connection CID %d\n",
+                    wil->pending_connect_cid);
+
+        rc = wil_vring_init_tx(wil, 0, WIL6210_TX_RING_SIZE,
+                               wil->pending_connect_cid, 0);
+        wil->pending_connect_cid = -1;
+        if (rc == 0)
+                wil_link_on(wil);
+}
diff --git a/drivers/net/wireless/ath/wil6210/wmi.h b/drivers/net/wireless/ath/wil6210/wmi.h
new file mode 100644
index 000000000000..3bbf87572b07
--- /dev/null
+++ b/drivers/net/wireless/ath/wil6210/wmi.h
@@ -0,0 +1,1116 @@
+/*
+ * Copyright (c) 2012 Qualcomm Atheros, Inc.
+ * Copyright (c) 2006-2012 Wilocity .
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * This file contains the definitions of the WMI protocol specified in the
+ * Wireless Module Interface (WMI) for the Wilocity
+ * MARLON 60 Gigabit wireless solution.
+ * It includes definitions of all the commands and events.
+ * Commands are messages from the host to the WM.
+ * Events are messages from the WM to the host.
+ */
+
+#ifndef __WILOCITY_WMI_H__
+#define __WILOCITY_WMI_H__
+
+/* General */
+
+#define WMI_MAC_LEN             (6)
+#define WMI_PROX_RANGE_NUM      (3)
+
+/* List of Commands */
+enum wmi_command_id {
+        WMI_CONNECT_CMDID               = 0x0001,
+        WMI_DISCONNECT_CMDID            = 0x0003,
+        WMI_START_SCAN_CMDID            = 0x0007,
+        WMI_SET_BSS_FILTER_CMDID        = 0x0009,
+        WMI_SET_PROBED_SSID_CMDID       = 0x000a,
+        WMI_SET_LISTEN_INT_CMDID        = 0x000b,
+        WMI_BCON_CTRL_CMDID             = 0x000f,
+        WMI_ADD_CIPHER_KEY_CMDID        = 0x0016,
+        WMI_DELETE_CIPHER_KEY_CMDID     = 0x0017,
+        WMI_SET_APPIE_CMDID             = 0x003f,
+        WMI_GET_APPIE_CMDID             = 0x0040,
+        WMI_SET_WSC_STATUS_CMDID        = 0x0041,
+        WMI_PXMT_RANGE_CFG_CMDID        = 0x0042,
+        WMI_PXMT_SNR2_RANGE_CFG_CMDID   = 0x0043,
+        WMI_FAST_MEM_ACC_MODE_CMDID     = 0x0300,
+        WMI_MEM_READ_CMDID              = 0x0800,
+        WMI_MEM_WR_CMDID                = 0x0801,
+        WMI_ECHO_CMDID                  = 0x0803,
+        WMI_DEEP_ECHO_CMDID             = 0x0804,
+        WMI_CONFIG_MAC_CMDID            = 0x0805,
+        WMI_CONFIG_PHY_DEBUG_CMDID      = 0x0806,
+        WMI_ADD_STATION_CMDID           = 0x0807,
+        WMI_ADD_DEBUG_TX_PCKT_CMDID     = 0x0808,
+        WMI_PHY_GET_STATISTICS_CMDID    = 0x0809,
+        WMI_FS_TUNE_CMDID               = 0x080a,
+        WMI_CORR_MEASURE_CMDID          = 0x080b,
+        WMI_TEMP_SENSE_CMDID            = 0x080e,
+        WMI_DC_CALIB_CMDID              = 0x080f,
+        WMI_SEND_TONE_CMDID             = 0x0810,
+        WMI_IQ_TX_CALIB_CMDID           = 0x0811,
+        WMI_IQ_RX_CALIB_CMDID           = 0x0812,
+        WMI_SET_UCODE_IDLE_CMDID        = 0x0813,
+        WMI_SET_WORK_MODE_CMDID         = 0x0815,
+        WMI_LO_LEAKAGE_CALIB_CMDID      = 0x0816,
+        WMI_MARLON_R_ACTIVATE_CMDID     = 0x0817,
+        WMI_MARLON_R_READ_CMDID         = 0x0818,
+        WMI_MARLON_R_WRITE_CMDID        = 0x0819,
+        WMI_MARLON_R_TXRX_SEL_CMDID     = 0x081a,
+        MAC_IO_STATIC_PARAMS_CMDID      = 0x081b,
+        MAC_IO_DYNAMIC_PARAMS_CMDID     = 0x081c,
+        WMI_SILENT_RSSI_CALIB_CMDID     = 0x081d,
+        WMI_CFG_RX_CHAIN_CMDID          = 0x0820,
+        WMI_VRING_CFG_CMDID             = 0x0821,
+        WMI_RX_ON_CMDID                 = 0x0822,
+        WMI_VRING_BA_EN_CMDID           = 0x0823,
+        WMI_VRING_BA_DIS_CMDID          = 0x0824,
+        WMI_RCP_ADDBA_RESP_CMDID        = 0x0825,
+        WMI_RCP_DELBA_CMDID             = 0x0826,
+        WMI_SET_SSID_CMDID              = 0x0827,
+        WMI_GET_SSID_CMDID              = 0x0828,
+        WMI_SET_PCP_CHANNEL_CMDID       = 0x0829,
+        WMI_GET_PCP_CHANNEL_CMDID       = 0x082a,
+        WMI_SW_TX_REQ_CMDID             = 0x082b,
+        WMI_RX_OFF_CMDID                = 0x082c,
+        WMI_READ_MAC_RXQ_CMDID          = 0x0830,
+        WMI_READ_MAC_TXQ_CMDID          = 0x0831,
+        WMI_WRITE_MAC_RXQ_CMDID         = 0x0832,
+        WMI_WRITE_MAC_TXQ_CMDID         = 0x0833,
+        WMI_WRITE_MAC_XQ_FIELD_CMDID    = 0x0834,
+        WMI_MLME_PUSH_CMDID             = 0x0835,
+        WMI_BEAMFORMING_MGMT_CMDID      = 0x0836,
+        WMI_BF_TXSS_MGMT_CMDID          = 0x0837,
+        WMI_BF_SM_MGMT_CMDID            = 0x0838,
+        WMI_BF_RXSS_MGMT_CMDID          = 0x0839,
+        WMI_SET_SECTORS_CMDID           = 0x0849,
+        WMI_MAINTAIN_PAUSE_CMDID        = 0x0850,
+        WMI_MAINTAIN_RESUME_CMDID       = 0x0851,
+        WMI_RS_MGMT_CMDID               = 0x0852,
+        WMI_RF_MGMT_CMDID               = 0x0853,
+        /* Performance monitoring commands */
+        WMI_BF_CTRL_CMDID               = 0x0862,
+        WMI_NOTIFY_REQ_CMDID            = 0x0863,
+        WMI_GET_STATUS_CMDID            = 0x0864,
+        WMI_UNIT_TEST_CMDID             = 0x0900,
+        WMI_HICCUP_CMDID                = 0x0901,
+        WMI_FLASH_READ_CMDID            = 0x0902,
+        WMI_FLASH_WRITE_CMDID           = 0x0903,
+        WMI_SECURITY_UNIT_TEST_CMDID    = 0x0904,
+
+        WMI_SET_MAC_ADDRESS_CMDID       = 0xf003,
+        WMI_ABORT_SCAN_CMDID            = 0xf007,
+        WMI_SET_PMK_CMDID               = 0xf028,
+
+        WMI_SET_PROMISCUOUS_MODE_CMDID  = 0xf041,
+        WMI_GET_PMK_CMDID               = 0xf048,
+        WMI_SET_PASSPHRASE_CMDID        = 0xf049,
+        WMI_SEND_ASSOC_RES_CMDID        = 0xf04a,
+        WMI_SET_ASSOC_REQ_RELAY_CMDID   = 0xf04b,
+        WMI_EAPOL_TX_CMDID              = 0xf04c,
+        WMI_MAC_ADDR_REQ_CMDID          = 0xf04d,
+        WMI_FW_VER_CMDID                = 0xf04e,
+};
+
+/*
+ * Commands data structures
+ */
+
+/*
+ * Frame Types
+ */
+enum wmi_mgmt_frame_type {
+        WMI_FRAME_BEACON        = 0,
+        WMI_FRAME_PROBE_REQ     = 1,
+        WMI_FRAME_PROBE_RESP    = 2,
+        WMI_FRAME_ASSOC_REQ     = 3,
+        WMI_FRAME_ASSOC_RESP    = 4,
+        WMI_NUM_MGMT_FRAME,
+};
+
+/*
+ * WMI_CONNECT_CMDID
+ */
+enum wmi_network_type {
+        WMI_NETTYPE_INFRA               = 0x01,
+        WMI_NETTYPE_ADHOC               = 0x02,
+        WMI_NETTYPE_ADHOC_CREATOR       = 0x04,
+        WMI_NETTYPE_AP                  = 0x10,
+        WMI_NETTYPE_P2P                 = 0x20,
+        WMI_NETTYPE_WBE                 = 0x40, /* PCIE over 60g */
+};
+
+enum wmi_dot11_auth_mode {
+        WMI_AUTH11_OPEN                 = 0x01,
+        WMI_AUTH11_SHARED               = 0x02,
+        WMI_AUTH11_LEAP                 = 0x04,
+        WMI_AUTH11_WSC                  = 0x08,
+};
+
+enum wmi_auth_mode {
+        WMI_AUTH_NONE                   = 0x01,
+        WMI_AUTH_WPA                    = 0x02,
+        WMI_AUTH_WPA2                   = 0x04,
+        WMI_AUTH_WPA_PSK                = 0x08,
+        WMI_AUTH_WPA2_PSK               = 0x10,
+        WMI_AUTH_WPA_CCKM               = 0x20,
+        WMI_AUTH_WPA2_CCKM              = 0x40,
+};
+
+enum wmi_crypto_type {
+        WMI_CRYPT_NONE                  = 0x01,
+        WMI_CRYPT_WEP                   = 0x02,
+        WMI_CRYPT_TKIP                  = 0x04,
+        WMI_CRYPT_AES                   = 0x08,
+        WMI_CRYPT_AES_GCMP              = 0x20,
+};
+
+
+enum wmi_connect_ctrl_flag_bits {
+        WMI_CONNECT_ASSOC_POLICY_USER           = 0x0001,
+        WMI_CONNECT_SEND_REASSOC                = 0x0002,
+        WMI_CONNECT_IGNORE_WPAx_GROUP_CIPHER    = 0x0004,
+        WMI_CONNECT_PROFILE_MATCH_DONE          = 0x0008,
+        WMI_CONNECT_IGNORE_AAC_BEACON           = 0x0010,
+        WMI_CONNECT_CSA_FOLLOW_BSS              = 0x0020,
+        WMI_CONNECT_DO_WPA_OFFLOAD              = 0x0040,
+        WMI_CONNECT_DO_NOT_DEAUTH               = 0x0080,
+};
+
+#define WMI_MAX_SSID_LEN    (32)
+
+struct wmi_connect_cmd {
+        u8 network_type;
+        u8 dot11_auth_mode;
+        u8 auth_mode;
+        u8 pairwise_crypto_type;
+        u8 pairwise_crypto_len;
+        u8 group_crypto_type;
+        u8 group_crypto_len;
+        u8 ssid_len;
+        u8 ssid[WMI_MAX_SSID_LEN];
+        u8 channel;
+        u8 reserved0;
+        u8 bssid[WMI_MAC_LEN];
+        __le32 ctrl_flags;
+        u8 dst_mac[WMI_MAC_LEN];
+        u8 reserved1[2];
+} __packed;
+
+
+/*
+ * WMI_RECONNECT_CMDID
+ */
+struct wmi_reconnect_cmd {
+        u8 channel;                     /* hint */
+        u8 reserved;
+        u8 bssid[WMI_MAC_LEN];          /* mandatory if set */
+} __packed;
+
+
+/*
+ * WMI_SET_PMK_CMDID
+ */
+
+#define WMI_MIN_KEY_INDEX       (0)
+#define WMI_MAX_KEY_INDEX       (3)
+#define WMI_MAX_KEY_LEN         (32)
+#define WMI_PASSPHRASE_LEN      (64)
+#define WMI_PMK_LEN             (32)
+
+struct  wmi_set_pmk_cmd {
+        u8 pmk[WMI_PMK_LEN];
+} __packed;
+
+
+/*
+ * WMI_SET_PASSPHRASE_CMDID
+ */
+struct wmi_set_passphrase_cmd {
+        u8 ssid[WMI_MAX_SSID_LEN];
+        u8 passphrase[WMI_PASSPHRASE_LEN];
+        u8 ssid_len;
+        u8 passphrase_len;
+} __packed;
+
+/*
+ * WMI_ADD_CIPHER_KEY_CMDID
+ */
+enum wmi_key_usage {
+        WMI_KEY_USE_PAIRWISE    = 0,
+        WMI_KEY_USE_GROUP       = 1,
+        WMI_KEY_USE_TX          = 2,  /* default Tx Key - Static WEP only */
+};
+
+struct wmi_add_cipher_key_cmd {
+        u8 key_index;
+        u8 key_type;
+        u8 key_usage;           /* enum wmi_key_usage */
+        u8 key_len;
+        u8 key_rsc[8];          /* key replay sequence counter */
+        u8 key[WMI_MAX_KEY_LEN];
+        u8 key_op_ctrl;         /* Additional Key Control information */
+        u8 mac[WMI_MAC_LEN];
+} __packed;
+
+/*
+ * WMI_DELETE_CIPHER_KEY_CMDID
+ */
+struct wmi_delete_cipher_key_cmd {
+        u8 key_index;
+        u8 mac[WMI_MAC_LEN];
+} __packed;
+
+
+/*
+ * WMI_START_SCAN_CMDID
+ *
+ * Start L1 scan operation
+ *
+ * Returned events:
+ * - WMI_RX_MGMT_PACKET_EVENTID - for every probe resp.
+ * - WMI_SCAN_COMPLETE_EVENTID
+ */
+enum wmi_scan_type {
+        WMI_LONG_SCAN           = 0,
+        WMI_SHORT_SCAN          = 1,
+};
+
+struct wmi_start_scan_cmd {
+        u8 reserved[8];
+        __le32 home_dwell_time; /* Max duration in the home channel(ms) */
+        __le32 force_scan_interval;     /* Time interval between scans (ms)*/
+        u8 scan_type;           /* wmi_scan_type */
+        u8 num_channels;                /* how many channels follow */
+        struct {
+                u8 channel;
+                u8 reserved;
+        } channel_list[0];      /* channels ID's */
+                                /* 0 - 58320 MHz */
+                                /* 1 - 60480 MHz */
+                                /* 2 - 62640 MHz */
+} __packed;
+
+/*
+ * WMI_SET_PROBED_SSID_CMDID
+ */
+#define MAX_PROBED_SSID_INDEX   (15)
+
+enum wmi_ssid_flag {
+        WMI_SSID_FLAG_DISABLE   = 0,    /* disables entry */
+        WMI_SSID_FLAG_SPECIFIC  = 1,    /* probes specified ssid */
+        WMI_SSID_FLAG_ANY       = 2,    /* probes for any ssid */
+};
+
+struct wmi_probed_ssid_cmd {
+        u8 entry_index;                 /* 0 to MAX_PROBED_SSID_INDEX */
+        u8 flag;                        /* enum wmi_ssid_flag */
+        u8 ssid_len;
+        u8 ssid[WMI_MAX_SSID_LEN];
+} __packed;
+
+/*
+ * WMI_SET_APPIE_CMDID
+ * Add Application specified IE to a management frame
+ */
+struct wmi_set_appie_cmd {
+        u8 mgmt_frm_type;       /* enum wmi_mgmt_frame_type */
+        u8 reserved;
+        __le16 ie_len;  /* Length of the IE to be added to MGMT frame */
+        u8 ie_info[0];
+} __packed;
+
+#define WMI_MAX_IE_LEN (1024)
+
+struct wmi_pxmt_range_cfg_cmd {
+        u8 dst_mac[WMI_MAC_LEN];
+        __le16 range;
+} __packed;
+
+struct wmi_pxmt_snr2_range_cfg_cmd {
+        s8 snr2range_arr[WMI_PROX_RANGE_NUM-1];
+} __packed;
+
+/*
+ * WMI_RF_MGMT_CMDID
+ */
+enum wmi_rf_mgmt_type {
+        WMI_RF_MGMT_W_DISABLE   = 0,
+        WMI_RF_MGMT_W_ENABLE    = 1,
+        WMI_RF_MGMT_GET_STATUS  = 2,
+};
+
+struct wmi_rf_mgmt_cmd {
+        __le32 rf_mgmt_type;
+} __packed;
+
+/*
+ * WMI_SET_SSID_CMDID
+ */
+struct wmi_set_ssid_cmd {
+        __le32 ssid_len;
+        u8 ssid[WMI_MAX_SSID_LEN];
+} __packed;
+
+/*
+ * WMI_SET_PCP_CHANNEL_CMDID
+ */
+struct wmi_set_pcp_channel_cmd {
+        u8 channel;
+        u8 reserved[3];
+} __packed;
+
+/*
+ * WMI_BCON_CTRL_CMDID
+ */
+struct wmi_bcon_ctrl_cmd {
+        __le16 bcon_interval;
+        __le16 frag_num;
+        __le64 ss_mask;
+        u8 network_type;
+        u8 reserved;
+        u8 disable_sec_offload;
+        u8 disable_sec;
+} __packed;
+
+/*
+ * WMI_SW_TX_REQ_CMDID
+ */
+struct wmi_sw_tx_req_cmd {
+        u8 dst_mac[WMI_MAC_LEN];
+        __le16 len;
+        u8 payload[0];
+} __packed;
+
+/*
+ * WMI_VRING_CFG_CMDID
+ */
+
+struct wmi_sw_ring_cfg {
+        __le64 ring_mem_base;
+        __le16 ring_size;
+        __le16 max_mpdu_size;
+} __packed;
+
+struct wmi_vring_cfg_schd {
+        __le16 priority;
+        __le16 timeslot_us;
+} __packed;
+
+enum wmi_vring_cfg_encap_trans_type {
+        WMI_VRING_ENC_TYPE_802_3                = 0,
+        WMI_VRING_ENC_TYPE_NATIVE_WIFI          = 1,
+};
+
+enum wmi_vring_cfg_ds_cfg {
+        WMI_VRING_DS_PBSS                       = 0,
+        WMI_VRING_DS_STATION                    = 1,
+        WMI_VRING_DS_AP                         = 2,
+        WMI_VRING_DS_ADDR4                      = 3,
+};
+
+enum wmi_vring_cfg_nwifi_ds_trans_type {
+        WMI_NWIFI_TX_TRANS_MODE_NO              = 0,
+        WMI_NWIFI_TX_TRANS_MODE_AP2PBSS         = 1,
+        WMI_NWIFI_TX_TRANS_MODE_STA2PBSS        = 2,
+};
+
+enum wmi_vring_cfg_schd_params_priority {
+        WMI_SCH_PRIO_REGULAR                    = 0,
+        WMI_SCH_PRIO_HIGH                       = 1,
+};
+
+struct wmi_vring_cfg {
+        struct wmi_sw_ring_cfg tx_sw_ring;
+        u8 ringid;                              /* 0-23 vrings */
+
+        #define CIDXTID_CID_POS (0)
+        #define CIDXTID_CID_LEN (4)
+        #define CIDXTID_CID_MSK (0xF)
+        #define CIDXTID_TID_POS (4)
+        #define CIDXTID_TID_LEN (4)
+        #define CIDXTID_TID_MSK (0xF0)
+        u8 cidxtid;
+
+        u8 encap_trans_type;
+        u8 ds_cfg;                              /* 802.3 DS cfg */
+        u8 nwifi_ds_trans_type;
+
+        #define VRING_CFG_MAC_CTRL_LIFETIME_EN_POS (0)
+        #define VRING_CFG_MAC_CTRL_LIFETIME_EN_LEN (1)
+        #define VRING_CFG_MAC_CTRL_LIFETIME_EN_MSK (0x1)
+        #define VRING_CFG_MAC_CTRL_AGGR_EN_POS (1)
+        #define VRING_CFG_MAC_CTRL_AGGR_EN_LEN (1)
+        #define VRING_CFG_MAC_CTRL_AGGR_EN_MSK (0x2)
+        u8 mac_ctrl;
+
+        #define VRING_CFG_TO_RESOLUTION_VALUE_POS (0)
+        #define VRING_CFG_TO_RESOLUTION_VALUE_LEN (6)
+        #define VRING_CFG_TO_RESOLUTION_VALUE_MSK (0x3F)
+        u8 to_resolution;
+        u8 agg_max_wsize;
+        struct wmi_vring_cfg_schd schd_params;
+} __packed;
+
+enum wmi_vring_cfg_cmd_action {
+        WMI_VRING_CMD_ADD                       = 0,
+        WMI_VRING_CMD_MODIFY                    = 1,
+        WMI_VRING_CMD_DELETE                    = 2,
+};
+
+struct wmi_vring_cfg_cmd {
+        __le32 action;
+        struct wmi_vring_cfg vring_cfg;
+} __packed;
+
+/*
+ * WMI_VRING_BA_EN_CMDID
+ */
+struct wmi_vring_ba_en_cmd {
+        u8 ringid;
+        u8 agg_max_wsize;
+        __le16 ba_timeout;
+} __packed;
+
+/*
+ * WMI_VRING_BA_DIS_CMDID
+ */
+struct wmi_vring_ba_dis_cmd {
+        u8 ringid;
+        u8 reserved;
+        __le16 reason;
+} __packed;
+
+/*
+ * WMI_NOTIFY_REQ_CMDID
+ */
+struct wmi_notify_req_cmd {
+        u8 cid;
+        u8 reserved[3];
+        __le32 interval_usec;
+} __packed;
+
+/*
+ * WMI_CFG_RX_CHAIN_CMDID
+ */
+enum wmi_sniffer_cfg_mode {
+        WMI_SNIFFER_OFF                         = 0,
+        WMI_SNIFFER_ON                          = 1,
+};
+
+enum wmi_sniffer_cfg_phy_info_mode {
+        WMI_SNIFFER_PHY_INFO_DISABLED           = 0,
+        WMI_SNIFFER_PHY_INFO_ENABLED            = 1,
+};
+
+enum wmi_sniffer_cfg_phy_support {
+        WMI_SNIFFER_CP                          = 0,
+        WMI_SNIFFER_DP                          = 1,
+        WMI_SNIFFER_BOTH_PHYS                   = 2,
+};
+
+struct wmi_sniffer_cfg {
+        __le32 mode;            /* enum wmi_sniffer_cfg_mode */
+        __le32 phy_info_mode;   /* enum wmi_sniffer_cfg_phy_info_mode */
+        __le32 phy_support;     /* enum wmi_sniffer_cfg_phy_support */
+        u8 channel;
+        u8 reserved[3];
+} __packed;
+
+enum wmi_cfg_rx_chain_cmd_action {
+        WMI_RX_CHAIN_ADD                        = 0,
+        WMI_RX_CHAIN_DEL                        = 1,
+};
+
+enum wmi_cfg_rx_chain_cmd_decap_trans_type {
+        WMI_DECAP_TYPE_802_3                    = 0,
+        WMI_DECAP_TYPE_NATIVE_WIFI              = 1,
+};
+
+enum wmi_cfg_rx_chain_cmd_nwifi_ds_trans_type {
+        WMI_NWIFI_RX_TRANS_MODE_NO              = 0,
+        WMI_NWIFI_RX_TRANS_MODE_PBSS2AP         = 1,
+        WMI_NWIFI_RX_TRANS_MODE_PBSS2STA        = 2,
+};
+
+struct wmi_cfg_rx_chain_cmd {
+        __le32 action;
+        struct wmi_sw_ring_cfg rx_sw_ring;
+        u8 mid;
+        u8 decap_trans_type;
+
+        #define L2_802_3_OFFLOAD_CTRL_VLAN_TAG_INSERTION_POS (0)
+        #define L2_802_3_OFFLOAD_CTRL_VLAN_TAG_INSERTION_LEN (1)
+        #define L2_802_3_OFFLOAD_CTRL_VLAN_TAG_INSERTION_MSK (0x1)
+        u8 l2_802_3_offload_ctrl;
+
+        #define L2_NWIFI_OFFLOAD_CTRL_REMOVE_QOS_POS (0)
+        #define L2_NWIFI_OFFLOAD_CTRL_REMOVE_QOS_LEN (1)
+        #define L2_NWIFI_OFFLOAD_CTRL_REMOVE_QOS_MSK (0x1)
+        #define L2_NWIFI_OFFLOAD_CTRL_REMOVE_PN_POS (1)
+        #define L2_NWIFI_OFFLOAD_CTRL_REMOVE_PN_LEN (1)
+        #define L2_NWIFI_OFFLOAD_CTRL_REMOVE_PN_MSK (0x2)
+        u8 l2_nwifi_offload_ctrl;
+
+        u8 vlan_id;
+        u8 nwifi_ds_trans_type;
+
+        #define L3_L4_CTRL_IPV4_CHECKSUM_EN_POS (0)
+        #define L3_L4_CTRL_IPV4_CHECKSUM_EN_LEN (1)
+        #define L3_L4_CTRL_IPV4_CHECKSUM_EN_MSK (0x1)
+        #define L3_L4_CTRL_TCPIP_CHECKSUM_EN_POS (1)
+        #define L3_L4_CTRL_TCPIP_CHECKSUM_EN_LEN (1)
+        #define L3_L4_CTRL_TCPIP_CHECKSUM_EN_MSK (0x2)
+        u8 l3_l4_ctrl;
+
+        #define RING_CTRL_OVERRIDE_PREFETCH_THRSH_POS (0)
+        #define RING_CTRL_OVERRIDE_PREFETCH_THRSH_LEN (1)
+        #define RING_CTRL_OVERRIDE_PREFETCH_THRSH_MSK (0x1)
+        #define RING_CTRL_OVERRIDE_WB_THRSH_POS (1)
+        #define RING_CTRL_OVERRIDE_WB_THRSH_LEN (1)
+        #define RING_CTRL_OVERRIDE_WB_THRSH_MSK (0x2)
+        #define RING_CTRL_OVERRIDE_ITR_THRSH_POS (2)
+        #define RING_CTRL_OVERRIDE_ITR_THRSH_LEN (1)
+        #define RING_CTRL_OVERRIDE_ITR_THRSH_MSK (0x4)
+        #define RING_CTRL_OVERRIDE_HOST_THRSH_POS (3)
+        #define RING_CTRL_OVERRIDE_HOST_THRSH_LEN (1)
+        #define RING_CTRL_OVERRIDE_HOST_THRSH_MSK (0x8)
+        u8 ring_ctrl;
+
+        __le16 prefetch_thrsh;
+        __le16 wb_thrsh;
+        __le32 itr_value;
+        __le16 host_thrsh;
+        u8 reserved[2];
+        struct wmi_sniffer_cfg sniffer_cfg;
+} __packed;
+
+/*
+ * WMI_RCP_ADDBA_RESP_CMDID
+ */
+struct wmi_rcp_addba_resp_cmd {
+
+        #define CIDXTID_CID_POS (0)
+        #define CIDXTID_CID_LEN (4)
+        #define CIDXTID_CID_MSK (0xF)
+        #define CIDXTID_TID_POS (4)
+        #define CIDXTID_TID_LEN (4)
+        #define CIDXTID_TID_MSK (0xF0)
+        u8 cidxtid;
+
+        u8 dialog_token;
+        __le16 status_code;
+        __le16 ba_param_set;    /* ieee80211_ba_parameterset field to send */
+        __le16 ba_timeout;
+} __packed;
+
+/*
+ * WMI_RCP_DELBA_CMDID
+ */
+struct wmi_rcp_delba_cmd {
+
+        #define CIDXTID_CID_POS (0)
+        #define CIDXTID_CID_LEN (4)
+        #define CIDXTID_CID_MSK (0xF)
+        #define CIDXTID_TID_POS (4)
+        #define CIDXTID_TID_LEN (4)
+        #define CIDXTID_TID_MSK (0xF0)
+        u8 cidxtid;
+
+        u8 reserved;
+        __le16 reason;
+} __packed;
+
+/*
+ * WMI_RCP_ADDBA_REQ_CMDID
+ */
+struct wmi_rcp_addba_req_cmd {
+
+        #define CIDXTID_CID_POS (0)
+        #define CIDXTID_CID_LEN (4)
+        #define CIDXTID_CID_MSK (0xF)
+        #define CIDXTID_TID_POS (4)
+        #define CIDXTID_TID_LEN (4)
+        #define CIDXTID_TID_MSK (0xF0)
+        u8 cidxtid;
+
+        u8 dialog_token;
+        /* ieee80211_ba_parameterset field as it received */
+        __le16 ba_param_set;
+        __le16 ba_timeout;
+        /* ieee80211_ba_seqstrl field as it received */
+        __le16 ba_seq_ctrl;
+} __packed;
+
+/*
+ * WMI_SET_MAC_ADDRESS_CMDID
+ */
+struct wmi_set_mac_address_cmd {
+        u8 mac[WMI_MAC_LEN];
+        u8 reserved[2];
+} __packed;
+
+
+/*
+* WMI_EAPOL_TX_CMDID
+*/
+struct wmi_eapol_tx_cmd {
+        u8 dst_mac[WMI_MAC_LEN];
+        __le16 eapol_len;
+        u8 eapol[0];
+} __packed;
+
+/*
+ * WMI_ECHO_CMDID
+ *
+ * Check FW is alive
+ *
+ * WMI_DEEP_ECHO_CMDID
+ *
+ * Check FW and ucode are alive
+ *
+ * Returned event: WMI_ECHO_RSP_EVENTID
+ * same event for both commands
+ */
+struct wmi_echo_cmd {
+        __le32 value;
+} __packed;
+
+/*
+ * WMI Events
+ */
+
+/*
+ * List of Events (target to host)
+ */
+enum wmi_event_id {
+        WMI_IMM_RSP_EVENTID                     = 0x0000,
+        WMI_READY_EVENTID                       = 0x1001,
+        WMI_CONNECT_EVENTID                     = 0x1002,
+        WMI_DISCONNECT_EVENTID                  = 0x1003,
+        WMI_SCAN_COMPLETE_EVENTID               = 0x100a,
+        WMI_REPORT_STATISTICS_EVENTID           = 0x100b,
+        WMI_RD_MEM_RSP_EVENTID                  = 0x1800,
+        WMI_FW_READY_EVENTID                    = 0x1801,
+        WMI_EXIT_FAST_MEM_ACC_MODE_EVENTID      = 0x0200,
+        WMI_ECHO_RSP_EVENTID                    = 0x1803,
+        WMI_CONFIG_MAC_DONE_EVENTID             = 0x1805,
+        WMI_CONFIG_PHY_DEBUG_DONE_EVENTID       = 0x1806,
+        WMI_ADD_STATION_DONE_EVENTID            = 0x1807,
+        WMI_ADD_DEBUG_TX_PCKT_DONE_EVENTID      = 0x1808,
+        WMI_PHY_GET_STATISTICS_EVENTID          = 0x1809,
+        WMI_FS_TUNE_DONE_EVENTID                = 0x180a,
+        WMI_CORR_MEASURE_DONE_EVENTID           = 0x180b,
+        WMI_TEMP_SENSE_DONE_EVENTID             = 0x180e,
+        WMI_DC_CALIB_DONE_EVENTID               = 0x180f,
+        WMI_IQ_TX_CALIB_DONE_EVENTID            = 0x1811,
+        WMI_IQ_RX_CALIB_DONE_EVENTID            = 0x1812,
+        WMI_SET_WORK_MODE_DONE_EVENTID          = 0x1815,
+        WMI_LO_LEAKAGE_CALIB_DONE_EVENTID       = 0x1816,
+        WMI_MARLON_R_ACTIVATE_DONE_EVENTID      = 0x1817,
+        WMI_MARLON_R_READ_DONE_EVENTID          = 0x1818,
+        WMI_MARLON_R_WRITE_DONE_EVENTID         = 0x1819,
+        WMI_MARLON_R_TXRX_SEL_DONE_EVENTID      = 0x181a,
+        WMI_SILENT_RSSI_CALIB_DONE_EVENTID      = 0x181d,
+
+        WMI_CFG_RX_CHAIN_DONE_EVENTID           = 0x1820,
+        WMI_VRING_CFG_DONE_EVENTID              = 0x1821,
+        WMI_RX_ON_DONE_EVENTID                  = 0x1822,
+        WMI_BA_STATUS_EVENTID                   = 0x1823,
+        WMI_RCP_ADDBA_REQ_EVENTID               = 0x1824,
+        WMI_ADDBA_RESP_SENT_EVENTID             = 0x1825,
+        WMI_DELBA_EVENTID                       = 0x1826,
+        WMI_GET_SSID_EVENTID                    = 0x1828,
+        WMI_GET_PCP_CHANNEL_EVENTID             = 0x182a,
+        WMI_SW_TX_COMPLETE_EVENTID              = 0x182b,
+        WMI_RX_OFF_DONE_EVENTID                 = 0x182c,
+
+        WMI_READ_MAC_RXQ_EVENTID                = 0x1830,
+        WMI_READ_MAC_TXQ_EVENTID                = 0x1831,
+        WMI_WRITE_MAC_RXQ_EVENTID               = 0x1832,
+        WMI_WRITE_MAC_TXQ_EVENTID               = 0x1833,
+        WMI_WRITE_MAC_XQ_FIELD_EVENTID          = 0x1834,
+
+        WMI_BEAFORMING_MGMT_DONE_EVENTID        = 0x1836,
+        WMI_BF_TXSS_MGMT_DONE_EVENTID           = 0x1837,
+        WMI_BF_RXSS_MGMT_DONE_EVENTID           = 0x1839,
+        WMI_RS_MGMT_DONE_EVENTID                = 0x1852,
+        WMI_RF_MGMT_STATUS_EVENTID              = 0x1853,
+        WMI_BF_SM_MGMT_DONE_EVENTID             = 0x1838,
+        WMI_RX_MGMT_PACKET_EVENTID              = 0x1840,
+
+        /* Performance monitoring events */
+        WMI_DATA_PORT_OPEN_EVENTID              = 0x1860,
+        WMI_WBE_LINKDOWN_EVENTID                = 0x1861,
+
+        WMI_BF_CTRL_DONE_EVENTID                = 0x1862,
+        WMI_NOTIFY_REQ_DONE_EVENTID             = 0x1863,
+        WMI_GET_STATUS_DONE_EVENTID             = 0x1864,
+
+        WMI_UNIT_TEST_EVENTID                   = 0x1900,
+        WMI_FLASH_READ_DONE_EVENTID             = 0x1902,
+        WMI_FLASH_WRITE_DONE_EVENTID            = 0x1903,
+
+        WMI_SET_CHANNEL_EVENTID                 = 0x9000,
+        WMI_ASSOC_REQ_EVENTID                   = 0x9001,
+        WMI_EAPOL_RX_EVENTID                    = 0x9002,
+        WMI_MAC_ADDR_RESP_EVENTID               = 0x9003,
+        WMI_FW_VER_EVENTID                      = 0x9004,
+};
+
+/*
+ * Events data structures
+ */
+
+/*
+ * WMI_RF_MGMT_STATUS_EVENTID
+ */
+enum wmi_rf_status {
+        WMI_RF_ENABLED                  = 0,
+        WMI_RF_DISABLED_HW              = 1,
+        WMI_RF_DISABLED_SW              = 2,
+        WMI_RF_DISABLED_HW_SW           = 3,
+};
+
+struct wmi_rf_mgmt_status_event {
+        __le32 rf_status;
+} __packed;
+
+/*
+ * WMI_GET_STATUS_DONE_EVENTID
+ */
+struct wmi_get_status_done_event {
+        __le32 is_associated;
+        u8 cid;
+        u8 reserved0[3];
+        u8 bssid[WMI_MAC_LEN];
+        u8 channel;
+        u8 reserved1;
+        u8 network_type;
+        u8 reserved2[3];
+        __le32 ssid_len;
+        u8 ssid[WMI_MAX_SSID_LEN];
+        __le32 rf_status;
+        __le32 is_secured;
+} __packed;
+
+/*
+ * WMI_FW_VER_EVENTID
+ */
+struct wmi_fw_ver_event {
+        u8 major;
+        u8 minor;
+        __le16 subminor;
+        __le16 build;
+} __packed;
+
+/*
+* WMI_MAC_ADDR_RESP_EVENTID
+*/
+struct wmi_mac_addr_resp_event {
+        u8 mac[WMI_MAC_LEN];
+        u8 auth_mode;
+        u8 crypt_mode;
+        __le32 offload_mode;
+} __packed;
+
+/*
+* WMI_EAPOL_RX_EVENTID
+*/
+struct wmi_eapol_rx_event {
+        u8 src_mac[WMI_MAC_LEN];
+        __le16 eapol_len;
+        u8 eapol[0];
+} __packed;
+
+/*
+* WMI_READY_EVENTID
+*/
+enum wmi_phy_capability {
+        WMI_11A_CAPABILITY              = 1,
+        WMI_11G_CAPABILITY              = 2,
+        WMI_11AG_CAPABILITY             = 3,
+        WMI_11NA_CAPABILITY             = 4,
+        WMI_11NG_CAPABILITY             = 5,
+        WMI_11NAG_CAPABILITY            = 6,
+        WMI_11AD_CAPABILITY             = 7,
+        WMI_11N_CAPABILITY_OFFSET = WMI_11NA_CAPABILITY - WMI_11A_CAPABILITY,
+};
+
+struct wmi_ready_event {
+        __le32 sw_version;
+        __le32 abi_version;
+        u8 mac[WMI_MAC_LEN];
+        u8 phy_capability;              /* enum wmi_phy_capability */
+        u8 reserved;
+} __packed;
+
+/*
+ * WMI_NOTIFY_REQ_DONE_EVENTID
+ */
+struct wmi_notify_req_done_event {
+        __le32 status;
+        __le64 tsf;
+        __le32 snr_val;
+        __le32 tx_tpt;
+        __le32 tx_goodput;
+        __le32 rx_goodput;
+        __le16 bf_mcs;
+        __le16 my_rx_sector;
+        __le16 my_tx_sector;
+        __le16 other_rx_sector;
+        __le16 other_tx_sector;
+        __le16 range;
+} __packed;
+
+/*
+ * WMI_CONNECT_EVENTID
+ */
+struct wmi_connect_event {
+        u8 channel;
+        u8 reserved0;
+        u8 bssid[WMI_MAC_LEN];
+        __le16 listen_interval;
+        __le16 beacon_interval;
+        u8 network_type;
+        u8 reserved1[3];
+        u8 beacon_ie_len;
+        u8 assoc_req_len;
+        u8 assoc_resp_len;
+        u8 cid;
+        u8 reserved2[3];
+        u8 assoc_info[0];
+} __packed;
+
+/*
+ * WMI_DISCONNECT_EVENTID
+ */
+enum wmi_disconnect_reason {
+        WMI_DIS_REASON_NO_NETWORK_AVAIL         = 1,
+        WMI_DIS_REASON_LOST_LINK                = 2, /* bmiss */
+        WMI_DIS_REASON_DISCONNECT_CMD           = 3,
+        WMI_DIS_REASON_BSS_DISCONNECTED         = 4,
+        WMI_DIS_REASON_AUTH_FAILED              = 5,
+        WMI_DIS_REASON_ASSOC_FAILED             = 6,
+        WMI_DIS_REASON_NO_RESOURCES_AVAIL       = 7,
+        WMI_DIS_REASON_CSERV_DISCONNECT         = 8,
+        WMI_DIS_REASON_INVALID_PROFILE          = 10,
+        WMI_DIS_REASON_DOT11H_CHANNEL_SWITCH    = 11,
+        WMI_DIS_REASON_PROFILE_MISMATCH         = 12,
+        WMI_DIS_REASON_CONNECTION_EVICTED       = 13,
+        WMI_DIS_REASON_IBSS_MERGE               = 14,
+};
+
+struct wmi_disconnect_event {
+        __le16 protocol_reason_status;  /* reason code, see 802.11 spec. */
+        u8 bssid[WMI_MAC_LEN];          /* set if known */
+        u8 disconnect_reason;           /* see wmi_disconnect_reason_e */
+        u8 assoc_resp_len;
+        u8 assoc_info[0];
+} __packed;
+
+/*
+ * WMI_SCAN_COMPLETE_EVENTID
+ */
+struct wmi_scan_complete_event {
+        __le32 status;
+} __packed;
+
+/*
+ * WMI_BA_STATUS_EVENTID
+ */
+enum wmi_vring_ba_status {
+        WMI_BA_AGREED                   = 0,
+        WMI_BA_NON_AGREED               = 1,
+};
+
+struct wmi_vring_ba_status_event {
+        __le16 status;
+        u8 reserved[2];
+        u8 ringid;
+        u8 agg_wsize;
+        __le16 ba_timeout;
+} __packed;
+
+/*
+ * WMI_DELBA_EVENTID
+ */
+struct wmi_delba_event {
+
+        #define CIDXTID_CID_POS (0)
+        #define CIDXTID_CID_LEN (4)
+        #define CIDXTID_CID_MSK (0xF)
+        #define CIDXTID_TID_POS (4)
+        #define CIDXTID_TID_LEN (4)
+        #define CIDXTID_TID_MSK (0xF0)
+        u8 cidxtid;
+
+        u8 from_initiator;
+        __le16 reason;
+} __packed;
+
+/*
+ * WMI_VRING_CFG_DONE_EVENTID
+ */
+enum wmi_vring_cfg_done_event_status {
+        WMI_VRING_CFG_SUCCESS           = 0,
+        WMI_VRING_CFG_FAILURE           = 1,
+};
+
+struct wmi_vring_cfg_done_event {
+        u8 ringid;
+        u8 status;
+        u8 reserved[2];
+        __le32 tx_vring_tail_ptr;
+} __packed;
+
+/*
+ * WMI_ADDBA_RESP_SENT_EVENTID
+ */
+enum wmi_rcp_addba_resp_sent_event_status {
+        WMI_ADDBA_SUCCESS               = 0,
+        WMI_ADDBA_FAIL                  = 1,
+};
+
+struct wmi_rcp_addba_resp_sent_event {
+
+        #define CIDXTID_CID_POS (0)
+        #define CIDXTID_CID_LEN (4)
+        #define CIDXTID_CID_MSK (0xF)
+        #define CIDXTID_TID_POS (4)
+        #define CIDXTID_TID_LEN (4)
+        #define CIDXTID_TID_MSK (0xF0)
+        u8 cidxtid;
+
+        u8 reserved;
+        __le16 status;
+} __packed;
+
+/*
+ * WMI_RCP_ADDBA_REQ_EVENTID
+ */
+struct wmi_rcp_addba_req_event {
+
+        #define CIDXTID_CID_POS (0)
+        #define CIDXTID_CID_LEN (4)
+        #define CIDXTID_CID_MSK (0xF)
+        #define CIDXTID_TID_POS (4)
+        #define CIDXTID_TID_LEN (4)
+        #define CIDXTID_TID_MSK (0xF0)
+        u8 cidxtid;
+
+        u8 dialog_token;
+        __le16 ba_param_set;    /* ieee80211_ba_parameterset as it received */
+        __le16 ba_timeout;
+        __le16 ba_seq_ctrl;     /* ieee80211_ba_seqstrl field as it received */
+} __packed;
+
+/*
+ * WMI_CFG_RX_CHAIN_DONE_EVENTID
+ */
+enum wmi_cfg_rx_chain_done_event_status {
+        WMI_CFG_RX_CHAIN_SUCCESS        = 1,
+};
+
+struct wmi_cfg_rx_chain_done_event {
+        __le32 rx_ring_tail_ptr;        /* Rx V-Ring Tail pointer */
+        __le32 status;
+} __packed;
+
+/*
+ * WMI_WBE_LINKDOWN_EVENTID
+ */
+enum wmi_wbe_link_down_event_reason {
+        WMI_WBE_REASON_USER_REQUEST     = 0,
+        WMI_WBE_REASON_RX_DISASSOC      = 1,
+        WMI_WBE_REASON_BAD_PHY_LINK     = 2,
+};
+
+struct wmi_wbe_link_down_event {
+        u8 cid;
+        u8 reserved[3];
+        __le32 reason;
+} __packed;
+
+/*
+ * WMI_DATA_PORT_OPEN_EVENTID
+ */
+struct wmi_data_port_open_event {
+        u8 cid;
+        u8 reserved[3];
+} __packed;
+
+/*
+ * WMI_GET_PCP_CHANNEL_EVENTID
+ */
+struct wmi_get_pcp_channel_event {
+        u8 channel;
+        u8 reserved[3];
+} __packed;
+
+/*
+ * WMI_SW_TX_COMPLETE_EVENTID
+ */
+enum wmi_sw_tx_status {
+        WMI_TX_SW_STATUS_SUCCESS                = 0,
+        WMI_TX_SW_STATUS_FAILED_NO_RESOURCES    = 1,
+        WMI_TX_SW_STATUS_FAILED_TX              = 2,
+};
+
+struct wmi_sw_tx_complete_event {
+        u8 status;      /* enum wmi_sw_tx_status */
+        u8 reserved[3];
+} __packed;
+
+/*
+ * WMI_GET_SSID_EVENTID
+ */
+struct wmi_get_ssid_event {
+        __le32 ssid_len;
+        u8 ssid[WMI_MAX_SSID_LEN];
+} __packed;
+
+/*
+ * WMI_RX_MGMT_PACKET_EVENTID
+ */
+struct wmi_rx_mgmt_info {
+        u8 mcs;
+        s8 snr;
+        __le16 range;
+        __le16 stype;
+        __le16 status;
+        __le32 len;
+        u8 qid;
+        u8 mid;
+        u8 cid;
+        u8 channel;     /* From Radio MNGR */
+} __packed;
+
+struct wmi_rx_mgmt_packet_event {
+        struct wmi_rx_mgmt_info info;
+        u8 payload[0];
+} __packed;
+
+/*
+ * WMI_ECHO_RSP_EVENTID
+ */
+struct wmi_echo_event {
+        __le32 echoed_value;
+} __packed;
+
+#endif /* __WILOCITY_WMI_H__ */
diff --git a/drivers/net/wireless/b43/b43.h b/drivers/net/wireless/b43/b43.h
index b298e5d68be2..10e288d470e7 100644
--- a/drivers/net/wireless/b43/b43.h
+++ b/drivers/net/wireless/b43/b43.h
@@ -7,6 +7,7 @@
 #include <linux/hw_random.h>
 #include <linux/bcma/bcma.h>
 #include <linux/ssb/ssb.h>
+#include <linux/completion.h>
 #include <net/mac80211.h>
 
 #include "debugfs.h"
@@ -722,6 +723,10 @@ enum b43_firmware_file_type {
 struct b43_request_fw_context {
         /* The device we are requesting the fw for. */
         struct b43_wldev *dev;
+        /* a completion event structure needed if this call is asynchronous */
+        struct completion fw_load_complete;
+        /* a pointer to the firmware object */
+        const struct firmware *blob;
         /* The type of firmware to request. */
         enum b43_firmware_file_type req_type;
         /* Error messages for each firmware type. */
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 16ab280359bd..806e34c19281 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -2088,11 +2088,18 @@ static void b43_print_fw_helptext(struct b43_wl *wl, bool error)
                 b43warn(wl, text);
 }
 
+static void b43_fw_cb(const struct firmware *firmware, void *context)
+{
+        struct b43_request_fw_context *ctx = context;
+
+        ctx->blob = firmware;
+        complete(&ctx->fw_load_complete);
+}
+
 int b43_do_request_fw(struct b43_request_fw_context *ctx,
                       const char *name,
-                      struct b43_firmware_file *fw)
+                      struct b43_firmware_file *fw, bool async)
 {
-        const struct firmware *blob;
         struct b43_fw_header *hdr;
         u32 size;
         int err;
@@ -2131,11 +2138,31 @@ int b43_do_request_fw(struct b43_request_fw_context *ctx,
                 B43_WARN_ON(1);
                 return -ENOSYS;
         }
-        err = request_firmware(&blob, ctx->fwname, ctx->dev->dev->dev);
+        if (async) {
+                /* do this part asynchronously */
+                init_completion(&ctx->fw_load_complete);
+                err = request_firmware_nowait(THIS_MODULE, 1, ctx->fwname,
+                                              ctx->dev->dev->dev, GFP_KERNEL,
+                                              ctx, b43_fw_cb);
+                if (err < 0) {
+                        pr_err("Unable to load firmware\n");
+                        return err;
+                }
+                /* stall here until fw ready */
+                wait_for_completion(&ctx->fw_load_complete);
+                if (ctx->blob)
+                        goto fw_ready;
+        /* On some ARM systems, the async request will fail, but the next sync
+         * request works. For this reason, we dall through here
+         */
+        }
+        err = request_firmware(&ctx->blob, ctx->fwname,
+                               ctx->dev->dev->dev);
         if (err == -ENOENT) {
                 snprintf(ctx->errors[ctx->req_type],
                          sizeof(ctx->errors[ctx->req_type]),
-                         "Firmware file \"%s\" not found\n", ctx->fwname);
+                         "Firmware file \"%s\" not found\n",
+                         ctx->fwname);
                 return err;
         } else if (err) {
                 snprintf(ctx->errors[ctx->req_type],
@@ -2144,14 +2171,15 @@ int b43_do_request_fw(struct b43_request_fw_context *ctx,
                          ctx->fwname, err);
                 return err;
         }
-        if (blob->size < sizeof(struct b43_fw_header))
+fw_ready:
+        if (ctx->blob->size < sizeof(struct b43_fw_header))
                 goto err_format;
-        hdr = (struct b43_fw_header *)(blob->data);
+        hdr = (struct b43_fw_header *)(ctx->blob->data);
         switch (hdr->type) {
         case B43_FW_TYPE_UCODE:
         case B43_FW_TYPE_PCM:
                 size = be32_to_cpu(hdr->size);
-                if (size != blob->size - sizeof(struct b43_fw_header))
+                if (size != ctx->blob->size - sizeof(struct b43_fw_header))
                         goto err_format;
                 /* fallthrough */
         case B43_FW_TYPE_IV:
@@ -2162,7 +2190,7 @@ int b43_do_request_fw(struct b43_request_fw_context *ctx,
                 goto err_format;
         }
 
-        fw->data = blob;
+        fw->data = ctx->blob;
         fw->filename = name;
         fw->type = ctx->req_type;
 
@@ -2172,7 +2200,7 @@ err_format:
         snprintf(ctx->errors[ctx->req_type],
                  sizeof(ctx->errors[ctx->req_type]),
                  "Firmware file \"%s\" format error.\n", ctx->fwname);
-        release_firmware(blob);
+        release_firmware(ctx->blob);
 
         return -EPROTO;
 }
@@ -2223,7 +2251,7 @@ static int b43_try_request_fw(struct b43_request_fw_context *ctx)
                         goto err_no_ucode;
                 }
         }
-        err = b43_do_request_fw(ctx, filename, &fw->ucode);
+        err = b43_do_request_fw(ctx, filename, &fw->ucode, true);
         if (err)
                 goto err_load;
 
@@ -2235,7 +2263,7 @@ static int b43_try_request_fw(struct b43_request_fw_context *ctx)
         else
                 goto err_no_pcm;
         fw->pcm_request_failed = false;
-        err = b43_do_request_fw(ctx, filename, &fw->pcm);
+        err = b43_do_request_fw(ctx, filename, &fw->pcm, false);
         if (err == -ENOENT) {
                 /* We did not find a PCM file? Not fatal, but
                  * core rev <= 10 must do without hwcrypto then. */
@@ -2296,7 +2324,7 @@ static int b43_try_request_fw(struct b43_request_fw_context *ctx)
         default:
                 goto err_no_initvals;
         }
-        err = b43_do_request_fw(ctx, filename, &fw->initvals);
+        err = b43_do_request_fw(ctx, filename, &fw->initvals, false);
         if (err)
                 goto err_load;
 
@@ -2355,7 +2383,7 @@ static int b43_try_request_fw(struct b43_request_fw_context *ctx)
         default:
                 goto err_no_initvals;
         }
-        err = b43_do_request_fw(ctx, filename, &fw->initvals_band);
+        err = b43_do_request_fw(ctx, filename, &fw->initvals_band, false);
         if (err)
                 goto err_load;
 
diff --git a/drivers/net/wireless/b43/main.h b/drivers/net/wireless/b43/main.h
index 8c684cd33529..abac25ee958d 100644
--- a/drivers/net/wireless/b43/main.h
+++ b/drivers/net/wireless/b43/main.h
@@ -137,9 +137,8 @@ void b43_mac_phy_clock_set(struct b43_wldev *dev, bool on);
 
 
 struct b43_request_fw_context;
-int b43_do_request_fw(struct b43_request_fw_context *ctx,
-                      const char *name,
-                      struct b43_firmware_file *fw);
+int b43_do_request_fw(struct b43_request_fw_context *ctx, const char *name,
+                      struct b43_firmware_file *fw, bool async);
 void b43_do_release_fw(struct b43_firmware_file *fw);
 
 #endif /* B43_MAIN_H_ */
diff --git a/drivers/net/wireless/b43/tables_nphy.c b/drivers/net/wireless/b43/tables_nphy.c
index 97d4e27bf36f..aaca60c6f575 100644
--- a/drivers/net/wireless/b43/tables_nphy.c
+++ b/drivers/net/wireless/b43/tables_nphy.c
@@ -3226,8 +3226,6 @@ struct nphy_gain_ctl_workaround_entry *b43_nphy_get_gain_ctl_workaround_ent(
 {
         struct nphy_gain_ctl_workaround_entry *e;
         u8 phy_idx;
-        u8 tr_iso = ghz5 ? dev->dev->bus_sprom->fem.ghz5.tr_iso :
-                           dev->dev->bus_sprom->fem.ghz2.tr_iso;
 
         if (!ghz5 && dev->phy.rev >= 6 && dev->phy.radio_rev == 11)
                 return &nphy_gain_ctl_wa_phy6_radio11_ghz2;
@@ -3249,6 +3247,10 @@ struct nphy_gain_ctl_workaround_entry *b43_nphy_get_gain_ctl_workaround_ent(
                     !b43_channel_type_is_40mhz(dev->phy.channel_type))
                         e->cliplo_gain = 0x2d;
         } else if (!ghz5 && dev->phy.rev >= 5) {
+                static const int gain_data[] = {0x0062, 0x0064, 0x006a, 0x106a,
+                                                0x106c, 0x1074, 0x107c, 0x207c};
+                u8 tr_iso = dev->dev->bus_sprom->fem.ghz2.tr_iso;
+
                 if (ext_lna) {
                         e->rfseq_init[0] &= ~0x4000;
                         e->rfseq_init[1] &= ~0x4000;
@@ -3256,26 +3258,10 @@ struct nphy_gain_ctl_workaround_entry *b43_nphy_get_gain_ctl_workaround_ent(
                         e->rfseq_init[3] &= ~0x4000;
                         e->init_gain &= ~0x4000;
                 }
-                switch (tr_iso) {
-                case 0:
-                        e->cliplo_gain = 0x0062;
-                case 1:
-                        e->cliplo_gain = 0x0064;
-                case 2:
-                        e->cliplo_gain = 0x006a;
-                case 3:
-                        e->cliplo_gain = 0x106a;
-                case 4:
-                        e->cliplo_gain = 0x106c;
-                case 5:
-                        e->cliplo_gain = 0x1074;
-                case 6:
-                        e->cliplo_gain = 0x107c;
-                case 7:
-                        e->cliplo_gain = 0x207c;
-                default:
-                        e->cliplo_gain = 0x106a;
-                }
+                if (tr_iso > 7)
+                        tr_iso = 3;
+                e->cliplo_gain = gain_data[tr_iso];
+
         } else if (ghz5 && dev->phy.rev == 4 && ext_lna) {
                 e->rfseq_init[0] &= ~0x4000;
                 e->rfseq_init[1] &= ~0x4000;
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
index be35a2f99b1c..11fd1c735589 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
@@ -15,8 +15,6 @@
  */
 /* ****************** SDIO CARD Interface Functions **************************/
 
-#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
-
 #include <linux/types.h>
 #include <linux/netdevice.h>
 #include <linux/export.h>
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
index d33e5598611b..d92d373733d7 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
@@ -14,8 +14,6 @@
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
-
 #include <linux/types.h>
 #include <linux/netdevice.h>
 #include <linux/mmc/sdio.h>
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd.h b/drivers/net/wireless/brcm80211/brcmfmac/dhd.h
index fd672bf53867..a2f32fb990fa 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd.h
@@ -39,6 +39,7 @@
 #define BRCMF_C_GET_BSSID                       23
 #define BRCMF_C_GET_SSID                        25
 #define BRCMF_C_SET_SSID                        26
+#define BRCMF_C_TERMINATED                      28
 #define BRCMF_C_GET_CHANNEL                     29
 #define BRCMF_C_SET_CHANNEL                     30
 #define BRCMF_C_GET_SRL                         31
@@ -480,36 +481,14 @@ struct brcmf_pub {
         unsigned long drv_version;      /* Version of dongle-resident driver */
         u8 mac[ETH_ALEN];               /* MAC address obtained from dongle */
 
-        /* Additional stats for the bus level */
-
         /* Multicast data packets sent to dongle */
         unsigned long tx_multicast;
-        /* Packets flushed due to unscheduled sendup thread */
-        unsigned long rx_flushed;
-        /* Number of times dpc scheduled by watchdog timer */
-        unsigned long wd_dpc_sched;
-
-        /* Number of flow control pkts recvd */
-        unsigned long fc_packets;
-
-        /* Last error return */
-        int bcmerror;
-
-        /* Last error from dongle */
-        int dongle_error;
-
-        /* Suspend disable flag  flag */
-        int suspend_disable_flag;       /* "1" to disable all extra powersaving
-                                         during suspend */
-        int in_suspend;         /* flag set to 1 when early suspend called */
-        int dtim_skip;          /* dtim skip , default 0 means wake each dtim */
 
         struct brcmf_if *iflist[BRCMF_MAX_IFS];
 
         struct mutex proto_block;
         unsigned char proto_buf[BRCMF_DCMD_MAXLEN];
 
-        u8 macvalue[ETH_ALEN];
         atomic_t pend_8021x_cnt;
         wait_queue_head_t pend_8021x_wait;
 
@@ -519,11 +498,6 @@ struct brcmf_pub {
 #endif
 };
 
-struct bcmevent_name {
-        uint event;
-        const char *name;
-};
-
 struct brcmf_if_event {
         u8 ifidx;
         u8 action;
@@ -557,13 +531,6 @@ struct brcmf_if {
         u8 mac_addr[ETH_ALEN];
 };
 
-static inline s32 brcmf_ndev_bssidx(struct net_device *ndev)
-{
-        struct brcmf_if *ifp = netdev_priv(ndev);
-        return ifp->bssidx;
-}
-
-extern const struct bcmevent_name bcmevent_names[];
 
 extern int brcmf_netdev_wait_pend8021x(struct net_device *ndev);
 
@@ -576,6 +543,10 @@ extern int brcmf_proto_cdc_query_dcmd(struct brcmf_pub *drvr, int ifidx,
 extern int brcmf_proto_cdc_set_dcmd(struct brcmf_pub *drvr, int ifidx, uint cmd,
                                     void *buf, uint len);
 
+/* Remove any protocol-specific data header. */
+extern int brcmf_proto_hdrpull(struct brcmf_pub *drvr, u8 *ifidx,
+                               struct sk_buff *rxp);
+
 extern int brcmf_net_attach(struct brcmf_if *ifp);
 extern struct brcmf_if *brcmf_add_if(struct brcmf_pub *drvr, int ifidx,
                                      s32 bssidx, char *name, u8 *mac_addr);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h b/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
index dd38b78a9726..64c38f4226a3 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
@@ -130,31 +130,18 @@ int brcmf_bus_rxctl(struct brcmf_bus *bus, unsigned char *msg, uint len)
  * interface functions from common layer
  */
 
-/* Remove any protocol-specific data header. */
-extern int brcmf_proto_hdrpull(struct device *dev, int *ifidx,
-                               struct sk_buff *rxp);
-
 extern bool brcmf_c_prec_enq(struct device *dev, struct pktq *q,
                          struct sk_buff *pkt, int prec);
 
 /* Receive frame for delivery to OS.  Callee disposes of rxp. */
-extern void brcmf_rx_frame(struct device *dev, u8 ifidx,
-                           struct sk_buff_head *rxlist);
-static inline void brcmf_rx_packet(struct device *dev, int ifidx,
-                                   struct sk_buff *pkt)
-{
-        struct sk_buff_head q;
-
-        skb_queue_head_init(&q);
-        skb_queue_tail(&q, pkt);
-        brcmf_rx_frame(dev, ifidx, &q);
-}
+extern void brcmf_rx_frames(struct device *dev, struct sk_buff_head *rxlist);
 
 /* Indication from bus module regarding presence/insertion of dongle. */
 extern int brcmf_attach(uint bus_hdrlen, struct device *dev);
 /* Indication from bus module regarding removal/absence of dongle */
 extern void brcmf_detach(struct device *dev);
-
+/* Indication from bus module that dongle should be reset */
+extern void brcmf_dev_reset(struct device *dev);
 /* Indication from bus module to change flow-control state */
 extern void brcmf_txflowblock(struct device *dev, bool state);
 
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_cdc.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_cdc.c
index 83923553f1ac..bb454cdab29d 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_cdc.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_cdc.c
@@ -19,8 +19,6 @@
  * For certain dcmd codes, the dongle interprets string data from the host.
  ******************************************************************************/
 
-#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
-
 #include <linux/types.h>
 #include <linux/netdevice.h>
 
@@ -94,8 +92,6 @@ struct brcmf_proto_bdc_header {
 
 struct brcmf_proto {
         u16 reqid;
-        u8 pending;
-        u32 lastcmd;
         u8 bus_header[BUS_HEADER_LEN];
         struct brcmf_proto_cdc_dcmd msg;
         unsigned char buf[BRCMF_DCMD_MAXLEN + ROUND_UP_MARGIN];
@@ -107,7 +103,7 @@ static int brcmf_proto_cdc_msg(struct brcmf_pub *drvr)
         int len = le32_to_cpu(prot->msg.len) +
                         sizeof(struct brcmf_proto_cdc_dcmd);
 
-        brcmf_dbg(TRACE, "Enter\n");
+        brcmf_dbg(CDC, "Enter\n");
 
         /* NOTE : cdc->msg.len holds the desired length of the buffer to be
          *        returned. Only up to CDC_MAX_MSG_SIZE of this buffer area
@@ -125,7 +121,7 @@ static int brcmf_proto_cdc_cmplt(struct brcmf_pub *drvr, u32 id, u32 len)
         int ret;
         struct brcmf_proto *prot = drvr->prot;
 
-        brcmf_dbg(TRACE, "Enter\n");
+        brcmf_dbg(CDC, "Enter\n");
         len += sizeof(struct brcmf_proto_cdc_dcmd);
         do {
                 ret = brcmf_bus_rxctl(drvr->bus_if, (unsigned char *)&prot->msg,
@@ -147,20 +143,7 @@ brcmf_proto_cdc_query_dcmd(struct brcmf_pub *drvr, int ifidx, uint cmd,
         int ret = 0, retries = 0;
         u32 id, flags;
 
-        brcmf_dbg(TRACE, "Enter\n");
-        brcmf_dbg(CTL, "cmd %d len %d\n", cmd, len);
-
-        /* Respond "bcmerror" and "bcmerrorstr" with local cache */
-        if (cmd == BRCMF_C_GET_VAR && buf) {
-                if (!strcmp((char *)buf, "bcmerrorstr")) {
-                        strncpy((char *)buf, "bcm_error",
-                                BCME_STRLEN);
-                        goto done;
-                } else if (!strcmp((char *)buf, "bcmerror")) {
-                        *(int *)buf = drvr->dongle_error;
-                        goto done;
-                }
-        }
+        brcmf_dbg(CDC, "Enter, cmd %d len %d\n", cmd, len);
 
         memset(msg, 0, sizeof(struct brcmf_proto_cdc_dcmd));
 
@@ -210,11 +193,8 @@ retry:
         }
 
         /* Check the ERROR flag */
-        if (flags & CDC_DCMD_ERROR) {
+        if (flags & CDC_DCMD_ERROR)
                 ret = le32_to_cpu(msg->status);
-                /* Cache error from dongle */
-                drvr->dongle_error = ret;
-        }
 
 done:
         return ret;
@@ -228,8 +208,7 @@ int brcmf_proto_cdc_set_dcmd(struct brcmf_pub *drvr, int ifidx, uint cmd,
         int ret = 0;
         u32 flags, id;
 
-        brcmf_dbg(TRACE, "Enter\n");
-        brcmf_dbg(CTL, "cmd %d len %d\n", cmd, len);
+        brcmf_dbg(CDC, "Enter, cmd %d len %d\n", cmd, len);
 
         memset(msg, 0, sizeof(struct brcmf_proto_cdc_dcmd));
 
@@ -262,11 +241,8 @@ int brcmf_proto_cdc_set_dcmd(struct brcmf_pub *drvr, int ifidx, uint cmd,
         }
 
         /* Check the ERROR flag */
-        if (flags & CDC_DCMD_ERROR) {
+        if (flags & CDC_DCMD_ERROR)
                 ret = le32_to_cpu(msg->status);
-                /* Cache error from dongle */
-                drvr->dongle_error = ret;
-        }
 
 done:
         return ret;
@@ -287,7 +263,7 @@ void brcmf_proto_hdrpush(struct brcmf_pub *drvr, int ifidx,
 {
         struct brcmf_proto_bdc_header *h;
 
-        brcmf_dbg(TRACE, "Enter\n");
+        brcmf_dbg(CDC, "Enter\n");
 
         /* Push BDC header used to convey priority for buses that don't */
 
@@ -305,14 +281,12 @@ void brcmf_proto_hdrpush(struct brcmf_pub *drvr, int ifidx,
         BDC_SET_IF_IDX(h, ifidx);
 }
 
-int brcmf_proto_hdrpull(struct device *dev, int *ifidx,
+int brcmf_proto_hdrpull(struct brcmf_pub *drvr, u8 *ifidx,
                         struct sk_buff *pktbuf)
 {
         struct brcmf_proto_bdc_header *h;
-        struct brcmf_bus *bus_if = dev_get_drvdata(dev);
-        struct brcmf_pub *drvr = bus_if->drvr;
 
-        brcmf_dbg(TRACE, "Enter\n");
+        brcmf_dbg(CDC, "Enter\n");
 
         /* Pop BDC header used to convey priority for buses that don't */
 
@@ -338,7 +312,7 @@ int brcmf_proto_hdrpull(struct device *dev, int *ifidx,
         }
 
         if (h->flags & BDC_FLAG_SUM_GOOD) {
-                brcmf_dbg(INFO, "%s: BDC packet received with good rx-csum, flags 0x%x\n",
+                brcmf_dbg(CDC, "%s: BDC rcv, good checksum, flags 0x%x\n",
                           brcmf_ifname(drvr, *ifidx), h->flags);
                 pkt_set_sum_good(pktbuf, true);
         }
@@ -348,6 +322,8 @@ int brcmf_proto_hdrpull(struct device *dev, int *ifidx,
         skb_pull(pktbuf, BDC_HEADER_LEN);
         skb_pull(pktbuf, h->data_offset << 2);
 
+        if (pktbuf->len == 0)
+                return -ENODATA;
         return 0;
 }
 
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
index f8b52e5b941a..4544342a0428 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
@@ -14,8 +14,6 @@
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
-
 #include <linux/kernel.h>
 #include <linux/string.h>
 #include <linux/netdevice.h>
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.h b/drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.h
index f2ab01cd7966..bc013cbe06f6 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.h
@@ -18,21 +18,26 @@
 #define _BRCMF_DBG_H_
 
 /* message levels */
-#define BRCMF_TRACE_VAL 0x0002
-#define BRCMF_INFO_VAL  0x0004
-#define BRCMF_DATA_VAL  0x0008
-#define BRCMF_CTL_VAL   0x0010
-#define BRCMF_TIMER_VAL 0x0020
-#define BRCMF_HDRS_VAL  0x0040
-#define BRCMF_BYTES_VAL 0x0080
-#define BRCMF_INTR_VAL  0x0100
-#define BRCMF_GLOM_VAL  0x0200
-#define BRCMF_EVENT_VAL 0x0400
-#define BRCMF_BTA_VAL   0x0800
-#define BRCMF_FIL_VAL   0x1000
-#define BRCMF_USB_VAL   0x2000
-#define BRCMF_SCAN_VAL  0x4000
-#define BRCMF_CONN_VAL  0x8000
+#define BRCMF_TRACE_VAL 0x00000002
+#define BRCMF_INFO_VAL  0x00000004
+#define BRCMF_DATA_VAL  0x00000008
+#define BRCMF_CTL_VAL   0x00000010
+#define BRCMF_TIMER_VAL 0x00000020
+#define BRCMF_HDRS_VAL  0x00000040
+#define BRCMF_BYTES_VAL 0x00000080
+#define BRCMF_INTR_VAL  0x00000100
+#define BRCMF_GLOM_VAL  0x00000200
+#define BRCMF_EVENT_VAL 0x00000400
+#define BRCMF_BTA_VAL   0x00000800
+#define BRCMF_FIL_VAL   0x00001000
+#define BRCMF_USB_VAL   0x00002000
+#define BRCMF_SCAN_VAL  0x00004000
+#define BRCMF_CONN_VAL  0x00008000
+#define BRCMF_CDC_VAL   0x00010000
+
+/* set default print format */
+#undef pr_fmt
+#define pr_fmt(fmt)             KBUILD_MODNAME ": " fmt
 
 /* Macro for error messages. net_ratelimit() is used when driver
  * debugging is not selected. When debugging the driver error
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
index 74a616b4de8e..e3326a58bdb1 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
@@ -14,8 +14,6 @@
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
-
 #include <linux/kernel.h>
 #include <linux/etherdevice.h>
 #include <linux/module.h>
@@ -162,28 +160,31 @@ static void brcmf_netdev_set_multicast_list(struct net_device *ndev)
         schedule_work(&ifp->multicast_work);
 }
 
-static int brcmf_netdev_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb,
+                                           struct net_device *ndev)
 {
         int ret;
         struct brcmf_if *ifp = netdev_priv(ndev);
         struct brcmf_pub *drvr = ifp->drvr;
+        struct ethhdr *eh;
 
         brcmf_dbg(TRACE, "Enter\n");
 
-        /* Reject if down */
-        if (!drvr->bus_if->drvr_up ||
-            (drvr->bus_if->state != BRCMF_BUS_DATA)) {
-                brcmf_err("xmit rejected drvup=%d state=%d\n",
-                          drvr->bus_if->drvr_up,
-                          drvr->bus_if->state);
+        /* Can the device send data? */
+        if (drvr->bus_if->state != BRCMF_BUS_DATA) {
+                brcmf_err("xmit rejected state=%d\n", drvr->bus_if->state);
                 netif_stop_queue(ndev);
-                return -ENODEV;
+                dev_kfree_skb(skb);
+                ret = -ENODEV;
+                goto done;
         }
 
         if (!drvr->iflist[ifp->idx]) {
                 brcmf_err("bad ifidx %d\n", ifp->idx);
                 netif_stop_queue(ndev);
-                return -ENODEV;
+                dev_kfree_skb(skb);
+                ret = -ENODEV;
+                goto done;
         }
 
         /* Make sure there's enough room for any header */
@@ -204,17 +205,20 @@ static int brcmf_netdev_start_xmit(struct sk_buff *skb, struct net_device *ndev)
                 }
         }
 
-        /* Update multicast statistic */
-        if (skb->len >= ETH_ALEN) {
-                u8 *pktdata = (u8 *)(skb->data);
-                struct ethhdr *eh = (struct ethhdr *)pktdata;
-
-                if (is_multicast_ether_addr(eh->h_dest))
-                        drvr->tx_multicast++;
-                if (ntohs(eh->h_proto) == ETH_P_PAE)
-                        atomic_inc(&drvr->pend_8021x_cnt);
+        /* validate length for ether packet */
+        if (skb->len < sizeof(*eh)) {
+                ret = -EINVAL;
+                dev_kfree_skb(skb);
+                goto done;
         }
 
+        /* handle ethernet header */
+        eh = (struct ethhdr *)(skb->data);
+        if (is_multicast_ether_addr(eh->h_dest))
+                drvr->tx_multicast++;
+        if (ntohs(eh->h_proto) == ETH_P_PAE)
+                atomic_inc(&drvr->pend_8021x_cnt);
+
         /* If the protocol uses a data header, apply it */
         brcmf_proto_hdrpush(drvr, ifp->idx, skb);
 
@@ -228,7 +232,7 @@ done:
                 drvr->bus_if->dstats.tx_packets++;
 
         /* Return ok: we always eat the packet */
-        return 0;
+        return NETDEV_TX_OK;
 }
 
 void brcmf_txflowblock(struct device *dev, bool state)
@@ -250,8 +254,7 @@ void brcmf_txflowblock(struct device *dev, bool state)
                 }
 }
 
-void brcmf_rx_frame(struct device *dev, u8 ifidx,
-                    struct sk_buff_head *skb_list)
+void brcmf_rx_frames(struct device *dev, struct sk_buff_head *skb_list)
 {
         unsigned char *eth;
         uint len;
@@ -259,12 +262,24 @@ void brcmf_rx_frame(struct device *dev, u8 ifidx,
         struct brcmf_if *ifp;
         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
         struct brcmf_pub *drvr = bus_if->drvr;
+        u8 ifidx;
+        int ret;
 
         brcmf_dbg(TRACE, "Enter\n");
 
         skb_queue_walk_safe(skb_list, skb, pnext) {
                 skb_unlink(skb, skb_list);
 
+                /* process and remove protocol-specific header
+                 */
+                ret = brcmf_proto_hdrpull(drvr, &ifidx, skb);
+                if (ret < 0) {
+                        if (ret != -ENODATA)
+                                bus_if->dstats.rx_errors++;
+                        brcmu_pkt_buf_free_skb(skb);
+                        continue;
+                }
+
                 /* Get the protocol, maintain skb around eth_type_trans()
                  * The main reason for this hack is for the limitation of
                  * Linux 2.4 where 'eth_type_trans' uses the
@@ -328,13 +343,13 @@ void brcmf_rx_frame(struct device *dev, u8 ifidx,
 
 void brcmf_txcomplete(struct device *dev, struct sk_buff *txp, bool success)
 {
-        uint ifidx;
+        u8 ifidx;
         struct ethhdr *eh;
         u16 type;
         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
         struct brcmf_pub *drvr = bus_if->drvr;
 
-        brcmf_proto_hdrpull(dev, &ifidx, txp);
+        brcmf_proto_hdrpull(drvr, &ifidx, txp);
 
         eh = (struct ethhdr *)(txp->data);
         type = ntohs(eh->h_proto);
@@ -450,7 +465,7 @@ static int brcmf_ethtool(struct brcmf_if *ifp, void __user *uaddr)
                 sprintf(info.version, "%lu", drvr->drv_version);
                 if (copy_to_user(uaddr, &info, sizeof(info)))
                         return -EFAULT;
-                brcmf_dbg(CTL, "given %*s, returning %s\n",
+                brcmf_dbg(TRACE, "given %*s, returning %s\n",
                           (int)sizeof(drvname), drvname, info.driver);
                 break;
 
@@ -570,14 +585,9 @@ static int brcmf_netdev_open(struct net_device *ndev)
         /* Get current TOE mode from dongle */
         if (brcmf_fil_iovar_int_get(ifp, "toe_ol", &toe_ol) >= 0
             && (toe_ol & TOE_TX_CSUM_OL) != 0)
-                drvr->iflist[ifp->idx]->ndev->features |=
-                        NETIF_F_IP_CSUM;
+                ndev->features |= NETIF_F_IP_CSUM;
         else
-                drvr->iflist[ifp->idx]->ndev->features &=
-                        ~NETIF_F_IP_CSUM;
-
-        /* make sure RF is ready for work */
-        brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 0);
+                ndev->features &= ~NETIF_F_IP_CSUM;
 
         /* Allow transmit calls */
         netif_start_queue(ndev);
@@ -845,6 +855,17 @@ static void brcmf_bus_detach(struct brcmf_pub *drvr)
         }
 }
 
+void brcmf_dev_reset(struct device *dev)
+{
+        struct brcmf_bus *bus_if = dev_get_drvdata(dev);
+        struct brcmf_pub *drvr = bus_if->drvr;
+
+        if (drvr == NULL)
+                return;
+
+        brcmf_fil_cmd_int_set(drvr->iflist[0], BRCMF_C_TERMINATED, 1);
+}
+
 void brcmf_detach(struct device *dev)
 {
         int i;
@@ -866,9 +887,8 @@ void brcmf_detach(struct device *dev)
 
         brcmf_bus_detach(drvr);
 
-        if (drvr->prot) {
+        if (drvr->prot)
                 brcmf_proto_detach(drvr);
-        }
 
         brcmf_debugfs_detach(drvr);
         bus_if->drvr = NULL;
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
index cf857f1edf8c..7fef9b5ba003 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
@@ -14,8 +14,6 @@
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
-
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/kthread.h>
@@ -1169,7 +1167,6 @@ static u8 brcmf_sdbrcm_rxglom(struct brcmf_sdio *bus, u8 rxseq)
         int errcode;
         u8 doff, sfdoff;
 
-        int ifidx = 0;
         bool usechain = bus->use_rxchain;
 
         struct brcmf_sdio_read rd_new;
@@ -1388,13 +1385,6 @@ static u8 brcmf_sdbrcm_rxglom(struct brcmf_sdio *bus, u8 rxseq)
                                 skb_unlink(pfirst, &bus->glom);
                                 brcmu_pkt_buf_free_skb(pfirst);
                                 continue;
-                        } else if (brcmf_proto_hdrpull(bus->sdiodev->dev,
-                                                       &ifidx, pfirst) != 0) {
-                                brcmf_err("rx protocol error\n");
-                                bus->sdiodev->bus_if->dstats.rx_errors++;
-                                skb_unlink(pfirst, &bus->glom);
-                                brcmu_pkt_buf_free_skb(pfirst);
-                                continue;
                         }
 
                         brcmf_dbg_hex_dump(BRCMF_GLOM_ON(),
@@ -1407,7 +1397,7 @@ static u8 brcmf_sdbrcm_rxglom(struct brcmf_sdio *bus, u8 rxseq)
                 }
                 /* sent any remaining packets up */
                 if (bus->glom.qlen)
-                        brcmf_rx_frame(bus->sdiodev->dev, ifidx, &bus->glom);
+                        brcmf_rx_frames(bus->sdiodev->dev, &bus->glom);
 
                 bus->sdcnt.rxglomframes++;
                 bus->sdcnt.rxglompkts += bus->glom.qlen;
@@ -1558,10 +1548,10 @@ static void brcmf_pad(struct brcmf_sdio *bus, u16 *pad, u16 *rdlen)
 static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes)
 {
         struct sk_buff *pkt;            /* Packet for event or data frames */
+        struct sk_buff_head pktlist;    /* needed for bus interface */
         u16 pad;                /* Number of pad bytes to read */
         uint rxleft = 0;        /* Remaining number of frames allowed */
         int sdret;              /* Return code from calls */
-        int ifidx = 0;
         uint rxcount = 0;       /* Total frames read */
         struct brcmf_sdio_read *rd = &bus->cur_read, rd_new;
         u8 head_read = 0;
@@ -1760,15 +1750,11 @@ static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes)
                 if (pkt->len == 0) {
                         brcmu_pkt_buf_free_skb(pkt);
                         continue;
-                } else if (brcmf_proto_hdrpull(bus->sdiodev->dev, &ifidx,
-                           pkt) != 0) {
-                        brcmf_err("rx protocol error\n");
-                        brcmu_pkt_buf_free_skb(pkt);
-                        bus->sdiodev->bus_if->dstats.rx_errors++;
-                        continue;
                 }
 
-                brcmf_rx_packet(bus->sdiodev->dev, ifidx, pkt);
+                skb_queue_head_init(&pktlist);
+                skb_queue_tail(&pktlist, pkt);
+                brcmf_rx_frames(bus->sdiodev->dev, &pktlist);
         }
 
         rxcount = maxframes - rxleft;
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.c b/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.c
index b1bb46c49799..14be2d5530ce 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.c
@@ -15,8 +15,6 @@
  */
 /* ***** SDIO interface chip backplane handle functions ***** */
 
-#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
-
 #include <linux/types.h>
 #include <linux/netdevice.h>
 #include <linux/mmc/card.h>
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
index 914c56fe6c5f..e15630cc3889 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/usb.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
@@ -443,14 +443,15 @@ static void brcmf_usb_rx_complete(struct urb *urb)
         struct brcmf_usbreq  *req = (struct brcmf_usbreq *)urb->context;
         struct brcmf_usbdev_info *devinfo = req->devinfo;
         struct sk_buff *skb;
-        int ifidx = 0;
+        struct sk_buff_head skbq;
 
         brcmf_dbg(USB, "Enter, urb->status=%d\n", urb->status);
         brcmf_usb_del_fromq(devinfo, req);
         skb = req->skb;
         req->skb = NULL;
 
-        if (urb->status == 0) {
+        /* zero lenght packets indicate usb "failure". Do not refill */
+        if (urb->status == 0 && urb->actual_length) {
                 devinfo->bus_pub.bus->dstats.rx_packets++;
         } else {
                 devinfo->bus_pub.bus->dstats.rx_errors++;
@@ -460,13 +461,10 @@ static void brcmf_usb_rx_complete(struct urb *urb)
         }
 
         if (devinfo->bus_pub.state == BRCMFMAC_USB_STATE_UP) {
+                skb_queue_head_init(&skbq);
+                skb_queue_tail(&skbq, skb);
                 skb_put(skb, urb->actual_length);
-                if (brcmf_proto_hdrpull(devinfo->dev, &ifidx, skb) != 0) {
-                        brcmf_err("rx protocol error\n");
-                        brcmu_pkt_buf_free_skb(skb);
-                        devinfo->bus_pub.bus->dstats.rx_errors++;
-                } else
-                        brcmf_rx_packet(devinfo->dev, ifidx, skb);
+                brcmf_rx_frames(devinfo->dev, &skbq);
                 brcmf_usb_rx_refill(devinfo, req);
         } else {
                 brcmu_pkt_buf_free_skb(skb);
@@ -1520,10 +1518,23 @@ static void brcmf_release_fw(struct list_head *q)
         }
 }
 
+static int brcmf_usb_reset_device(struct device *dev, void *notused)
+{
+        /* device past is the usb interface so we
+         * need to use parent here.
+         */
+        brcmf_dev_reset(dev->parent);
+        return 0;
+}
 
 void brcmf_usb_exit(void)
 {
+        struct device_driver *drv = &brcmf_usbdrvr.drvwrap.driver;
+        int ret;
+
         brcmf_dbg(USB, "Enter\n");
+        ret = driver_for_each_device(drv, NULL, NULL,
+                                     brcmf_usb_reset_device);
         usb_deregister(&brcmf_usbdrvr);
         brcmf_release_fw(&fw_image_list);
 }
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
index 1261a9b84e04..62a528e8b958 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
@@ -16,8 +16,6 @@
 
 /* Toplevel file. Relies on dhd_linux.c to send commands to the dongle. */
 
-#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
-
 #include <linux/kernel.h>
 #include <linux/etherdevice.h>
 #include <net/cfg80211.h>
@@ -2011,67 +2009,6 @@ done:
         return err;
 }
 
-static s32
-brcmf_cfg80211_set_bitrate_mask(struct wiphy *wiphy, struct net_device *ndev,
-                             const u8 *addr,
-                             const struct cfg80211_bitrate_mask *mask)
-{
-        struct brcmf_if *ifp = netdev_priv(ndev);
-        struct brcm_rateset_le rateset_le;
-        s32 rate;
-        s32 val;
-        s32 err_bg;
-        s32 err_a;
-        u32 legacy;
-        s32 err = 0;
-
-        brcmf_dbg(TRACE, "Enter\n");
-        if (!check_vif_up(ifp->vif))
-                return -EIO;
-
-        /* addr param is always NULL. ignore it */
-        /* Get current rateset */
-        err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_CURR_RATESET,
-                                     &rateset_le, sizeof(rateset_le));
-        if (err) {
-                brcmf_err("could not get current rateset (%d)\n", err);
-                goto done;
-        }
-
-        legacy = ffs(mask->control[IEEE80211_BAND_2GHZ].legacy & 0xFFFF);
-        if (!legacy)
-                legacy = ffs(mask->control[IEEE80211_BAND_5GHZ].legacy &
-                             0xFFFF);
-
-        val = wl_g_rates[legacy - 1].bitrate * 100000;
-
-        if (val < le32_to_cpu(rateset_le.count))
-                /* Select rate by rateset index */
-                rate = rateset_le.rates[val] & 0x7f;
-        else
-                /* Specified rate in bps */
-                rate = val / 500000;
-
-        brcmf_dbg(CONN, "rate %d mbps\n", rate / 2);
-
-        /*
-         *
-         *      Set rate override,
-         *      Since the is a/b/g-blind, both a/bg_rate are enforced.
-         */
-        err_bg = brcmf_fil_iovar_int_set(ifp, "bg_rate", rate);
-        err_a = brcmf_fil_iovar_int_set(ifp, "a_rate", rate);
-        if (err_bg && err_a) {
-                brcmf_err("could not set fixed rate (%d) (%d)\n", err_bg,
-                          err_a);
-                err = err_bg | err_a;
-        }
-
-done:
-        brcmf_dbg(TRACE, "Exit\n");
-        return err;
-}
-
 static s32 brcmf_inform_single_bss(struct brcmf_cfg80211_info *cfg,
                                    struct brcmf_bss_info_le *bi)
 {
@@ -3091,10 +3028,11 @@ brcmf_configure_wpaie(struct net_device *ndev, struct brcmf_vs_tlv *wpa_ie,
 
         len = wpa_ie->len + TLV_HDR_LEN;
         data = (u8 *)wpa_ie;
-        offset = 0;
+        offset = TLV_HDR_LEN;
         if (!is_rsn_ie)
                 offset += VS_IE_FIXED_HDR_LEN;
-        offset += WPA_IE_VERSION_LEN;
+        else
+                offset += WPA_IE_VERSION_LEN;
 
         /* check for multicast cipher suite */
         if (offset + WPA_IE_MIN_OUI_LEN > len) {
@@ -3703,7 +3641,6 @@ static struct cfg80211_ops wl_cfg80211_ops = {
         .set_default_key = brcmf_cfg80211_config_default_key,
         .set_default_mgmt_key = brcmf_cfg80211_config_default_mgmt_key,
         .set_power_mgmt = brcmf_cfg80211_set_power_mgmt,
-        .set_bitrate_mask = brcmf_cfg80211_set_bitrate_mask,
         .connect = brcmf_cfg80211_connect,
         .disconnect = brcmf_cfg80211_disconnect,
         .suspend = brcmf_cfg80211_suspend,
@@ -4329,9 +4266,8 @@ void brcmf_cfg80211_detach(struct brcmf_cfg80211_info *cfg)
 }
 
 static s32
-brcmf_dongle_roam(struct net_device *ndev, u32 roamvar, u32 bcn_timeout)
+brcmf_dongle_roam(struct brcmf_if *ifp, u32 roamvar, u32 bcn_timeout)
 {
-        struct brcmf_if *ifp = netdev_priv(ndev);
         s32 err = 0;
         __le32 roamtrigger[2];
         __le32 roam_delta[2];
@@ -4382,10 +4318,9 @@ dongle_rom_out:
 }
 
 static s32
-brcmf_dongle_scantime(struct net_device *ndev, s32 scan_assoc_time,
+brcmf_dongle_scantime(struct brcmf_if *ifp, s32 scan_assoc_time,
                       s32 scan_unassoc_time, s32 scan_passive_time)
 {
-        struct brcmf_if *ifp = netdev_priv(ndev);
         s32 err = 0;
 
         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_CHANNEL_TIME,
@@ -4455,6 +4390,7 @@ static s32 brcmf_config_dongle(struct brcmf_cfg80211_info *cfg)
 {
         struct net_device *ndev;
         struct wireless_dev *wdev;
+        struct brcmf_if *ifp;
         s32 power_mode;
         s32 err = 0;
 
@@ -4463,35 +4399,34 @@ static s32 brcmf_config_dongle(struct brcmf_cfg80211_info *cfg)
 
         ndev = cfg_to_ndev(cfg);
         wdev = ndev->ieee80211_ptr;
+        ifp = netdev_priv(ndev);
 
-        brcmf_dongle_scantime(ndev, WL_SCAN_CHANNEL_TIME,
-                        WL_SCAN_UNASSOC_TIME, WL_SCAN_PASSIVE_TIME);
+        /* make sure RF is ready for work */
+        brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 0);
+
+        brcmf_dongle_scantime(ifp, WL_SCAN_CHANNEL_TIME,
+                              WL_SCAN_UNASSOC_TIME, WL_SCAN_PASSIVE_TIME);
 
         power_mode = cfg->pwr_save ? PM_FAST : PM_OFF;
-        err = brcmf_fil_cmd_int_set(netdev_priv(ndev), BRCMF_C_SET_PM,
-                                    power_mode);
+        err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, power_mode);
         if (err)
                 goto default_conf_out;
         brcmf_dbg(INFO, "power save set to %s\n",
                   (power_mode ? "enabled" : "disabled"));
 
-        err = brcmf_dongle_roam(ndev, (cfg->roam_on ? 0 : 1),
-                                WL_BEACON_TIMEOUT);
+        err = brcmf_dongle_roam(ifp, (cfg->roam_on ? 0 : 1), WL_BEACON_TIMEOUT);
         if (err)
                 goto default_conf_out;
         err = brcmf_cfg80211_change_iface(wdev->wiphy, ndev, wdev->iftype,
                                           NULL, NULL);
-        if (err && err != -EINPROGRESS)
+        if (err)
                 goto default_conf_out;
         err = brcmf_dongle_probecap(cfg);
         if (err)
                 goto default_conf_out;
 
-        /* -EINPROGRESS: Call commit handler */
-
-default_conf_out:
-
         cfg->dongle_up = true;
+default_conf_out:
 
         return err;
 
@@ -4500,8 +4435,6 @@ default_conf_out:
 static s32 __brcmf_cfg80211_up(struct brcmf_if *ifp)
 {
         set_bit(BRCMF_VIF_STATUS_READY, &ifp->vif->sme_state);
-        if (ifp->idx)
-                return 0;
 
         return brcmf_config_dongle(ifp->drvr->config);
 }
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c b/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c
index 1de94f30564f..1585cc5bf866 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c
@@ -961,7 +961,6 @@ brcms_c_ampdu_dotxstatus_complete(struct ampdu_info *ampdu, struct scb *scb,
                         /* if acked then clear bit and free packet */
                         if ((bindex < AMPDU_TX_BA_MAX_WSIZE)
                             && isset(bitmap, bindex)) {
-                                ini->tx_in_transit--;
                                 ini->txretry[index] = 0;
 
                                 /*
@@ -990,7 +989,6 @@ brcms_c_ampdu_dotxstatus_complete(struct ampdu_info *ampdu, struct scb *scb,
                         if (retry && (ini->txretry[index] < (int)retry_limit)) {
                                 int ret;
                                 ini->txretry[index]++;
-                                ini->tx_in_transit--;
                                 ret = brcms_c_txfifo(wlc, queue, p);
                                 /*
                                  * We shouldn't be out of space in the DMA
@@ -1000,7 +998,6 @@ brcms_c_ampdu_dotxstatus_complete(struct ampdu_info *ampdu, struct scb *scb,
                                 WARN_ONCE(ret, "queue %d out of txds\n", queue);
                         } else {
                                 /* Retry timeout */
-                                ini->tx_in_transit--;
                                 ieee80211_tx_info_clear_status(tx_info);
                                 tx_info->status.ampdu_ack_len = 0;
                                 tx_info->status.ampdu_len = 1;
@@ -1009,8 +1006,8 @@ brcms_c_ampdu_dotxstatus_complete(struct ampdu_info *ampdu, struct scb *scb,
                                 skb_pull(p, D11_PHY_HDR_LEN);
                                 skb_pull(p, D11_TXH_LEN);
                                 brcms_dbg_ht(wlc->hw->d11core,
-                                             "BA Timeout, seq %d, in_transit %d\n",
-                                             seq, ini->tx_in_transit);
+                                             "BA Timeout, seq %d\n",
+                                             seq);
                                 ieee80211_tx_status_irqsafe(wlc->pub->ieee_hw,
                                                             p);
                         }
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/channel.c b/drivers/net/wireless/brcm80211/brcmsmac/channel.c
index a90b72202ec5..cdb62b8ccc79 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/channel.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/channel.c
@@ -670,7 +670,7 @@ brcms_reg_apply_beaconing_flags(struct wiphy *wiphy,
         struct ieee80211_supported_band *sband;
         struct ieee80211_channel *ch;
         const struct ieee80211_reg_rule *rule;
-        int band, i, ret;
+        int band, i;
 
         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
                 sband = wiphy->bands[band];
@@ -685,9 +685,8 @@ brcms_reg_apply_beaconing_flags(struct wiphy *wiphy,
                                 continue;
 
                         if (initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE) {
-                                ret = freq_reg_info(wiphy, ch->center_freq,
-                                                    0, &rule);
-                                if (ret)
+                                rule = freq_reg_info(wiphy, ch->center_freq);
+                                if (IS_ERR(rule))
                                         continue;
 
                                 if (!(rule->flags & NL80211_RRF_NO_IBSS))
@@ -703,8 +702,8 @@ brcms_reg_apply_beaconing_flags(struct wiphy *wiphy,
         }
 }
 
-static int brcms_reg_notifier(struct wiphy *wiphy,
-                              struct regulatory_request *request)
+static void brcms_reg_notifier(struct wiphy *wiphy,
+                               struct regulatory_request *request)
 {
         struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
         struct brcms_info *wl = hw->priv;
@@ -745,8 +744,6 @@ static int brcms_reg_notifier(struct wiphy *wiphy,
         if (wlc->pub->_nbands > 1 || wlc->band->bandtype == BRCM_BAND_2G)
                 wlc_phy_chanspec_ch14_widefilter_set(wlc->band->pi,
                                         brcms_c_japan_ccode(request->alpha2));
-
-        return 0;
 }
 
 void brcms_c_regd_init(struct brcms_c_info *wlc)
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/debug.h b/drivers/net/wireless/brcm80211/brcmsmac/debug.h
index 796836b0f469..822781cf15d4 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/debug.h
+++ b/drivers/net/wireless/brcm80211/brcmsmac/debug.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2012 Broadcom Corporation
+ * Copyright (c) 2012 Canonical Ltd.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
index 1fbd8ecbe2ea..b1dd5600fd02 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
@@ -362,8 +362,11 @@ brcms_ops_add_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
                 return -EOPNOTSUPP;
         }
 
+        spin_lock_bh(&wl->lock);
+        memcpy(wl->pub->cur_etheraddr, vif->addr, sizeof(vif->addr));
         wl->mute_tx = false;
         brcms_c_mute(wl->wlc, false);
+        spin_unlock_bh(&wl->lock);
 
         return 0;
 }
@@ -539,9 +542,8 @@ brcms_ops_bss_info_changed(struct ieee80211_hw *hw,
 
         if (changed & BSS_CHANGED_ARP_FILTER) {
                 /* Hardware ARP filter address list or state changed */
-                brcms_err(core, "%s: arp filtering: enabled %s, count %d"
-                          " (implement)\n", __func__, info->arp_filter_enabled ?
-                          "true" : "false", info->arp_addr_cnt);
+                brcms_err(core, "%s: arp filtering: %d addresses"
+                          " (implement)\n", __func__, info->arp_addr_cnt);
         }
 
         if (changed & BSS_CHANGED_QOS) {
@@ -668,7 +670,9 @@ brcms_ops_ampdu_action(struct ieee80211_hw *hw,
                 ieee80211_start_tx_ba_cb_irqsafe(vif, sta->addr, tid);
                 break;
 
-        case IEEE80211_AMPDU_TX_STOP:
+        case IEEE80211_AMPDU_TX_STOP_CONT:
+        case IEEE80211_AMPDU_TX_STOP_FLUSH:
+        case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
                 spin_lock_bh(&wl->lock);
                 brcms_c_ampdu_flush(wl->wlc, sta, tid);
                 spin_unlock_bh(&wl->lock);
@@ -1407,9 +1411,10 @@ void brcms_add_timer(struct brcms_timer *t, uint ms, int periodic)
 #endif
         t->ms = ms;
         t->periodic = (bool) periodic;
-        t->set = true;
-
-        atomic_inc(&t->wl->callbacks);
+        if (!t->set) {
+                t->set = true;
+                atomic_inc(&t->wl->callbacks);
+        }
 
         ieee80211_queue_delayed_work(hw, &t->dly_wrk, msecs_to_jiffies(ms));
 }
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.c b/drivers/net/wireless/brcm80211/brcmsmac/main.c
index 17594de4199e..c26992a60e6c 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
@@ -2473,6 +2473,7 @@ static void brcms_b_tx_fifo_resume(struct brcms_hardware *wlc_hw,
 static void brcms_b_mute(struct brcms_hardware *wlc_hw, bool mute_tx)
 {
         static const u8 null_ether_addr[ETH_ALEN] = {0, 0, 0, 0, 0, 0};
+        u8 *ethaddr = wlc_hw->wlc->pub->cur_etheraddr;
 
         if (mute_tx) {
                 /* suspend tx fifos */
@@ -2482,8 +2483,7 @@ static void brcms_b_mute(struct brcms_hardware *wlc_hw, bool mute_tx)
                 brcms_b_tx_fifo_suspend(wlc_hw, TX_AC_VI_FIFO);
 
                 /* zero the address match register so we do not send ACKs */
-                brcms_b_set_addrmatch(wlc_hw, RCM_MAC_OFFSET,
-                                       null_ether_addr);
+                brcms_b_set_addrmatch(wlc_hw, RCM_MAC_OFFSET, null_ether_addr);
         } else {
                 /* resume tx fifos */
                 brcms_b_tx_fifo_resume(wlc_hw, TX_DATA_FIFO);
@@ -2492,8 +2492,7 @@ static void brcms_b_mute(struct brcms_hardware *wlc_hw, bool mute_tx)
                 brcms_b_tx_fifo_resume(wlc_hw, TX_AC_VI_FIFO);
 
                 /* Restore address */
-                brcms_b_set_addrmatch(wlc_hw, RCM_MAC_OFFSET,
-                                       wlc_hw->etheraddr);
+                brcms_b_set_addrmatch(wlc_hw, RCM_MAC_OFFSET, ethaddr);
         }
 
         wlc_phy_mute_upd(wlc_hw->band->pi, mute_tx, 0);
@@ -7633,7 +7632,7 @@ brcms_b_recv(struct brcms_hardware *wlc_hw, uint fifo, bool bound)
 
         uint n = 0;
         uint bound_limit = bound ? RXBND : -1;
-        bool morepending;
+        bool morepending = false;
 
         skb_queue_head_init(&recv_frames);
 
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c
index 606b534347bc..21a824232478 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c
@@ -1343,13 +1343,13 @@ static bool wlc_lcnphy_rx_iq_cal_gain(struct brcms_phy *pi, u16 biq1_gain,
 
         wlc_lcnphy_rx_gain_override_enable(pi, true);
         wlc_lcnphy_start_tx_tone(pi, 2000, (40 >> 1), 0);
-        usleep_range(500, 500);
+        udelay(500);
         write_radio_reg(pi, RADIO_2064_REG112, 0);
         if (!wlc_lcnphy_rx_iq_est(pi, 1024, 32, &iq_est_l))
                 return false;
 
         wlc_lcnphy_start_tx_tone(pi, 2000, 40, 0);
-        usleep_range(500, 500);
+        udelay(500);
         write_radio_reg(pi, RADIO_2064_REG112, 0);
         if (!wlc_lcnphy_rx_iq_est(pi, 1024, 32, &iq_est_h))
                 return false;
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/scb.h b/drivers/net/wireless/brcm80211/brcmsmac/scb.h
index 51c79c7239b7..3a3d73699f83 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/scb.h
+++ b/drivers/net/wireless/brcm80211/brcmsmac/scb.h
@@ -36,7 +36,6 @@
 
 /* structure to store per-tid state for the ampdu initiator */
 struct scb_ampdu_tid_ini {
-        u8 tx_in_transit; /* number of pending mpdus in transit in driver */
         u8 tid;           /* initiator tid for easy lookup */
         /* tx retry count; indexed by seq modulo */
         u8 txretry[AMPDU_TX_BA_MAX_WSIZE];
diff --git a/drivers/net/wireless/iwlegacy/3945-mac.c b/drivers/net/wireless/iwlegacy/3945-mac.c
index d604b4036a76..050ce7c70d74 100644
--- a/drivers/net/wireless/iwlegacy/3945-mac.c
+++ b/drivers/net/wireless/iwlegacy/3945-mac.c
@@ -3273,7 +3273,7 @@ il3945_store_measurement(struct device *d, struct device_attribute *attr,
 
         if (count) {
                 char *p = buffer;
-                strncpy(buffer, buf, min(sizeof(buffer), count));
+                strlcpy(buffer, buf, sizeof(buffer));
                 channel = simple_strtoul(p, NULL, 0);
                 if (channel)
                         params.channel = channel;
@@ -3474,6 +3474,7 @@ struct ieee80211_ops il3945_mac_ops = {
         .sta_add = il3945_mac_sta_add,
         .sta_remove = il_mac_sta_remove,
         .tx_last_beacon = il_mac_tx_last_beacon,
+        .flush = il_mac_flush,
 };
 
 static int
@@ -3548,7 +3549,8 @@ il3945_setup_mac(struct il_priv *il)
         hw->vif_data_size = sizeof(struct il_vif_priv);
 
         /* Tell mac80211 our characteristics */
-        hw->flags = IEEE80211_HW_SIGNAL_DBM | IEEE80211_HW_SPECTRUM_MGMT;
+        hw->flags = IEEE80211_HW_SIGNAL_DBM | IEEE80211_HW_SPECTRUM_MGMT |
+                    IEEE80211_HW_SUPPORTS_PS | IEEE80211_HW_SUPPORTS_DYNAMIC_PS;
 
         hw->wiphy->interface_modes =
             BIT(NL80211_IFTYPE_STATION) | BIT(NL80211_IFTYPE_ADHOC);
@@ -3557,6 +3559,8 @@ il3945_setup_mac(struct il_priv *il)
             WIPHY_FLAG_CUSTOM_REGULATORY | WIPHY_FLAG_DISABLE_BEACON_HINTS |
             WIPHY_FLAG_IBSS_RSN;
 
+        hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
+
         hw->wiphy->max_scan_ssids = PROBE_OPTION_MAX_3945;
         /* we create the 802.11 header and a zero-length SSID element */
         hw->wiphy->max_scan_ie_len = IL3945_MAX_PROBE_REQUEST - 24 - 2;
diff --git a/drivers/net/wireless/iwlegacy/4965-mac.c b/drivers/net/wireless/iwlegacy/4965-mac.c
index c3fbf6717564..d665a3d9f08f 100644
--- a/drivers/net/wireless/iwlegacy/4965-mac.c
+++ b/drivers/net/wireless/iwlegacy/4965-mac.c
@@ -5712,8 +5712,8 @@ il4965_mac_setup_register(struct il_priv *il, u32 max_probe_length)
         hw->flags =
             IEEE80211_HW_SIGNAL_DBM | IEEE80211_HW_AMPDU_AGGREGATION |
             IEEE80211_HW_NEED_DTIM_PERIOD | IEEE80211_HW_SPECTRUM_MGMT |
-            IEEE80211_HW_REPORTS_TX_ACK_STATUS;
-
+            IEEE80211_HW_REPORTS_TX_ACK_STATUS | IEEE80211_HW_SUPPORTS_PS |
+            IEEE80211_HW_SUPPORTS_DYNAMIC_PS;
         if (il->cfg->sku & IL_SKU_N)
                 hw->flags |=
                     IEEE80211_HW_SUPPORTS_DYNAMIC_SMPS |
@@ -5968,7 +5968,9 @@ il4965_mac_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                 D_HT("start Tx\n");
                 ret = il4965_tx_agg_start(il, vif, sta, tid, ssn);
                 break;
-        case IEEE80211_AMPDU_TX_STOP:
+        case IEEE80211_AMPDU_TX_STOP_CONT:
+        case IEEE80211_AMPDU_TX_STOP_FLUSH:
+        case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
                 D_HT("stop Tx\n");
                 ret = il4965_tx_agg_stop(il, vif, sta, tid);
                 if (test_bit(S_EXIT_PENDING, &il->status))
@@ -6306,6 +6308,7 @@ const struct ieee80211_ops il4965_mac_ops = {
         .sta_remove = il_mac_sta_remove,
         .channel_switch = il4965_mac_channel_switch,
         .tx_last_beacon = il_mac_tx_last_beacon,
+        .flush = il_mac_flush,
 };
 
 static int
@@ -6553,6 +6556,7 @@ il4965_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         il4965_prepare_card_hw(il);
         if (!il->hw_ready) {
                 IL_WARN("Failed, HW not ready\n");
+                err = -EIO;
                 goto out_iounmap;
         }
 
@@ -6569,9 +6573,6 @@ il4965_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (err)
                 goto out_free_eeprom;
 
-        if (err)
-                goto out_free_eeprom;
-
         /* extract MAC Address */
         il4965_eeprom_get_mac(il, il->addresses[0].addr);
         D_INFO("MAC address: %pM\n", il->addresses[0].addr);
diff --git a/drivers/net/wireless/iwlegacy/4965.c b/drivers/net/wireless/iwlegacy/4965.c
index 5db11714e047..91eb2d07fdb8 100644
--- a/drivers/net/wireless/iwlegacy/4965.c
+++ b/drivers/net/wireless/iwlegacy/4965.c
@@ -1748,7 +1748,6 @@ static void
 il4965_post_associate(struct il_priv *il)
 {
         struct ieee80211_vif *vif = il->vif;
-        struct ieee80211_conf *conf = NULL;
         int ret = 0;
 
         if (!vif || !il->is_open)
@@ -1759,8 +1758,6 @@ il4965_post_associate(struct il_priv *il)
 
         il_scan_cancel_timeout(il, 200);
 
-        conf = &il->hw->conf;
-
         il->staging.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
         il_commit_rxon(il);
 
diff --git a/drivers/net/wireless/iwlegacy/commands.h b/drivers/net/wireless/iwlegacy/commands.h
index 25dd7d28d022..829d3b9aaa17 100644
--- a/drivers/net/wireless/iwlegacy/commands.h
+++ b/drivers/net/wireless/iwlegacy/commands.h
@@ -1134,7 +1134,7 @@ struct il_wep_cmd {
 #define RX_RES_PHY_FLAGS_MOD_CCK_MSK            cpu_to_le16(1 << 1)
 #define RX_RES_PHY_FLAGS_SHORT_PREAMBLE_MSK     cpu_to_le16(1 << 2)
 #define RX_RES_PHY_FLAGS_NARROW_BAND_MSK        cpu_to_le16(1 << 3)
-#define RX_RES_PHY_FLAGS_ANTENNA_MSK            0xf0
+#define RX_RES_PHY_FLAGS_ANTENNA_MSK            0x70
 #define RX_RES_PHY_FLAGS_ANTENNA_POS            4
 
 #define RX_RES_STATUS_SEC_TYPE_MSK      (0x7 << 8)
diff --git a/drivers/net/wireless/iwlegacy/common.c b/drivers/net/wireless/iwlegacy/common.c
index 7e16d10a7f14..1f598604a79c 100644
--- a/drivers/net/wireless/iwlegacy/common.c
+++ b/drivers/net/wireless/iwlegacy/common.c
@@ -3958,17 +3958,21 @@ il_connection_init_rx_config(struct il_priv *il)
 
         memset(&il->staging, 0, sizeof(il->staging));
 
-        if (!il->vif) {
+        switch (il->iw_mode) {
+        case NL80211_IFTYPE_UNSPECIFIED:
                 il->staging.dev_type = RXON_DEV_TYPE_ESS;
-        } else if (il->vif->type == NL80211_IFTYPE_STATION) {
+                break;
+        case NL80211_IFTYPE_STATION:
                 il->staging.dev_type = RXON_DEV_TYPE_ESS;
                 il->staging.filter_flags = RXON_FILTER_ACCEPT_GRP_MSK;
-        } else if (il->vif->type == NL80211_IFTYPE_ADHOC) {
+                break;
+        case NL80211_IFTYPE_ADHOC:
                 il->staging.dev_type = RXON_DEV_TYPE_IBSS;
                 il->staging.flags = RXON_FLG_SHORT_PREAMBLE_MSK;
                 il->staging.filter_flags =
                     RXON_FILTER_BCON_AWARE_MSK | RXON_FILTER_ACCEPT_GRP_MSK;
-        } else {
+                break;
+        default:
                 IL_ERR("Unsupported interface type %d\n", il->vif->type);
                 return;
         }
@@ -4550,8 +4554,7 @@ out:
 EXPORT_SYMBOL(il_mac_add_interface);
 
 static void
-il_teardown_interface(struct il_priv *il, struct ieee80211_vif *vif,
-                      bool mode_change)
+il_teardown_interface(struct il_priv *il, struct ieee80211_vif *vif)
 {
         lockdep_assert_held(&il->mutex);
 
@@ -4560,9 +4563,7 @@ il_teardown_interface(struct il_priv *il, struct ieee80211_vif *vif,
                 il_force_scan_end(il);
         }
 
-        if (!mode_change)
-                il_set_mode(il);
-
+        il_set_mode(il);
 }
 
 void
@@ -4575,8 +4576,8 @@ il_mac_remove_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
 
         WARN_ON(il->vif != vif);
         il->vif = NULL;
-
-        il_teardown_interface(il, vif, false);
+        il->iw_mode = NL80211_IFTYPE_UNSPECIFIED;
+        il_teardown_interface(il, vif);
         memset(il->bssid, 0, ETH_ALEN);
 
         D_MAC80211("leave\n");
@@ -4685,18 +4686,10 @@ il_mac_change_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
         }
 
         /* success */
-        il_teardown_interface(il, vif, true);
         vif->type = newtype;
         vif->p2p = false;
-        err = il_set_mode(il);
-        WARN_ON(err);
-        /*
-         * We've switched internally, but submitting to the
-         * device may have failed for some reason. Mask this
-         * error, because otherwise mac80211 will not switch
-         * (and set the interface type back) and we'll be
-         * out of sync with it.
-         */
+        il->iw_mode = newtype;
+        il_teardown_interface(il, vif);
         err = 0;
 
 out:
@@ -4707,6 +4700,42 @@ out:
 }
 EXPORT_SYMBOL(il_mac_change_interface);
 
+void
+il_mac_flush(struct ieee80211_hw *hw, bool drop)
+{
+        struct il_priv *il = hw->priv;
+        unsigned long timeout = jiffies + msecs_to_jiffies(500);
+        int i;
+
+        mutex_lock(&il->mutex);
+        D_MAC80211("enter\n");
+
+        if (il->txq == NULL)
+                goto out;
+
+        for (i = 0; i < il->hw_params.max_txq_num; i++) {
+                struct il_queue *q;
+
+                if (i == il->cmd_queue)
+                        continue;
+
+                q = &il->txq[i].q;
+                if (q->read_ptr == q->write_ptr)
+                        continue;
+
+                if (time_after(jiffies, timeout)) {
+                        IL_ERR("Failed to flush queue %d\n", q->id);
+                        break;
+                }
+
+                msleep(20);
+        }
+out:
+        D_MAC80211("leave\n");
+        mutex_unlock(&il->mutex);
+}
+EXPORT_SYMBOL(il_mac_flush);
+
 /*
  * On every watchdog tick we check (latest) time stamp. If it does not
  * change during timeout period and queue is not empty we reset firmware.
diff --git a/drivers/net/wireless/iwlegacy/common.h b/drivers/net/wireless/iwlegacy/common.h
index a9a569f432fb..37fe553b25e0 100644
--- a/drivers/net/wireless/iwlegacy/common.h
+++ b/drivers/net/wireless/iwlegacy/common.h
@@ -1723,6 +1723,7 @@ void il_mac_remove_interface(struct ieee80211_hw *hw,
                              struct ieee80211_vif *vif);
 int il_mac_change_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                             enum nl80211_iftype newtype, bool newp2p);
+void il_mac_flush(struct ieee80211_hw *hw, bool drop);
 int il_alloc_txq_mem(struct il_priv *il);
 void il_free_txq_mem(struct il_priv *il);
 
diff --git a/drivers/net/wireless/iwlwifi/dvm/mac80211.c b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
index 293c7bf3f826..b55181275fd0 100644
--- a/drivers/net/wireless/iwlwifi/dvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
@@ -677,7 +677,9 @@ static int iwlagn_mac_ampdu_action(struct ieee80211_hw *hw,
                 IWL_DEBUG_HT(priv, "start Tx\n");
                 ret = iwlagn_tx_agg_start(priv, vif, sta, tid, ssn);
                 break;
-        case IEEE80211_AMPDU_TX_STOP:
+        case IEEE80211_AMPDU_TX_STOP_CONT:
+        case IEEE80211_AMPDU_TX_STOP_FLUSH:
+        case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
                 IWL_DEBUG_HT(priv, "stop Tx\n");
                 ret = iwlagn_tx_agg_stop(priv, vif, sta, tid);
                 if ((ret == 0) && (priv->agg_tids_count > 0)) {
@@ -1152,6 +1154,7 @@ static int iwlagn_mac_cancel_remain_on_channel(struct ieee80211_hw *hw)
 }
 
 static void iwlagn_mac_rssi_callback(struct ieee80211_hw *hw,
+                                     struct ieee80211_vif *vif,
                                      enum ieee80211_rssi_event rssi_event)
 {
         struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
diff --git a/drivers/net/wireless/iwlwifi/dvm/tx.c b/drivers/net/wireless/iwlwifi/dvm/tx.c
index 4bd42cdfdf55..7b0550d35a91 100644
--- a/drivers/net/wireless/iwlwifi/dvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/dvm/tx.c
@@ -1071,6 +1071,8 @@ static void iwlagn_set_tx_status(struct iwl_priv *priv,
 {
         u16 status = le16_to_cpu(tx_resp->status.status);
 
+        info->flags &= ~IEEE80211_TX_CTL_AMPDU;
+
         info->status.rates[0].count = tx_resp->failure_frame + 1;
         info->flags |= iwl_tx_status_to_mac80211(status);
         iwlagn_hwrate_to_tx_control(priv, le32_to_cpu(tx_resp->rate_n_flags),
@@ -1143,13 +1145,6 @@ int iwlagn_rx_reply_tx(struct iwl_priv *priv, struct iwl_rx_cmd_buffer *rxb,
                         next_reclaimed = ssn;
                 }
 
-                if (tid != IWL_TID_NON_QOS) {
-                        priv->tid_data[sta_id][tid].next_reclaimed =
-                                next_reclaimed;
-                        IWL_DEBUG_TX_REPLY(priv, "Next reclaimed packet:%d\n",
-                                                  next_reclaimed);
-                }
-
                 iwl_trans_reclaim(priv->trans, txq_id, ssn, &skbs);
 
                 iwlagn_check_ratid_empty(priv, sta_id, tid);
@@ -1200,11 +1195,28 @@ int iwlagn_rx_reply_tx(struct iwl_priv *priv, struct iwl_rx_cmd_buffer *rxb,
                         if (!is_agg)
                                 iwlagn_non_agg_tx_status(priv, ctx, hdr->addr1);
 
+                        /*
+                         * W/A for FW bug - the seq_ctl isn't updated when the
+                         * queues are flushed. Fetch it from the packet itself
+                         */
+                        if (!is_agg && status == TX_STATUS_FAIL_FIFO_FLUSHED) {
+                                next_reclaimed = le16_to_cpu(hdr->seq_ctrl);
+                                next_reclaimed =
+                                        SEQ_TO_SN(next_reclaimed + 0x10);
+                        }
+
                         is_offchannel_skb =
                                 (info->flags & IEEE80211_TX_CTL_TX_OFFCHAN);
                         freed++;
                 }
 
+                if (tid != IWL_TID_NON_QOS) {
+                        priv->tid_data[sta_id][tid].next_reclaimed =
+                                next_reclaimed;
+                        IWL_DEBUG_TX_REPLY(priv, "Next reclaimed packet:%d\n",
+                                           next_reclaimed);
+                }
+
                 if (!is_agg && freed != 1)
                         IWL_ERR(priv, "Q: %d, freed %d\n", txq_id, freed);
 
diff --git a/drivers/net/wireless/iwlwifi/pcie/rx.c b/drivers/net/wireless/iwlwifi/pcie/rx.c
index a2f351779941..a9ca1d35fa93 100644
--- a/drivers/net/wireless/iwlwifi/pcie/rx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/rx.c
@@ -1173,6 +1173,7 @@ static irqreturn_t iwl_pcie_isr(int irq, void *data)
         else if (test_bit(STATUS_INT_ENABLED, &trans_pcie->status) &&
                  !trans_pcie->inta)
                 iwl_enable_interrupts(trans);
+        return IRQ_HANDLED;
 
 none:
         /* re-enable interrupts here since we don't have anything to service. */
diff --git a/drivers/net/wireless/libertas/cfg.c b/drivers/net/wireless/libertas/cfg.c
index ec6d5d6b452e..230f8ebbe289 100644
--- a/drivers/net/wireless/libertas/cfg.c
+++ b/drivers/net/wireless/libertas/cfg.c
@@ -2132,6 +2132,21 @@ static void lbs_cfg_set_regulatory_hint(struct lbs_private *priv)
         lbs_deb_leave(LBS_DEB_CFG80211);
 }
 
+static void lbs_reg_notifier(struct wiphy *wiphy,
+                             struct regulatory_request *request)
+{
+        struct lbs_private *priv = wiphy_priv(wiphy);
+
+        lbs_deb_enter_args(LBS_DEB_CFG80211, "cfg80211 regulatory domain "
+                        "callback for domain %c%c\n", request->alpha2[0],
+                        request->alpha2[1]);
+
+        memcpy(priv->country_code, request->alpha2, sizeof(request->alpha2));
+        if (lbs_iface_active(priv))
+                lbs_set_11d_domain_info(priv);
+
+        lbs_deb_leave(LBS_DEB_CFG80211);
+}
 
 /*
  * This function get's called after lbs_setup_firmware() determined the
@@ -2184,24 +2199,6 @@ int lbs_cfg_register(struct lbs_private *priv)
         return ret;
 }
 
-int lbs_reg_notifier(struct wiphy *wiphy,
-                struct regulatory_request *request)
-{
-        struct lbs_private *priv = wiphy_priv(wiphy);
-        int ret = 0;
-
-        lbs_deb_enter_args(LBS_DEB_CFG80211, "cfg80211 regulatory domain "
-                        "callback for domain %c%c\n", request->alpha2[0],
-                        request->alpha2[1]);
-
-        memcpy(priv->country_code, request->alpha2, sizeof(request->alpha2));
-        if (lbs_iface_active(priv))
-                ret = lbs_set_11d_domain_info(priv);
-
-        lbs_deb_leave(LBS_DEB_CFG80211);
-        return ret;
-}
-
 void lbs_scan_deinit(struct lbs_private *priv)
 {
         lbs_deb_enter(LBS_DEB_CFG80211);
diff --git a/drivers/net/wireless/libertas/cfg.h b/drivers/net/wireless/libertas/cfg.h
index 558168ce634d..10995f59fe34 100644
--- a/drivers/net/wireless/libertas/cfg.h
+++ b/drivers/net/wireless/libertas/cfg.h
@@ -10,9 +10,6 @@ struct wireless_dev *lbs_cfg_alloc(struct device *dev);
 int lbs_cfg_register(struct lbs_private *priv);
 void lbs_cfg_free(struct lbs_private *priv);
 
-int lbs_reg_notifier(struct wiphy *wiphy,
-                struct regulatory_request *request);
-
 void lbs_send_disconnect_notification(struct lbs_private *priv);
 void lbs_send_mic_failureevent(struct lbs_private *priv, u32 event);
 
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index ff9085502bea..b73e497fe770 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -48,6 +48,10 @@ static int channels = 1;
 module_param(channels, int, 0444);
 MODULE_PARM_DESC(channels, "Number of concurrent channels");
 
+static bool paged_rx = false;
+module_param(paged_rx, bool, 0644);
+MODULE_PARM_DESC(paged_rx, "Use paged SKBs for RX instead of linear ones");
+
 /**
  * enum hwsim_regtest - the type of regulatory tests we offer
  *
@@ -333,11 +337,11 @@ struct mac80211_hwsim_data {
         int scan_chan_idx;
 
         struct ieee80211_channel *channel;
-        unsigned long beacon_int; /* in jiffies unit */
+        u64 beacon_int  /* beacon interval in us */;
         unsigned int rx_filter;
         bool started, idle, scanning;
         struct mutex mutex;
-        struct timer_list beacon_timer;
+        struct tasklet_hrtimer beacon_timer;
         enum ps_mode {
                 PS_DISABLED, PS_ENABLED, PS_AUTO_POLL, PS_MANUAL_POLL
         } ps;
@@ -357,7 +361,10 @@ struct mac80211_hwsim_data {
         int power_level;
 
         /* difference between this hw's clock and the real clock, in usecs */
-        u64 tsf_offset;
+        s64 tsf_offset;
+        s64 bcn_delta;
+        /* absolute beacon transmission time. Used to cover up "tx" delay. */
+        u64 abs_bcn_ts;
 };
 
 
@@ -405,15 +412,19 @@ static netdev_tx_t hwsim_mon_xmit(struct sk_buff *skb,
         return NETDEV_TX_OK;
 }
 
+static inline u64 mac80211_hwsim_get_tsf_raw(void)
+{
+        return ktime_to_us(ktime_get_real());
+}
+
 static __le64 __mac80211_hwsim_get_tsf(struct mac80211_hwsim_data *data)
 {
-        struct timeval tv = ktime_to_timeval(ktime_get_real());
-        u64 now = tv.tv_sec * USEC_PER_SEC + tv.tv_usec;
+        u64 now = mac80211_hwsim_get_tsf_raw();
         return cpu_to_le64(now + data->tsf_offset);
 }
 
 static u64 mac80211_hwsim_get_tsf(struct ieee80211_hw *hw,
-                struct ieee80211_vif *vif)
+                                  struct ieee80211_vif *vif)
 {
         struct mac80211_hwsim_data *data = hw->priv;
         return le64_to_cpu(__mac80211_hwsim_get_tsf(data));
@@ -423,9 +434,13 @@ static void mac80211_hwsim_set_tsf(struct ieee80211_hw *hw,
                 struct ieee80211_vif *vif, u64 tsf)
 {
         struct mac80211_hwsim_data *data = hw->priv;
-        struct timeval tv = ktime_to_timeval(ktime_get_real());
-        u64 now = tv.tv_sec * USEC_PER_SEC + tv.tv_usec;
-        data->tsf_offset = tsf - now;
+        u64 now = mac80211_hwsim_get_tsf(hw, vif);
+        u32 bcn_int = data->beacon_int;
+        s64 delta = tsf - now;
+
+        data->tsf_offset += delta;
+        /* adjust after beaconing with new timestamp at old TBTT */
+        data->bcn_delta = do_div(delta, bcn_int);
 }
 
 static void mac80211_hwsim_monitor_rx(struct ieee80211_hw *hw,
@@ -696,7 +711,7 @@ static bool mac80211_hwsim_tx_frame_no_nl(struct ieee80211_hw *hw,
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct ieee80211_rx_status rx_status;
-        struct ieee80211_rate *txrate = ieee80211_get_tx_rate(hw, info);
+        u64 now;
 
         memset(&rx_status, 0, sizeof(rx_status));
         rx_status.flag |= RX_FLAG_MACTIME_START;
@@ -722,11 +737,23 @@ static bool mac80211_hwsim_tx_frame_no_nl(struct ieee80211_hw *hw,
         secpath_reset(skb);
         nf_reset(skb);
 
+        /*
+         * Get absolute mactime here so all HWs RX at the "same time", and
+         * absolute TX time for beacon mactime so the timestamp matches.
+         * Giving beacons a different mactime than non-beacons looks messy, but
+         * it helps the Toffset be exact and a ~10us mactime discrepancy
+         * probably doesn't really matter.
+         */
+        if (ieee80211_is_beacon(hdr->frame_control) ||
+            ieee80211_is_probe_resp(hdr->frame_control))
+                now = data->abs_bcn_ts;
+        else
+                now = mac80211_hwsim_get_tsf_raw();
+
         /* Copy skb to all enabled radios that are on the current frequency */
         spin_lock(&hwsim_radio_lock);
         list_for_each_entry(data2, &hwsim_radios, list) {
                 struct sk_buff *nskb;
-                struct ieee80211_mgmt *mgmt;
                 struct tx_iter_data tx_iter_data = {
                         .receive = false,
                         .channel = chan,
@@ -755,24 +782,30 @@ static bool mac80211_hwsim_tx_frame_no_nl(struct ieee80211_hw *hw,
                  * reserve some space for our vendor and the normal
                  * radiotap header, since we're copying anyway
                  */
-                nskb = skb_copy_expand(skb, 64, 0, GFP_ATOMIC);
-                if (nskb == NULL)
-                        continue;
+                if (skb->len < PAGE_SIZE && paged_rx) {
+                        struct page *page = alloc_page(GFP_ATOMIC);
+
+                        if (!page)
+                                continue;
+
+                        nskb = dev_alloc_skb(128);
+                        if (!nskb) {
+                                __free_page(page);
+                                continue;
+                        }
+
+                        memcpy(page_address(page), skb->data, skb->len);
+                        skb_add_rx_frag(nskb, 0, page, 0, skb->len, skb->len);
+                } else {
+                        nskb = skb_copy(skb, GFP_ATOMIC);
+                        if (!nskb)
+                                continue;
+                }
 
                 if (mac80211_hwsim_addr_match(data2, hdr->addr1))
                         ack = true;
 
-                /* set bcn timestamp relative to receiver mactime */
-                rx_status.mactime =
-                                le64_to_cpu(__mac80211_hwsim_get_tsf(data2));
-                mgmt = (struct ieee80211_mgmt *) nskb->data;
-                if (ieee80211_is_beacon(mgmt->frame_control) ||
-                    ieee80211_is_probe_resp(mgmt->frame_control))
-                        mgmt->u.beacon.timestamp = cpu_to_le64(
-                                rx_status.mactime +
-                                (data->tsf_offset - data2->tsf_offset) +
-                                24 * 8 * 10 / txrate->bitrate);
-
+                rx_status.mactime = now + data2->tsf_offset;
 #if 0
                 /*
                  * Don't enable this code by default as the OUI 00:00:00
@@ -896,7 +929,7 @@ static void mac80211_hwsim_stop(struct ieee80211_hw *hw)
 {
         struct mac80211_hwsim_data *data = hw->priv;
         data->started = false;
-        del_timer(&data->beacon_timer);
+        tasklet_hrtimer_cancel(&data->beacon_timer);
         wiphy_debug(hw->wiphy, "%s\n", __func__);
 }
 
@@ -962,7 +995,11 @@ static void mac80211_hwsim_tx_frame(struct ieee80211_hw *hw,
 static void mac80211_hwsim_beacon_tx(void *arg, u8 *mac,
                                      struct ieee80211_vif *vif)
 {
-        struct ieee80211_hw *hw = arg;
+        struct mac80211_hwsim_data *data = arg;
+        struct ieee80211_hw *hw = data->hw;
+        struct ieee80211_tx_info *info;
+        struct ieee80211_rate *txrate;
+        struct ieee80211_mgmt *mgmt;
         struct sk_buff *skb;
 
         hwsim_check_magic(vif);
@@ -975,26 +1012,48 @@ static void mac80211_hwsim_beacon_tx(void *arg, u8 *mac,
         skb = ieee80211_beacon_get(hw, vif);
         if (skb == NULL)
                 return;
+        info = IEEE80211_SKB_CB(skb);
+        txrate = ieee80211_get_tx_rate(hw, info);
+
+        mgmt = (struct ieee80211_mgmt *) skb->data;
+        /* fake header transmission time */
+        data->abs_bcn_ts = mac80211_hwsim_get_tsf_raw();
+        mgmt->u.beacon.timestamp = cpu_to_le64(data->abs_bcn_ts +
+                                               data->tsf_offset +
+                                               24 * 8 * 10 / txrate->bitrate);
 
         mac80211_hwsim_tx_frame(hw, skb,
                                 rcu_dereference(vif->chanctx_conf)->def.chan);
 }
 
-
-static void mac80211_hwsim_beacon(unsigned long arg)
+static enum hrtimer_restart
+mac80211_hwsim_beacon(struct hrtimer *timer)
 {
-        struct ieee80211_hw *hw = (struct ieee80211_hw *) arg;
-        struct mac80211_hwsim_data *data = hw->priv;
+        struct mac80211_hwsim_data *data =
+                container_of(timer, struct mac80211_hwsim_data,
+                             beacon_timer.timer);
+        struct ieee80211_hw *hw = data->hw;
+        u64 bcn_int = data->beacon_int;
+        ktime_t next_bcn;
 
         if (!data->started)
-                return;
+                goto out;
 
         ieee80211_iterate_active_interfaces_atomic(
                 hw, IEEE80211_IFACE_ITER_NORMAL,
-                mac80211_hwsim_beacon_tx, hw);
+                mac80211_hwsim_beacon_tx, data);
+
+        /* beacon at new TBTT + beacon interval */
+        if (data->bcn_delta) {
+                bcn_int -= data->bcn_delta;
+                data->bcn_delta = 0;
+        }
 
-        data->beacon_timer.expires = jiffies + data->beacon_int;
-        add_timer(&data->beacon_timer);
+        next_bcn = ktime_add(hrtimer_get_expires(timer),
+                             ns_to_ktime(bcn_int * 1000));
+        tasklet_hrtimer_start(&data->beacon_timer, next_bcn, HRTIMER_MODE_ABS);
+out:
+        return HRTIMER_NORESTART;
 }
 
 static const char *hwsim_chantypes[] = {
@@ -1032,9 +1091,16 @@ static int mac80211_hwsim_config(struct ieee80211_hw *hw, u32 changed)
 
         data->power_level = conf->power_level;
         if (!data->started || !data->beacon_int)
-                del_timer(&data->beacon_timer);
-        else
-                mod_timer(&data->beacon_timer, jiffies + data->beacon_int);
+                tasklet_hrtimer_cancel(&data->beacon_timer);
+        else if (!hrtimer_is_queued(&data->beacon_timer.timer)) {
+                u64 tsf = mac80211_hwsim_get_tsf(hw, NULL);
+                u32 bcn_int = data->beacon_int;
+                u64 until_tbtt = bcn_int - do_div(tsf, bcn_int);
+
+                tasklet_hrtimer_start(&data->beacon_timer,
+                                      ns_to_ktime(until_tbtt * 1000),
+                                      HRTIMER_MODE_REL);
+        }
 
         return 0;
 }
@@ -1084,12 +1150,26 @@ static void mac80211_hwsim_bss_info_changed(struct ieee80211_hw *hw,
 
         if (changed & BSS_CHANGED_BEACON_INT) {
                 wiphy_debug(hw->wiphy, "  BCNINT: %d\n", info->beacon_int);
-                data->beacon_int = 1024 * info->beacon_int / 1000 * HZ / 1000;
-                if (WARN_ON(!data->beacon_int))
-                        data->beacon_int = 1;
-                if (data->started)
-                        mod_timer(&data->beacon_timer,
-                                  jiffies + data->beacon_int);
+                data->beacon_int = info->beacon_int * 1024;
+        }
+
+        if (changed & BSS_CHANGED_BEACON_ENABLED) {
+                wiphy_debug(hw->wiphy, "  BCN EN: %d\n", info->enable_beacon);
+                if (data->started &&
+                    !hrtimer_is_queued(&data->beacon_timer.timer) &&
+                    info->enable_beacon) {
+                        u64 tsf, until_tbtt;
+                        u32 bcn_int;
+                        if (WARN_ON(!data->beacon_int))
+                                data->beacon_int = 1000 * 1024;
+                        tsf = mac80211_hwsim_get_tsf(hw, vif);
+                        bcn_int = data->beacon_int;
+                        until_tbtt = bcn_int - do_div(tsf, bcn_int);
+                        tasklet_hrtimer_start(&data->beacon_timer,
+                                              ns_to_ktime(until_tbtt * 1000),
+                                              HRTIMER_MODE_REL);
+                } else if (!info->enable_beacon)
+                        tasklet_hrtimer_cancel(&data->beacon_timer);
         }
 
         if (changed & BSS_CHANGED_ERP_CTS_PROT) {
@@ -1292,7 +1372,9 @@ static int mac80211_hwsim_ampdu_action(struct ieee80211_hw *hw,
         case IEEE80211_AMPDU_TX_START:
                 ieee80211_start_tx_ba_cb_irqsafe(vif, sta->addr, tid);
                 break;
-        case IEEE80211_AMPDU_TX_STOP:
+        case IEEE80211_AMPDU_TX_STOP_CONT:
+        case IEEE80211_AMPDU_TX_STOP_FLUSH:
+        case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
                 ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
                 break;
         case IEEE80211_AMPDU_TX_OPERATIONAL:
@@ -2370,8 +2452,9 @@ static int __init init_mac80211_hwsim(void)
                                                         data->debugfs, data,
                                                         &hwsim_fops_group);
 
-                setup_timer(&data->beacon_timer, mac80211_hwsim_beacon,
-                            (unsigned long) hw);
+                tasklet_hrtimer_init(&data->beacon_timer,
+                                     mac80211_hwsim_beacon,
+                                     CLOCK_REALTIME, HRTIMER_MODE_ABS);
 
                 list_add_tail(&data->list, &hwsim_radios);
         }
diff --git a/drivers/net/wireless/mwifiex/11n.c b/drivers/net/wireless/mwifiex/11n.c
index 245a371f1a43..9cd6216c61e6 100644
--- a/drivers/net/wireless/mwifiex/11n.c
+++ b/drivers/net/wireless/mwifiex/11n.c
@@ -53,7 +53,9 @@ mwifiex_fill_cap_info(struct mwifiex_private *priv, u8 radio_type,
                sizeof(sband->ht_cap.mcs));
 
         if (priv->bss_mode == NL80211_IFTYPE_STATION ||
-            sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40)
+            (sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40 &&
+             (priv->adapter->sec_chan_offset !=
+                                        IEEE80211_HT_PARAM_CHA_SEC_NONE)))
                 /* Set MCS32 for infra mode or ad-hoc mode with 40MHz support */
                 SETHT_MCS32(ht_cap->ht_cap.mcs.rx_mask);
 
diff --git a/drivers/net/wireless/mwifiex/11n_aggr.c b/drivers/net/wireless/mwifiex/11n_aggr.c
index 68d52cfc1ebd..af8fe6352eed 100644
--- a/drivers/net/wireless/mwifiex/11n_aggr.c
+++ b/drivers/net/wireless/mwifiex/11n_aggr.c
@@ -278,14 +278,16 @@ mwifiex_11n_aggregate_pkt(struct mwifiex_private *priv,
                 dev_dbg(adapter->dev, "data: -EBUSY is returned\n");
                 break;
         case -1:
-                adapter->data_sent = false;
+                if (adapter->iface_type != MWIFIEX_PCIE)
+                        adapter->data_sent = false;
                 dev_err(adapter->dev, "%s: host_to_card failed: %#x\n",
                         __func__, ret);
                 adapter->dbg.num_tx_host_to_card_failure++;
                 mwifiex_write_data_complete(adapter, skb_aggr, 1, ret);
                 return 0;
         case -EINPROGRESS:
-                adapter->data_sent = false;
+                if (adapter->iface_type != MWIFIEX_PCIE)
+                        adapter->data_sent = false;
                 break;
         case 0:
                 mwifiex_write_data_complete(adapter, skb_aggr, 1, ret);
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index a875499f8945..3a004b85b99f 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -519,8 +519,8 @@ static int mwifiex_send_domain_info_cmd_fw(struct wiphy *wiphy)
  *      - Set by user
  *      - Set bt Country IE
  */
-static int mwifiex_reg_notifier(struct wiphy *wiphy,
-                                struct regulatory_request *request)
+static void mwifiex_reg_notifier(struct wiphy *wiphy,
+                                 struct regulatory_request *request)
 {
         struct mwifiex_adapter *adapter = mwifiex_cfg80211_get_adapter(wiphy);
 
@@ -540,8 +540,6 @@ static int mwifiex_reg_notifier(struct wiphy *wiphy,
                 break;
         }
         mwifiex_send_domain_info_cmd_fw(wiphy);
-
-        return 0;
 }
 
 /*
@@ -1327,6 +1325,7 @@ static int mwifiex_cfg80211_start_ap(struct wiphy *wiphy,
         }
 
         mwifiex_set_ht_params(priv, bss_cfg, params);
+        mwifiex_set_wmm_params(priv, bss_cfg, params);
 
         if (params->inactivity_timeout > 0) {
                 /* sta_ao_timer/ps_sta_ao_timer is in unit of 100ms */
@@ -1459,7 +1458,7 @@ mwifiex_cfg80211_assoc(struct mwifiex_private *priv, size_t ssid_len, u8 *ssid,
         struct cfg80211_ssid req_ssid;
         int ret, auth_type = 0;
         struct cfg80211_bss *bss = NULL;
-        u8 is_scanning_required = 0, config_bands = 0;
+        u8 is_scanning_required = 0;
 
         memset(&req_ssid, 0, sizeof(struct cfg80211_ssid));
 
@@ -1478,19 +1477,6 @@ mwifiex_cfg80211_assoc(struct mwifiex_private *priv, size_t ssid_len, u8 *ssid,
         /* disconnect before try to associate */
         mwifiex_deauthenticate(priv, NULL);
 
-        if (channel) {
-                if (mode == NL80211_IFTYPE_STATION) {
-                        if (channel->band == IEEE80211_BAND_2GHZ)
-                                config_bands = BAND_B | BAND_G | BAND_GN;
-                        else
-                                config_bands = BAND_A | BAND_AN;
-
-                        if (!((config_bands | priv->adapter->fw_bands) &
-                              ~priv->adapter->fw_bands))
-                                priv->adapter->config_bands = config_bands;
-                }
-        }
-
         /* As this is new association, clear locally stored
          * keys and security related flags */
         priv->sec_info.wpa_enabled = false;
@@ -1707,9 +1693,9 @@ static int mwifiex_set_ibss_params(struct mwifiex_private *priv,
 
                 if (cfg80211_get_chandef_type(&params->chandef) !=
                                                 NL80211_CHAN_NO_HT)
-                        config_bands |= BAND_GN;
+                        config_bands |= BAND_G | BAND_GN;
         } else {
-                if (cfg80211_get_chandef_type(&params->chandef) !=
+                if (cfg80211_get_chandef_type(&params->chandef) ==
                                                 NL80211_CHAN_NO_HT)
                         config_bands = BAND_A;
                 else
@@ -2261,6 +2247,7 @@ int mwifiex_register_cfg80211(struct mwifiex_adapter *adapter)
         wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
         wiphy->flags |= WIPHY_FLAG_HAVE_AP_SME |
                         WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD |
+                        WIPHY_FLAG_AP_UAPSD |
                         WIPHY_FLAG_CUSTOM_REGULATORY |
                         WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
 
diff --git a/drivers/net/wireless/mwifiex/decl.h b/drivers/net/wireless/mwifiex/decl.h
index e9357d87d327..e8a569aaa2e8 100644
--- a/drivers/net/wireless/mwifiex/decl.h
+++ b/drivers/net/wireless/mwifiex/decl.h
@@ -26,6 +26,7 @@
 #include <linux/wait.h>
 #include <linux/timer.h>
 #include <linux/ieee80211.h>
+#include <net/mac80211.h>
 
 
 #define MWIFIEX_MAX_BSS_NUM         (3)
@@ -58,6 +59,8 @@
 #define MWIFIEX_RTS_MAX_VALUE              (2347)
 #define MWIFIEX_FRAG_MIN_VALUE             (256)
 #define MWIFIEX_FRAG_MAX_VALUE             (2346)
+#define MWIFIEX_WMM_VERSION                0x01
+#define MWIFIEX_WMM_SUBTYPE                0x01
 
 #define MWIFIEX_RETRY_LIMIT                14
 #define MWIFIEX_SDIO_BLOCK_SIZE            256
@@ -126,4 +129,19 @@ enum mwifiex_wmm_ac_e {
         WMM_AC_VI,
         WMM_AC_VO
 } __packed;
+
+struct ieee_types_wmm_ac_parameters {
+        u8 aci_aifsn_bitmap;
+        u8 ecw_bitmap;
+        __le16 tx_op_limit;
+} __packed;
+
+struct mwifiex_types_wmm_info {
+        u8 oui[4];
+        u8 subtype;
+        u8 version;
+        u8 qos_info;
+        u8 reserved;
+        struct ieee_types_wmm_ac_parameters ac_params[IEEE80211_NUM_ACS];
+} __packed;
 #endif /* !_MWIFIEX_DECL_H_ */
diff --git a/drivers/net/wireless/mwifiex/fw.h b/drivers/net/wireless/mwifiex/fw.h
index 4dc8e2e9a889..ebe2f6a7984c 100644
--- a/drivers/net/wireless/mwifiex/fw.h
+++ b/drivers/net/wireless/mwifiex/fw.h
@@ -330,6 +330,9 @@ enum P2P_MODES {
 #define HOST_SLEEP_CFG_GPIO_DEF         0xff
 #define HOST_SLEEP_CFG_GAP_DEF          0
 
+#define MWIFIEX_TIMEOUT_FOR_AP_RESP             0xfffc
+#define MWIFIEX_STATUS_CODE_AUTH_TIMEOUT        2
+
 #define CMD_F_HOSTCMD           (1 << 0)
 #define CMD_F_CANCELED          (1 << 1)
 
@@ -1131,12 +1134,6 @@ struct ieee_types_vendor_header {
         u8 version;
 } __packed;
 
-struct ieee_types_wmm_ac_parameters {
-        u8 aci_aifsn_bitmap;
-        u8 ecw_bitmap;
-        __le16 tx_op_limit;
-} __packed;
-
 struct ieee_types_wmm_parameter {
         /*
          * WMM Parameter IE - Vendor Specific Header:
@@ -1186,6 +1183,11 @@ struct mwifiex_ie_types_htcap {
         struct ieee80211_ht_cap ht_cap;
 } __packed;
 
+struct mwifiex_ie_types_wmmcap {
+        struct mwifiex_ie_types_header header;
+        struct mwifiex_types_wmm_info wmm_info;
+} __packed;
+
 struct mwifiex_ie_types_htinfo {
         struct mwifiex_ie_types_header header;
         struct ieee80211_ht_operation ht_oper;
diff --git a/drivers/net/wireless/mwifiex/init.c b/drivers/net/wireless/mwifiex/init.c
index 39f03ce5a5b1..e00b8060aff7 100644
--- a/drivers/net/wireless/mwifiex/init.c
+++ b/drivers/net/wireless/mwifiex/init.c
@@ -591,6 +591,12 @@ int mwifiex_init_fw(struct mwifiex_adapter *adapter)
                                 return -1;
                 }
         }
+
+        if (adapter->if_ops.init_fw_port) {
+                if (adapter->if_ops.init_fw_port(adapter))
+                        return -1;
+        }
+
         for (i = 0; i < adapter->priv_num; i++) {
                 if (adapter->priv[i]) {
                         ret = mwifiex_sta_init_cmd(adapter->priv[i], first_sta);
diff --git a/drivers/net/wireless/mwifiex/ioctl.h b/drivers/net/wireless/mwifiex/ioctl.h
index 4e31c6013ebe..6095b3e53f4e 100644
--- a/drivers/net/wireless/mwifiex/ioctl.h
+++ b/drivers/net/wireless/mwifiex/ioctl.h
@@ -20,7 +20,6 @@
 #ifndef _MWIFIEX_IOCTL_H_
 #define _MWIFIEX_IOCTL_H_
 
-#include <net/mac80211.h>
 #include <net/lib80211.h>
 
 enum {
@@ -107,6 +106,8 @@ struct mwifiex_uap_bss_param {
         u8 rates[MWIFIEX_SUPPORTED_RATES];
         u32 sta_ao_timer;
         u32 ps_sta_ao_timer;
+        u8 qos_info;
+        struct mwifiex_types_wmm_info wmm_info;
 };
 
 enum {
diff --git a/drivers/net/wireless/mwifiex/join.c b/drivers/net/wireless/mwifiex/join.c
index 88664ae667ba..f0a634d237c1 100644
--- a/drivers/net/wireless/mwifiex/join.c
+++ b/drivers/net/wireless/mwifiex/join.c
@@ -157,8 +157,8 @@ static int mwifiex_get_common_rates(struct mwifiex_private *priv, u8 *rate1,
 
         memset(rate1, 0, rate1_size);
 
-        for (i = 0; rate2[i] && i < rate2_size; i++) {
-                for (j = 0; tmp[j] && j < rate1_size; j++) {
+        for (i = 0; i < rate2_size && rate2[i]; i++) {
+                for (j = 0; j < rate1_size && tmp[j]; j++) {
                         /* Check common rate, excluding the bit for
                            basic rate */
                         if ((rate2[i] & 0x7F) == (tmp[j] & 0x7F)) {
@@ -615,23 +615,33 @@ int mwifiex_ret_802_11_associate(struct mwifiex_private *priv,
         struct ieee_types_assoc_rsp *assoc_rsp;
         struct mwifiex_bssdescriptor *bss_desc;
         u8 enable_data = true;
+        u16 cap_info, status_code;
 
         assoc_rsp = (struct ieee_types_assoc_rsp *) &resp->params;
 
+        cap_info = le16_to_cpu(assoc_rsp->cap_info_bitmap);
+        status_code = le16_to_cpu(assoc_rsp->status_code);
+
         priv->assoc_rsp_size = min(le16_to_cpu(resp->size) - S_DS_GEN,
                                    sizeof(priv->assoc_rsp_buf));
 
         memcpy(priv->assoc_rsp_buf, &resp->params, priv->assoc_rsp_size);
 
-        if (le16_to_cpu(assoc_rsp->status_code)) {
+        if (status_code) {
                 priv->adapter->dbg.num_cmd_assoc_failure++;
                 dev_err(priv->adapter->dev,
                         "ASSOC_RESP: failed, status code=%d err=%#x a_id=%#x\n",
-                        le16_to_cpu(assoc_rsp->status_code),
-                        le16_to_cpu(assoc_rsp->cap_info_bitmap),
-                        le16_to_cpu(assoc_rsp->a_id));
+                        status_code, cap_info, le16_to_cpu(assoc_rsp->a_id));
+
+                if (cap_info == MWIFIEX_TIMEOUT_FOR_AP_RESP) {
+                        if (status_code == MWIFIEX_STATUS_CODE_AUTH_TIMEOUT)
+                                ret = WLAN_STATUS_AUTH_TIMEOUT;
+                        else
+                                ret = WLAN_STATUS_UNSPECIFIED_FAILURE;
+                } else {
+                        ret = status_code;
+                }
 
-                ret = le16_to_cpu(assoc_rsp->status_code);
                 goto done;
         }
 
@@ -969,6 +979,16 @@ mwifiex_cmd_802_11_ad_hoc_start(struct mwifiex_private *priv,
                                         priv->adapter->config_bands);
                 mwifiex_fill_cap_info(priv, radio_type, ht_cap);
 
+                if (adapter->sec_chan_offset ==
+                                        IEEE80211_HT_PARAM_CHA_SEC_NONE) {
+                        u16 tmp_ht_cap;
+
+                        tmp_ht_cap = le16_to_cpu(ht_cap->ht_cap.cap_info);
+                        tmp_ht_cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+                        tmp_ht_cap &= ~IEEE80211_HT_CAP_SGI_40;
+                        ht_cap->ht_cap.cap_info = cpu_to_le16(tmp_ht_cap);
+                }
+
                 pos += sizeof(struct mwifiex_ie_types_htcap);
                 cmd_append_size += sizeof(struct mwifiex_ie_types_htcap);
 
diff --git a/drivers/net/wireless/mwifiex/main.h b/drivers/net/wireless/mwifiex/main.h
index 1b3cfc821940..51044e3ea89b 100644
--- a/drivers/net/wireless/mwifiex/main.h
+++ b/drivers/net/wireless/mwifiex/main.h
@@ -599,8 +599,10 @@ struct mwifiex_if_ops {
         int (*cmdrsp_complete) (struct mwifiex_adapter *, struct sk_buff *);
         int (*event_complete) (struct mwifiex_adapter *, struct sk_buff *);
         int (*data_complete) (struct mwifiex_adapter *, struct sk_buff *);
+        int (*init_fw_port) (struct mwifiex_adapter *);
         int (*dnld_fw) (struct mwifiex_adapter *, struct mwifiex_fw_image *);
         void (*card_reset) (struct mwifiex_adapter *);
+        int (*clean_pcie_ring) (struct mwifiex_adapter *adapter);
 };
 
 struct mwifiex_adapter {
@@ -890,6 +892,10 @@ void mwifiex_set_ht_params(struct mwifiex_private *priv,
                            struct cfg80211_ap_settings *params);
 void mwifiex_set_uap_rates(struct mwifiex_uap_bss_param *bss_cfg,
                            struct cfg80211_ap_settings *params);
+void
+mwifiex_set_wmm_params(struct mwifiex_private *priv,
+                       struct mwifiex_uap_bss_param *bss_cfg,
+                       struct cfg80211_ap_settings *params);
 
 /*
  * This function checks if the queuing is RA based or not.
diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwifiex/pcie.c
index 13fbc4eb1595..df88e65595c8 100644
--- a/drivers/net/wireless/mwifiex/pcie.c
+++ b/drivers/net/wireless/mwifiex/pcie.c
@@ -39,17 +39,20 @@ static struct semaphore add_remove_card_sem;
 static int mwifiex_pcie_enable_host_int(struct mwifiex_adapter *adapter);
 static int mwifiex_pcie_resume(struct pci_dev *pdev);
 
-/*
- * This function is called after skb allocation to update
- * "skb->cb" with physical address of data pointer.
- */
-static phys_addr_t *mwifiex_update_sk_buff_pa(struct sk_buff *skb)
+static int
+mwifiex_map_pci_memory(struct mwifiex_adapter *adapter, struct sk_buff *skb,
+                       int size, int flags)
 {
-        phys_addr_t *buf_pa = MWIFIEX_SKB_PACB(skb);
-
-        *buf_pa = (phys_addr_t)virt_to_phys(skb->data);
+        struct pcie_service_card *card = adapter->card;
+        dma_addr_t buf_pa;
 
-        return buf_pa;
+        buf_pa = pci_map_single(card->dev, skb->data, size, flags);
+        if (pci_dma_mapping_error(card->dev, buf_pa)) {
+                dev_err(adapter->dev, "failed to map pci memory!\n");
+                return -1;
+        }
+        memcpy(skb->cb, &buf_pa, sizeof(dma_addr_t));
+        return 0;
 }
 
 /*
@@ -60,8 +63,8 @@ static bool mwifiex_pcie_ok_to_access_hw(struct mwifiex_adapter *adapter)
         u32 *cookie_addr;
         struct pcie_service_card *card = adapter->card;
 
-        if (card->sleep_cookie) {
-                cookie_addr = (u32 *)card->sleep_cookie->data;
+        if (card->sleep_cookie_vbase) {
+                cookie_addr = (u32 *)card->sleep_cookie_vbase;
                 dev_dbg(adapter->dev, "info: ACCESS_HW: sleep cookie=0x%x\n",
                         *cookie_addr);
                 if (*cookie_addr == FW_AWAKE_COOKIE)
@@ -161,7 +164,7 @@ static int mwifiex_pcie_suspend(struct pci_dev *pdev, pm_message_t state)
 
         if (pdev) {
                 card = (struct pcie_service_card *) pci_get_drvdata(pdev);
-                if (!card || card->adapter) {
+                if (!card || !card->adapter) {
                         pr_err("Card or adapter structure is not valid\n");
                         return 0;
                 }
@@ -366,9 +369,7 @@ static int mwifiex_pcie_enable_host_int(struct mwifiex_adapter *adapter)
 static int mwifiex_pcie_create_txbd_ring(struct mwifiex_adapter *adapter)
 {
         struct pcie_service_card *card = adapter->card;
-        struct sk_buff *skb;
         int i;
-        phys_addr_t *buf_pa;
 
         /*
          * driver maintaines the write pointer and firmware maintaines the read
@@ -384,16 +385,18 @@ static int mwifiex_pcie_create_txbd_ring(struct mwifiex_adapter *adapter)
                                                         MWIFIEX_MAX_TXRX_BD;
         dev_dbg(adapter->dev, "info: txbd_ring: Allocating %d bytes\n",
                 card->txbd_ring_size);
-        card->txbd_ring_vbase = kzalloc(card->txbd_ring_size, GFP_KERNEL);
+        card->txbd_ring_vbase = pci_alloc_consistent(card->dev,
+                                                     card->txbd_ring_size,
+                                                     &card->txbd_ring_pbase);
         if (!card->txbd_ring_vbase) {
-                dev_err(adapter->dev, "Unable to alloc buffer for txbd ring\n");
+                dev_err(adapter->dev,
+                        "allocate consistent memory (%d bytes) failed!\n",
+                        card->txbd_ring_size);
                 return -ENOMEM;
         }
-        card->txbd_ring_pbase = virt_to_phys(card->txbd_ring_vbase);
-
         dev_dbg(adapter->dev,
                 "info: txbd_ring - base: %p, pbase: %#x:%x, len: %x\n",
-                card->txbd_ring_vbase, (u32)card->txbd_ring_pbase,
+                card->txbd_ring_vbase, (unsigned int)card->txbd_ring_pbase,
                 (u32)((u64)card->txbd_ring_pbase >> 32), card->txbd_ring_size);
 
         for (i = 0; i < MWIFIEX_MAX_TXRX_BD; i++) {
@@ -402,24 +405,9 @@ static int mwifiex_pcie_create_txbd_ring(struct mwifiex_adapter *adapter)
                                       (sizeof(struct mwifiex_pcie_buf_desc)
                                        * i));
 
-                /* Allocate buffer here so that firmware can DMA data from it */
-                skb = dev_alloc_skb(MWIFIEX_RX_DATA_BUF_SIZE);
-                if (!skb) {
-                        dev_err(adapter->dev, "Unable to allocate skb for TX ring.\n");
-                        kfree(card->txbd_ring_vbase);
-                        return -ENOMEM;
-                }
-                buf_pa = mwifiex_update_sk_buff_pa(skb);
-
-                skb_put(skb, MWIFIEX_RX_DATA_BUF_SIZE);
-                dev_dbg(adapter->dev, "info: TX ring: add new skb base: %p, "
-                        "buf_base: %p, buf_pbase: %#x:%x, buf_len: %#x\n",
-                        skb, skb->data, (u32)*buf_pa,
-                        (u32)(((u64)*buf_pa >> 32)), skb->len);
-
-                card->tx_buf_list[i] = skb;
-                card->txbd_ring[i]->paddr = *buf_pa;
-                card->txbd_ring[i]->len = (u16)skb->len;
+                card->tx_buf_list[i] = NULL;
+                card->txbd_ring[i]->paddr = 0;
+                card->txbd_ring[i]->len = 0;
                 card->txbd_ring[i]->flags = 0;
         }
 
@@ -429,11 +417,16 @@ static int mwifiex_pcie_create_txbd_ring(struct mwifiex_adapter *adapter)
 static int mwifiex_pcie_delete_txbd_ring(struct mwifiex_adapter *adapter)
 {
         struct pcie_service_card *card = adapter->card;
+        struct sk_buff *skb;
         int i;
 
         for (i = 0; i < MWIFIEX_MAX_TXRX_BD; i++) {
-                if (card->tx_buf_list[i])
-                        dev_kfree_skb_any(card->tx_buf_list[i]);
+                if (card->tx_buf_list[i]) {
+                        skb = card->tx_buf_list[i];
+                        pci_unmap_single(card->dev, card->txbd_ring[i]->paddr,
+                                         skb->len, PCI_DMA_TODEVICE);
+                        dev_kfree_skb_any(skb);
+                }
                 card->tx_buf_list[i] = NULL;
                 card->txbd_ring[i]->paddr = 0;
                 card->txbd_ring[i]->len = 0;
@@ -441,11 +434,15 @@ static int mwifiex_pcie_delete_txbd_ring(struct mwifiex_adapter *adapter)
                 card->txbd_ring[i] = NULL;
         }
 
-        kfree(card->txbd_ring_vbase);
+        if (card->txbd_ring_vbase)
+                pci_free_consistent(card->dev, card->txbd_ring_size,
+                                    card->txbd_ring_vbase,
+                                    card->txbd_ring_pbase);
         card->txbd_ring_size = 0;
         card->txbd_wrptr = 0;
         card->txbd_rdptr = 0 | MWIFIEX_BD_FLAG_ROLLOVER_IND;
         card->txbd_ring_vbase = NULL;
+        card->txbd_ring_pbase = 0;
 
         return 0;
 }
@@ -458,7 +455,7 @@ static int mwifiex_pcie_create_rxbd_ring(struct mwifiex_adapter *adapter)
         struct pcie_service_card *card = adapter->card;
         struct sk_buff *skb;
         int i;
-        phys_addr_t *buf_pa;
+        dma_addr_t buf_pa;
 
         /*
          * driver maintaines the read pointer and firmware maintaines the write
@@ -472,13 +469,15 @@ static int mwifiex_pcie_create_rxbd_ring(struct mwifiex_adapter *adapter)
                                                         MWIFIEX_MAX_TXRX_BD;
         dev_dbg(adapter->dev, "info: rxbd_ring: Allocating %d bytes\n",
                 card->rxbd_ring_size);
-        card->rxbd_ring_vbase = kzalloc(card->rxbd_ring_size, GFP_KERNEL);
+        card->rxbd_ring_vbase = pci_alloc_consistent(card->dev,
+                                                     card->rxbd_ring_size,
+                                                     &card->rxbd_ring_pbase);
         if (!card->rxbd_ring_vbase) {
-                dev_err(adapter->dev, "Unable to allocate buffer for "
-                                "rxbd_ring.\n");
+                dev_err(adapter->dev,
+                        "allocate consistent memory (%d bytes) failed!\n",
+                        card->rxbd_ring_size);
                 return -ENOMEM;
         }
-        card->rxbd_ring_pbase = virt_to_phys(card->rxbd_ring_vbase);
 
         dev_dbg(adapter->dev,
                 "info: rxbd_ring - base: %p, pbase: %#x:%x, len: %#x\n",
@@ -500,16 +499,20 @@ static int mwifiex_pcie_create_rxbd_ring(struct mwifiex_adapter *adapter)
                         kfree(card->rxbd_ring_vbase);
                         return -ENOMEM;
                 }
-                buf_pa = mwifiex_update_sk_buff_pa(skb);
-                skb_put(skb, MWIFIEX_RX_DATA_BUF_SIZE);
+                if (mwifiex_map_pci_memory(adapter, skb,
+                                           MWIFIEX_RX_DATA_BUF_SIZE,
+                                           PCI_DMA_FROMDEVICE))
+                        return -1;
+
+                MWIFIEX_SKB_PACB(skb, &buf_pa);
 
                 dev_dbg(adapter->dev, "info: RX ring: add new skb base: %p, "
                         "buf_base: %p, buf_pbase: %#x:%x, buf_len: %#x\n",
-                        skb, skb->data, (u32)*buf_pa, (u32)((u64)*buf_pa >> 32),
+                        skb, skb->data, (u32)buf_pa, (u32)((u64)buf_pa >> 32),
                         skb->len);
 
                 card->rx_buf_list[i] = skb;
-                card->rxbd_ring[i]->paddr = *buf_pa;
+                card->rxbd_ring[i]->paddr = buf_pa;
                 card->rxbd_ring[i]->len = (u16)skb->len;
                 card->rxbd_ring[i]->flags = 0;
         }
@@ -523,11 +526,17 @@ static int mwifiex_pcie_create_rxbd_ring(struct mwifiex_adapter *adapter)
 static int mwifiex_pcie_delete_rxbd_ring(struct mwifiex_adapter *adapter)
 {
         struct pcie_service_card *card = adapter->card;
+        struct sk_buff *skb;
         int i;
 
         for (i = 0; i < MWIFIEX_MAX_TXRX_BD; i++) {
-                if (card->rx_buf_list[i])
-                        dev_kfree_skb_any(card->rx_buf_list[i]);
+                if (card->rx_buf_list[i]) {
+                        skb = card->rx_buf_list[i];
+                        pci_unmap_single(card->dev, card->rxbd_ring[i]->paddr ,
+                                         MWIFIEX_RX_DATA_BUF_SIZE,
+                                         PCI_DMA_FROMDEVICE);
+                        dev_kfree_skb_any(skb);
+                }
                 card->rx_buf_list[i] = NULL;
                 card->rxbd_ring[i]->paddr = 0;
                 card->rxbd_ring[i]->len = 0;
@@ -535,11 +544,15 @@ static int mwifiex_pcie_delete_rxbd_ring(struct mwifiex_adapter *adapter)
                 card->rxbd_ring[i] = NULL;
         }
 
-        kfree(card->rxbd_ring_vbase);
+        if (card->rxbd_ring_vbase)
+                pci_free_consistent(card->dev, card->rxbd_ring_size,
+                                    card->rxbd_ring_vbase,
+                                    card->rxbd_ring_pbase);
         card->rxbd_ring_size = 0;
         card->rxbd_wrptr = 0;
         card->rxbd_rdptr = 0 | MWIFIEX_BD_FLAG_ROLLOVER_IND;
         card->rxbd_ring_vbase = NULL;
+        card->rxbd_ring_pbase = 0;
 
         return 0;
 }
@@ -552,7 +565,7 @@ static int mwifiex_pcie_create_evtbd_ring(struct mwifiex_adapter *adapter)
         struct pcie_service_card *card = adapter->card;
         struct sk_buff *skb;
         int i;
-        phys_addr_t *buf_pa;
+        dma_addr_t buf_pa;
 
         /*
          * driver maintaines the read pointer and firmware maintaines the write
@@ -566,13 +579,15 @@ static int mwifiex_pcie_create_evtbd_ring(struct mwifiex_adapter *adapter)
                                                         MWIFIEX_MAX_EVT_BD;
         dev_dbg(adapter->dev, "info: evtbd_ring: Allocating %d bytes\n",
                 card->evtbd_ring_size);
-        card->evtbd_ring_vbase = kzalloc(card->evtbd_ring_size, GFP_KERNEL);
+        card->evtbd_ring_vbase = pci_alloc_consistent(card->dev,
+                                                      card->evtbd_ring_size,
+                                                      &card->evtbd_ring_pbase);
         if (!card->evtbd_ring_vbase) {
                 dev_err(adapter->dev,
-                        "Unable to allocate buffer. Terminating download\n");
+                        "allocate consistent memory (%d bytes) failed!\n",
+                        card->evtbd_ring_size);
                 return -ENOMEM;
         }
-        card->evtbd_ring_pbase = virt_to_phys(card->evtbd_ring_vbase);
 
         dev_dbg(adapter->dev,
                 "info: CMDRSP/EVT bd_ring - base: %p pbase: %#x:%x len: %#x\n",
@@ -594,16 +609,20 @@ static int mwifiex_pcie_create_evtbd_ring(struct mwifiex_adapter *adapter)
                         kfree(card->evtbd_ring_vbase);
                         return -ENOMEM;
                 }
-                buf_pa = mwifiex_update_sk_buff_pa(skb);
                 skb_put(skb, MAX_EVENT_SIZE);
 
+                if (mwifiex_map_pci_memory(adapter, skb, MAX_EVENT_SIZE,
+                                           PCI_DMA_FROMDEVICE))
+                        return -1;
+
+                MWIFIEX_SKB_PACB(skb, &buf_pa);
                 dev_dbg(adapter->dev, "info: Evt ring: add new skb. base: %p, "
                         "buf_base: %p, buf_pbase: %#x:%x, buf_len: %#x\n",
-                        skb, skb->data, (u32)*buf_pa, (u32)((u64)*buf_pa >> 32),
+                        skb, skb->data, (u32)buf_pa, (u32)((u64)buf_pa >> 32),
                         skb->len);
 
                 card->evt_buf_list[i] = skb;
-                card->evtbd_ring[i]->paddr = *buf_pa;
+                card->evtbd_ring[i]->paddr = buf_pa;
                 card->evtbd_ring[i]->len = (u16)skb->len;
                 card->evtbd_ring[i]->flags = 0;
         }
@@ -617,11 +636,16 @@ static int mwifiex_pcie_create_evtbd_ring(struct mwifiex_adapter *adapter)
 static int mwifiex_pcie_delete_evtbd_ring(struct mwifiex_adapter *adapter)
 {
         struct pcie_service_card *card = adapter->card;
+        struct sk_buff *skb;
         int i;
 
         for (i = 0; i < MWIFIEX_MAX_EVT_BD; i++) {
-                if (card->evt_buf_list[i])
-                        dev_kfree_skb_any(card->evt_buf_list[i]);
+                if (card->evt_buf_list[i]) {
+                        skb = card->evt_buf_list[i];
+                        pci_unmap_single(card->dev, card->evtbd_ring[i]->paddr,
+                                         MAX_EVENT_SIZE, PCI_DMA_FROMDEVICE);
+                        dev_kfree_skb_any(skb);
+                }
                 card->evt_buf_list[i] = NULL;
                 card->evtbd_ring[i]->paddr = 0;
                 card->evtbd_ring[i]->len = 0;
@@ -629,11 +653,15 @@ static int mwifiex_pcie_delete_evtbd_ring(struct mwifiex_adapter *adapter)
                 card->evtbd_ring[i] = NULL;
         }
 
-        kfree(card->evtbd_ring_vbase);
+        if (card->evtbd_ring_vbase)
+                pci_free_consistent(card->dev, card->evtbd_ring_size,
+                                    card->evtbd_ring_vbase,
+                                    card->evtbd_ring_pbase);
         card->evtbd_wrptr = 0;
         card->evtbd_rdptr = 0 | MWIFIEX_BD_FLAG_ROLLOVER_IND;
         card->evtbd_ring_size = 0;
         card->evtbd_ring_vbase = NULL;
+        card->evtbd_ring_pbase = 0;
 
         return 0;
 }
@@ -653,21 +681,12 @@ static int mwifiex_pcie_alloc_cmdrsp_buf(struct mwifiex_adapter *adapter)
                         "Unable to allocate skb for command response data.\n");
                 return -ENOMEM;
         }
-        mwifiex_update_sk_buff_pa(skb);
         skb_put(skb, MWIFIEX_UPLD_SIZE);
-        card->cmdrsp_buf = skb;
+        if (mwifiex_map_pci_memory(adapter, skb, MWIFIEX_UPLD_SIZE,
+                                   PCI_DMA_FROMDEVICE))
+                return -1;
 
-        skb = NULL;
-        /* Allocate memory for sending command to firmware */
-        skb = dev_alloc_skb(MWIFIEX_SIZE_OF_CMD_BUFFER);
-        if (!skb) {
-                dev_err(adapter->dev,
-                        "Unable to allocate skb for command data.\n");
-                return -ENOMEM;
-        }
-        mwifiex_update_sk_buff_pa(skb);
-        skb_put(skb, MWIFIEX_SIZE_OF_CMD_BUFFER);
-        card->cmd_buf = skb;
+        card->cmdrsp_buf = skb;
 
         return 0;
 }
@@ -678,18 +697,26 @@ static int mwifiex_pcie_alloc_cmdrsp_buf(struct mwifiex_adapter *adapter)
 static int mwifiex_pcie_delete_cmdrsp_buf(struct mwifiex_adapter *adapter)
 {
         struct pcie_service_card *card;
+        dma_addr_t buf_pa;
 
         if (!adapter)
                 return 0;
 
         card = adapter->card;
 
-        if (card && card->cmdrsp_buf)
+        if (card && card->cmdrsp_buf) {
+                MWIFIEX_SKB_PACB(card->cmdrsp_buf, &buf_pa);
+                pci_unmap_single(card->dev, buf_pa, MWIFIEX_UPLD_SIZE,
+                                 PCI_DMA_FROMDEVICE);
                 dev_kfree_skb_any(card->cmdrsp_buf);
+        }
 
-        if (card && card->cmd_buf)
+        if (card && card->cmd_buf) {
+                MWIFIEX_SKB_PACB(card->cmd_buf, &buf_pa);
+                pci_unmap_single(card->dev, buf_pa, MWIFIEX_SIZE_OF_CMD_BUFFER,
+                                 PCI_DMA_TODEVICE);
                 dev_kfree_skb_any(card->cmd_buf);
-
+        }
         return 0;
 }
 
@@ -698,27 +725,19 @@ static int mwifiex_pcie_delete_cmdrsp_buf(struct mwifiex_adapter *adapter)
  */
 static int mwifiex_pcie_alloc_sleep_cookie_buf(struct mwifiex_adapter *adapter)
 {
-        struct sk_buff *skb;
         struct pcie_service_card *card = adapter->card;
 
-        /* Allocate memory for sleep cookie */
-        skb = dev_alloc_skb(sizeof(u32));
-        if (!skb) {
-                dev_err(adapter->dev,
-                        "Unable to allocate skb for sleep cookie!\n");
+        card->sleep_cookie_vbase = pci_alloc_consistent(card->dev, sizeof(u32),
+                                                     &card->sleep_cookie_pbase);
+        if (!card->sleep_cookie_vbase) {
+                dev_err(adapter->dev, "pci_alloc_consistent failed!\n");
                 return -ENOMEM;
         }
-        mwifiex_update_sk_buff_pa(skb);
-        skb_put(skb, sizeof(u32));
-
         /* Init val of Sleep Cookie */
-        *(u32 *)skb->data = FW_AWAKE_COOKIE;
+        *(u32 *)card->sleep_cookie_vbase = FW_AWAKE_COOKIE;
 
         dev_dbg(adapter->dev, "alloc_scook: sleep cookie=0x%x\n",
-                *((u32 *)skb->data));
-
-        /* Save the sleep cookie */
-        card->sleep_cookie = skb;
+                *((u32 *)card->sleep_cookie_vbase));
 
         return 0;
 }
@@ -735,24 +754,57 @@ static int mwifiex_pcie_delete_sleep_cookie_buf(struct mwifiex_adapter *adapter)
 
         card = adapter->card;
 
-        if (card && card->sleep_cookie) {
-                dev_kfree_skb_any(card->sleep_cookie);
-                card->sleep_cookie = NULL;
+        if (card && card->sleep_cookie_vbase) {
+                pci_free_consistent(card->dev, sizeof(u32),
+                                    card->sleep_cookie_vbase,
+                                    card->sleep_cookie_pbase);
+                card->sleep_cookie_vbase = NULL;
         }
 
         return 0;
 }
 
+/* This function flushes the TX buffer descriptor ring
+ * This function defined as handler is also called while cleaning TXRX
+ * during disconnect/ bss stop.
+ */
+static int mwifiex_clean_pcie_ring_buf(struct mwifiex_adapter *adapter)
+{
+        struct pcie_service_card *card = adapter->card;
+        u32 rdptr;
+
+        /* Read the TX ring read pointer set by firmware */
+        if (mwifiex_read_reg(adapter, REG_TXBD_RDPTR, &rdptr)) {
+                dev_err(adapter->dev,
+                        "Flush TXBD: failed to read REG_TXBD_RDPTR\n");
+                return -1;
+        }
+
+        if (!mwifiex_pcie_txbd_empty(card, rdptr)) {
+                card->txbd_flush = 1;
+                /* write pointer already set at last send
+                 * send dnld-rdy intr again, wait for completion.
+                 */
+                if (mwifiex_write_reg(adapter, PCIE_CPU_INT_EVENT,
+                                      CPU_INTR_DNLD_RDY)) {
+                        dev_err(adapter->dev,
+                                "failed to assert dnld-rdy interrupt.\n");
+                        return -1;
+                }
+        }
+        return 0;
+}
+
 /*
- * This function sends data buffer to device
+ * This function unmaps and frees downloaded data buffer
  */
-static int
-mwifiex_pcie_send_data(struct mwifiex_adapter *adapter, struct sk_buff *skb)
+static int mwifiex_pcie_send_data_complete(struct mwifiex_adapter *adapter)
 {
+        const u32 num_tx_buffs = MWIFIEX_MAX_TXRX_BD;
+        struct sk_buff *skb;
+        dma_addr_t buf_pa;
+        u32 wrdoneidx, rdptr, unmap_count = 0;
         struct pcie_service_card *card = adapter->card;
-        u32 wrindx, rdptr;
-        phys_addr_t *buf_pa;
-        __le16 *tmp;
 
         if (!mwifiex_pcie_ok_to_access_hw(adapter))
                 mwifiex_pm_wakeup_card(adapter);
@@ -760,34 +812,112 @@ mwifiex_pcie_send_data(struct mwifiex_adapter *adapter, struct sk_buff *skb)
         /* Read the TX ring read pointer set by firmware */
         if (mwifiex_read_reg(adapter, REG_TXBD_RDPTR, &rdptr)) {
                 dev_err(adapter->dev,
-                        "SEND DATA: failed to read REG_TXBD_RDPTR\n");
+                        "SEND COMP: failed to read REG_TXBD_RDPTR\n");
                 return -1;
         }
 
-        wrindx = card->txbd_wrptr & MWIFIEX_TXBD_MASK;
+        dev_dbg(adapter->dev, "SEND COMP: rdptr_prev=0x%x, rdptr=0x%x\n",
+                card->txbd_rdptr, rdptr);
 
-        dev_dbg(adapter->dev, "info: SEND DATA: <Rd: %#x, Wr: %#x>\n", rdptr,
-                card->txbd_wrptr);
-        if (((card->txbd_wrptr & MWIFIEX_TXBD_MASK) !=
-                        (rdptr & MWIFIEX_TXBD_MASK)) ||
-            ((card->txbd_wrptr & MWIFIEX_BD_FLAG_ROLLOVER_IND) !=
-                        (rdptr & MWIFIEX_BD_FLAG_ROLLOVER_IND))) {
-                struct sk_buff *skb_data;
+        /* free from previous txbd_rdptr to current txbd_rdptr */
+        while (((card->txbd_rdptr & MWIFIEX_TXBD_MASK) !=
+                (rdptr & MWIFIEX_TXBD_MASK)) ||
+               ((card->txbd_rdptr & MWIFIEX_BD_FLAG_ROLLOVER_IND) !=
+                (rdptr & MWIFIEX_BD_FLAG_ROLLOVER_IND))) {
+                wrdoneidx = card->txbd_rdptr & MWIFIEX_TXBD_MASK;
+
+                skb = card->tx_buf_list[wrdoneidx];
+                if (skb) {
+                        dev_dbg(adapter->dev,
+                                "SEND COMP: Detach skb %p at txbd_rdidx=%d\n",
+                                skb, wrdoneidx);
+                        MWIFIEX_SKB_PACB(skb, &buf_pa);
+                        pci_unmap_single(card->dev, buf_pa, skb->len,
+                                         PCI_DMA_TODEVICE);
+
+                        unmap_count++;
+
+                        if (card->txbd_flush)
+                                mwifiex_write_data_complete(adapter, skb, 0,
+                                                            -1);
+                        else
+                                mwifiex_write_data_complete(adapter, skb, 0, 0);
+                }
+
+                card->tx_buf_list[wrdoneidx] = NULL;
+                card->txbd_ring[wrdoneidx]->paddr = 0;
+                card->txbd_ring[wrdoneidx]->len = 0;
+                card->txbd_ring[wrdoneidx]->flags = 0;
+                card->txbd_rdptr++;
+
+                if ((card->txbd_rdptr & MWIFIEX_TXBD_MASK) == num_tx_buffs)
+                        card->txbd_rdptr = ((card->txbd_rdptr &
+                                            MWIFIEX_BD_FLAG_ROLLOVER_IND) ^
+                                            MWIFIEX_BD_FLAG_ROLLOVER_IND);
+        }
+
+        if (unmap_count)
+                adapter->data_sent = false;
+
+        if (card->txbd_flush) {
+                if (((card->txbd_wrptr & MWIFIEX_TXBD_MASK) ==
+                     (card->txbd_rdptr & MWIFIEX_TXBD_MASK)) &&
+                    ((card->txbd_wrptr & MWIFIEX_BD_FLAG_ROLLOVER_IND) !=
+                     (card->txbd_rdptr & MWIFIEX_BD_FLAG_ROLLOVER_IND)))
+                        card->txbd_flush = 0;
+                else
+                        mwifiex_clean_pcie_ring_buf(adapter);
+        }
+
+        return 0;
+}
+
+/* This function sends data buffer to device. First 4 bytes of payload
+ * are filled with payload length and payload type. Then this payload
+ * is mapped to PCI device memory. Tx ring pointers are advanced accordingly.
+ * Download ready interrupt to FW is deffered if Tx ring is not full and
+ * additional payload can be accomodated.
+ */
+static int
+mwifiex_pcie_send_data(struct mwifiex_adapter *adapter, struct sk_buff *skb,
+                       struct mwifiex_tx_param *tx_param)
+{
+        struct pcie_service_card *card = adapter->card;
+        u32 wrindx;
+        int ret;
+        dma_addr_t buf_pa;
+        __le16 *tmp;
+
+        if (!(skb->data && skb->len)) {
+                dev_err(adapter->dev, "%s(): invalid parameter <%p, %#x>\n",
+                        __func__, skb->data, skb->len);
+                return -1;
+        }
+
+        if (!mwifiex_pcie_ok_to_access_hw(adapter))
+                mwifiex_pm_wakeup_card(adapter);
+
+        dev_dbg(adapter->dev, "info: SEND DATA: <Rd: %#x, Wr: %#x>\n",
+                card->txbd_rdptr, card->txbd_wrptr);
+        if (mwifiex_pcie_txbd_not_full(card)) {
                 u8 *payload;
 
                 adapter->data_sent = true;
-                skb_data = card->tx_buf_list[wrindx];
-                memcpy(skb_data->data, skb->data, skb->len);
-                payload = skb_data->data;
+                payload = skb->data;
                 tmp = (__le16 *)&payload[0];
                 *tmp = cpu_to_le16((u16)skb->len);
                 tmp = (__le16 *)&payload[2];
                 *tmp = cpu_to_le16(MWIFIEX_TYPE_DATA);
-                skb_put(skb_data, MWIFIEX_RX_DATA_BUF_SIZE - skb_data->len);
-                skb_trim(skb_data, skb->len);
-                buf_pa = MWIFIEX_SKB_PACB(skb_data);
-                card->txbd_ring[wrindx]->paddr = *buf_pa;
-                card->txbd_ring[wrindx]->len = (u16)skb_data->len;
+
+                if (mwifiex_map_pci_memory(adapter, skb, skb->len ,
+                                           PCI_DMA_TODEVICE))
+                        return -1;
+
+                wrindx = card->txbd_wrptr & MWIFIEX_TXBD_MASK;
+                MWIFIEX_SKB_PACB(skb, &buf_pa);
+                card->tx_buf_list[wrindx] = skb;
+                card->txbd_ring[wrindx]->paddr = buf_pa;
+                card->txbd_ring[wrindx]->len = (u16)skb->len;
                 card->txbd_ring[wrindx]->flags = MWIFIEX_BD_FLAG_FIRST_DESC |
                                                 MWIFIEX_BD_FLAG_LAST_DESC;
 
@@ -802,19 +932,28 @@ mwifiex_pcie_send_data(struct mwifiex_adapter *adapter, struct sk_buff *skb)
                                       card->txbd_wrptr)) {
                         dev_err(adapter->dev,
                                 "SEND DATA: failed to write REG_TXBD_WRPTR\n");
-                        return 0;
+                        ret = -1;
+                        goto done_unmap;
                 }
-
-                /* Send the TX ready interrupt */
-                if (mwifiex_write_reg(adapter, PCIE_CPU_INT_EVENT,
-                                      CPU_INTR_DNLD_RDY)) {
-                        dev_err(adapter->dev,
-                                "SEND DATA: failed to assert door-bell intr\n");
-                        return -1;
+                if ((mwifiex_pcie_txbd_not_full(card)) &&
+                    tx_param->next_pkt_len) {
+                        /* have more packets and TxBD still can hold more */
+                        dev_dbg(adapter->dev,
+                                "SEND DATA: delay dnld-rdy interrupt.\n");
+                        adapter->data_sent = false;
+                } else {
+                        /* Send the TX ready interrupt */
+                        if (mwifiex_write_reg(adapter, PCIE_CPU_INT_EVENT,
+                                              CPU_INTR_DNLD_RDY)) {
+                                dev_err(adapter->dev,
+                                        "SEND DATA: failed to assert dnld-rdy interrupt.\n");
+                                ret = -1;
+                                goto done_unmap;
+                        }
                 }
                 dev_dbg(adapter->dev, "info: SEND DATA: Updated <Rd: %#x, Wr: "
                         "%#x> and sent packet to firmware successfully\n",
-                        rdptr, card->txbd_wrptr);
+                        card->txbd_rdptr, card->txbd_wrptr);
         } else {
                 dev_dbg(adapter->dev,
                         "info: TX Ring full, can't send packets to fw\n");
@@ -827,7 +966,15 @@ mwifiex_pcie_send_data(struct mwifiex_adapter *adapter, struct sk_buff *skb)
                 return -EBUSY;
         }
 
-        return 0;
+        return -EINPROGRESS;
+done_unmap:
+        MWIFIEX_SKB_PACB(skb, &buf_pa);
+        pci_unmap_single(card->dev, buf_pa, skb->len, PCI_DMA_TODEVICE);
+        card->tx_buf_list[wrindx] = NULL;
+        card->txbd_ring[wrindx]->paddr = 0;
+        card->txbd_ring[wrindx]->len = 0;
+        card->txbd_ring[wrindx]->flags = 0;
+        return ret;
 }
 
 /*
@@ -838,9 +985,13 @@ static int mwifiex_pcie_process_recv_data(struct mwifiex_adapter *adapter)
 {
         struct pcie_service_card *card = adapter->card;
         u32 wrptr, rd_index;
+        dma_addr_t buf_pa;
         int ret = 0;
         struct sk_buff *skb_tmp = NULL;
 
+        if (!mwifiex_pcie_ok_to_access_hw(adapter))
+                mwifiex_pm_wakeup_card(adapter);
+
         /* Read the RX ring Write pointer set by firmware */
         if (mwifiex_read_reg(adapter, REG_RXBD_WRPTR, &wrptr)) {
                 dev_err(adapter->dev,
@@ -848,6 +999,7 @@ static int mwifiex_pcie_process_recv_data(struct mwifiex_adapter *adapter)
                 ret = -1;
                 goto done;
         }
+        card->rxbd_wrptr = wrptr;
 
         while (((wrptr & MWIFIEX_RXBD_MASK) !=
                 (card->rxbd_rdptr & MWIFIEX_RXBD_MASK)) ||
@@ -855,27 +1007,50 @@ static int mwifiex_pcie_process_recv_data(struct mwifiex_adapter *adapter)
                 (card->rxbd_rdptr & MWIFIEX_BD_FLAG_ROLLOVER_IND))) {
                 struct sk_buff *skb_data;
                 u16 rx_len;
+                __le16 pkt_len;
 
                 rd_index = card->rxbd_rdptr & MWIFIEX_RXBD_MASK;
                 skb_data = card->rx_buf_list[rd_index];
 
+                MWIFIEX_SKB_PACB(skb_data, &buf_pa);
+                pci_unmap_single(card->dev, buf_pa, MWIFIEX_RX_DATA_BUF_SIZE,
+                                 PCI_DMA_FROMDEVICE);
+                card->rx_buf_list[rd_index] = NULL;
+
                 /* Get data length from interface header -
-                   first byte is len, second byte is type */
-                rx_len = *((u16 *)skb_data->data);
+                 * first 2 bytes for len, next 2 bytes is for type
+                 */
+                pkt_len = *((__le16 *)skb_data->data);
+                rx_len = le16_to_cpu(pkt_len);
+                skb_put(skb_data, rx_len);
                 dev_dbg(adapter->dev,
                         "info: RECV DATA: Rd=%#x, Wr=%#x, Len=%d\n",
                         card->rxbd_rdptr, wrptr, rx_len);
-                skb_tmp = dev_alloc_skb(rx_len);
+                skb_pull(skb_data, INTF_HEADER_LEN);
+                mwifiex_handle_rx_packet(adapter, skb_data);
+
+                skb_tmp = dev_alloc_skb(MWIFIEX_RX_DATA_BUF_SIZE);
                 if (!skb_tmp) {
-                        dev_dbg(adapter->dev,
-                                "info: Failed to alloc skb for RX\n");
-                        ret = -EBUSY;
-                        goto done;
+                        dev_err(adapter->dev,
+                                "Unable to allocate skb.\n");
+                        return -ENOMEM;
                 }
 
-                skb_put(skb_tmp, rx_len);
+                if (mwifiex_map_pci_memory(adapter, skb_tmp,
+                                           MWIFIEX_RX_DATA_BUF_SIZE,
+                                           PCI_DMA_FROMDEVICE))
+                        return -1;
+
+                MWIFIEX_SKB_PACB(skb_tmp, &buf_pa);
+
+                dev_dbg(adapter->dev,
+                        "RECV DATA: Attach new sk_buff %p at rxbd_rdidx=%d\n",
+                        skb_tmp, rd_index);
+                card->rx_buf_list[rd_index] = skb_tmp;
+                card->rxbd_ring[rd_index]->paddr = buf_pa;
+                card->rxbd_ring[rd_index]->len = skb_tmp->len;
+                card->rxbd_ring[rd_index]->flags = 0;
 
-                memcpy(skb_tmp->data, skb_data->data + INTF_HEADER_LEN, rx_len);
                 if ((++card->rxbd_rdptr & MWIFIEX_RXBD_MASK) ==
                                                         MWIFIEX_MAX_TXRX_BD) {
                         card->rxbd_rdptr = ((card->rxbd_rdptr &
@@ -903,12 +1078,10 @@ static int mwifiex_pcie_process_recv_data(struct mwifiex_adapter *adapter)
                 }
                 dev_dbg(adapter->dev,
                         "info: RECV DATA: Rcvd packet from fw successfully\n");
-                mwifiex_handle_rx_packet(adapter, skb_tmp);
+                card->rxbd_wrptr = wrptr;
         }
 
 done:
-        if (ret && skb_tmp)
-                dev_kfree_skb_any(skb_tmp);
         return ret;
 }
 
@@ -918,32 +1091,41 @@ done:
 static int
 mwifiex_pcie_send_boot_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb)
 {
-        phys_addr_t *buf_pa = MWIFIEX_SKB_PACB(skb);
+        dma_addr_t buf_pa;
+        struct pcie_service_card *card = adapter->card;
 
-        if (!(skb->data && skb->len && *buf_pa)) {
+        if (!(skb->data && skb->len)) {
                 dev_err(adapter->dev,
-                        "Invalid parameter in %s <%p, %#x:%x, %x>\n",
-                        __func__, skb->data, skb->len,
-                        (u32)*buf_pa, (u32)((u64)*buf_pa >> 32));
+                        "Invalid parameter in %s <%p. len %d>\n",
+                        __func__, skb->data, skb->len);
                 return -1;
         }
 
+        if (mwifiex_map_pci_memory(adapter, skb, skb->len , PCI_DMA_TODEVICE))
+                return -1;
+
+        MWIFIEX_SKB_PACB(skb, &buf_pa);
+
         /* Write the lower 32bits of the physical address to scratch
          * register 0 */
-        if (mwifiex_write_reg(adapter, PCIE_SCRATCH_0_REG, (u32)*buf_pa)) {
+        if (mwifiex_write_reg(adapter, PCIE_SCRATCH_0_REG, (u32)buf_pa)) {
                 dev_err(adapter->dev,
                         "%s: failed to write download command to boot code.\n",
                         __func__);
+                pci_unmap_single(card->dev, buf_pa, MWIFIEX_UPLD_SIZE,
+                                 PCI_DMA_TODEVICE);
                 return -1;
         }
 
         /* Write the upper 32bits of the physical address to scratch
          * register 1 */
         if (mwifiex_write_reg(adapter, PCIE_SCRATCH_1_REG,
-                              (u32)((u64)*buf_pa >> 32))) {
+                              (u32)((u64)buf_pa >> 32))) {
                 dev_err(adapter->dev,
                         "%s: failed to write download command to boot code.\n",
                         __func__);
+                pci_unmap_single(card->dev, buf_pa, MWIFIEX_UPLD_SIZE,
+                                 PCI_DMA_TODEVICE);
                 return -1;
         }
 
@@ -952,6 +1134,8 @@ mwifiex_pcie_send_boot_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb)
                 dev_err(adapter->dev,
                         "%s: failed to write command len to scratch reg 2\n",
                         __func__);
+                pci_unmap_single(card->dev, buf_pa, MWIFIEX_UPLD_SIZE,
+                                 PCI_DMA_TODEVICE);
                 return -1;
         }
 
@@ -960,22 +1144,39 @@ mwifiex_pcie_send_boot_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb)
                               CPU_INTR_DOOR_BELL)) {
                 dev_err(adapter->dev,
                         "%s: failed to assert door-bell intr\n", __func__);
+                pci_unmap_single(card->dev, buf_pa,
+                                 MWIFIEX_UPLD_SIZE, PCI_DMA_TODEVICE);
                 return -1;
         }
 
         return 0;
 }
 
-/*
- * This function downloads commands to the device
+/* This function init rx port in firmware which in turn enables to receive data
+ * from device before transmitting any packet.
+ */
+static int mwifiex_pcie_init_fw_port(struct mwifiex_adapter *adapter)
+{
+        struct pcie_service_card *card = adapter->card;
+
+        /* Write the RX ring read pointer in to REG_RXBD_RDPTR */
+        if (mwifiex_write_reg(adapter, REG_RXBD_RDPTR, card->rxbd_rdptr | 0)) {
+                dev_err(adapter->dev,
+                        "RECV DATA: failed to write REG_RXBD_RDPTR\n");
+                return -1;
+        }
+        return 0;
+}
+
+/* This function downloads commands to the device
  */
 static int
 mwifiex_pcie_send_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb)
 {
         struct pcie_service_card *card = adapter->card;
         int ret = 0;
-        phys_addr_t *cmd_buf_pa;
-        phys_addr_t *cmdrsp_buf_pa;
+        dma_addr_t cmd_buf_pa, cmdrsp_buf_pa;
+        u8 *payload = (u8 *)skb->data;
 
         if (!(skb->data && skb->len)) {
                 dev_err(adapter->dev, "Invalid parameter in %s <%p, %#x>\n",
@@ -990,17 +1191,18 @@ mwifiex_pcie_send_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb)
                 return -EBUSY;
         }
 
-        /* Make sure a command buffer is available */
-        if (!card->cmd_buf) {
-                dev_err(adapter->dev, "Command buffer not available\n");
-                return -EBUSY;
-        }
+        if (!mwifiex_pcie_ok_to_access_hw(adapter))
+                mwifiex_pm_wakeup_card(adapter);
 
         adapter->cmd_sent = true;
-        /* Copy the given skb in to DMA accessable shared buffer */
-        skb_put(card->cmd_buf, MWIFIEX_SIZE_OF_CMD_BUFFER - card->cmd_buf->len);
-        skb_trim(card->cmd_buf, skb->len);
-        memcpy(card->cmd_buf->data, skb->data, skb->len);
+
+        *(__le16 *)&payload[0] = cpu_to_le16((u16)skb->len);
+        *(__le16 *)&payload[2] = cpu_to_le16(MWIFIEX_TYPE_CMD);
+
+        if (mwifiex_map_pci_memory(adapter, skb, skb->len, PCI_DMA_TODEVICE))
+                return -1;
+
+        card->cmd_buf = skb;
 
         /* To send a command, the driver will:
                 1. Write the 64bit physical address of the data buffer to
@@ -1013,11 +1215,11 @@ mwifiex_pcie_send_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb)
         */
 
         if (card->cmdrsp_buf) {
-                cmdrsp_buf_pa = MWIFIEX_SKB_PACB(card->cmdrsp_buf);
+                MWIFIEX_SKB_PACB(card->cmdrsp_buf, &cmdrsp_buf_pa);
                 /* Write the lower 32bits of the cmdrsp buffer physical
                    address */
                 if (mwifiex_write_reg(adapter, REG_CMDRSP_ADDR_LO,
-                                      (u32)*cmdrsp_buf_pa)) {
+                                      (u32)cmdrsp_buf_pa)) {
                         dev_err(adapter->dev,
                                 "Failed to write download cmd to boot code.\n");
                         ret = -1;
@@ -1026,7 +1228,7 @@ mwifiex_pcie_send_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb)
                 /* Write the upper 32bits of the cmdrsp buffer physical
                    address */
                 if (mwifiex_write_reg(adapter, REG_CMDRSP_ADDR_HI,
-                                      (u32)((u64)*cmdrsp_buf_pa >> 32))) {
+                                      (u32)((u64)cmdrsp_buf_pa >> 32))) {
                         dev_err(adapter->dev,
                                 "Failed to write download cmd to boot code.\n");
                         ret = -1;
@@ -1034,9 +1236,9 @@ mwifiex_pcie_send_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb)
                 }
         }
 
-        cmd_buf_pa = MWIFIEX_SKB_PACB(card->cmd_buf);
+        MWIFIEX_SKB_PACB(card->cmd_buf, &cmd_buf_pa);
         /* Write the lower 32bits of the physical address to REG_CMD_ADDR_LO */
-        if (mwifiex_write_reg(adapter, REG_CMD_ADDR_LO, (u32)*cmd_buf_pa)) {
+        if (mwifiex_write_reg(adapter, REG_CMD_ADDR_LO, (u32)cmd_buf_pa)) {
                 dev_err(adapter->dev,
                         "Failed to write download cmd to boot code.\n");
                 ret = -1;
@@ -1044,7 +1246,7 @@ mwifiex_pcie_send_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb)
         }
         /* Write the upper 32bits of the physical address to REG_CMD_ADDR_HI */
         if (mwifiex_write_reg(adapter, REG_CMD_ADDR_HI,
-                              (u32)((u64)*cmd_buf_pa >> 32))) {
+                              (u32)((u64)cmd_buf_pa >> 32))) {
                 dev_err(adapter->dev,
                         "Failed to write download cmd to boot code.\n");
                 ret = -1;
@@ -1083,11 +1285,22 @@ static int mwifiex_pcie_process_cmd_complete(struct mwifiex_adapter *adapter)
         struct pcie_service_card *card = adapter->card;
         struct sk_buff *skb = card->cmdrsp_buf;
         int count = 0;
+        u16 rx_len;
+        __le16 pkt_len;
+        dma_addr_t buf_pa;
 
         dev_dbg(adapter->dev, "info: Rx CMD Response\n");
 
+        MWIFIEX_SKB_PACB(skb, &buf_pa);
+        pci_unmap_single(card->dev, buf_pa, MWIFIEX_UPLD_SIZE,
+                         PCI_DMA_FROMDEVICE);
+
+        pkt_len = *((__le16 *)skb->data);
+        rx_len = le16_to_cpu(pkt_len);
+        skb_trim(skb, rx_len);
+        skb_pull(skb, INTF_HEADER_LEN);
+
         if (!adapter->curr_cmd) {
-                skb_pull(skb, INTF_HEADER_LEN);
                 if (adapter->ps_state == PS_STATE_SLEEP_CFM) {
                         mwifiex_process_sleep_confirm_resp(adapter, skb->data,
                                                            skb->len);
@@ -1100,9 +1313,12 @@ static int mwifiex_pcie_process_cmd_complete(struct mwifiex_adapter *adapter)
                 }
                 memcpy(adapter->upld_buf, skb->data,
                        min_t(u32, MWIFIEX_SIZE_OF_CMD_BUFFER, skb->len));
-                skb_push(skb, INTF_HEADER_LEN);
+                if (mwifiex_map_pci_memory(adapter, skb, MWIFIEX_UPLD_SIZE,
+                                           PCI_DMA_FROMDEVICE))
+                        return -1;
+
+                MWIFIEX_SKB_PACB(skb, &buf_pa);
         } else if (mwifiex_pcie_ok_to_access_hw(adapter)) {
-                skb_pull(skb, INTF_HEADER_LEN);
                 adapter->curr_cmd->resp_skb = skb;
                 adapter->cmd_resp_received = true;
                 /* Take the pointer and set it to CMD node and will
@@ -1136,10 +1352,23 @@ static int mwifiex_pcie_cmdrsp_complete(struct mwifiex_adapter *adapter,
                                         struct sk_buff *skb)
 {
         struct pcie_service_card *card = adapter->card;
+        dma_addr_t buf_pa;
+        struct sk_buff *skb_tmp;
 
         if (skb) {
                 card->cmdrsp_buf = skb;
                 skb_push(card->cmdrsp_buf, INTF_HEADER_LEN);
+                if (mwifiex_map_pci_memory(adapter, skb, MWIFIEX_UPLD_SIZE,
+                                           PCI_DMA_FROMDEVICE))
+                        return -1;
+        }
+
+        skb_tmp = card->cmd_buf;
+        if (skb_tmp) {
+                MWIFIEX_SKB_PACB(skb_tmp, &buf_pa);
+                pci_unmap_single(card->dev, buf_pa, MWIFIEX_UPLD_SIZE,
+                                 PCI_DMA_FROMDEVICE);
+                card->cmd_buf = NULL;
         }
 
         return 0;
@@ -1153,6 +1382,10 @@ static int mwifiex_pcie_process_event_ready(struct mwifiex_adapter *adapter)
         struct pcie_service_card *card = adapter->card;
         u32 rdptr = card->evtbd_rdptr & MWIFIEX_EVTBD_MASK;
         u32 wrptr, event;
+        dma_addr_t buf_pa;
+
+        if (!mwifiex_pcie_ok_to_access_hw(adapter))
+                mwifiex_pm_wakeup_card(adapter);
 
         if (adapter->event_received) {
                 dev_dbg(adapter->dev, "info: Event being processed, "
@@ -1184,6 +1417,10 @@ static int mwifiex_pcie_process_event_ready(struct mwifiex_adapter *adapter)
 
                 dev_dbg(adapter->dev, "info: Read Index: %d\n", rdptr);
                 skb_cmd = card->evt_buf_list[rdptr];
+                MWIFIEX_SKB_PACB(skb_cmd, &buf_pa);
+                pci_unmap_single(card->dev, buf_pa, MAX_EVENT_SIZE,
+                                 PCI_DMA_FROMDEVICE);
+
                 /* Take the pointer and set it to event pointer in adapter
                    and will return back after event handling callback */
                 card->evt_buf_list[rdptr] = NULL;
@@ -1228,7 +1465,7 @@ static int mwifiex_pcie_event_complete(struct mwifiex_adapter *adapter,
         int ret = 0;
         u32 rdptr = card->evtbd_rdptr & MWIFIEX_EVTBD_MASK;
         u32 wrptr;
-        phys_addr_t *buf_pa;
+        dma_addr_t buf_pa;
 
         if (!skb)
                 return 0;
@@ -1248,9 +1485,14 @@ static int mwifiex_pcie_event_complete(struct mwifiex_adapter *adapter,
 
         if (!card->evt_buf_list[rdptr]) {
                 skb_push(skb, INTF_HEADER_LEN);
+                if (mwifiex_map_pci_memory(adapter, skb,
+                                           MAX_EVENT_SIZE,
+                                           PCI_DMA_FROMDEVICE))
+                        return -1;
+                MWIFIEX_SKB_PACB(skb, &buf_pa);
                 card->evt_buf_list[rdptr] = skb;
-                buf_pa = MWIFIEX_SKB_PACB(skb);
-                card->evtbd_ring[rdptr]->paddr = *buf_pa;
+                MWIFIEX_SKB_PACB(skb, &buf_pa);
+                card->evtbd_ring[rdptr]->paddr = buf_pa;
                 card->evtbd_ring[rdptr]->len = (u16)skb->len;
                 card->evtbd_ring[rdptr]->flags = 0;
                 skb = NULL;
@@ -1299,11 +1541,8 @@ static int mwifiex_prog_fw_w_helper(struct mwifiex_adapter *adapter,
         struct sk_buff *skb;
         u32 txlen, tx_blocks = 0, tries, len;
         u32 block_retry_cnt = 0;
-
-        if (!adapter) {
-                pr_err("adapter structure is not valid\n");
-                return -1;
-        }
+        dma_addr_t buf_pa;
+        struct pcie_service_card *card = adapter->card;
 
         if (!firmware || !firmware_len) {
                 dev_err(adapter->dev,
@@ -1325,7 +1564,6 @@ static int mwifiex_prog_fw_w_helper(struct mwifiex_adapter *adapter,
                 ret = -ENOMEM;
                 goto done;
         }
-        mwifiex_update_sk_buff_pa(skb);
 
         /* Perform firmware data transfer */
         do {
@@ -1400,6 +1638,9 @@ static int mwifiex_prog_fw_w_helper(struct mwifiex_adapter *adapter,
                         ret = -1;
                         goto done;
                 }
+
+                MWIFIEX_SKB_PACB(skb, &buf_pa);
+
                 /* Wait for the command done interrupt */
                 do {
                         if (mwifiex_read_reg(adapter, PCIE_CPU_INT_STATUS,
@@ -1407,11 +1648,17 @@ static int mwifiex_prog_fw_w_helper(struct mwifiex_adapter *adapter,
                                 dev_err(adapter->dev, "%s: Failed to read "
                                         "interrupt status during fw dnld.\n",
                                         __func__);
+                                pci_unmap_single(card->dev, buf_pa, skb->len,
+                                                 PCI_DMA_TODEVICE);
                                 ret = -1;
                                 goto done;
                         }
                 } while ((ireg_intr & CPU_INTR_DOOR_BELL) ==
                          CPU_INTR_DOOR_BELL);
+
+                pci_unmap_single(card->dev, buf_pa, skb->len,
+                                 PCI_DMA_TODEVICE);
+
                 offset += txlen;
         } while (true);
 
@@ -1594,39 +1841,40 @@ exit:
 static int mwifiex_process_int_status(struct mwifiex_adapter *adapter)
 {
         int ret;
-        u32 pcie_ireg = 0;
+        u32 pcie_ireg;
         unsigned long flags;
 
         spin_lock_irqsave(&adapter->int_lock, flags);
         /* Clear out unused interrupts */
-        adapter->int_status &= HOST_INTR_MASK;
+        pcie_ireg = adapter->int_status;
+        adapter->int_status = 0;
         spin_unlock_irqrestore(&adapter->int_lock, flags);
 
-        while (adapter->int_status & HOST_INTR_MASK) {
-                if (adapter->int_status & HOST_INTR_DNLD_DONE) {
-                        adapter->int_status &= ~HOST_INTR_DNLD_DONE;
-                        if (adapter->data_sent) {
-                                dev_dbg(adapter->dev, "info: DATA sent intr\n");
-                                adapter->data_sent = false;
-                        }
+        while (pcie_ireg & HOST_INTR_MASK) {
+                if (pcie_ireg & HOST_INTR_DNLD_DONE) {
+                        pcie_ireg &= ~HOST_INTR_DNLD_DONE;
+                        dev_dbg(adapter->dev, "info: TX DNLD Done\n");
+                        ret = mwifiex_pcie_send_data_complete(adapter);
+                        if (ret)
+                                return ret;
                 }
-                if (adapter->int_status & HOST_INTR_UPLD_RDY) {
-                        adapter->int_status &= ~HOST_INTR_UPLD_RDY;
+                if (pcie_ireg & HOST_INTR_UPLD_RDY) {
+                        pcie_ireg &= ~HOST_INTR_UPLD_RDY;
                         dev_dbg(adapter->dev, "info: Rx DATA\n");
                         ret = mwifiex_pcie_process_recv_data(adapter);
                         if (ret)
                                 return ret;
                 }
-                if (adapter->int_status & HOST_INTR_EVENT_RDY) {
-                        adapter->int_status &= ~HOST_INTR_EVENT_RDY;
+                if (pcie_ireg & HOST_INTR_EVENT_RDY) {
+                        pcie_ireg &= ~HOST_INTR_EVENT_RDY;
                         dev_dbg(adapter->dev, "info: Rx EVENT\n");
                         ret = mwifiex_pcie_process_event_ready(adapter);
                         if (ret)
                                 return ret;
                 }
 
-                if (adapter->int_status & HOST_INTR_CMD_DONE) {
-                        adapter->int_status &= ~HOST_INTR_CMD_DONE;
+                if (pcie_ireg & HOST_INTR_CMD_DONE) {
+                        pcie_ireg &= ~HOST_INTR_CMD_DONE;
                         if (adapter->cmd_sent) {
                                 dev_dbg(adapter->dev,
                                         "info: CMD sent Interrupt\n");
@@ -1654,8 +1902,6 @@ static int mwifiex_process_int_status(struct mwifiex_adapter *adapter)
                                                  "Write register failed\n");
                                         return -1;
                                 }
-                                adapter->int_status |= pcie_ireg;
-                                adapter->int_status &= HOST_INTR_MASK;
                         }
 
                 }
@@ -1687,7 +1933,7 @@ static int mwifiex_pcie_host_to_card(struct mwifiex_adapter *adapter, u8 type,
         }
 
         if (type == MWIFIEX_TYPE_DATA)
-                return mwifiex_pcie_send_data(adapter, skb);
+                return mwifiex_pcie_send_data(adapter, skb, tx_param);
         else if (type == MWIFIEX_TYPE_CMD)
                 return mwifiex_pcie_send_cmd(adapter, skb);
 
@@ -1739,6 +1985,7 @@ static int mwifiex_pcie_init(struct mwifiex_adapter *adapter)
         card->pci_mmap = pci_iomap(pdev, 0, 0);
         if (!card->pci_mmap) {
                 dev_err(adapter->dev, "iomap(0) error\n");
+                ret = -EIO;
                 goto err_iomap0;
         }
         ret = pci_request_region(pdev, 2, DRV_NAME);
@@ -1749,6 +1996,7 @@ static int mwifiex_pcie_init(struct mwifiex_adapter *adapter)
         card->pci_mmap1 = pci_iomap(pdev, 2, 0);
         if (!card->pci_mmap1) {
                 dev_err(adapter->dev, "iomap(2) error\n");
+                ret = -EIO;
                 goto err_iomap2;
         }
 
@@ -1814,15 +2062,8 @@ static void mwifiex_pcie_cleanup(struct mwifiex_adapter *adapter)
         struct pcie_service_card *card = adapter->card;
         struct pci_dev *pdev = card->dev;
 
-        mwifiex_pcie_delete_sleep_cookie_buf(adapter);
-        mwifiex_pcie_delete_cmdrsp_buf(adapter);
-        mwifiex_pcie_delete_evtbd_ring(adapter);
-        mwifiex_pcie_delete_rxbd_ring(adapter);
-        mwifiex_pcie_delete_txbd_ring(adapter);
-        card->cmdrsp_buf = NULL;
-
-        dev_dbg(adapter->dev, "Clearing driver ready signature\n");
         if (user_rmmod) {
+                dev_dbg(adapter->dev, "Clearing driver ready signature\n");
                 if (mwifiex_write_reg(adapter, REG_DRV_READY, 0x00000000))
                         dev_err(adapter->dev,
                                 "Failed to write driver not-ready signature\n");
@@ -1879,6 +2120,13 @@ static void mwifiex_unregister_dev(struct mwifiex_adapter *adapter)
         if (card) {
                 dev_dbg(adapter->dev, "%s(): calling free_irq()\n", __func__);
                 free_irq(card->dev->irq, card->dev);
+
+                mwifiex_pcie_delete_sleep_cookie_buf(adapter);
+                mwifiex_pcie_delete_cmdrsp_buf(adapter);
+                mwifiex_pcie_delete_evtbd_ring(adapter);
+                mwifiex_pcie_delete_rxbd_ring(adapter);
+                mwifiex_pcie_delete_txbd_ring(adapter);
+                card->cmdrsp_buf = NULL;
         }
 }
 
@@ -1900,6 +2148,8 @@ static struct mwifiex_if_ops pcie_ops = {
         .event_complete =               mwifiex_pcie_event_complete,
         .update_mp_end_port =           NULL,
         .cleanup_mpa_buf =              NULL,
+        .init_fw_port =                 mwifiex_pcie_init_fw_port,
+        .clean_pcie_ring =              mwifiex_clean_pcie_ring_buf,
 };
 
 /*
diff --git a/drivers/net/wireless/mwifiex/pcie.h b/drivers/net/wireless/mwifiex/pcie.h
index 2f218f9a3fd3..37eeb2ca6b29 100644
--- a/drivers/net/wireless/mwifiex/pcie.h
+++ b/drivers/net/wireless/mwifiex/pcie.h
@@ -114,11 +114,12 @@ struct pcie_service_card {
         struct pci_dev *dev;
         struct mwifiex_adapter *adapter;
 
+        u8 txbd_flush;
         u32 txbd_wrptr;
         u32 txbd_rdptr;
         u32 txbd_ring_size;
         u8 *txbd_ring_vbase;
-        phys_addr_t txbd_ring_pbase;
+        dma_addr_t txbd_ring_pbase;
         struct mwifiex_pcie_buf_desc *txbd_ring[MWIFIEX_MAX_TXRX_BD];
         struct sk_buff *tx_buf_list[MWIFIEX_MAX_TXRX_BD];
 
@@ -126,7 +127,7 @@ struct pcie_service_card {
         u32 rxbd_rdptr;
         u32 rxbd_ring_size;
         u8 *rxbd_ring_vbase;
-        phys_addr_t rxbd_ring_pbase;
+        dma_addr_t rxbd_ring_pbase;
         struct mwifiex_pcie_buf_desc *rxbd_ring[MWIFIEX_MAX_TXRX_BD];
         struct sk_buff *rx_buf_list[MWIFIEX_MAX_TXRX_BD];
 
@@ -134,15 +135,39 @@ struct pcie_service_card {
         u32 evtbd_rdptr;
         u32 evtbd_ring_size;
         u8 *evtbd_ring_vbase;
-        phys_addr_t evtbd_ring_pbase;
+        dma_addr_t evtbd_ring_pbase;
         struct mwifiex_pcie_buf_desc *evtbd_ring[MWIFIEX_MAX_EVT_BD];
         struct sk_buff *evt_buf_list[MWIFIEX_MAX_EVT_BD];
 
         struct sk_buff *cmd_buf;
         struct sk_buff *cmdrsp_buf;
-        struct sk_buff *sleep_cookie;
+        u8 *sleep_cookie_vbase;
+        dma_addr_t sleep_cookie_pbase;
         void __iomem *pci_mmap;
         void __iomem *pci_mmap1;
 };
 
+static inline int
+mwifiex_pcie_txbd_empty(struct pcie_service_card *card, u32 rdptr)
+{
+        if (((card->txbd_wrptr & MWIFIEX_TXBD_MASK) ==
+                        (rdptr & MWIFIEX_TXBD_MASK)) &&
+            ((card->txbd_wrptr & MWIFIEX_BD_FLAG_ROLLOVER_IND) !=
+                        (rdptr & MWIFIEX_BD_FLAG_ROLLOVER_IND)))
+                return 1;
+
+        return 0;
+}
+
+static inline int
+mwifiex_pcie_txbd_not_full(struct pcie_service_card *card)
+{
+        if (((card->txbd_wrptr & MWIFIEX_TXBD_MASK) !=
+             (card->txbd_rdptr & MWIFIEX_TXBD_MASK)) ||
+            ((card->txbd_wrptr & MWIFIEX_BD_FLAG_ROLLOVER_IND) !=
+             (card->txbd_rdptr & MWIFIEX_BD_FLAG_ROLLOVER_IND)))
+                return 1;
+
+        return 0;
+}
 #endif /* _MWIFIEX_PCIE_H */
diff --git a/drivers/net/wireless/mwifiex/sdio.c b/drivers/net/wireless/mwifiex/sdio.c
index 5a1c1d0e5599..e35b67a9e6a6 100644
--- a/drivers/net/wireless/mwifiex/sdio.c
+++ b/drivers/net/wireless/mwifiex/sdio.c
@@ -332,7 +332,7 @@ mwifiex_write_data_sync(struct mwifiex_adapter *adapter,
                         u8 *buffer, u32 pkt_len, u32 port)
 {
         struct sdio_mmc_card *card = adapter->card;
-        int ret = -1;
+        int ret;
         u8 blk_mode =
                 (port & MWIFIEX_SDIO_BYTE_MODE_MASK) ? BYTE_MODE : BLOCK_MODE;
         u32 blk_size = (blk_mode == BLOCK_MODE) ? MWIFIEX_SDIO_BLOCK_SIZE : 1;
@@ -350,8 +350,7 @@ mwifiex_write_data_sync(struct mwifiex_adapter *adapter,
 
         sdio_claim_host(card->func);
 
-        if (!sdio_writesb(card->func, ioport, buffer, blk_cnt * blk_size))
-                ret = 0;
+        ret = sdio_writesb(card->func, ioport, buffer, blk_cnt * blk_size);
 
         sdio_release_host(card->func);
 
@@ -365,7 +364,7 @@ static int mwifiex_read_data_sync(struct mwifiex_adapter *adapter, u8 *buffer,
                                   u32 len, u32 port, u8 claim)
 {
         struct sdio_mmc_card *card = adapter->card;
-        int ret = -1;
+        int ret;
         u8 blk_mode = (port & MWIFIEX_SDIO_BYTE_MODE_MASK) ? BYTE_MODE
                        : BLOCK_MODE;
         u32 blk_size = (blk_mode == BLOCK_MODE) ? MWIFIEX_SDIO_BLOCK_SIZE : 1;
@@ -376,8 +375,7 @@ static int mwifiex_read_data_sync(struct mwifiex_adapter *adapter, u8 *buffer,
         if (claim)
                 sdio_claim_host(card->func);
 
-        if (!sdio_readsb(card->func, buffer, ioport, blk_cnt * blk_size))
-                ret = 0;
+        ret = sdio_readsb(card->func, buffer, ioport, blk_cnt * blk_size);
 
         if (claim)
                 sdio_release_host(card->func);
diff --git a/drivers/net/wireless/mwifiex/sta_cmd.c b/drivers/net/wireless/mwifiex/sta_cmd.c
index 5d87195390f8..c4607859d59d 100644
--- a/drivers/net/wireless/mwifiex/sta_cmd.c
+++ b/drivers/net/wireless/mwifiex/sta_cmd.c
@@ -931,7 +931,6 @@ mwifiex_cmd_pcie_host_spec(struct mwifiex_private *priv,
         struct host_cmd_ds_pcie_details *host_spec =
                                         &cmd->params.pcie_host_spec;
         struct pcie_service_card *card = priv->adapter->card;
-        phys_addr_t *buf_pa;
 
         cmd->command = cpu_to_le16(HostCmd_CMD_PCIE_DESC_DETAILS);
         cmd->size = cpu_to_le16(sizeof(struct
@@ -953,10 +952,11 @@ mwifiex_cmd_pcie_host_spec(struct mwifiex_private *priv,
         host_spec->evtbd_addr_lo = (u32)(card->evtbd_ring_pbase);
         host_spec->evtbd_addr_hi = (u32)(((u64)card->evtbd_ring_pbase)>>32);
         host_spec->evtbd_count = MWIFIEX_MAX_EVT_BD;
-        if (card->sleep_cookie) {
-                buf_pa = MWIFIEX_SKB_PACB(card->sleep_cookie);
-                host_spec->sleep_cookie_addr_lo = (u32) *buf_pa;
-                host_spec->sleep_cookie_addr_hi = (u32) (((u64)*buf_pa) >> 32);
+        if (card->sleep_cookie_vbase) {
+                host_spec->sleep_cookie_addr_lo =
+                                                (u32)(card->sleep_cookie_pbase);
+                host_spec->sleep_cookie_addr_hi =
+                                 (u32)(((u64)(card->sleep_cookie_pbase)) >> 32);
                 dev_dbg(priv->adapter->dev, "sleep_cook_lo phy addr: 0x%x\n",
                         host_spec->sleep_cookie_addr_lo);
         }
diff --git a/drivers/net/wireless/mwifiex/sta_ioctl.c b/drivers/net/wireless/mwifiex/sta_ioctl.c
index cb682561c438..f542bb8ccbc8 100644
--- a/drivers/net/wireless/mwifiex/sta_ioctl.c
+++ b/drivers/net/wireless/mwifiex/sta_ioctl.c
@@ -56,7 +56,6 @@ int mwifiex_copy_mcast_addr(struct mwifiex_multicast_list *mlist,
  */
 int mwifiex_wait_queue_complete(struct mwifiex_adapter *adapter)
 {
-        bool cancel_flag = false;
         int status;
         struct cmd_ctrl_node *cmd_queued;
 
@@ -70,14 +69,11 @@ int mwifiex_wait_queue_complete(struct mwifiex_adapter *adapter)
         atomic_inc(&adapter->cmd_pending);
 
         /* Wait for completion */
-        wait_event_interruptible(adapter->cmd_wait_q.wait,
-                                 *(cmd_queued->condition));
-        if (!*(cmd_queued->condition))
-                cancel_flag = true;
-
-        if (cancel_flag) {
-                mwifiex_cancel_pending_ioctl(adapter);
-                dev_dbg(adapter->dev, "cmd cancel\n");
+        status = wait_event_interruptible(adapter->cmd_wait_q.wait,
+                                          *(cmd_queued->condition));
+        if (status) {
+                dev_err(adapter->dev, "cmd_wait_q terminated: %d\n", status);
+                return status;
         }
 
         status = adapter->cmd_wait_q.status;
@@ -287,6 +283,20 @@ int mwifiex_bss_start(struct mwifiex_private *priv, struct cfg80211_bss *bss,
                 if (ret)
                         goto done;
 
+                if (bss_desc) {
+                        u8 config_bands = 0;
+
+                        if (mwifiex_band_to_radio_type((u8) bss_desc->bss_band)
+                            == HostCmd_SCAN_RADIO_TYPE_BG)
+                                config_bands = BAND_B | BAND_G | BAND_GN;
+                        else
+                                config_bands = BAND_A | BAND_AN;
+
+                        if (!((config_bands | adapter->fw_bands) &
+                              ~adapter->fw_bands))
+                                adapter->config_bands = config_bands;
+                }
+
                 ret = mwifiex_check_network_compatibility(priv, bss_desc);
                 if (ret)
                         goto done;
@@ -496,8 +506,11 @@ int mwifiex_enable_hs(struct mwifiex_adapter *adapter)
                 return false;
         }
 
-        wait_event_interruptible(adapter->hs_activate_wait_q,
-                                 adapter->hs_activate_wait_q_woken);
+        if (wait_event_interruptible(adapter->hs_activate_wait_q,
+                                     adapter->hs_activate_wait_q_woken)) {
+                dev_err(adapter->dev, "hs_activate_wait_q terminated\n");
+                return false;
+        }
 
         return true;
 }
diff --git a/drivers/net/wireless/mwifiex/txrx.c b/drivers/net/wireless/mwifiex/txrx.c
index 8c80024c30ff..296faec14365 100644
--- a/drivers/net/wireless/mwifiex/txrx.c
+++ b/drivers/net/wireless/mwifiex/txrx.c
@@ -117,14 +117,16 @@ int mwifiex_process_tx(struct mwifiex_private *priv, struct sk_buff *skb,
                 dev_dbg(adapter->dev, "data: -EBUSY is returned\n");
                 break;
         case -1:
-                adapter->data_sent = false;
+                if (adapter->iface_type != MWIFIEX_PCIE)
+                        adapter->data_sent = false;
                 dev_err(adapter->dev, "mwifiex_write_data_async failed: 0x%X\n",
                         ret);
                 adapter->dbg.num_tx_host_to_card_failure++;
                 mwifiex_write_data_complete(adapter, skb, 0, ret);
                 break;
         case -EINPROGRESS:
-                adapter->data_sent = false;
+                if (adapter->iface_type != MWIFIEX_PCIE)
+                        adapter->data_sent = false;
                 break;
         case 0:
                 mwifiex_write_data_complete(adapter, skb, 0, ret);
diff --git a/drivers/net/wireless/mwifiex/uap_cmd.c b/drivers/net/wireless/mwifiex/uap_cmd.c
index 8dd72240f162..6e76a15a8950 100644
--- a/drivers/net/wireless/mwifiex/uap_cmd.c
+++ b/drivers/net/wireless/mwifiex/uap_cmd.c
@@ -219,6 +219,7 @@ void mwifiex_set_sys_config_invalid_data(struct mwifiex_uap_bss_param *config)
         config->rts_threshold = 0x7FFF;
         config->frag_threshold = 0x7FFF;
         config->retry_limit = 0x7F;
+        config->qos_info = 0xFF;
 }
 
 /* This function parses BSS related parameters from structure
@@ -297,6 +298,38 @@ mwifiex_uap_bss_wpa(u8 **tlv_buf, void *cmd_buf, u16 *param_size)
         return;
 }
 
+/* This function parses WMM related parameters from cfg80211_ap_settings
+ * structure and updates bss_config structure.
+ */
+void
+mwifiex_set_wmm_params(struct mwifiex_private *priv,
+                       struct mwifiex_uap_bss_param *bss_cfg,
+                       struct cfg80211_ap_settings *params)
+{
+        const u8 *vendor_ie;
+        struct ieee_types_header *wmm_ie;
+        u8 wmm_oui[] = {0x00, 0x50, 0xf2, 0x02};
+
+        vendor_ie = cfg80211_find_vendor_ie(WLAN_OUI_MICROSOFT,
+                                            WLAN_OUI_TYPE_MICROSOFT_WMM,
+                                            params->beacon.tail,
+                                            params->beacon.tail_len);
+        if (vendor_ie) {
+                wmm_ie = (struct ieee_types_header *)vendor_ie;
+                memcpy(&bss_cfg->wmm_info, wmm_ie + 1,
+                       sizeof(bss_cfg->wmm_info));
+                priv->wmm_enabled = 1;
+        } else {
+                memset(&bss_cfg->wmm_info, 0, sizeof(bss_cfg->wmm_info));
+                memcpy(&bss_cfg->wmm_info.oui, wmm_oui, sizeof(wmm_oui));
+                bss_cfg->wmm_info.subtype = MWIFIEX_WMM_SUBTYPE;
+                bss_cfg->wmm_info.version = MWIFIEX_WMM_VERSION;
+                priv->wmm_enabled = 0;
+        }
+
+        bss_cfg->qos_info = 0x00;
+        return;
+}
 /* This function parses BSS related parameters from structure
  * and prepares TLVs specific to WEP encryption.
  * These TLVs are appended to command buffer.
@@ -354,6 +387,7 @@ mwifiex_uap_bss_param_prepare(u8 *tlv, void *cmd_buf, u16 *param_size)
         struct host_cmd_tlv_rates *tlv_rates;
         struct host_cmd_tlv_ageout_timer *ao_timer, *ps_ao_timer;
         struct mwifiex_ie_types_htcap *htcap;
+        struct mwifiex_ie_types_wmmcap *wmm_cap;
         struct mwifiex_uap_bss_param *bss_cfg = cmd_buf;
         int i;
         u16 cmd_size = *param_size;
@@ -507,6 +541,16 @@ mwifiex_uap_bss_param_prepare(u8 *tlv, void *cmd_buf, u16 *param_size)
                 tlv += sizeof(struct mwifiex_ie_types_htcap);
         }
 
+        if (bss_cfg->wmm_info.qos_info != 0xFF) {
+                wmm_cap = (struct mwifiex_ie_types_wmmcap *)tlv;
+                wmm_cap->header.type = cpu_to_le16(WLAN_EID_VENDOR_SPECIFIC);
+                wmm_cap->header.len = cpu_to_le16(sizeof(wmm_cap->wmm_info));
+                memcpy(&wmm_cap->wmm_info, &bss_cfg->wmm_info,
+                       sizeof(wmm_cap->wmm_info));
+                cmd_size += sizeof(struct mwifiex_ie_types_wmmcap);
+                tlv += sizeof(struct mwifiex_ie_types_wmmcap);
+        }
+
         if (bss_cfg->sta_ao_timer) {
                 ao_timer = (struct host_cmd_tlv_ageout_timer *)tlv;
                 ao_timer->tlv.type = cpu_to_le16(TLV_TYPE_UAP_AO_TIMER);
diff --git a/drivers/net/wireless/mwifiex/usb.c b/drivers/net/wireless/mwifiex/usb.c
index 63ac9f2d11ae..f90fe21e5bfd 100644
--- a/drivers/net/wireless/mwifiex/usb.c
+++ b/drivers/net/wireless/mwifiex/usb.c
@@ -672,7 +672,7 @@ static int mwifiex_write_data_sync(struct mwifiex_adapter *adapter, u8 *pbuf,
                            *len, &actual_length, timeout);
         if (ret) {
                 dev_err(adapter->dev, "usb_bulk_msg for tx failed: %d\n", ret);
-                ret = -1;
+                return ret;
         }
 
         *len = actual_length;
@@ -691,7 +691,7 @@ static int mwifiex_read_data_sync(struct mwifiex_adapter *adapter, u8 *pbuf,
                            *len, &actual_length, timeout);
         if (ret) {
                 dev_err(adapter->dev, "usb_bulk_msg for rx failed: %d\n", ret);
-                ret = -1;
+                return ret;
         }
 
         *len = actual_length;
@@ -786,21 +786,6 @@ static int mwifiex_register_dev(struct mwifiex_adapter *adapter)
         return 0;
 }
 
-/* This function reads one block of firmware data. */
-static int mwifiex_get_fw_data(struct mwifiex_adapter *adapter,
-                               u32 offset, u32 len, u8 *buf)
-{
-        if (!buf || !len)
-                return -1;
-
-        if (offset + len > adapter->firmware->size)
-                return -1;
-
-        memcpy(buf, adapter->firmware->data + offset, len);
-
-        return 0;
-}
-
 static int mwifiex_prog_fw_w_helper(struct mwifiex_adapter *adapter,
                                     struct mwifiex_fw_image *fw)
 {
@@ -836,23 +821,14 @@ static int mwifiex_prog_fw_w_helper(struct mwifiex_adapter *adapter,
                         dlen = 0;
                 } else {
                         /* copy the header of the fw_data to get the length */
-                        if (firmware)
-                                memcpy(&fwdata->fw_hdr, &firmware[tlen],
-                                       sizeof(struct fw_header));
-                        else
-                                mwifiex_get_fw_data(adapter, tlen,
-                                                    sizeof(struct fw_header),
-                                                    (u8 *)&fwdata->fw_hdr);
+                        memcpy(&fwdata->fw_hdr, &firmware[tlen],
+                               sizeof(struct fw_header));
 
                         dlen = le32_to_cpu(fwdata->fw_hdr.data_len);
                         dnld_cmd = le32_to_cpu(fwdata->fw_hdr.dnld_cmd);
                         tlen += sizeof(struct fw_header);
 
-                        if (firmware)
-                                memcpy(fwdata->data, &firmware[tlen], dlen);
-                        else
-                                mwifiex_get_fw_data(adapter, tlen, dlen,
-                                                    (u8 *)fwdata->data);
+                        memcpy(fwdata->data, &firmware[tlen], dlen);
 
                         fwdata->seq_num = cpu_to_le32(fw_seqnum);
                         tlen += dlen;
diff --git a/drivers/net/wireless/mwifiex/util.h b/drivers/net/wireless/mwifiex/util.h
index f6d36b9654a0..cb2d0582bd36 100644
--- a/drivers/net/wireless/mwifiex/util.h
+++ b/drivers/net/wireless/mwifiex/util.h
@@ -22,16 +22,16 @@
 
 static inline struct mwifiex_rxinfo *MWIFIEX_SKB_RXCB(struct sk_buff *skb)
 {
-        return (struct mwifiex_rxinfo *)(skb->cb + sizeof(phys_addr_t));
+        return (struct mwifiex_rxinfo *)(skb->cb + sizeof(dma_addr_t));
 }
 
 static inline struct mwifiex_txinfo *MWIFIEX_SKB_TXCB(struct sk_buff *skb)
 {
-        return (struct mwifiex_txinfo *)(skb->cb + sizeof(phys_addr_t));
+        return (struct mwifiex_txinfo *)(skb->cb + sizeof(dma_addr_t));
 }
 
-static inline phys_addr_t *MWIFIEX_SKB_PACB(struct sk_buff *skb)
+static inline void MWIFIEX_SKB_PACB(struct sk_buff *skb, dma_addr_t *buf_pa)
 {
-        return (phys_addr_t *)skb->cb;
+        memcpy(buf_pa, skb->cb, sizeof(dma_addr_t));
 }
 #endif /* !_MWIFIEX_UTIL_H_ */
diff --git a/drivers/net/wireless/mwifiex/wmm.c b/drivers/net/wireless/mwifiex/wmm.c
index 818f871ae987..135d96df2063 100644
--- a/drivers/net/wireless/mwifiex/wmm.c
+++ b/drivers/net/wireless/mwifiex/wmm.c
@@ -568,6 +568,8 @@ mwifiex_clean_txrx(struct mwifiex_private *priv)
         mwifiex_wmm_delete_all_ralist(priv);
         memcpy(tos_to_tid, ac_to_tid, sizeof(tos_to_tid));
 
+        if (priv->adapter->if_ops.clean_pcie_ring)
+                priv->adapter->if_ops.clean_pcie_ring(priv->adapter);
         spin_unlock_irqrestore(&priv->wmm.ra_list_spinlock, flags);
 }
 
@@ -1206,13 +1208,15 @@ mwifiex_send_processed_packet(struct mwifiex_private *priv,
                                        ra_list_flags);
                 break;
         case -1:
-                adapter->data_sent = false;
+                if (adapter->iface_type != MWIFIEX_PCIE)
+                        adapter->data_sent = false;
                 dev_err(adapter->dev, "host_to_card failed: %#x\n", ret);
                 adapter->dbg.num_tx_host_to_card_failure++;
                 mwifiex_write_data_complete(adapter, skb, 0, ret);
                 break;
         case -EINPROGRESS:
-                adapter->data_sent = false;
+                if (adapter->iface_type != MWIFIEX_PCIE)
+                        adapter->data_sent = false;
         default:
                 break;
         }
diff --git a/drivers/net/wireless/mwl8k.c b/drivers/net/wireless/mwl8k.c
index f221b95b90b3..2031130d860b 100644
--- a/drivers/net/wireless/mwl8k.c
+++ b/drivers/net/wireless/mwl8k.c
@@ -101,6 +101,18 @@ MODULE_PARM_DESC(ap_mode_default,
 #define MWL8K_MAX_TX_QUEUES     (MWL8K_TX_WMM_QUEUES + MWL8K_MAX_AMPDU_QUEUES)
 #define mwl8k_tx_queues(priv)   (MWL8K_TX_WMM_QUEUES + (priv)->num_ampdu_queues)
 
+/* txpriorities are mapped with hw queues.
+ * Each hw queue has a txpriority.
+ */
+#define TOTAL_HW_TX_QUEUES      8
+
+/* Each HW queue can have one AMPDU stream.
+ * But, because one of the hw queue is reserved,
+ * maximum AMPDU queues that can be created are
+ * one short of total tx queues.
+ */
+#define MWL8K_NUM_AMPDU_STREAMS (TOTAL_HW_TX_QUEUES - 1)
+
 struct rxd_ops {
         int rxd_size;
         void (*rxd_init)(void *rxd, dma_addr_t next_dma_addr);
@@ -160,7 +172,6 @@ struct mwl8k_ampdu_stream {
         u8 tid;
         u8 state;
         u8 idx;
-        u8 txq_idx; /* index of this stream in priv->txq */
 };
 
 struct mwl8k_priv {
@@ -202,6 +213,8 @@ struct mwl8k_priv {
         int fw_mutex_depth;
         struct completion *hostcmd_wait;
 
+        atomic_t watchdog_event_pending;
+
         /* lock held over TX and TX reap */
         spinlock_t tx_lock;
 
@@ -272,6 +285,9 @@ struct mwl8k_priv {
         char *fw_pref;
         char *fw_alt;
         struct completion firmware_loading_complete;
+
+        /* bitmap of running BSSes */
+        u32 running_bsses;
 };
 
 #define MAX_WEP_KEY_LEN         13
@@ -1516,6 +1532,9 @@ static int mwl8k_tx_wait_empty(struct ieee80211_hw *hw)
                         return -EBUSY;
         }
 
+        if (atomic_read(&priv->watchdog_event_pending))
+                return 0;
+
         /*
          * The TX queues are stopped at this point, so this test
          * doesn't need to take ->tx_lock.
@@ -1537,6 +1556,14 @@ static int mwl8k_tx_wait_empty(struct ieee80211_hw *hw)
                 spin_unlock_bh(&priv->tx_lock);
                 timeout = wait_for_completion_timeout(&tx_wait,
                             msecs_to_jiffies(MWL8K_TX_WAIT_TIMEOUT_MS));
+
+                if (atomic_read(&priv->watchdog_event_pending)) {
+                        spin_lock_bh(&priv->tx_lock);
+                        priv->tx_wait = NULL;
+                        spin_unlock_bh(&priv->tx_lock);
+                        return 0;
+                }
+
                 spin_lock_bh(&priv->tx_lock);
 
                 if (timeout) {
@@ -1564,6 +1591,7 @@ static int mwl8k_tx_wait_empty(struct ieee80211_hw *hw)
 
                 rc = -ETIMEDOUT;
         }
+        priv->tx_wait = NULL;
         spin_unlock_bh(&priv->tx_lock);
 
         return rc;
@@ -1734,14 +1762,13 @@ mwl8k_add_stream(struct ieee80211_hw *hw, struct ieee80211_sta *sta, u8 tid)
         struct mwl8k_priv *priv = hw->priv;
         int i;
 
-        for (i = 0; i < priv->num_ampdu_queues; i++) {
+        for (i = 0; i < MWL8K_NUM_AMPDU_STREAMS; i++) {
                 stream = &priv->ampdu[i];
                 if (stream->state == AMPDU_NO_STREAM) {
                         stream->sta = sta;
                         stream->state = AMPDU_STREAM_NEW;
                         stream->tid = tid;
                         stream->idx = i;
-                        stream->txq_idx = MWL8K_TX_WMM_QUEUES + i;
                         wiphy_debug(hw->wiphy, "Added a new stream for %pM %d",
                                     sta->addr, tid);
                         return stream;
@@ -1782,7 +1809,7 @@ mwl8k_lookup_stream(struct ieee80211_hw *hw, u8 *addr, u8 tid)
         struct mwl8k_priv *priv = hw->priv;
         int i;
 
-        for (i = 0 ; i < priv->num_ampdu_queues; i++) {
+        for (i = 0; i < MWL8K_NUM_AMPDU_STREAMS; i++) {
                 struct mwl8k_ampdu_stream *stream;
                 stream = &priv->ampdu[i];
                 if (stream->state == AMPDU_NO_STREAM)
@@ -1829,6 +1856,13 @@ static inline void mwl8k_tx_count_packet(struct ieee80211_sta *sta, u8 tid)
                 tx_stats->pkts++;
 }
 
+/* The hardware ampdu queues start from 5.
+ * txpriorities for ampdu queues are
+ * 5 6 7 0 1 2 3 4 ie., queue 5 is highest
+ * and queue 3 is lowest (queue 4 is reserved)
+ */
+#define BA_QUEUE                5
+
 static void
 mwl8k_txq_xmit(struct ieee80211_hw *hw,
                int index,
@@ -1928,8 +1962,13 @@ mwl8k_txq_xmit(struct ieee80211_hw *hw,
                 stream = mwl8k_lookup_stream(hw, sta->addr, tid);
                 if (stream != NULL) {
                         if (stream->state == AMPDU_STREAM_ACTIVE) {
-                                txpriority = stream->txq_idx;
-                                index = stream->txq_idx;
+                                WARN_ON(!(qos & MWL8K_QOS_ACK_POLICY_BLOCKACK));
+                                txpriority = (BA_QUEUE + stream->idx) %
+                                             TOTAL_HW_TX_QUEUES;
+                                if (stream->idx <= 1)
+                                        index = stream->idx +
+                                                MWL8K_TX_WMM_QUEUES;
+
                         } else if (stream->state == AMPDU_STREAM_NEW) {
                                 /* We get here if the driver sends us packets
                                  * after we've initiated a stream, but before
@@ -1971,6 +2010,9 @@ mwl8k_txq_xmit(struct ieee80211_hw *hw,
                         }
                 }
                 spin_unlock(&priv->stream_lock);
+        } else {
+                qos &= ~MWL8K_QOS_ACK_POLICY_MASK;
+                qos |= MWL8K_QOS_ACK_POLICY_NORMAL;
         }
 
         dma = pci_map_single(priv->pdev, skb->data,
@@ -2117,6 +2159,8 @@ static void mwl8k_fw_unlock(struct ieee80211_hw *hw)
         }
 }
 
+static void mwl8k_enable_bsses(struct ieee80211_hw *hw, bool enable,
+                               u32 bitmap);
 
 /*
  * Command processing.
@@ -2135,6 +2179,34 @@ static int mwl8k_post_cmd(struct ieee80211_hw *hw, struct mwl8k_cmd_pkt *cmd)
         int rc;
         unsigned long timeout = 0;
         u8 buf[32];
+        u32 bitmap = 0;
+
+        wiphy_dbg(hw->wiphy, "Posting %s [%d]\n",
+                  mwl8k_cmd_name(cmd->code, buf, sizeof(buf)), cmd->macid);
+
+        /* Before posting firmware commands that could change the hardware
+         * characteristics, make sure that all BSSes are stopped temporary.
+         * Enable these stopped BSSes after completion of the commands
+         */
+
+        rc = mwl8k_fw_lock(hw);
+        if (rc)
+                return rc;
+
+        if (priv->ap_fw && priv->running_bsses) {
+                switch (le16_to_cpu(cmd->code)) {
+                case MWL8K_CMD_SET_RF_CHANNEL:
+                case MWL8K_CMD_RADIO_CONTROL:
+                case MWL8K_CMD_RF_TX_POWER:
+                case MWL8K_CMD_TX_POWER:
+                case MWL8K_CMD_RF_ANTENNA:
+                case MWL8K_CMD_RTS_THRESHOLD:
+                case MWL8K_CMD_MIMO_CONFIG:
+                        bitmap = priv->running_bsses;
+                        mwl8k_enable_bsses(hw, false, bitmap);
+                        break;
+                }
+        }
 
         cmd->result = (__force __le16) 0xffff;
         dma_size = le16_to_cpu(cmd->length);
@@ -2143,13 +2215,6 @@ static int mwl8k_post_cmd(struct ieee80211_hw *hw, struct mwl8k_cmd_pkt *cmd)
         if (pci_dma_mapping_error(priv->pdev, dma_addr))
                 return -ENOMEM;
 
-        rc = mwl8k_fw_lock(hw);
-        if (rc) {
-                pci_unmap_single(priv->pdev, dma_addr, dma_size,
-                                                PCI_DMA_BIDIRECTIONAL);
-                return rc;
-        }
-
         priv->hostcmd_wait = &cmd_wait;
         iowrite32(dma_addr, regs + MWL8K_HIU_GEN_PTR);
         iowrite32(MWL8K_H2A_INT_DOORBELL,
@@ -2162,7 +2227,6 @@ static int mwl8k_post_cmd(struct ieee80211_hw *hw, struct mwl8k_cmd_pkt *cmd)
 
         priv->hostcmd_wait = NULL;
 
-        mwl8k_fw_unlock(hw);
 
         pci_unmap_single(priv->pdev, dma_addr, dma_size,
                                         PCI_DMA_BIDIRECTIONAL);
@@ -2189,6 +2253,11 @@ static int mwl8k_post_cmd(struct ieee80211_hw *hw, struct mwl8k_cmd_pkt *cmd)
                                      ms);
         }
 
+        if (bitmap)
+                mwl8k_enable_bsses(hw, true, bitmap);
+
+        mwl8k_fw_unlock(hw);
+
         return rc;
 }
 
@@ -2450,7 +2519,7 @@ static int mwl8k_cmd_get_hw_spec_ap(struct ieee80211_hw *hw)
                 priv->hw_rev = cmd->hw_rev;
                 mwl8k_set_caps(hw, le32_to_cpu(cmd->caps));
                 priv->ap_macids_supported = 0x000000ff;
-                priv->sta_macids_supported = 0x00000000;
+                priv->sta_macids_supported = 0x00000100;
                 priv->num_ampdu_queues = le32_to_cpu(cmd->num_of_ampdu_queues);
                 if (priv->num_ampdu_queues > MWL8K_MAX_AMPDU_QUEUES) {
                         wiphy_warn(hw->wiphy, "fw reported %d ampdu queues"
@@ -3469,7 +3538,10 @@ static int mwl8k_cmd_update_mac_addr(struct ieee80211_hw *hw,
         mac_type = MWL8K_MAC_TYPE_PRIMARY_AP;
         if (vif != NULL && vif->type == NL80211_IFTYPE_STATION) {
                 if (mwl8k_vif->macid + 1 == ffs(priv->sta_macids_supported))
-                        mac_type = MWL8K_MAC_TYPE_PRIMARY_CLIENT;
+                        if (priv->ap_fw)
+                                mac_type = MWL8K_MAC_TYPE_SECONDARY_CLIENT;
+                        else
+                                mac_type = MWL8K_MAC_TYPE_PRIMARY_CLIENT;
                 else
                         mac_type = MWL8K_MAC_TYPE_SECONDARY_CLIENT;
         } else if (vif != NULL && vif->type == NL80211_IFTYPE_AP) {
@@ -3578,7 +3650,11 @@ static int mwl8k_cmd_get_watchdog_bitmap(struct ieee80211_hw *hw, u8 *bitmap)
         return rc;
 }
 
-#define INVALID_BA      0xAA
+#define MWL8K_WMM_QUEUE_NUMBER  3
+
+static void mwl8k_destroy_ba(struct ieee80211_hw *hw,
+                             u8 idx);
+
 static void mwl8k_watchdog_ba_events(struct work_struct *work)
 {
         int rc;
@@ -3586,24 +3662,41 @@ static void mwl8k_watchdog_ba_events(struct work_struct *work)
         struct mwl8k_ampdu_stream *streams;
         struct mwl8k_priv *priv =
                 container_of(work, struct mwl8k_priv, watchdog_ba_handle);
+        struct ieee80211_hw *hw = priv->hw;
+        int i;
+        u32 status = 0;
+
+        mwl8k_fw_lock(hw);
 
         rc = mwl8k_cmd_get_watchdog_bitmap(priv->hw, &bitmap);
         if (rc)
-                return;
+                goto done;
 
-        if (bitmap == INVALID_BA)
-                return;
+        spin_lock(&priv->stream_lock);
 
         /* the bitmap is the hw queue number.  Map it to the ampdu queue. */
-        stream_index = bitmap - MWL8K_TX_WMM_QUEUES;
-
-        BUG_ON(stream_index >= priv->num_ampdu_queues);
-
-        streams = &priv->ampdu[stream_index];
-
-        if (streams->state == AMPDU_STREAM_ACTIVE)
-                ieee80211_stop_tx_ba_session(streams->sta, streams->tid);
+        for (i = 0; i < TOTAL_HW_TX_QUEUES; i++) {
+                if (bitmap & (1 << i)) {
+                        stream_index = (i + MWL8K_WMM_QUEUE_NUMBER) %
+                                       TOTAL_HW_TX_QUEUES;
+                        streams = &priv->ampdu[stream_index];
+                        if (streams->state == AMPDU_STREAM_ACTIVE) {
+                                ieee80211_stop_tx_ba_session(streams->sta,
+                                                             streams->tid);
+                                spin_unlock(&priv->stream_lock);
+                                mwl8k_destroy_ba(hw, stream_index);
+                                spin_lock(&priv->stream_lock);
+                        }
+                }
+        }
 
+        spin_unlock(&priv->stream_lock);
+done:
+        atomic_dec(&priv->watchdog_event_pending);
+        status = ioread32(priv->regs + MWL8K_HIU_A2H_INTERRUPT_STATUS_MASK);
+        iowrite32((status | MWL8K_A2H_INT_BA_WATCHDOG),
+                  priv->regs + MWL8K_HIU_A2H_INTERRUPT_STATUS_MASK);
+        mwl8k_fw_unlock(hw);
         return;
 }
 
@@ -3620,8 +3713,16 @@ static int mwl8k_cmd_bss_start(struct ieee80211_hw *hw,
                                struct ieee80211_vif *vif, int enable)
 {
         struct mwl8k_cmd_bss_start *cmd;
+        struct mwl8k_vif *mwl8k_vif = MWL8K_VIF(vif);
+        struct mwl8k_priv *priv = hw->priv;
         int rc;
 
+        if (enable && (priv->running_bsses & (1 << mwl8k_vif->macid)))
+                return 0;
+
+        if (!enable && !(priv->running_bsses & (1 << mwl8k_vif->macid)))
+                return 0;
+
         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
         if (cmd == NULL)
                 return -ENOMEM;
@@ -3633,9 +3734,31 @@ static int mwl8k_cmd_bss_start(struct ieee80211_hw *hw,
         rc = mwl8k_post_pervif_cmd(hw, vif, &cmd->header);
         kfree(cmd);
 
+        if (!rc) {
+                if (enable)
+                        priv->running_bsses |= (1 << mwl8k_vif->macid);
+                else
+                        priv->running_bsses &= ~(1 << mwl8k_vif->macid);
+        }
         return rc;
 }
 
+static void mwl8k_enable_bsses(struct ieee80211_hw *hw, bool enable, u32 bitmap)
+{
+        struct mwl8k_priv *priv = hw->priv;
+        struct mwl8k_vif *mwl8k_vif, *tmp_vif;
+        struct ieee80211_vif *vif;
+
+        list_for_each_entry_safe(mwl8k_vif, tmp_vif, &priv->vif_list, list) {
+                vif = mwl8k_vif->vif;
+
+                if (!(bitmap & (1 << mwl8k_vif->macid)))
+                        continue;
+
+                if (vif->type == NL80211_IFTYPE_AP)
+                        mwl8k_cmd_bss_start(hw, vif, enable);
+        }
+}
 /*
  * CMD_BASTREAM.
  */
@@ -3763,7 +3886,7 @@ mwl8k_create_ba(struct ieee80211_hw *hw, struct mwl8k_ampdu_stream *stream,
 }
 
 static void mwl8k_destroy_ba(struct ieee80211_hw *hw,
-                             struct mwl8k_ampdu_stream *stream)
+                             u8 idx)
 {
         struct mwl8k_cmd_bastream *cmd;
 
@@ -3775,10 +3898,10 @@ static void mwl8k_destroy_ba(struct ieee80211_hw *hw,
         cmd->header.length = cpu_to_le16(sizeof(*cmd));
         cmd->action = cpu_to_le32(MWL8K_BA_DESTROY);
 
-        cmd->destroy_params.ba_context = cpu_to_le32(stream->idx);
+        cmd->destroy_params.ba_context = cpu_to_le32(idx);
         mwl8k_post_cmd(hw, &cmd->header);
 
-        wiphy_debug(hw->wiphy, "Deleted BA stream index %d\n", stream->idx);
+        wiphy_debug(hw->wiphy, "Deleted BA stream index %d\n", idx);
 
         kfree(cmd);
 }
@@ -3875,7 +3998,30 @@ static int mwl8k_cmd_set_new_stn_del(struct ieee80211_hw *hw,
                                      struct ieee80211_vif *vif, u8 *addr)
 {
         struct mwl8k_cmd_set_new_stn *cmd;
-        int rc;
+        struct mwl8k_priv *priv = hw->priv;
+        int rc, i;
+        u8 idx;
+
+        spin_lock(&priv->stream_lock);
+        /* Destroy any active ampdu streams for this sta */
+        for (i = 0; i < MWL8K_NUM_AMPDU_STREAMS; i++) {
+                struct mwl8k_ampdu_stream *s;
+                s = &priv->ampdu[i];
+                if (s->state != AMPDU_NO_STREAM) {
+                        if (memcmp(s->sta->addr, addr, ETH_ALEN) == 0) {
+                                if (s->state == AMPDU_STREAM_ACTIVE) {
+                                        idx = s->idx;
+                                        spin_unlock(&priv->stream_lock);
+                                        mwl8k_destroy_ba(hw, idx);
+                                        spin_lock(&priv->stream_lock);
+                                } else if (s->state == AMPDU_STREAM_NEW) {
+                                        mwl8k_remove_stream(hw, s);
+                                }
+                        }
+                }
+        }
+
+        spin_unlock(&priv->stream_lock);
 
         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
         if (cmd == NULL)
@@ -4119,8 +4265,9 @@ static int mwl8k_set_key(struct ieee80211_hw *hw,
         u8 encr_type;
         u8 *addr;
         struct mwl8k_vif *mwl8k_vif = MWL8K_VIF(vif);
+        struct mwl8k_priv *priv = hw->priv;
 
-        if (vif->type == NL80211_IFTYPE_STATION)
+        if (vif->type == NL80211_IFTYPE_STATION && !priv->ap_fw)
                 return -EOPNOTSUPP;
 
         if (sta == NULL)
@@ -4250,9 +4397,11 @@ static int mwl8k_cmd_update_stadb_add(struct ieee80211_hw *hw,
         p->amsdu_enabled = 0;
 
         rc = mwl8k_post_cmd(hw, &cmd->header);
+        if (!rc)
+                rc = p->station_id;
         kfree(cmd);
 
-        return rc ? rc : p->station_id;
+        return rc;
 }
 
 static int mwl8k_cmd_update_stadb_del(struct ieee80211_hw *hw,
@@ -4301,6 +4450,10 @@ static irqreturn_t mwl8k_interrupt(int irq, void *dev_id)
         }
 
         if (status & MWL8K_A2H_INT_BA_WATCHDOG) {
+                iowrite32(~MWL8K_A2H_INT_BA_WATCHDOG,
+                          priv->regs + MWL8K_HIU_A2H_INTERRUPT_STATUS_MASK);
+
+                atomic_inc(&priv->watchdog_event_pending);
                 status &= ~MWL8K_A2H_INT_BA_WATCHDOG;
                 ieee80211_queue_work(hw, &priv->watchdog_ba_handle);
         }
@@ -4444,6 +4597,8 @@ static int mwl8k_start(struct ieee80211_hw *hw)
                 priv->irq = -1;
                 tasklet_disable(&priv->poll_tx_task);
                 tasklet_disable(&priv->poll_rx_task);
+        } else {
+                ieee80211_wake_queues(hw);
         }
 
         return rc;
@@ -4518,12 +4673,18 @@ static int mwl8k_add_interface(struct ieee80211_hw *hw,
                 break;
         case NL80211_IFTYPE_STATION:
                 if (priv->ap_fw && di->fw_image_sta) {
-                        /* we must load the sta fw to meet this request */
-                        if (!list_empty(&priv->vif_list))
-                                return -EBUSY;
-                        rc = mwl8k_reload_firmware(hw, di->fw_image_sta);
-                        if (rc)
-                                return rc;
+                        if (!list_empty(&priv->vif_list)) {
+                                wiphy_warn(hw->wiphy, "AP interface is running.\n"
+                                           "Adding STA interface for WDS");
+                        } else {
+                                /* we must load the sta fw to
+                                 * meet this request.
+                                 */
+                                rc = mwl8k_reload_firmware(hw,
+                                                           di->fw_image_sta);
+                                if (rc)
+                                        return rc;
+                        }
                 }
                 macids_supported = priv->sta_macids_supported;
                 break;
@@ -4547,7 +4708,7 @@ static int mwl8k_add_interface(struct ieee80211_hw *hw,
         /* Set the mac address.  */
         mwl8k_cmd_set_mac_addr(hw, vif, vif->addr);
 
-        if (priv->ap_fw)
+        if (vif->type == NL80211_IFTYPE_AP)
                 mwl8k_cmd_set_new_stn_add_self(hw, vif);
 
         priv->macids_used |= 1 << mwl8k_vif->macid;
@@ -4572,7 +4733,7 @@ static void mwl8k_remove_interface(struct ieee80211_hw *hw,
         struct mwl8k_priv *priv = hw->priv;
         struct mwl8k_vif *mwl8k_vif = MWL8K_VIF(vif);
 
-        if (priv->ap_fw)
+        if (vif->type == NL80211_IFTYPE_AP)
                 mwl8k_cmd_set_new_stn_del(hw, vif, vif->addr);
 
         mwl8k_cmd_del_mac_addr(hw, vif, vif->addr);
@@ -4646,9 +4807,11 @@ static int mwl8k_config(struct ieee80211_hw *hw, u32 changed)
         if (rc)
                 goto out;
 
-        rc = mwl8k_cmd_set_rf_channel(hw, conf);
-        if (rc)
-                goto out;
+        if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
+                rc = mwl8k_cmd_set_rf_channel(hw, conf);
+                if (rc)
+                        goto out;
+        }
 
         if (conf->power_level > 18)
                 conf->power_level = 18;
@@ -4661,12 +4824,6 @@ static int mwl8k_config(struct ieee80211_hw *hw, u32 changed)
                                 goto out;
                 }
 
-                rc = mwl8k_cmd_rf_antenna(hw, MWL8K_RF_ANTENNA_RX, 0x3);
-                if (rc)
-                        wiphy_warn(hw->wiphy, "failed to set # of RX antennas");
-                rc = mwl8k_cmd_rf_antenna(hw, MWL8K_RF_ANTENNA_TX, 0x7);
-                if (rc)
-                        wiphy_warn(hw->wiphy, "failed to set # of TX antennas");
 
         } else {
                 rc = mwl8k_cmd_rf_tx_power(hw, conf->power_level);
@@ -4724,7 +4881,8 @@ mwl8k_bss_info_changed_sta(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                 rcu_read_unlock();
         }
 
-        if ((changed & BSS_CHANGED_ASSOC) && vif->bss_conf.assoc) {
+        if ((changed & BSS_CHANGED_ASSOC) && vif->bss_conf.assoc &&
+            !priv->ap_fw) {
                 rc = mwl8k_cmd_set_rate(hw, vif, ap_legacy_rates, ap_mcs_rates);
                 if (rc)
                         goto out;
@@ -4732,6 +4890,25 @@ mwl8k_bss_info_changed_sta(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                 rc = mwl8k_cmd_use_fixed_rate_sta(hw);
                 if (rc)
                         goto out;
+        } else {
+                if ((changed & BSS_CHANGED_ASSOC) && vif->bss_conf.assoc &&
+                    priv->ap_fw) {
+                        int idx;
+                        int rate;
+
+                        /* Use AP firmware specific rate command.
+                         */
+                        idx = ffs(vif->bss_conf.basic_rates);
+                        if (idx)
+                                idx--;
+
+                        if (hw->conf.channel->band == IEEE80211_BAND_2GHZ)
+                                rate = mwl8k_rates_24[idx].hw_value;
+                        else
+                                rate = mwl8k_rates_50[idx].hw_value;
+
+                        mwl8k_cmd_use_fixed_rate_ap(hw, rate, rate);
+                }
         }
 
         if (changed & BSS_CHANGED_ERP_PREAMBLE) {
@@ -4741,13 +4918,13 @@ mwl8k_bss_info_changed_sta(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                         goto out;
         }
 
-        if (changed & BSS_CHANGED_ERP_SLOT) {
+        if ((changed & BSS_CHANGED_ERP_SLOT) && !priv->ap_fw)  {
                 rc = mwl8k_cmd_set_slot(hw, vif->bss_conf.use_short_slot);
                 if (rc)
                         goto out;
         }
 
-        if (vif->bss_conf.assoc &&
+        if (vif->bss_conf.assoc && !priv->ap_fw &&
             (changed & (BSS_CHANGED_ASSOC | BSS_CHANGED_ERP_CTS_PROT |
                         BSS_CHANGED_HT))) {
                 rc = mwl8k_cmd_set_aid(hw, vif, ap_legacy_rates);
@@ -4827,11 +5004,9 @@ static void
 mwl8k_bss_info_changed(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                        struct ieee80211_bss_conf *info, u32 changed)
 {
-        struct mwl8k_priv *priv = hw->priv;
-
-        if (!priv->ap_fw)
+        if (vif->type == NL80211_IFTYPE_STATION)
                 mwl8k_bss_info_changed_sta(hw, vif, info, changed);
-        else
+        if (vif->type == NL80211_IFTYPE_AP)
                 mwl8k_bss_info_changed_ap(hw, vif, info, changed);
 }
 
@@ -5092,7 +5267,7 @@ mwl8k_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
         int i, rc = 0;
         struct mwl8k_priv *priv = hw->priv;
         struct mwl8k_ampdu_stream *stream;
-        u8 *addr = sta->addr;
+        u8 *addr = sta->addr, idx;
         struct mwl8k_sta *sta_info = MWL8K_STA(sta);
 
         if (!(hw->flags & IEEE80211_HW_AMPDU_AGGREGATION))
@@ -5170,11 +5345,14 @@ mwl8k_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                 }
                 ieee80211_start_tx_ba_cb_irqsafe(vif, addr, tid);
                 break;
-        case IEEE80211_AMPDU_TX_STOP:
+        case IEEE80211_AMPDU_TX_STOP_CONT:
+        case IEEE80211_AMPDU_TX_STOP_FLUSH:
+        case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
                 if (stream) {
                         if (stream->state == AMPDU_STREAM_ACTIVE) {
+                                idx = stream->idx;
                                 spin_unlock(&priv->stream_lock);
-                                mwl8k_destroy_ba(hw, stream);
+                                mwl8k_destroy_ba(hw, idx);
                                 spin_lock(&priv->stream_lock);
                         }
                         mwl8k_remove_stream(hw, stream);
@@ -5190,8 +5368,9 @@ mwl8k_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                 if (!rc)
                         stream->state = AMPDU_STREAM_ACTIVE;
                 else {
+                        idx = stream->idx;
                         spin_unlock(&priv->stream_lock);
-                        mwl8k_destroy_ba(hw, stream);
+                        mwl8k_destroy_ba(hw, idx);
                         spin_lock(&priv->stream_lock);
                         wiphy_debug(hw->wiphy,
                                 "Failed adding stream for sta %pM tid %d\n",
@@ -5254,7 +5433,7 @@ enum {
         MWL8366,
 };
 
-#define MWL8K_8366_AP_FW_API 2
+#define MWL8K_8366_AP_FW_API 3
 #define _MWL8K_8366_AP_FW(api) "mwl8k/fmimage_8366_ap-" #api ".fw"
 #define MWL8K_8366_AP_FW(api) _MWL8K_8366_AP_FW(api)
 
@@ -5462,6 +5641,7 @@ static int mwl8k_probe_hw(struct ieee80211_hw *hw)
                 if (priv->rxd_ops == NULL) {
                         wiphy_err(hw->wiphy,
                                   "Driver does not have AP firmware image support for this hardware\n");
+                        rc = -ENOENT;
                         goto err_stop_firmware;
                 }
         } else {
@@ -5471,6 +5651,7 @@ static int mwl8k_probe_hw(struct ieee80211_hw *hw)
         priv->sniffer_enabled = false;
         priv->wmm_enabled = false;
         priv->pending_tx_pkts = 0;
+        atomic_set(&priv->watchdog_event_pending, 0);
 
         rc = mwl8k_rxq_init(hw, 0);
         if (rc)
@@ -5550,6 +5731,15 @@ static int mwl8k_probe_hw(struct ieee80211_hw *hw)
                 goto err_free_irq;
         }
 
+        /* Configure Antennas */
+        rc = mwl8k_cmd_rf_antenna(hw, MWL8K_RF_ANTENNA_RX, 0x3);
+        if (rc)
+                wiphy_warn(hw->wiphy, "failed to set # of RX antennas");
+        rc = mwl8k_cmd_rf_antenna(hw, MWL8K_RF_ANTENNA_TX, 0x7);
+        if (rc)
+                wiphy_warn(hw->wiphy, "failed to set # of TX antennas");
+
+
         /* Disable interrupts */
         iowrite32(0, priv->regs + MWL8K_HIU_A2H_INTERRUPT_MASK);
         free_irq(priv->pdev->irq, hw);
@@ -5637,6 +5827,7 @@ fail:
 
 static const struct ieee80211_iface_limit ap_if_limits[] = {
         { .max = 8,     .types = BIT(NL80211_IFTYPE_AP) },
+        { .max = 1,     .types = BIT(NL80211_IFTYPE_STATION) },
 };
 
 static const struct ieee80211_iface_combination ap_if_comb = {
@@ -5729,6 +5920,7 @@ static int mwl8k_firmware_load_success(struct mwl8k_priv *priv)
 
         if (priv->ap_macids_supported || priv->device_info->fw_image_ap) {
                 hw->wiphy->interface_modes |= BIT(NL80211_IFTYPE_AP);
+                hw->wiphy->interface_modes |= BIT(NL80211_IFTYPE_STATION);
                 hw->wiphy->iface_combinations = &ap_if_comb;
                 hw->wiphy->n_iface_combinations = 1;
         }
@@ -5807,6 +5999,7 @@ static int mwl8k_probe(struct pci_dev *pdev,
         priv->sram = pci_iomap(pdev, 0, 0x10000);
         if (priv->sram == NULL) {
                 wiphy_err(hw->wiphy, "Cannot map device SRAM\n");
+                rc = -EIO;
                 goto err_iounmap;
         }
 
@@ -5819,6 +6012,7 @@ static int mwl8k_probe(struct pci_dev *pdev,
                 priv->regs = pci_iomap(pdev, 2, 0x10000);
                 if (priv->regs == NULL) {
                         wiphy_err(hw->wiphy, "Cannot map device registers\n");
+                        rc = -EIO;
                         goto err_iounmap;
                 }
         }
@@ -5849,6 +6043,8 @@ static int mwl8k_probe(struct pci_dev *pdev,
 
         priv->hw_restart_in_progress = false;
 
+        priv->running_bsses = 0;
+
         return rc;
 
 err_stop_firmware:
diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
index 933e5d941937..57e3af8ebb4b 100644
--- a/drivers/net/wireless/p54/p54pci.c
+++ b/drivers/net/wireless/p54/p54pci.c
@@ -559,6 +559,7 @@ static int p54p_probe(struct pci_dev *pdev,
         mem_len = pci_resource_len(pdev, 0);
         if (mem_len < sizeof(struct p54p_csr)) {
                 dev_err(&pdev->dev, "Too short PCI resources\n");
+                err = -ENODEV;
                 goto err_disable_dev;
         }
 
@@ -568,8 +569,10 @@ static int p54p_probe(struct pci_dev *pdev,
                 goto err_disable_dev;
         }
 
-        if (pci_set_dma_mask(pdev, DMA_BIT_MASK(32)) ||
-            pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32))) {
+        err = pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
+        if (!err)
+                err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32));
+        if (err) {
                 dev_err(&pdev->dev, "No suitable DMA available\n");
                 goto err_free_reg;
         }
diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
index e71c702e2eb1..800a16526c8e 100644
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -47,6 +47,7 @@ static struct usb_device_id p54u_table[] = {
         {USB_DEVICE(0x0411, 0x0050)},   /* Buffalo WLI2-USB2-G54 */
         {USB_DEVICE(0x045e, 0x00c2)},   /* Microsoft MN-710 */
         {USB_DEVICE(0x0506, 0x0a11)},   /* 3COM 3CRWE254G72 */
+        {USB_DEVICE(0x0675, 0x0530)},   /* DrayTek Vigor 530 */
         {USB_DEVICE(0x06b9, 0x0120)},   /* Thomson SpeedTouch 120g */
         {USB_DEVICE(0x0707, 0xee06)},   /* SMC 2862W-G */
         {USB_DEVICE(0x07aa, 0x001c)},   /* Corega CG-WLUSB2GT */
@@ -82,6 +83,8 @@ static struct usb_device_id p54u_table[] = {
         {USB_DEVICE(0x06a9, 0x000e)},   /* Westell 802.11g USB (A90-211WG-01) */
         {USB_DEVICE(0x06b9, 0x0121)},   /* Thomson SpeedTouch 121g */
         {USB_DEVICE(0x0707, 0xee13)},   /* SMC 2862W-G version 2 */
+        {USB_DEVICE(0x0803, 0x4310)},   /* Zoom 4410a */
+        {USB_DEVICE(0x083a, 0x4503)},   /* T-Com Sinus 154 data II */
         {USB_DEVICE(0x083a, 0x4521)},   /* Siemens Gigaset USB Adapter 54 version 2 */
         {USB_DEVICE(0x083a, 0xc501)},   /* Zoom Wireless-G 4410 */
         {USB_DEVICE(0x083a, 0xf503)},   /* Accton FD7050E ver 1010ec  */
@@ -101,6 +104,7 @@ static struct usb_device_id p54u_table[] = {
         {USB_DEVICE(0x13B1, 0x000C)},   /* Linksys WUSB54AG */
         {USB_DEVICE(0x1413, 0x5400)},   /* Telsey 802.11g USB2.0 Adapter */
         {USB_DEVICE(0x1435, 0x0427)},   /* Inventel UR054G */
+        /* {USB_DEVICE(0x15a9, 0x0002)}, * Also SparkLAN WL-682 with 3887 */
         {USB_DEVICE(0x1668, 0x1050)},   /* Actiontec 802UIG-1 */
         {USB_DEVICE(0x1740, 0x1000)},   /* Senao NUB-350 */
         {USB_DEVICE(0x2001, 0x3704)},   /* DLink DWL-G122 rev A2 */
diff --git a/drivers/net/wireless/prism54/isl_ioctl.c b/drivers/net/wireless/prism54/isl_ioctl.c
index 4e44b1af119a..1c22b81e6ef3 100644
--- a/drivers/net/wireless/prism54/isl_ioctl.c
+++ b/drivers/net/wireless/prism54/isl_ioctl.c
@@ -1503,6 +1503,7 @@ static int prism54_get_auth(struct net_device *ndev,
                         case DOT11_AUTH_BOTH:
                         case DOT11_AUTH_SK:
                                 param->value = IW_AUTH_ALG_SHARED_KEY;
+                                break;
                         case DOT11_AUTH_NONE:
                         default:
                                 param->value = 0;
diff --git a/drivers/net/wireless/ray_cs.c b/drivers/net/wireless/ray_cs.c
index 598ca1cafb95..e7cf37f550d1 100644
--- a/drivers/net/wireless/ray_cs.c
+++ b/drivers/net/wireless/ray_cs.c
@@ -1107,12 +1107,15 @@ static int ray_get_essid(struct net_device *dev, struct iw_request_info *info,
                          union iwreq_data *wrqu, char *extra)
 {
         ray_dev_t *local = netdev_priv(dev);
+        UCHAR tmp[IW_ESSID_MAX_SIZE + 1];
 
         /* Get the essid that was set */
         memcpy(extra, local->sparm.b5.a_current_ess_id, IW_ESSID_MAX_SIZE);
+        memcpy(tmp, local->sparm.b5.a_current_ess_id, IW_ESSID_MAX_SIZE);
+        tmp[IW_ESSID_MAX_SIZE] = '\0';
 
         /* Push it out ! */
-        wrqu->essid.length = strlen(extra);
+        wrqu->essid.length = strlen(tmp);
         wrqu->essid.flags = 1;  /* active */
 
         return 0;
@@ -1842,6 +1845,8 @@ static irqreturn_t ray_interrupt(int irq, void *dev_id)
         UCHAR tmp;
         UCHAR cmd;
         UCHAR status;
+        UCHAR memtmp[ESSID_SIZE + 1];
+
 
         if (dev == NULL)        /* Note that we want interrupts with dev->start == 0 */
                 return IRQ_NONE;
@@ -1901,17 +1906,21 @@ static irqreturn_t ray_interrupt(int irq, void *dev_id)
                         break;
                 case CCS_START_NETWORK:
                 case CCS_JOIN_NETWORK:
+                        memcpy(memtmp, local->sparm.b4.a_current_ess_id,
+                                                                ESSID_SIZE);
+                        memtmp[ESSID_SIZE] = '\0';
+
                         if (status == CCS_COMMAND_COMPLETE) {
                                 if (readb
                                     (&pccs->var.start_network.net_initiated) ==
                                     1) {
                                         dev_dbg(&link->dev,
                                               "ray_cs interrupt network \"%s\" started\n",
-                                              local->sparm.b4.a_current_ess_id);
+                                              memtmp);
                                 } else {
                                         dev_dbg(&link->dev,
                                               "ray_cs interrupt network \"%s\" joined\n",
-                                              local->sparm.b4.a_current_ess_id);
+                                              memtmp);
                                 }
                                 memcpy_fromio(&local->bss_id,
                                               pccs->var.start_network.bssid,
@@ -1939,12 +1948,12 @@ static irqreturn_t ray_interrupt(int irq, void *dev_id)
                                 if (status == CCS_START_NETWORK) {
                                         dev_dbg(&link->dev,
                                               "ray_cs interrupt network \"%s\" start failed\n",
-                                              local->sparm.b4.a_current_ess_id);
+                                              memtmp);
                                         local->timer.function = start_net;
                                 } else {
                                         dev_dbg(&link->dev,
                                               "ray_cs interrupt network \"%s\" join failed\n",
-                                              local->sparm.b4.a_current_ess_id);
+                                              memtmp);
                                         local->timer.function = join_net;
                                 }
                                 add_timer(&local->timer);
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index 197b4466a5d2..a658b4bc7da2 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -80,7 +80,7 @@ static inline bool rt2800_is_305x_soc(struct rt2x00_dev *rt2x00dev)
             rt2x00_rf(rt2x00dev, RF3022))
                 return true;
 
-        NOTICE(rt2x00dev, "Unknown RF chipset on rt305x\n");
+        WARNING(rt2x00dev, "Unknown RF chipset on rt305x\n");
         return false;
 }
 
@@ -1296,8 +1296,7 @@ void rt2800_config_filter(struct rt2x00_dev *rt2x00dev,
                            !(filter_flags & FIF_CONTROL));
         rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_PSPOLL,
                            !(filter_flags & FIF_PSPOLL));
-        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_BA,
-                           !(filter_flags & FIF_CONTROL));
+        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_BA, 0);
         rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_BAR,
                            !(filter_flags & FIF_CONTROL));
         rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_CNTL,
@@ -3866,6 +3865,400 @@ static u8 rt2800_init_rx_filter(struct rt2x00_dev *rt2x00dev,
         return rfcsr24;
 }
 
+static void rt2800_init_rfcsr_305x_soc(struct rt2x00_dev *rt2x00dev)
+{
+        rt2800_rfcsr_write(rt2x00dev, 0, 0x50);
+        rt2800_rfcsr_write(rt2x00dev, 1, 0x01);
+        rt2800_rfcsr_write(rt2x00dev, 2, 0xf7);
+        rt2800_rfcsr_write(rt2x00dev, 3, 0x75);
+        rt2800_rfcsr_write(rt2x00dev, 4, 0x40);
+        rt2800_rfcsr_write(rt2x00dev, 5, 0x03);
+        rt2800_rfcsr_write(rt2x00dev, 6, 0x02);
+        rt2800_rfcsr_write(rt2x00dev, 7, 0x50);
+        rt2800_rfcsr_write(rt2x00dev, 8, 0x39);
+        rt2800_rfcsr_write(rt2x00dev, 9, 0x0f);
+        rt2800_rfcsr_write(rt2x00dev, 10, 0x60);
+        rt2800_rfcsr_write(rt2x00dev, 11, 0x21);
+        rt2800_rfcsr_write(rt2x00dev, 12, 0x75);
+        rt2800_rfcsr_write(rt2x00dev, 13, 0x75);
+        rt2800_rfcsr_write(rt2x00dev, 14, 0x90);
+        rt2800_rfcsr_write(rt2x00dev, 15, 0x58);
+        rt2800_rfcsr_write(rt2x00dev, 16, 0xb3);
+        rt2800_rfcsr_write(rt2x00dev, 17, 0x92);
+        rt2800_rfcsr_write(rt2x00dev, 18, 0x2c);
+        rt2800_rfcsr_write(rt2x00dev, 19, 0x02);
+        rt2800_rfcsr_write(rt2x00dev, 20, 0xba);
+        rt2800_rfcsr_write(rt2x00dev, 21, 0xdb);
+        rt2800_rfcsr_write(rt2x00dev, 22, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 23, 0x31);
+        rt2800_rfcsr_write(rt2x00dev, 24, 0x08);
+        rt2800_rfcsr_write(rt2x00dev, 25, 0x01);
+        rt2800_rfcsr_write(rt2x00dev, 26, 0x25);
+        rt2800_rfcsr_write(rt2x00dev, 27, 0x23);
+        rt2800_rfcsr_write(rt2x00dev, 28, 0x13);
+        rt2800_rfcsr_write(rt2x00dev, 29, 0x83);
+        rt2800_rfcsr_write(rt2x00dev, 30, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 31, 0x00);
+}
+
+static void rt2800_init_rfcsr_30xx(struct rt2x00_dev *rt2x00dev)
+{
+        rt2800_rfcsr_write(rt2x00dev, 4, 0x40);
+        rt2800_rfcsr_write(rt2x00dev, 5, 0x03);
+        rt2800_rfcsr_write(rt2x00dev, 6, 0x02);
+        rt2800_rfcsr_write(rt2x00dev, 7, 0x60);
+        rt2800_rfcsr_write(rt2x00dev, 9, 0x0f);
+        rt2800_rfcsr_write(rt2x00dev, 10, 0x41);
+        rt2800_rfcsr_write(rt2x00dev, 11, 0x21);
+        rt2800_rfcsr_write(rt2x00dev, 12, 0x7b);
+        rt2800_rfcsr_write(rt2x00dev, 14, 0x90);
+        rt2800_rfcsr_write(rt2x00dev, 15, 0x58);
+        rt2800_rfcsr_write(rt2x00dev, 16, 0xb3);
+        rt2800_rfcsr_write(rt2x00dev, 17, 0x92);
+        rt2800_rfcsr_write(rt2x00dev, 18, 0x2c);
+        rt2800_rfcsr_write(rt2x00dev, 19, 0x02);
+        rt2800_rfcsr_write(rt2x00dev, 20, 0xba);
+        rt2800_rfcsr_write(rt2x00dev, 21, 0xdb);
+        rt2800_rfcsr_write(rt2x00dev, 24, 0x16);
+        rt2800_rfcsr_write(rt2x00dev, 25, 0x01);
+        rt2800_rfcsr_write(rt2x00dev, 29, 0x1f);
+}
+
+static void rt2800_init_rfcsr_3290(struct rt2x00_dev *rt2x00dev)
+{
+        rt2800_rfcsr_write(rt2x00dev, 1, 0x0f);
+        rt2800_rfcsr_write(rt2x00dev, 2, 0x80);
+        rt2800_rfcsr_write(rt2x00dev, 3, 0x08);
+        rt2800_rfcsr_write(rt2x00dev, 4, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 6, 0xa0);
+        rt2800_rfcsr_write(rt2x00dev, 8, 0xf3);
+        rt2800_rfcsr_write(rt2x00dev, 9, 0x02);
+        rt2800_rfcsr_write(rt2x00dev, 10, 0x53);
+        rt2800_rfcsr_write(rt2x00dev, 11, 0x4a);
+        rt2800_rfcsr_write(rt2x00dev, 12, 0x46);
+        rt2800_rfcsr_write(rt2x00dev, 13, 0x9f);
+        rt2800_rfcsr_write(rt2x00dev, 18, 0x02);
+        rt2800_rfcsr_write(rt2x00dev, 22, 0x20);
+        rt2800_rfcsr_write(rt2x00dev, 25, 0x83);
+        rt2800_rfcsr_write(rt2x00dev, 26, 0x82);
+        rt2800_rfcsr_write(rt2x00dev, 27, 0x09);
+        rt2800_rfcsr_write(rt2x00dev, 29, 0x10);
+        rt2800_rfcsr_write(rt2x00dev, 30, 0x10);
+        rt2800_rfcsr_write(rt2x00dev, 31, 0x80);
+        rt2800_rfcsr_write(rt2x00dev, 32, 0x80);
+        rt2800_rfcsr_write(rt2x00dev, 33, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 34, 0x05);
+        rt2800_rfcsr_write(rt2x00dev, 35, 0x12);
+        rt2800_rfcsr_write(rt2x00dev, 36, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 38, 0x85);
+        rt2800_rfcsr_write(rt2x00dev, 39, 0x1b);
+        rt2800_rfcsr_write(rt2x00dev, 40, 0x0b);
+        rt2800_rfcsr_write(rt2x00dev, 41, 0xbb);
+        rt2800_rfcsr_write(rt2x00dev, 42, 0xd5);
+        rt2800_rfcsr_write(rt2x00dev, 43, 0x7b);
+        rt2800_rfcsr_write(rt2x00dev, 44, 0x0e);
+        rt2800_rfcsr_write(rt2x00dev, 45, 0xa2);
+        rt2800_rfcsr_write(rt2x00dev, 46, 0x73);
+        rt2800_rfcsr_write(rt2x00dev, 47, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 48, 0x10);
+        rt2800_rfcsr_write(rt2x00dev, 49, 0x98);
+        rt2800_rfcsr_write(rt2x00dev, 52, 0x38);
+        rt2800_rfcsr_write(rt2x00dev, 53, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 54, 0x78);
+        rt2800_rfcsr_write(rt2x00dev, 55, 0x43);
+        rt2800_rfcsr_write(rt2x00dev, 56, 0x02);
+        rt2800_rfcsr_write(rt2x00dev, 57, 0x80);
+        rt2800_rfcsr_write(rt2x00dev, 58, 0x7f);
+        rt2800_rfcsr_write(rt2x00dev, 59, 0x09);
+        rt2800_rfcsr_write(rt2x00dev, 60, 0x45);
+        rt2800_rfcsr_write(rt2x00dev, 61, 0xc1);
+}
+
+static void rt2800_init_rfcsr_3352(struct rt2x00_dev *rt2x00dev)
+{
+        rt2800_rfcsr_write(rt2x00dev, 0, 0xf0);
+        rt2800_rfcsr_write(rt2x00dev, 1, 0x23);
+        rt2800_rfcsr_write(rt2x00dev, 2, 0x50);
+        rt2800_rfcsr_write(rt2x00dev, 3, 0x18);
+        rt2800_rfcsr_write(rt2x00dev, 4, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 5, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 6, 0x33);
+        rt2800_rfcsr_write(rt2x00dev, 7, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 8, 0xf1);
+        rt2800_rfcsr_write(rt2x00dev, 9, 0x02);
+        rt2800_rfcsr_write(rt2x00dev, 10, 0xd2);
+        rt2800_rfcsr_write(rt2x00dev, 11, 0x42);
+        rt2800_rfcsr_write(rt2x00dev, 12, 0x1c);
+        rt2800_rfcsr_write(rt2x00dev, 13, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 14, 0x5a);
+        rt2800_rfcsr_write(rt2x00dev, 15, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 16, 0x01);
+        rt2800_rfcsr_write(rt2x00dev, 18, 0x45);
+        rt2800_rfcsr_write(rt2x00dev, 19, 0x02);
+        rt2800_rfcsr_write(rt2x00dev, 20, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 21, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 22, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 23, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 24, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 25, 0x80);
+        rt2800_rfcsr_write(rt2x00dev, 26, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 27, 0x03);
+        rt2800_rfcsr_write(rt2x00dev, 28, 0x03);
+        rt2800_rfcsr_write(rt2x00dev, 29, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 30, 0x10);
+        rt2800_rfcsr_write(rt2x00dev, 31, 0x80);
+        rt2800_rfcsr_write(rt2x00dev, 32, 0x80);
+        rt2800_rfcsr_write(rt2x00dev, 33, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 34, 0x01);
+        rt2800_rfcsr_write(rt2x00dev, 35, 0x03);
+        rt2800_rfcsr_write(rt2x00dev, 36, 0xbd);
+        rt2800_rfcsr_write(rt2x00dev, 37, 0x3c);
+        rt2800_rfcsr_write(rt2x00dev, 38, 0x5f);
+        rt2800_rfcsr_write(rt2x00dev, 39, 0xc5);
+        rt2800_rfcsr_write(rt2x00dev, 40, 0x33);
+        rt2800_rfcsr_write(rt2x00dev, 41, 0x5b);
+        rt2800_rfcsr_write(rt2x00dev, 42, 0x5b);
+        rt2800_rfcsr_write(rt2x00dev, 43, 0xdb);
+        rt2800_rfcsr_write(rt2x00dev, 44, 0xdb);
+        rt2800_rfcsr_write(rt2x00dev, 45, 0xdb);
+        rt2800_rfcsr_write(rt2x00dev, 46, 0xdd);
+        rt2800_rfcsr_write(rt2x00dev, 47, 0x0d);
+        rt2800_rfcsr_write(rt2x00dev, 48, 0x14);
+        rt2800_rfcsr_write(rt2x00dev, 49, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 50, 0x2d);
+        rt2800_rfcsr_write(rt2x00dev, 51, 0x7f);
+        rt2800_rfcsr_write(rt2x00dev, 52, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 53, 0x52);
+        rt2800_rfcsr_write(rt2x00dev, 54, 0x1b);
+        rt2800_rfcsr_write(rt2x00dev, 55, 0x7f);
+        rt2800_rfcsr_write(rt2x00dev, 56, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 57, 0x52);
+        rt2800_rfcsr_write(rt2x00dev, 58, 0x1b);
+        rt2800_rfcsr_write(rt2x00dev, 59, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 60, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 61, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 62, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 63, 0x00);
+}
+
+static void rt2800_init_rfcsr_3390(struct rt2x00_dev *rt2x00dev)
+{
+        rt2800_rfcsr_write(rt2x00dev, 0, 0xa0);
+        rt2800_rfcsr_write(rt2x00dev, 1, 0xe1);
+        rt2800_rfcsr_write(rt2x00dev, 2, 0xf1);
+        rt2800_rfcsr_write(rt2x00dev, 3, 0x62);
+        rt2800_rfcsr_write(rt2x00dev, 4, 0x40);
+        rt2800_rfcsr_write(rt2x00dev, 5, 0x8b);
+        rt2800_rfcsr_write(rt2x00dev, 6, 0x42);
+        rt2800_rfcsr_write(rt2x00dev, 7, 0x34);
+        rt2800_rfcsr_write(rt2x00dev, 8, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 9, 0xc0);
+        rt2800_rfcsr_write(rt2x00dev, 10, 0x61);
+        rt2800_rfcsr_write(rt2x00dev, 11, 0x21);
+        rt2800_rfcsr_write(rt2x00dev, 12, 0x3b);
+        rt2800_rfcsr_write(rt2x00dev, 13, 0xe0);
+        rt2800_rfcsr_write(rt2x00dev, 14, 0x90);
+        rt2800_rfcsr_write(rt2x00dev, 15, 0x53);
+        rt2800_rfcsr_write(rt2x00dev, 16, 0xe0);
+        rt2800_rfcsr_write(rt2x00dev, 17, 0x94);
+        rt2800_rfcsr_write(rt2x00dev, 18, 0x5c);
+        rt2800_rfcsr_write(rt2x00dev, 19, 0x4a);
+        rt2800_rfcsr_write(rt2x00dev, 20, 0xb2);
+        rt2800_rfcsr_write(rt2x00dev, 21, 0xf6);
+        rt2800_rfcsr_write(rt2x00dev, 22, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 23, 0x14);
+        rt2800_rfcsr_write(rt2x00dev, 24, 0x08);
+        rt2800_rfcsr_write(rt2x00dev, 25, 0x3d);
+        rt2800_rfcsr_write(rt2x00dev, 26, 0x85);
+        rt2800_rfcsr_write(rt2x00dev, 27, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 28, 0x41);
+        rt2800_rfcsr_write(rt2x00dev, 29, 0x8f);
+        rt2800_rfcsr_write(rt2x00dev, 30, 0x20);
+        rt2800_rfcsr_write(rt2x00dev, 31, 0x0f);
+}
+
+static void rt2800_init_rfcsr_3572(struct rt2x00_dev *rt2x00dev)
+{
+        rt2800_rfcsr_write(rt2x00dev, 0, 0x70);
+        rt2800_rfcsr_write(rt2x00dev, 1, 0x81);
+        rt2800_rfcsr_write(rt2x00dev, 2, 0xf1);
+        rt2800_rfcsr_write(rt2x00dev, 3, 0x02);
+        rt2800_rfcsr_write(rt2x00dev, 4, 0x4c);
+        rt2800_rfcsr_write(rt2x00dev, 5, 0x05);
+        rt2800_rfcsr_write(rt2x00dev, 6, 0x4a);
+        rt2800_rfcsr_write(rt2x00dev, 7, 0xd8);
+        rt2800_rfcsr_write(rt2x00dev, 9, 0xc3);
+        rt2800_rfcsr_write(rt2x00dev, 10, 0xf1);
+        rt2800_rfcsr_write(rt2x00dev, 11, 0xb9);
+        rt2800_rfcsr_write(rt2x00dev, 12, 0x70);
+        rt2800_rfcsr_write(rt2x00dev, 13, 0x65);
+        rt2800_rfcsr_write(rt2x00dev, 14, 0xa0);
+        rt2800_rfcsr_write(rt2x00dev, 15, 0x53);
+        rt2800_rfcsr_write(rt2x00dev, 16, 0x4c);
+        rt2800_rfcsr_write(rt2x00dev, 17, 0x23);
+        rt2800_rfcsr_write(rt2x00dev, 18, 0xac);
+        rt2800_rfcsr_write(rt2x00dev, 19, 0x93);
+        rt2800_rfcsr_write(rt2x00dev, 20, 0xb3);
+        rt2800_rfcsr_write(rt2x00dev, 21, 0xd0);
+        rt2800_rfcsr_write(rt2x00dev, 22, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 23, 0x3c);
+        rt2800_rfcsr_write(rt2x00dev, 24, 0x16);
+        rt2800_rfcsr_write(rt2x00dev, 25, 0x15);
+        rt2800_rfcsr_write(rt2x00dev, 26, 0x85);
+        rt2800_rfcsr_write(rt2x00dev, 27, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 28, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 29, 0x9b);
+        rt2800_rfcsr_write(rt2x00dev, 30, 0x09);
+        rt2800_rfcsr_write(rt2x00dev, 31, 0x10);
+}
+
+static void rt2800_init_rfcsr_5390(struct rt2x00_dev *rt2x00dev)
+{
+        rt2800_rfcsr_write(rt2x00dev, 1, 0x0f);
+        rt2800_rfcsr_write(rt2x00dev, 2, 0x80);
+        rt2800_rfcsr_write(rt2x00dev, 3, 0x88);
+        rt2800_rfcsr_write(rt2x00dev, 5, 0x10);
+        if (rt2x00_rt_rev_gte(rt2x00dev, RT5390, REV_RT5390F))
+                rt2800_rfcsr_write(rt2x00dev, 6, 0xe0);
+        else
+                rt2800_rfcsr_write(rt2x00dev, 6, 0xa0);
+        rt2800_rfcsr_write(rt2x00dev, 7, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 10, 0x53);
+        rt2800_rfcsr_write(rt2x00dev, 11, 0x4a);
+        rt2800_rfcsr_write(rt2x00dev, 12, 0xc6);
+        rt2800_rfcsr_write(rt2x00dev, 13, 0x9f);
+        rt2800_rfcsr_write(rt2x00dev, 14, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 15, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 16, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 18, 0x03);
+        rt2800_rfcsr_write(rt2x00dev, 19, 0x00);
+
+        rt2800_rfcsr_write(rt2x00dev, 20, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 21, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 22, 0x20);
+        rt2800_rfcsr_write(rt2x00dev, 23, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 24, 0x00);
+        if (rt2x00_rt_rev_gte(rt2x00dev, RT5390, REV_RT5390F))
+                rt2800_rfcsr_write(rt2x00dev, 25, 0x80);
+        else
+                rt2800_rfcsr_write(rt2x00dev, 25, 0xc0);
+        rt2800_rfcsr_write(rt2x00dev, 26, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 27, 0x09);
+        rt2800_rfcsr_write(rt2x00dev, 28, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 29, 0x10);
+
+        rt2800_rfcsr_write(rt2x00dev, 30, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 31, 0x80);
+        rt2800_rfcsr_write(rt2x00dev, 32, 0x80);
+        rt2800_rfcsr_write(rt2x00dev, 33, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 34, 0x07);
+        rt2800_rfcsr_write(rt2x00dev, 35, 0x12);
+        rt2800_rfcsr_write(rt2x00dev, 36, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 37, 0x08);
+        rt2800_rfcsr_write(rt2x00dev, 38, 0x85);
+        rt2800_rfcsr_write(rt2x00dev, 39, 0x1b);
+
+        if (rt2x00_rt_rev_gte(rt2x00dev, RT5390, REV_RT5390F))
+                rt2800_rfcsr_write(rt2x00dev, 40, 0x0b);
+        else
+                rt2800_rfcsr_write(rt2x00dev, 40, 0x4b);
+        rt2800_rfcsr_write(rt2x00dev, 41, 0xbb);
+        rt2800_rfcsr_write(rt2x00dev, 42, 0xd2);
+        rt2800_rfcsr_write(rt2x00dev, 43, 0x9a);
+        rt2800_rfcsr_write(rt2x00dev, 44, 0x0e);
+        rt2800_rfcsr_write(rt2x00dev, 45, 0xa2);
+        if (rt2x00_rt_rev_gte(rt2x00dev, RT5390, REV_RT5390F))
+                rt2800_rfcsr_write(rt2x00dev, 46, 0x73);
+        else
+                rt2800_rfcsr_write(rt2x00dev, 46, 0x7b);
+        rt2800_rfcsr_write(rt2x00dev, 47, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 48, 0x10);
+        rt2800_rfcsr_write(rt2x00dev, 49, 0x94);
+
+        rt2800_rfcsr_write(rt2x00dev, 52, 0x38);
+        if (rt2x00_rt_rev_gte(rt2x00dev, RT5390, REV_RT5390F))
+                rt2800_rfcsr_write(rt2x00dev, 53, 0x00);
+        else
+                rt2800_rfcsr_write(rt2x00dev, 53, 0x84);
+        rt2800_rfcsr_write(rt2x00dev, 54, 0x78);
+        rt2800_rfcsr_write(rt2x00dev, 55, 0x44);
+        rt2800_rfcsr_write(rt2x00dev, 56, 0x22);
+        rt2800_rfcsr_write(rt2x00dev, 57, 0x80);
+        rt2800_rfcsr_write(rt2x00dev, 58, 0x7f);
+        rt2800_rfcsr_write(rt2x00dev, 59, 0x63);
+
+        rt2800_rfcsr_write(rt2x00dev, 60, 0x45);
+        if (rt2x00_rt_rev_gte(rt2x00dev, RT5390, REV_RT5390F))
+                rt2800_rfcsr_write(rt2x00dev, 61, 0xd1);
+        else
+                rt2800_rfcsr_write(rt2x00dev, 61, 0xdd);
+        rt2800_rfcsr_write(rt2x00dev, 62, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 63, 0x00);
+}
+
+static void rt2800_init_rfcsr_5392(struct rt2x00_dev *rt2x00dev)
+{
+        rt2800_rfcsr_write(rt2x00dev, 1, 0x17);
+        rt2800_rfcsr_write(rt2x00dev, 2, 0x80);
+        rt2800_rfcsr_write(rt2x00dev, 3, 0x88);
+        rt2800_rfcsr_write(rt2x00dev, 5, 0x10);
+        rt2800_rfcsr_write(rt2x00dev, 6, 0xe0);
+        rt2800_rfcsr_write(rt2x00dev, 7, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 10, 0x53);
+        rt2800_rfcsr_write(rt2x00dev, 11, 0x4a);
+        rt2800_rfcsr_write(rt2x00dev, 12, 0x46);
+        rt2800_rfcsr_write(rt2x00dev, 13, 0x9f);
+        rt2800_rfcsr_write(rt2x00dev, 14, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 15, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 16, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 18, 0x03);
+        rt2800_rfcsr_write(rt2x00dev, 19, 0x4d);
+        rt2800_rfcsr_write(rt2x00dev, 20, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 21, 0x8d);
+        rt2800_rfcsr_write(rt2x00dev, 22, 0x20);
+        rt2800_rfcsr_write(rt2x00dev, 23, 0x0b);
+        rt2800_rfcsr_write(rt2x00dev, 24, 0x44);
+        rt2800_rfcsr_write(rt2x00dev, 25, 0x80);
+        rt2800_rfcsr_write(rt2x00dev, 26, 0x82);
+        rt2800_rfcsr_write(rt2x00dev, 27, 0x09);
+        rt2800_rfcsr_write(rt2x00dev, 28, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 29, 0x10);
+        rt2800_rfcsr_write(rt2x00dev, 30, 0x10);
+        rt2800_rfcsr_write(rt2x00dev, 31, 0x80);
+        rt2800_rfcsr_write(rt2x00dev, 32, 0x20);
+        rt2800_rfcsr_write(rt2x00dev, 33, 0xC0);
+        rt2800_rfcsr_write(rt2x00dev, 34, 0x07);
+        rt2800_rfcsr_write(rt2x00dev, 35, 0x12);
+        rt2800_rfcsr_write(rt2x00dev, 36, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 37, 0x08);
+        rt2800_rfcsr_write(rt2x00dev, 38, 0x89);
+        rt2800_rfcsr_write(rt2x00dev, 39, 0x1b);
+        rt2800_rfcsr_write(rt2x00dev, 40, 0x0f);
+        rt2800_rfcsr_write(rt2x00dev, 41, 0xbb);
+        rt2800_rfcsr_write(rt2x00dev, 42, 0xd5);
+        rt2800_rfcsr_write(rt2x00dev, 43, 0x9b);
+        rt2800_rfcsr_write(rt2x00dev, 44, 0x0e);
+        rt2800_rfcsr_write(rt2x00dev, 45, 0xa2);
+        rt2800_rfcsr_write(rt2x00dev, 46, 0x73);
+        rt2800_rfcsr_write(rt2x00dev, 47, 0x0c);
+        rt2800_rfcsr_write(rt2x00dev, 48, 0x10);
+        rt2800_rfcsr_write(rt2x00dev, 49, 0x94);
+        rt2800_rfcsr_write(rt2x00dev, 50, 0x94);
+        rt2800_rfcsr_write(rt2x00dev, 51, 0x3a);
+        rt2800_rfcsr_write(rt2x00dev, 52, 0x48);
+        rt2800_rfcsr_write(rt2x00dev, 53, 0x44);
+        rt2800_rfcsr_write(rt2x00dev, 54, 0x38);
+        rt2800_rfcsr_write(rt2x00dev, 55, 0x43);
+        rt2800_rfcsr_write(rt2x00dev, 56, 0xa1);
+        rt2800_rfcsr_write(rt2x00dev, 57, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 58, 0x39);
+        rt2800_rfcsr_write(rt2x00dev, 59, 0x07);
+        rt2800_rfcsr_write(rt2x00dev, 60, 0x45);
+        rt2800_rfcsr_write(rt2x00dev, 61, 0x91);
+        rt2800_rfcsr_write(rt2x00dev, 62, 0x39);
+        rt2800_rfcsr_write(rt2x00dev, 63, 0x07);
+}
+
 static int rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev)
 {
         struct rt2800_drv_data *drv_data = rt2x00dev->drv_data;
@@ -3889,6 +4282,7 @@ static int rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev)
         /*
          * Init RF calibration.
          */
+
         if (rt2x00_rt(rt2x00dev, RT3290) ||
             rt2x00_rt(rt2x00dev, RT5390) ||
             rt2x00_rt(rt2x00dev, RT5392)) {
@@ -3907,379 +4301,35 @@ static int rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev)
                 rt2800_rfcsr_write(rt2x00dev, 30, rfcsr);
         }
 
-        if (rt2x00_rt(rt2x00dev, RT3070) ||
-            rt2x00_rt(rt2x00dev, RT3071) ||
-            rt2x00_rt(rt2x00dev, RT3090)) {
-                rt2800_rfcsr_write(rt2x00dev, 4, 0x40);
-                rt2800_rfcsr_write(rt2x00dev, 5, 0x03);
-                rt2800_rfcsr_write(rt2x00dev, 6, 0x02);
-                rt2800_rfcsr_write(rt2x00dev, 7, 0x60);
-                rt2800_rfcsr_write(rt2x00dev, 9, 0x0f);
-                rt2800_rfcsr_write(rt2x00dev, 10, 0x41);
-                rt2800_rfcsr_write(rt2x00dev, 11, 0x21);
-                rt2800_rfcsr_write(rt2x00dev, 12, 0x7b);
-                rt2800_rfcsr_write(rt2x00dev, 14, 0x90);
-                rt2800_rfcsr_write(rt2x00dev, 15, 0x58);
-                rt2800_rfcsr_write(rt2x00dev, 16, 0xb3);
-                rt2800_rfcsr_write(rt2x00dev, 17, 0x92);
-                rt2800_rfcsr_write(rt2x00dev, 18, 0x2c);
-                rt2800_rfcsr_write(rt2x00dev, 19, 0x02);
-                rt2800_rfcsr_write(rt2x00dev, 20, 0xba);
-                rt2800_rfcsr_write(rt2x00dev, 21, 0xdb);
-                rt2800_rfcsr_write(rt2x00dev, 24, 0x16);
-                rt2800_rfcsr_write(rt2x00dev, 25, 0x01);
-                rt2800_rfcsr_write(rt2x00dev, 29, 0x1f);
-        } else if (rt2x00_rt(rt2x00dev, RT3290)) {
-                rt2800_rfcsr_write(rt2x00dev, 1, 0x0f);
-                rt2800_rfcsr_write(rt2x00dev, 2, 0x80);
-                rt2800_rfcsr_write(rt2x00dev, 3, 0x08);
-                rt2800_rfcsr_write(rt2x00dev, 4, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 6, 0xa0);
-                rt2800_rfcsr_write(rt2x00dev, 8, 0xf3);
-                rt2800_rfcsr_write(rt2x00dev, 9, 0x02);
-                rt2800_rfcsr_write(rt2x00dev, 10, 0x53);
-                rt2800_rfcsr_write(rt2x00dev, 11, 0x4a);
-                rt2800_rfcsr_write(rt2x00dev, 12, 0x46);
-                rt2800_rfcsr_write(rt2x00dev, 13, 0x9f);
-                rt2800_rfcsr_write(rt2x00dev, 18, 0x02);
-                rt2800_rfcsr_write(rt2x00dev, 22, 0x20);
-                rt2800_rfcsr_write(rt2x00dev, 25, 0x83);
-                rt2800_rfcsr_write(rt2x00dev, 26, 0x82);
-                rt2800_rfcsr_write(rt2x00dev, 27, 0x09);
-                rt2800_rfcsr_write(rt2x00dev, 29, 0x10);
-                rt2800_rfcsr_write(rt2x00dev, 30, 0x10);
-                rt2800_rfcsr_write(rt2x00dev, 31, 0x80);
-                rt2800_rfcsr_write(rt2x00dev, 32, 0x80);
-                rt2800_rfcsr_write(rt2x00dev, 33, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 34, 0x05);
-                rt2800_rfcsr_write(rt2x00dev, 35, 0x12);
-                rt2800_rfcsr_write(rt2x00dev, 36, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 38, 0x85);
-                rt2800_rfcsr_write(rt2x00dev, 39, 0x1b);
-                rt2800_rfcsr_write(rt2x00dev, 40, 0x0b);
-                rt2800_rfcsr_write(rt2x00dev, 41, 0xbb);
-                rt2800_rfcsr_write(rt2x00dev, 42, 0xd5);
-                rt2800_rfcsr_write(rt2x00dev, 43, 0x7b);
-                rt2800_rfcsr_write(rt2x00dev, 44, 0x0e);
-                rt2800_rfcsr_write(rt2x00dev, 45, 0xa2);
-                rt2800_rfcsr_write(rt2x00dev, 46, 0x73);
-                rt2800_rfcsr_write(rt2x00dev, 47, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 48, 0x10);
-                rt2800_rfcsr_write(rt2x00dev, 49, 0x98);
-                rt2800_rfcsr_write(rt2x00dev, 52, 0x38);
-                rt2800_rfcsr_write(rt2x00dev, 53, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 54, 0x78);
-                rt2800_rfcsr_write(rt2x00dev, 55, 0x43);
-                rt2800_rfcsr_write(rt2x00dev, 56, 0x02);
-                rt2800_rfcsr_write(rt2x00dev, 57, 0x80);
-                rt2800_rfcsr_write(rt2x00dev, 58, 0x7f);
-                rt2800_rfcsr_write(rt2x00dev, 59, 0x09);
-                rt2800_rfcsr_write(rt2x00dev, 60, 0x45);
-                rt2800_rfcsr_write(rt2x00dev, 61, 0xc1);
-        } else if (rt2x00_rt(rt2x00dev, RT3390)) {
-                rt2800_rfcsr_write(rt2x00dev, 0, 0xa0);
-                rt2800_rfcsr_write(rt2x00dev, 1, 0xe1);
-                rt2800_rfcsr_write(rt2x00dev, 2, 0xf1);
-                rt2800_rfcsr_write(rt2x00dev, 3, 0x62);
-                rt2800_rfcsr_write(rt2x00dev, 4, 0x40);
-                rt2800_rfcsr_write(rt2x00dev, 5, 0x8b);
-                rt2800_rfcsr_write(rt2x00dev, 6, 0x42);
-                rt2800_rfcsr_write(rt2x00dev, 7, 0x34);
-                rt2800_rfcsr_write(rt2x00dev, 8, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 9, 0xc0);
-                rt2800_rfcsr_write(rt2x00dev, 10, 0x61);
-                rt2800_rfcsr_write(rt2x00dev, 11, 0x21);
-                rt2800_rfcsr_write(rt2x00dev, 12, 0x3b);
-                rt2800_rfcsr_write(rt2x00dev, 13, 0xe0);
-                rt2800_rfcsr_write(rt2x00dev, 14, 0x90);
-                rt2800_rfcsr_write(rt2x00dev, 15, 0x53);
-                rt2800_rfcsr_write(rt2x00dev, 16, 0xe0);
-                rt2800_rfcsr_write(rt2x00dev, 17, 0x94);
-                rt2800_rfcsr_write(rt2x00dev, 18, 0x5c);
-                rt2800_rfcsr_write(rt2x00dev, 19, 0x4a);
-                rt2800_rfcsr_write(rt2x00dev, 20, 0xb2);
-                rt2800_rfcsr_write(rt2x00dev, 21, 0xf6);
-                rt2800_rfcsr_write(rt2x00dev, 22, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 23, 0x14);
-                rt2800_rfcsr_write(rt2x00dev, 24, 0x08);
-                rt2800_rfcsr_write(rt2x00dev, 25, 0x3d);
-                rt2800_rfcsr_write(rt2x00dev, 26, 0x85);
-                rt2800_rfcsr_write(rt2x00dev, 27, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 28, 0x41);
-                rt2800_rfcsr_write(rt2x00dev, 29, 0x8f);
-                rt2800_rfcsr_write(rt2x00dev, 30, 0x20);
-                rt2800_rfcsr_write(rt2x00dev, 31, 0x0f);
-        } else if (rt2x00_rt(rt2x00dev, RT3572)) {
-                rt2800_rfcsr_write(rt2x00dev, 0, 0x70);
-                rt2800_rfcsr_write(rt2x00dev, 1, 0x81);
-                rt2800_rfcsr_write(rt2x00dev, 2, 0xf1);
-                rt2800_rfcsr_write(rt2x00dev, 3, 0x02);
-                rt2800_rfcsr_write(rt2x00dev, 4, 0x4c);
-                rt2800_rfcsr_write(rt2x00dev, 5, 0x05);
-                rt2800_rfcsr_write(rt2x00dev, 6, 0x4a);
-                rt2800_rfcsr_write(rt2x00dev, 7, 0xd8);
-                rt2800_rfcsr_write(rt2x00dev, 9, 0xc3);
-                rt2800_rfcsr_write(rt2x00dev, 10, 0xf1);
-                rt2800_rfcsr_write(rt2x00dev, 11, 0xb9);
-                rt2800_rfcsr_write(rt2x00dev, 12, 0x70);
-                rt2800_rfcsr_write(rt2x00dev, 13, 0x65);
-                rt2800_rfcsr_write(rt2x00dev, 14, 0xa0);
-                rt2800_rfcsr_write(rt2x00dev, 15, 0x53);
-                rt2800_rfcsr_write(rt2x00dev, 16, 0x4c);
-                rt2800_rfcsr_write(rt2x00dev, 17, 0x23);
-                rt2800_rfcsr_write(rt2x00dev, 18, 0xac);
-                rt2800_rfcsr_write(rt2x00dev, 19, 0x93);
-                rt2800_rfcsr_write(rt2x00dev, 20, 0xb3);
-                rt2800_rfcsr_write(rt2x00dev, 21, 0xd0);
-                rt2800_rfcsr_write(rt2x00dev, 22, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 23, 0x3c);
-                rt2800_rfcsr_write(rt2x00dev, 24, 0x16);
-                rt2800_rfcsr_write(rt2x00dev, 25, 0x15);
-                rt2800_rfcsr_write(rt2x00dev, 26, 0x85);
-                rt2800_rfcsr_write(rt2x00dev, 27, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 28, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 29, 0x9b);
-                rt2800_rfcsr_write(rt2x00dev, 30, 0x09);
-                rt2800_rfcsr_write(rt2x00dev, 31, 0x10);
-        } else if (rt2800_is_305x_soc(rt2x00dev)) {
-                rt2800_rfcsr_write(rt2x00dev, 0, 0x50);
-                rt2800_rfcsr_write(rt2x00dev, 1, 0x01);
-                rt2800_rfcsr_write(rt2x00dev, 2, 0xf7);
-                rt2800_rfcsr_write(rt2x00dev, 3, 0x75);
-                rt2800_rfcsr_write(rt2x00dev, 4, 0x40);
-                rt2800_rfcsr_write(rt2x00dev, 5, 0x03);
-                rt2800_rfcsr_write(rt2x00dev, 6, 0x02);
-                rt2800_rfcsr_write(rt2x00dev, 7, 0x50);
-                rt2800_rfcsr_write(rt2x00dev, 8, 0x39);
-                rt2800_rfcsr_write(rt2x00dev, 9, 0x0f);
-                rt2800_rfcsr_write(rt2x00dev, 10, 0x60);
-                rt2800_rfcsr_write(rt2x00dev, 11, 0x21);
-                rt2800_rfcsr_write(rt2x00dev, 12, 0x75);
-                rt2800_rfcsr_write(rt2x00dev, 13, 0x75);
-                rt2800_rfcsr_write(rt2x00dev, 14, 0x90);
-                rt2800_rfcsr_write(rt2x00dev, 15, 0x58);
-                rt2800_rfcsr_write(rt2x00dev, 16, 0xb3);
-                rt2800_rfcsr_write(rt2x00dev, 17, 0x92);
-                rt2800_rfcsr_write(rt2x00dev, 18, 0x2c);
-                rt2800_rfcsr_write(rt2x00dev, 19, 0x02);
-                rt2800_rfcsr_write(rt2x00dev, 20, 0xba);
-                rt2800_rfcsr_write(rt2x00dev, 21, 0xdb);
-                rt2800_rfcsr_write(rt2x00dev, 22, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 23, 0x31);
-                rt2800_rfcsr_write(rt2x00dev, 24, 0x08);
-                rt2800_rfcsr_write(rt2x00dev, 25, 0x01);
-                rt2800_rfcsr_write(rt2x00dev, 26, 0x25);
-                rt2800_rfcsr_write(rt2x00dev, 27, 0x23);
-                rt2800_rfcsr_write(rt2x00dev, 28, 0x13);
-                rt2800_rfcsr_write(rt2x00dev, 29, 0x83);
-                rt2800_rfcsr_write(rt2x00dev, 30, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 31, 0x00);
+        if (rt2800_is_305x_soc(rt2x00dev)) {
+                rt2800_init_rfcsr_305x_soc(rt2x00dev);
                 return 0;
-        } else if (rt2x00_rt(rt2x00dev, RT3352)) {
-                rt2800_rfcsr_write(rt2x00dev, 0, 0xf0);
-                rt2800_rfcsr_write(rt2x00dev, 1, 0x23);
-                rt2800_rfcsr_write(rt2x00dev, 2, 0x50);
-                rt2800_rfcsr_write(rt2x00dev, 3, 0x18);
-                rt2800_rfcsr_write(rt2x00dev, 4, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 5, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 6, 0x33);
-                rt2800_rfcsr_write(rt2x00dev, 7, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 8, 0xf1);
-                rt2800_rfcsr_write(rt2x00dev, 9, 0x02);
-                rt2800_rfcsr_write(rt2x00dev, 10, 0xd2);
-                rt2800_rfcsr_write(rt2x00dev, 11, 0x42);
-                rt2800_rfcsr_write(rt2x00dev, 12, 0x1c);
-                rt2800_rfcsr_write(rt2x00dev, 13, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 14, 0x5a);
-                rt2800_rfcsr_write(rt2x00dev, 15, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 16, 0x01);
-                rt2800_rfcsr_write(rt2x00dev, 18, 0x45);
-                rt2800_rfcsr_write(rt2x00dev, 19, 0x02);
-                rt2800_rfcsr_write(rt2x00dev, 20, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 21, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 22, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 23, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 24, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 25, 0x80);
-                rt2800_rfcsr_write(rt2x00dev, 26, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 27, 0x03);
-                rt2800_rfcsr_write(rt2x00dev, 28, 0x03);
-                rt2800_rfcsr_write(rt2x00dev, 29, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 30, 0x10);
-                rt2800_rfcsr_write(rt2x00dev, 31, 0x80);
-                rt2800_rfcsr_write(rt2x00dev, 32, 0x80);
-                rt2800_rfcsr_write(rt2x00dev, 33, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 34, 0x01);
-                rt2800_rfcsr_write(rt2x00dev, 35, 0x03);
-                rt2800_rfcsr_write(rt2x00dev, 36, 0xbd);
-                rt2800_rfcsr_write(rt2x00dev, 37, 0x3c);
-                rt2800_rfcsr_write(rt2x00dev, 38, 0x5f);
-                rt2800_rfcsr_write(rt2x00dev, 39, 0xc5);
-                rt2800_rfcsr_write(rt2x00dev, 40, 0x33);
-                rt2800_rfcsr_write(rt2x00dev, 41, 0x5b);
-                rt2800_rfcsr_write(rt2x00dev, 42, 0x5b);
-                rt2800_rfcsr_write(rt2x00dev, 43, 0xdb);
-                rt2800_rfcsr_write(rt2x00dev, 44, 0xdb);
-                rt2800_rfcsr_write(rt2x00dev, 45, 0xdb);
-                rt2800_rfcsr_write(rt2x00dev, 46, 0xdd);
-                rt2800_rfcsr_write(rt2x00dev, 47, 0x0d);
-                rt2800_rfcsr_write(rt2x00dev, 48, 0x14);
-                rt2800_rfcsr_write(rt2x00dev, 49, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 50, 0x2d);
-                rt2800_rfcsr_write(rt2x00dev, 51, 0x7f);
-                rt2800_rfcsr_write(rt2x00dev, 52, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 53, 0x52);
-                rt2800_rfcsr_write(rt2x00dev, 54, 0x1b);
-                rt2800_rfcsr_write(rt2x00dev, 55, 0x7f);
-                rt2800_rfcsr_write(rt2x00dev, 56, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 57, 0x52);
-                rt2800_rfcsr_write(rt2x00dev, 58, 0x1b);
-                rt2800_rfcsr_write(rt2x00dev, 59, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 60, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 61, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 62, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 63, 0x00);
-        } else if (rt2x00_rt(rt2x00dev, RT5390)) {
-                rt2800_rfcsr_write(rt2x00dev, 1, 0x0f);
-                rt2800_rfcsr_write(rt2x00dev, 2, 0x80);
-                rt2800_rfcsr_write(rt2x00dev, 3, 0x88);
-                rt2800_rfcsr_write(rt2x00dev, 5, 0x10);
-                if (rt2x00_rt_rev_gte(rt2x00dev, RT5390, REV_RT5390F))
-                        rt2800_rfcsr_write(rt2x00dev, 6, 0xe0);
-                else
-                        rt2800_rfcsr_write(rt2x00dev, 6, 0xa0);
-                rt2800_rfcsr_write(rt2x00dev, 7, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 10, 0x53);
-                rt2800_rfcsr_write(rt2x00dev, 11, 0x4a);
-                rt2800_rfcsr_write(rt2x00dev, 12, 0xc6);
-                rt2800_rfcsr_write(rt2x00dev, 13, 0x9f);
-                rt2800_rfcsr_write(rt2x00dev, 14, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 15, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 16, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 18, 0x03);
-                rt2800_rfcsr_write(rt2x00dev, 19, 0x00);
-
-                rt2800_rfcsr_write(rt2x00dev, 20, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 21, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 22, 0x20);
-                rt2800_rfcsr_write(rt2x00dev, 23, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 24, 0x00);
-                if (rt2x00_rt_rev_gte(rt2x00dev, RT5390, REV_RT5390F))
-                        rt2800_rfcsr_write(rt2x00dev, 25, 0x80);
-                else
-                        rt2800_rfcsr_write(rt2x00dev, 25, 0xc0);
-                rt2800_rfcsr_write(rt2x00dev, 26, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 27, 0x09);
-                rt2800_rfcsr_write(rt2x00dev, 28, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 29, 0x10);
-
-                rt2800_rfcsr_write(rt2x00dev, 30, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 31, 0x80);
-                rt2800_rfcsr_write(rt2x00dev, 32, 0x80);
-                rt2800_rfcsr_write(rt2x00dev, 33, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 34, 0x07);
-                rt2800_rfcsr_write(rt2x00dev, 35, 0x12);
-                rt2800_rfcsr_write(rt2x00dev, 36, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 37, 0x08);
-                rt2800_rfcsr_write(rt2x00dev, 38, 0x85);
-                rt2800_rfcsr_write(rt2x00dev, 39, 0x1b);
-
-                if (rt2x00_rt_rev_gte(rt2x00dev, RT5390, REV_RT5390F))
-                        rt2800_rfcsr_write(rt2x00dev, 40, 0x0b);
-                else
-                        rt2800_rfcsr_write(rt2x00dev, 40, 0x4b);
-                rt2800_rfcsr_write(rt2x00dev, 41, 0xbb);
-                rt2800_rfcsr_write(rt2x00dev, 42, 0xd2);
-                rt2800_rfcsr_write(rt2x00dev, 43, 0x9a);
-                rt2800_rfcsr_write(rt2x00dev, 44, 0x0e);
-                rt2800_rfcsr_write(rt2x00dev, 45, 0xa2);
-                if (rt2x00_rt_rev_gte(rt2x00dev, RT5390, REV_RT5390F))
-                        rt2800_rfcsr_write(rt2x00dev, 46, 0x73);
-                else
-                        rt2800_rfcsr_write(rt2x00dev, 46, 0x7b);
-                rt2800_rfcsr_write(rt2x00dev, 47, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 48, 0x10);
-                rt2800_rfcsr_write(rt2x00dev, 49, 0x94);
-
-                rt2800_rfcsr_write(rt2x00dev, 52, 0x38);
-                if (rt2x00_rt_rev_gte(rt2x00dev, RT5390, REV_RT5390F))
-                        rt2800_rfcsr_write(rt2x00dev, 53, 0x00);
-                else
-                        rt2800_rfcsr_write(rt2x00dev, 53, 0x84);
-                rt2800_rfcsr_write(rt2x00dev, 54, 0x78);
-                rt2800_rfcsr_write(rt2x00dev, 55, 0x44);
-                rt2800_rfcsr_write(rt2x00dev, 56, 0x22);
-                rt2800_rfcsr_write(rt2x00dev, 57, 0x80);
-                rt2800_rfcsr_write(rt2x00dev, 58, 0x7f);
-                rt2800_rfcsr_write(rt2x00dev, 59, 0x63);
-
-                rt2800_rfcsr_write(rt2x00dev, 60, 0x45);
-                if (rt2x00_rt_rev_gte(rt2x00dev, RT5390, REV_RT5390F))
-                        rt2800_rfcsr_write(rt2x00dev, 61, 0xd1);
-                else
-                        rt2800_rfcsr_write(rt2x00dev, 61, 0xdd);
-                rt2800_rfcsr_write(rt2x00dev, 62, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 63, 0x00);
-        } else if (rt2x00_rt(rt2x00dev, RT5392)) {
-                rt2800_rfcsr_write(rt2x00dev, 1, 0x17);
-                rt2800_rfcsr_write(rt2x00dev, 2, 0x80);
-                rt2800_rfcsr_write(rt2x00dev, 3, 0x88);
-                rt2800_rfcsr_write(rt2x00dev, 5, 0x10);
-                rt2800_rfcsr_write(rt2x00dev, 6, 0xe0);
-                rt2800_rfcsr_write(rt2x00dev, 7, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 10, 0x53);
-                rt2800_rfcsr_write(rt2x00dev, 11, 0x4a);
-                rt2800_rfcsr_write(rt2x00dev, 12, 0x46);
-                rt2800_rfcsr_write(rt2x00dev, 13, 0x9f);
-                rt2800_rfcsr_write(rt2x00dev, 14, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 15, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 16, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 18, 0x03);
-                rt2800_rfcsr_write(rt2x00dev, 19, 0x4d);
-                rt2800_rfcsr_write(rt2x00dev, 20, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 21, 0x8d);
-                rt2800_rfcsr_write(rt2x00dev, 22, 0x20);
-                rt2800_rfcsr_write(rt2x00dev, 23, 0x0b);
-                rt2800_rfcsr_write(rt2x00dev, 24, 0x44);
-                rt2800_rfcsr_write(rt2x00dev, 25, 0x80);
-                rt2800_rfcsr_write(rt2x00dev, 26, 0x82);
-                rt2800_rfcsr_write(rt2x00dev, 27, 0x09);
-                rt2800_rfcsr_write(rt2x00dev, 28, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 29, 0x10);
-                rt2800_rfcsr_write(rt2x00dev, 30, 0x10);
-                rt2800_rfcsr_write(rt2x00dev, 31, 0x80);
-                rt2800_rfcsr_write(rt2x00dev, 32, 0x20);
-                rt2800_rfcsr_write(rt2x00dev, 33, 0xC0);
-                rt2800_rfcsr_write(rt2x00dev, 34, 0x07);
-                rt2800_rfcsr_write(rt2x00dev, 35, 0x12);
-                rt2800_rfcsr_write(rt2x00dev, 36, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 37, 0x08);
-                rt2800_rfcsr_write(rt2x00dev, 38, 0x89);
-                rt2800_rfcsr_write(rt2x00dev, 39, 0x1b);
-                rt2800_rfcsr_write(rt2x00dev, 40, 0x0f);
-                rt2800_rfcsr_write(rt2x00dev, 41, 0xbb);
-                rt2800_rfcsr_write(rt2x00dev, 42, 0xd5);
-                rt2800_rfcsr_write(rt2x00dev, 43, 0x9b);
-                rt2800_rfcsr_write(rt2x00dev, 44, 0x0e);
-                rt2800_rfcsr_write(rt2x00dev, 45, 0xa2);
-                rt2800_rfcsr_write(rt2x00dev, 46, 0x73);
-                rt2800_rfcsr_write(rt2x00dev, 47, 0x0c);
-                rt2800_rfcsr_write(rt2x00dev, 48, 0x10);
-                rt2800_rfcsr_write(rt2x00dev, 49, 0x94);
-                rt2800_rfcsr_write(rt2x00dev, 50, 0x94);
-                rt2800_rfcsr_write(rt2x00dev, 51, 0x3a);
-                rt2800_rfcsr_write(rt2x00dev, 52, 0x48);
-                rt2800_rfcsr_write(rt2x00dev, 53, 0x44);
-                rt2800_rfcsr_write(rt2x00dev, 54, 0x38);
-                rt2800_rfcsr_write(rt2x00dev, 55, 0x43);
-                rt2800_rfcsr_write(rt2x00dev, 56, 0xa1);
-                rt2800_rfcsr_write(rt2x00dev, 57, 0x00);
-                rt2800_rfcsr_write(rt2x00dev, 58, 0x39);
-                rt2800_rfcsr_write(rt2x00dev, 59, 0x07);
-                rt2800_rfcsr_write(rt2x00dev, 60, 0x45);
-                rt2800_rfcsr_write(rt2x00dev, 61, 0x91);
-                rt2800_rfcsr_write(rt2x00dev, 62, 0x39);
-                rt2800_rfcsr_write(rt2x00dev, 63, 0x07);
+        }
+
+        switch (rt2x00dev->chip.rt) {
+        case RT3070:
+        case RT3071:
+        case RT3090:
+                rt2800_init_rfcsr_30xx(rt2x00dev);
+                break;
+        case RT3290:
+                rt2800_init_rfcsr_3290(rt2x00dev);
+                break;
+        case RT3352:
+                rt2800_init_rfcsr_3352(rt2x00dev);
+                break;
+        case RT3390:
+                rt2800_init_rfcsr_3390(rt2x00dev);
+                break;
+        case RT3572:
+                rt2800_init_rfcsr_3572(rt2x00dev);
+                break;
+        case RT5390:
+                rt2800_init_rfcsr_5390(rt2x00dev);
+                break;
+        case RT5392:
+                rt2800_init_rfcsr_5392(rt2x00dev);
+                break;
         }
 
         if (rt2x00_rt_rev_lt(rt2x00dev, RT3070, REV_RT3070F)) {
@@ -4620,12 +4670,14 @@ static void rt2800_efuse_read(struct rt2x00_dev *rt2x00dev, unsigned int i)
         mutex_unlock(&rt2x00dev->csr_mutex);
 }
 
-void rt2800_read_eeprom_efuse(struct rt2x00_dev *rt2x00dev)
+int rt2800_read_eeprom_efuse(struct rt2x00_dev *rt2x00dev)
 {
         unsigned int i;
 
         for (i = 0; i < EEPROM_SIZE / sizeof(u16); i += 8)
                 rt2800_efuse_read(rt2x00dev, i);
+
+        return 0;
 }
 EXPORT_SYMBOL_GPL(rt2800_read_eeprom_efuse);
 
@@ -4635,11 +4687,14 @@ static int rt2800_validate_eeprom(struct rt2x00_dev *rt2x00dev)
         u16 word;
         u8 *mac;
         u8 default_lna_gain;
+        int retval;
 
         /*
          * Read the EEPROM.
          */
-        rt2800_read_eeprom(rt2x00dev);
+        retval = rt2800_read_eeprom(rt2x00dev);
+        if (retval)
+                return retval;
 
         /*
          * Start validation of the data that has been read.
@@ -5090,8 +5145,7 @@ static int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
             IEEE80211_HW_SUPPORTS_PS |
             IEEE80211_HW_PS_NULLFUNC_STACK |
             IEEE80211_HW_AMPDU_AGGREGATION |
-            IEEE80211_HW_REPORTS_TX_ACK_STATUS |
-            IEEE80211_HW_TEARDOWN_AGGR_ON_BAR_FAIL;
+            IEEE80211_HW_REPORTS_TX_ACK_STATUS;
 
         /*
          * Don't set IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING for USB devices
@@ -5484,7 +5538,9 @@ int rt2800_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
         case IEEE80211_AMPDU_TX_START:
                 ieee80211_start_tx_ba_cb_irqsafe(vif, sta->addr, tid);
                 break;
-        case IEEE80211_AMPDU_TX_STOP:
+        case IEEE80211_AMPDU_TX_STOP_CONT:
+        case IEEE80211_AMPDU_TX_STOP_FLUSH:
+        case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
                 ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
                 break;
         case IEEE80211_AMPDU_TX_OPERATIONAL:
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.h b/drivers/net/wireless/rt2x00/rt2800lib.h
index a128ceadcb3e..6ec739466db4 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.h
+++ b/drivers/net/wireless/rt2x00/rt2800lib.h
@@ -43,7 +43,7 @@ struct rt2800_ops {
                             const unsigned int offset,
                             const struct rt2x00_field32 field, u32 *reg);
 
-        void (*read_eeprom)(struct rt2x00_dev *rt2x00dev);
+        int (*read_eeprom)(struct rt2x00_dev *rt2x00dev);
         bool (*hwcrypt_disabled)(struct rt2x00_dev *rt2x00dev);
 
         int (*drv_write_firmware)(struct rt2x00_dev *rt2x00dev,
@@ -117,11 +117,11 @@ static inline int rt2800_regbusy_read(struct rt2x00_dev *rt2x00dev,
         return rt2800ops->regbusy_read(rt2x00dev, offset, field, reg);
 }
 
-static inline void rt2800_read_eeprom(struct rt2x00_dev *rt2x00dev)
+static inline int rt2800_read_eeprom(struct rt2x00_dev *rt2x00dev)
 {
         const struct rt2800_ops *rt2800ops = rt2x00dev->ops->drv;
 
-        rt2800ops->read_eeprom(rt2x00dev);
+        return rt2800ops->read_eeprom(rt2x00dev);
 }
 
 static inline bool rt2800_hwcrypt_disabled(struct rt2x00_dev *rt2x00dev)
@@ -207,7 +207,7 @@ int rt2800_enable_radio(struct rt2x00_dev *rt2x00dev);
 void rt2800_disable_radio(struct rt2x00_dev *rt2x00dev);
 
 int rt2800_efuse_detect(struct rt2x00_dev *rt2x00dev);
-void rt2800_read_eeprom_efuse(struct rt2x00_dev *rt2x00dev);
+int rt2800_read_eeprom_efuse(struct rt2x00_dev *rt2x00dev);
 
 int rt2800_probe_hw(struct rt2x00_dev *rt2x00dev);
 
diff --git a/drivers/net/wireless/rt2x00/rt2800pci.c b/drivers/net/wireless/rt2x00/rt2800pci.c
index 9224d874bf24..0e8d1705e368 100644
--- a/drivers/net/wireless/rt2x00/rt2800pci.c
+++ b/drivers/net/wireless/rt2x00/rt2800pci.c
@@ -90,17 +90,22 @@ static void rt2800pci_mcu_status(struct rt2x00_dev *rt2x00dev, const u8 token)
 }
 
 #if defined(CONFIG_RALINK_RT288X) || defined(CONFIG_RALINK_RT305X)
-static void rt2800pci_read_eeprom_soc(struct rt2x00_dev *rt2x00dev)
+static int rt2800pci_read_eeprom_soc(struct rt2x00_dev *rt2x00dev)
 {
         void __iomem *base_addr = ioremap(0x1F040000, EEPROM_SIZE);
 
+        if (!base_addr)
+                return -ENOMEM;
+
         memcpy_fromio(rt2x00dev->eeprom, base_addr, EEPROM_SIZE);
 
         iounmap(base_addr);
+        return 0;
 }
 #else
-static inline void rt2800pci_read_eeprom_soc(struct rt2x00_dev *rt2x00dev)
+static inline int rt2800pci_read_eeprom_soc(struct rt2x00_dev *rt2x00dev)
 {
+        return -ENOMEM;
 }
 #endif /* CONFIG_RALINK_RT288X || CONFIG_RALINK_RT305X */
 
@@ -135,7 +140,7 @@ static void rt2800pci_eepromregister_write(struct eeprom_93cx6 *eeprom)
         rt2x00pci_register_write(rt2x00dev, E2PROM_CSR, reg);
 }
 
-static void rt2800pci_read_eeprom_pci(struct rt2x00_dev *rt2x00dev)
+static int rt2800pci_read_eeprom_pci(struct rt2x00_dev *rt2x00dev)
 {
         struct eeprom_93cx6 eeprom;
         u32 reg;
@@ -164,6 +169,8 @@ static void rt2800pci_read_eeprom_pci(struct rt2x00_dev *rt2x00dev)
 
         eeprom_93cx6_multiread(&eeprom, EEPROM_BASE, rt2x00dev->eeprom,
                                EEPROM_SIZE / sizeof(u16));
+
+        return 0;
 }
 
 static int rt2800pci_efuse_detect(struct rt2x00_dev *rt2x00dev)
@@ -171,13 +178,14 @@ static int rt2800pci_efuse_detect(struct rt2x00_dev *rt2x00dev)
         return rt2800_efuse_detect(rt2x00dev);
 }
 
-static inline void rt2800pci_read_eeprom_efuse(struct rt2x00_dev *rt2x00dev)
+static inline int rt2800pci_read_eeprom_efuse(struct rt2x00_dev *rt2x00dev)
 {
-        rt2800_read_eeprom_efuse(rt2x00dev);
+        return rt2800_read_eeprom_efuse(rt2x00dev);
 }
 #else
-static inline void rt2800pci_read_eeprom_pci(struct rt2x00_dev *rt2x00dev)
+static inline int rt2800pci_read_eeprom_pci(struct rt2x00_dev *rt2x00dev)
 {
+        return -EOPNOTSUPP;
 }
 
 static inline int rt2800pci_efuse_detect(struct rt2x00_dev *rt2x00dev)
@@ -185,8 +193,9 @@ static inline int rt2800pci_efuse_detect(struct rt2x00_dev *rt2x00dev)
         return 0;
 }
 
-static inline void rt2800pci_read_eeprom_efuse(struct rt2x00_dev *rt2x00dev)
+static inline int rt2800pci_read_eeprom_efuse(struct rt2x00_dev *rt2x00dev)
 {
+        return -EOPNOTSUPP;
 }
 #endif /* CONFIG_PCI */
 
@@ -970,14 +979,18 @@ static irqreturn_t rt2800pci_interrupt(int irq, void *dev_instance)
 /*
  * Device probe functions.
  */
-static void rt2800pci_read_eeprom(struct rt2x00_dev *rt2x00dev)
+static int rt2800pci_read_eeprom(struct rt2x00_dev *rt2x00dev)
 {
+        int retval;
+
         if (rt2x00_is_soc(rt2x00dev))
-                rt2800pci_read_eeprom_soc(rt2x00dev);
+                retval = rt2800pci_read_eeprom_soc(rt2x00dev);
         else if (rt2800pci_efuse_detect(rt2x00dev))
-                rt2800pci_read_eeprom_efuse(rt2x00dev);
+                retval = rt2800pci_read_eeprom_efuse(rt2x00dev);
         else
-                rt2800pci_read_eeprom_pci(rt2x00dev);
+                retval = rt2800pci_read_eeprom_pci(rt2x00dev);
+
+        return retval;
 }
 
 static const struct ieee80211_ops rt2800pci_mac80211_ops = {
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index 5c149b58ab46..d6863289471b 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -540,9 +540,9 @@ rt2800usb_txdone_entry_check(struct queue_entry *entry, u32 reg)
         tx_pid  = rt2x00_get_field32(word, TXWI_W1_PACKETID);
 
         if (wcid != tx_wcid || ack != tx_ack || (!is_agg && pid != tx_pid)) {
-                WARNING(entry->queue->rt2x00dev,
-                        "TX status report missed for queue %d entry %d\n",
-                        entry->queue->qid, entry->entry_idx);
+                DEBUG(entry->queue->rt2x00dev,
+                      "TX status report missed for queue %d entry %d\n",
+                      entry->queue->qid, entry->entry_idx);
                 return TXDONE_UNKNOWN;
         }
 
@@ -735,13 +735,17 @@ static void rt2800usb_fill_rxdone(struct queue_entry *entry,
 /*
  * Device probe functions.
  */
-static void rt2800usb_read_eeprom(struct rt2x00_dev *rt2x00dev)
+static int rt2800usb_read_eeprom(struct rt2x00_dev *rt2x00dev)
 {
+        int retval;
+
         if (rt2800_efuse_detect(rt2x00dev))
-                rt2800_read_eeprom_efuse(rt2x00dev);
+                retval = rt2800_read_eeprom_efuse(rt2x00dev);
         else
-                rt2x00usb_eeprom_read(rt2x00dev, rt2x00dev->eeprom,
-                                      EEPROM_SIZE);
+                retval = rt2x00usb_eeprom_read(rt2x00dev, rt2x00dev->eeprom,
+                                               EEPROM_SIZE);
+
+        return retval;
 }
 
 static int rt2800usb_probe_hw(struct rt2x00_dev *rt2x00dev)
diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
index 0751b35ef6dc..9a3f31a543ce 100644
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -88,11 +88,9 @@
 #define ERROR_PROBE(__msg, __args...) \
         DEBUG_PRINTK_PROBE(KERN_ERR, "Error", __msg, ##__args)
 #define WARNING(__dev, __msg, __args...) \
-        DEBUG_PRINTK(__dev, KERN_WARNING, "Warning", __msg, ##__args)
-#define NOTICE(__dev, __msg, __args...) \
-        DEBUG_PRINTK(__dev, KERN_NOTICE, "Notice", __msg, ##__args)
+        DEBUG_PRINTK_MSG(__dev, KERN_WARNING, "Warning", __msg, ##__args)
 #define INFO(__dev, __msg, __args...) \
-        DEBUG_PRINTK(__dev, KERN_INFO, "Info", __msg, ##__args)
+        DEBUG_PRINTK_MSG(__dev, KERN_INFO, "Info", __msg, ##__args)
 #define DEBUG(__dev, __msg, __args...) \
         DEBUG_PRINTK(__dev, KERN_DEBUG, "Debug", __msg, ##__args)
 #define EEPROM(__dev, __msg, __args...) \
@@ -1016,6 +1014,26 @@ struct rt2x00_dev {
          * Protect the interrupt mask register.
          */
         spinlock_t irqmask_lock;
+
+        /*
+         * List of BlockAckReq TX entries that need driver BlockAck processing.
+         */
+        struct list_head bar_list;
+        spinlock_t bar_list_lock;
+};
+
+struct rt2x00_bar_list_entry {
+        struct list_head list;
+        struct rcu_head head;
+
+        struct queue_entry *entry;
+        int block_acked;
+
+        /* Relevant parts of the IEEE80211 BAR header */
+        __u8 ra[6];
+        __u8 ta[6];
+        __le16 control;
+        __le16 start_seq_num;
 };
 
 /*
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index 44f8b3f3cbed..1031db66474a 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -271,6 +271,50 @@ void rt2x00lib_dmadone(struct queue_entry *entry)
 }
 EXPORT_SYMBOL_GPL(rt2x00lib_dmadone);
 
+static inline int rt2x00lib_txdone_bar_status(struct queue_entry *entry)
+{
+        struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
+        struct ieee80211_bar *bar = (void *) entry->skb->data;
+        struct rt2x00_bar_list_entry *bar_entry;
+        int ret;
+
+        if (likely(!ieee80211_is_back_req(bar->frame_control)))
+                return 0;
+
+        /*
+         * Unlike all other frames, the status report for BARs does
+         * not directly come from the hardware as it is incapable of
+         * matching a BA to a previously send BAR. The hardware will
+         * report all BARs as if they weren't acked at all.
+         *
+         * Instead the RX-path will scan for incoming BAs and set the
+         * block_acked flag if it sees one that was likely caused by
+         * a BAR from us.
+         *
+         * Remove remaining BARs here and return their status for
+         * TX done processing.
+         */
+        ret = 0;
+        rcu_read_lock();
+        list_for_each_entry_rcu(bar_entry, &rt2x00dev->bar_list, list) {
+                if (bar_entry->entry != entry)
+                        continue;
+
+                spin_lock_bh(&rt2x00dev->bar_list_lock);
+                /* Return whether this BAR was blockacked or not */
+                ret = bar_entry->block_acked;
+                /* Remove the BAR from our checklist */
+                list_del_rcu(&bar_entry->list);
+                spin_unlock_bh(&rt2x00dev->bar_list_lock);
+                kfree_rcu(bar_entry, head);
+
+                break;
+        }
+        rcu_read_unlock();
+
+        return ret;
+}
+
 void rt2x00lib_txdone(struct queue_entry *entry,
                       struct txdone_entry_desc *txdesc)
 {
@@ -324,9 +368,12 @@ void rt2x00lib_txdone(struct queue_entry *entry,
         rt2x00debug_dump_frame(rt2x00dev, DUMP_FRAME_TXDONE, entry->skb);
 
         /*
-         * Determine if the frame has been successfully transmitted.
+         * Determine if the frame has been successfully transmitted and
+         * remove BARs from our check list while checking for their
+         * TX status.
          */
         success =
+            rt2x00lib_txdone_bar_status(entry) ||
             test_bit(TXDONE_SUCCESS, &txdesc->flags) ||
             test_bit(TXDONE_UNKNOWN, &txdesc->flags);
 
@@ -491,6 +538,50 @@ static void rt2x00lib_sleep(struct work_struct *work)
                                  IEEE80211_CONF_CHANGE_PS);
 }
 
+static void rt2x00lib_rxdone_check_ba(struct rt2x00_dev *rt2x00dev,
+                                      struct sk_buff *skb,
+                                      struct rxdone_entry_desc *rxdesc)
+{
+        struct rt2x00_bar_list_entry *entry;
+        struct ieee80211_bar *ba = (void *)skb->data;
+
+        if (likely(!ieee80211_is_back(ba->frame_control)))
+                return;
+
+        if (rxdesc->size < sizeof(*ba) + FCS_LEN)
+                return;
+
+        rcu_read_lock();
+        list_for_each_entry_rcu(entry, &rt2x00dev->bar_list, list) {
+
+                if (ba->start_seq_num != entry->start_seq_num)
+                        continue;
+
+#define TID_CHECK(a, b) (                                               \
+        ((a) & cpu_to_le16(IEEE80211_BAR_CTRL_TID_INFO_MASK)) ==        \
+        ((b) & cpu_to_le16(IEEE80211_BAR_CTRL_TID_INFO_MASK)))          \
+
+                if (!TID_CHECK(ba->control, entry->control))
+                        continue;
+
+#undef TID_CHECK
+
+                if (compare_ether_addr(ba->ra, entry->ta))
+                        continue;
+
+                if (compare_ether_addr(ba->ta, entry->ra))
+                        continue;
+
+                /* Mark BAR since we received the according BA */
+                spin_lock_bh(&rt2x00dev->bar_list_lock);
+                entry->block_acked = 1;
+                spin_unlock_bh(&rt2x00dev->bar_list_lock);
+                break;
+        }
+        rcu_read_unlock();
+
+}
+
 static void rt2x00lib_rxdone_check_ps(struct rt2x00_dev *rt2x00dev,
                                       struct sk_buff *skb,
                                       struct rxdone_entry_desc *rxdesc)
@@ -674,6 +765,12 @@ void rt2x00lib_rxdone(struct queue_entry *entry, gfp_t gfp)
         rt2x00lib_rxdone_check_ps(rt2x00dev, entry->skb, &rxdesc);
 
         /*
+         * Check for incoming BlockAcks to match to the BlockAckReqs
+         * we've send out.
+         */
+        rt2x00lib_rxdone_check_ba(rt2x00dev, entry->skb, &rxdesc);
+
+        /*
          * Update extra components
          */
         rt2x00link_update_stats(rt2x00dev, entry->skb, &rxdesc);
@@ -1139,7 +1236,8 @@ static inline void rt2x00lib_set_if_combinations(struct rt2x00_dev *rt2x00dev)
          */
         if_limit = &rt2x00dev->if_limits_ap;
         if_limit->max = rt2x00dev->ops->max_ap_intf;
-        if_limit->types = BIT(NL80211_IFTYPE_AP);
+        if_limit->types = BIT(NL80211_IFTYPE_AP) |
+                        BIT(NL80211_IFTYPE_MESH_POINT);
 
         /*
          * Build up AP interface combinations structure.
@@ -1183,6 +1281,8 @@ int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev)
 
         spin_lock_init(&rt2x00dev->irqmask_lock);
         mutex_init(&rt2x00dev->csr_mutex);
+        INIT_LIST_HEAD(&rt2x00dev->bar_list);
+        spin_lock_init(&rt2x00dev->bar_list_lock);
 
         set_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags);
 
@@ -1347,7 +1447,7 @@ EXPORT_SYMBOL_GPL(rt2x00lib_remove_dev);
 #ifdef CONFIG_PM
 int rt2x00lib_suspend(struct rt2x00_dev *rt2x00dev, pm_message_t state)
 {
-        NOTICE(rt2x00dev, "Going to sleep.\n");
+        DEBUG(rt2x00dev, "Going to sleep.\n");
 
         /*
          * Prevent mac80211 from accessing driver while suspended.
@@ -1387,7 +1487,7 @@ EXPORT_SYMBOL_GPL(rt2x00lib_suspend);
 
 int rt2x00lib_resume(struct rt2x00_dev *rt2x00dev)
 {
-        NOTICE(rt2x00dev, "Waking up.\n");
+        DEBUG(rt2x00dev, "Waking up.\n");
 
         /*
          * Restore/enable extra components.
diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
index ed7a1bb3f245..20c6eccce5aa 100644
--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
@@ -731,9 +731,9 @@ int rt2x00mac_conf_tx(struct ieee80211_hw *hw,
         queue->aifs = params->aifs;
         queue->txop = params->txop;
 
-        INFO(rt2x00dev,
-             "Configured TX queue %d - CWmin: %d, CWmax: %d, Aifs: %d, TXop: %d.\n",
-             queue_idx, queue->cw_min, queue->cw_max, queue->aifs, queue->txop);
+        DEBUG(rt2x00dev,
+              "Configured TX queue %d - CWmin: %d, CWmax: %d, Aifs: %d, TXop: %d.\n",
+              queue_idx, queue->cw_min, queue->cw_max, queue->aifs, queue->txop);
 
         return 0;
 }
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index e488b944a034..f35d85a71bbc 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -582,6 +582,48 @@ static void rt2x00queue_kick_tx_queue(struct data_queue *queue,
                 queue->rt2x00dev->ops->lib->kick_queue(queue);
 }
 
+static void rt2x00queue_bar_check(struct queue_entry *entry)
+{
+        struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
+        struct ieee80211_bar *bar = (void *) (entry->skb->data +
+                                    rt2x00dev->ops->extra_tx_headroom);
+        struct rt2x00_bar_list_entry *bar_entry;
+
+        if (likely(!ieee80211_is_back_req(bar->frame_control)))
+                return;
+
+        bar_entry = kmalloc(sizeof(*bar_entry), GFP_ATOMIC);
+
+        /*
+         * If the alloc fails we still send the BAR out but just don't track
+         * it in our bar list. And as a result we will report it to mac80211
+         * back as failed.
+         */
+        if (!bar_entry)
+                return;
+
+        bar_entry->entry = entry;
+        bar_entry->block_acked = 0;
+
+        /*
+         * Copy the relevant parts of the 802.11 BAR into out check list
+         * such that we can use RCU for less-overhead in the RX path since
+         * sending BARs and processing the according BlockAck should be
+         * the exception.
+         */
+        memcpy(bar_entry->ra, bar->ra, sizeof(bar->ra));
+        memcpy(bar_entry->ta, bar->ta, sizeof(bar->ta));
+        bar_entry->control = bar->control;
+        bar_entry->start_seq_num = bar->start_seq_num;
+
+        /*
+         * Insert BAR into our BAR check list.
+         */
+        spin_lock_bh(&rt2x00dev->bar_list_lock);
+        list_add_tail_rcu(&bar_entry->list, &rt2x00dev->bar_list);
+        spin_unlock_bh(&rt2x00dev->bar_list_lock);
+}
+
 int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb,
                                bool local)
 {
@@ -680,6 +722,11 @@ int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb,
                 goto out;
         }
 
+        /*
+         * Put BlockAckReqs into our check list for driver BA processing.
+         */
+        rt2x00queue_bar_check(entry);
+
         set_bit(ENTRY_DATA_PENDING, &entry->flags);
 
         rt2x00queue_index_inc(entry, Q_INDEX);
diff --git a/drivers/net/wireless/rtlwifi/Kconfig b/drivers/net/wireless/rtlwifi/Kconfig
index 21b1bbb93a7e..b80bc4612581 100644
--- a/drivers/net/wireless/rtlwifi/Kconfig
+++ b/drivers/net/wireless/rtlwifi/Kconfig
@@ -57,12 +57,12 @@ config RTL8192CU
 
 config RTLWIFI
         tristate
-        depends on RTL8192CE || RTL8192CU || RTL8192SE || RTL8192DE
+        depends on RTL8192CE || RTL8192CU || RTL8192SE || RTL8192DE || RTL8723AE
         default m
 
 config RTLWIFI_DEBUG
         bool "Additional debugging output"
-        depends on RTL8192CE || RTL8192CU || RTL8192SE || RTL8192DE
+        depends on RTL8192CE || RTL8192CU || RTL8192SE || RTL8192DE || RTL8723AE
         default y
 
 config RTL8192C_COMMON
diff --git a/drivers/net/wireless/rtlwifi/core.c b/drivers/net/wireless/rtlwifi/core.c
index be33aa14c8af..d3ce9fbef00e 100644
--- a/drivers/net/wireless/rtlwifi/core.c
+++ b/drivers/net/wireless/rtlwifi/core.c
@@ -879,7 +879,9 @@ static int rtl_op_ampdu_action(struct ieee80211_hw *hw,
                          "IEEE80211_AMPDU_TX_START: TID:%d\n", tid);
                 return rtl_tx_agg_start(hw, sta, tid, ssn);
                 break;
-        case IEEE80211_AMPDU_TX_STOP:
+        case IEEE80211_AMPDU_TX_STOP_CONT:
+        case IEEE80211_AMPDU_TX_STOP_FLUSH:
+        case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
                 RT_TRACE(rtlpriv, COMP_MAC80211, DBG_TRACE,
                          "IEEE80211_AMPDU_TX_STOP: TID:%d\n", tid);
                 return rtl_tx_agg_stop(hw, sta, tid);
diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
index 3deacafdcd5e..4261e8ecc4c3 100644
--- a/drivers/net/wireless/rtlwifi/pci.c
+++ b/drivers/net/wireless/rtlwifi/pci.c
@@ -743,6 +743,8 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
 
 done:
                 bufferaddress = (*((dma_addr_t *)skb->cb));
+                if (pci_dma_mapping_error(rtlpci->pdev, bufferaddress))
+                        return;
                 tmp_one = 1;
                 rtlpriv->cfg->ops->set_desc((u8 *) pdesc, false,
                                             HW_DESC_RXBUFF_ADDR,
@@ -1115,6 +1117,10 @@ static int _rtl_pci_init_rx_ring(struct ieee80211_hw *hw)
                                            PCI_DMA_FROMDEVICE);
 
                         bufferaddress = (*((dma_addr_t *)skb->cb));
+                        if (pci_dma_mapping_error(rtlpci->pdev, bufferaddress)) {
+                                dev_kfree_skb_any(skb);
+                                return 1;
+                        }
                         rtlpriv->cfg->ops->set_desc((u8 *)entry, false,
                                                     HW_DESC_RXBUFF_ADDR,
                                                     (u8 *)&bufferaddress);
diff --git a/drivers/net/wireless/rtlwifi/rc.c b/drivers/net/wireless/rtlwifi/rc.c
index c1e065f136ba..204f46c4510d 100644
--- a/drivers/net/wireless/rtlwifi/rc.c
+++ b/drivers/net/wireless/rtlwifi/rc.c
@@ -217,19 +217,6 @@ static void rtl_tx_status(void *ppriv,
         }
 }
 
-static void rtl_rate_init(void *ppriv,
-                          struct ieee80211_supported_band *sband,
-                          struct ieee80211_sta *sta, void *priv_sta)
-{
-}
-
-static void rtl_rate_update(void *ppriv,
-                            struct ieee80211_supported_band *sband,
-                            struct ieee80211_sta *sta, void *priv_sta,
-                            u32 changed)
-{
-}
-
 static void *rtl_rate_alloc(struct ieee80211_hw *hw,
                 struct dentry *debugfsdir)
 {
@@ -274,8 +261,6 @@ static struct rate_control_ops rtl_rate_ops = {
         .free = rtl_rate_free,
         .alloc_sta = rtl_rate_alloc_sta,
         .free_sta = rtl_rate_free_sta,
-        .rate_init = rtl_rate_init,
-        .rate_update = rtl_rate_update,
         .tx_status = rtl_tx_status,
         .get_rate = rtl_get_rate,
 };
diff --git a/drivers/net/wireless/rtlwifi/regd.c b/drivers/net/wireless/rtlwifi/regd.c
index c1608cddc529..d7d0d4948b01 100644
--- a/drivers/net/wireless/rtlwifi/regd.c
+++ b/drivers/net/wireless/rtlwifi/regd.c
@@ -158,8 +158,6 @@ static void _rtl_reg_apply_beaconing_flags(struct wiphy *wiphy,
         const struct ieee80211_reg_rule *reg_rule;
         struct ieee80211_channel *ch;
         unsigned int i;
-        u32 bandwidth = 0;
-        int r;
 
         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 
@@ -174,9 +172,8 @@ static void _rtl_reg_apply_beaconing_flags(struct wiphy *wiphy,
                             (ch->flags & IEEE80211_CHAN_RADAR))
                                 continue;
                         if (initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE) {
-                                r = freq_reg_info(wiphy, ch->center_freq,
-                                                  bandwidth, &reg_rule);
-                                if (r)
+                                reg_rule = freq_reg_info(wiphy, ch->center_freq);
+                                if (IS_ERR(reg_rule))
                                         continue;
 
                                 /*
@@ -211,8 +208,6 @@ static void _rtl_reg_apply_active_scan_flags(struct wiphy *wiphy,
         struct ieee80211_supported_band *sband;
         struct ieee80211_channel *ch;
         const struct ieee80211_reg_rule *reg_rule;
-        u32 bandwidth = 0;
-        int r;
 
         if (!wiphy->bands[IEEE80211_BAND_2GHZ])
                 return;
@@ -240,16 +235,16 @@ static void _rtl_reg_apply_active_scan_flags(struct wiphy *wiphy,
          */
 
         ch = &sband->channels[11];      /* CH 12 */
-        r = freq_reg_info(wiphy, ch->center_freq, bandwidth, &reg_rule);
-        if (!r) {
+        reg_rule = freq_reg_info(wiphy, ch->center_freq);
+        if (!IS_ERR(reg_rule)) {
                 if (!(reg_rule->flags & NL80211_RRF_PASSIVE_SCAN))
                         if (ch->flags & IEEE80211_CHAN_PASSIVE_SCAN)
                                 ch->flags &= ~IEEE80211_CHAN_PASSIVE_SCAN;
         }
 
         ch = &sband->channels[12];      /* CH 13 */
-        r = freq_reg_info(wiphy, ch->center_freq, bandwidth, &reg_rule);
-        if (!r) {
+        reg_rule = freq_reg_info(wiphy, ch->center_freq);
+        if (!IS_ERR(reg_rule)) {
                 if (!(reg_rule->flags & NL80211_RRF_PASSIVE_SCAN))
                         if (ch->flags & IEEE80211_CHAN_PASSIVE_SCAN)
                                 ch->flags &= ~IEEE80211_CHAN_PASSIVE_SCAN;
@@ -303,9 +298,9 @@ static void _rtl_reg_apply_world_flags(struct wiphy *wiphy,
         return;
 }
 
-static int _rtl_reg_notifier_apply(struct wiphy *wiphy,
-                                   struct regulatory_request *request,
-                                   struct rtl_regulatory *reg)
+static void _rtl_reg_notifier_apply(struct wiphy *wiphy,
+                                    struct regulatory_request *request,
+                                    struct rtl_regulatory *reg)
 {
         /* We always apply this */
         _rtl_reg_apply_radar_flags(wiphy);
@@ -319,8 +314,6 @@ static int _rtl_reg_notifier_apply(struct wiphy *wiphy,
                 _rtl_reg_apply_world_flags(wiphy, request->initiator, reg);
                 break;
         }
-
-        return 0;
 }
 
 static const struct ieee80211_regdomain *_rtl_regdomain_select(
@@ -353,9 +346,9 @@ static const struct ieee80211_regdomain *_rtl_regdomain_select(
 
 static int _rtl_regd_init_wiphy(struct rtl_regulatory *reg,
                                 struct wiphy *wiphy,
-                                int (*reg_notifier) (struct wiphy *wiphy,
-                                                     struct regulatory_request *
-                                                     request))
+                                void (*reg_notifier) (struct wiphy *wiphy,
+                                                      struct regulatory_request *
+                                                      request))
 {
         const struct ieee80211_regdomain *regd;
 
@@ -384,7 +377,7 @@ static struct country_code_to_enum_rd *_rtl_regd_find_country(u16 countrycode)
 }
 
 int rtl_regd_init(struct ieee80211_hw *hw,
-                  int (*reg_notifier) (struct wiphy *wiphy,
+                  void (*reg_notifier) (struct wiphy *wiphy,
                                        struct regulatory_request *request))
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
@@ -426,12 +419,12 @@ int rtl_regd_init(struct ieee80211_hw *hw,
         return 0;
 }
 
-int rtl_reg_notifier(struct wiphy *wiphy, struct regulatory_request *request)
+void rtl_reg_notifier(struct wiphy *wiphy, struct regulatory_request *request)
 {
         struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
         struct rtl_priv *rtlpriv = rtl_priv(hw);
 
         RT_TRACE(rtlpriv, COMP_REGD, DBG_LOUD, "\n");
 
-        return _rtl_reg_notifier_apply(wiphy, request, &rtlpriv->regd);
+        _rtl_reg_notifier_apply(wiphy, request, &rtlpriv->regd);
 }
diff --git a/drivers/net/wireless/rtlwifi/regd.h b/drivers/net/wireless/rtlwifi/regd.h
index 70ef2f418a44..4e1f4f00e6e9 100644
--- a/drivers/net/wireless/rtlwifi/regd.h
+++ b/drivers/net/wireless/rtlwifi/regd.h
@@ -55,7 +55,7 @@ enum country_code_type_t {
 };
 
 int rtl_regd_init(struct ieee80211_hw *hw,
-                  int (*reg_notifier) (struct wiphy *wiphy,
-                                       struct regulatory_request *request));
-int rtl_reg_notifier(struct wiphy *wiphy, struct regulatory_request *request);
+                  void (*reg_notifier) (struct wiphy *wiphy,
+                                        struct regulatory_request *request));
+void rtl_reg_notifier(struct wiphy *wiphy, struct regulatory_request *request);
 #endif
diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c b/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c
index 1d5d3604e3e0..246e5352f2e1 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c
@@ -692,7 +692,7 @@ u8 rtl92c_phy_sw_chnl(struct ieee80211_hw *hw)
         if (!(is_hal_stop(rtlhal)) && !(RT_CANNOT_IO(hw))) {
                 rtl92c_phy_sw_chnl_callback(hw);
                 RT_TRACE(rtlpriv, COMP_CHAN, DBG_LOUD,
-                         "sw_chnl_inprogress false schdule workitem\n");
+                         "sw_chnl_inprogress false schedule workitem\n");
                 rtlphy->sw_chnl_inprogress = false;
         } else {
                 RT_TRACE(rtlpriv, COMP_CHAN, DBG_LOUD,
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c b/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c
index 173424756149..c31795e379f7 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c
@@ -611,8 +611,14 @@ void rtl92ce_tx_fill_desc(struct ieee80211_hw *hw,
         dma_addr_t mapping = pci_map_single(rtlpci->pdev,
                                             skb->data, skb->len,
                                             PCI_DMA_TODEVICE);
+
         u8 bw_40 = 0;
 
+        if (pci_dma_mapping_error(rtlpci->pdev, mapping)) {
+                RT_TRACE(rtlpriv, COMP_SEND, DBG_TRACE,
+                         "DMA mapping error");
+                return;
+        }
         rcu_read_lock();
         sta = get_sta(hw, mac->vif, mac->bssid);
         if (mac->opmode == NL80211_IFTYPE_STATION) {
@@ -774,6 +780,11 @@ void rtl92ce_tx_fill_cmddesc(struct ieee80211_hw *hw,
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)(skb->data);
         __le16 fc = hdr->frame_control;
 
+        if (pci_dma_mapping_error(rtlpci->pdev, mapping)) {
+                RT_TRACE(rtlpriv, COMP_SEND, DBG_TRACE,
+                         "DMA mapping error");
+                return;
+        }
         CLEAR_PCI_TX_DESC_CONTENT(pdesc, TX_DESC_SIZE);
 
         if (firstseg)
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/trx.c b/drivers/net/wireless/rtlwifi/rtl8192de/trx.c
index f9f3861046c1..cdb570ffb4b5 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/trx.c
@@ -452,7 +452,7 @@ static void _rtl92de_translate_rx_signal_stuff(struct ieee80211_hw *hw,
         u8 *praddr;
         u16 type, cfc;
         __le16 fc;
-        bool packet_matchbssid, packet_toself, packet_beacon;
+        bool packet_matchbssid, packet_toself, packet_beacon = false;
 
         tmp_buf = skb->data + pstats->rx_drvinfo_size + pstats->rx_bufshift;
         hdr = (struct ieee80211_hdr *)tmp_buf;
@@ -587,6 +587,11 @@ void rtl92de_tx_fill_desc(struct ieee80211_hw *hw,
         buf_len = skb->len;
         mapping = pci_map_single(rtlpci->pdev, skb->data, skb->len,
                                  PCI_DMA_TODEVICE);
+        if (pci_dma_mapping_error(rtlpci->pdev, mapping)) {
+                RT_TRACE(rtlpriv, COMP_SEND, DBG_TRACE,
+                         "DMA mapping error");
+                return;
+        }
         CLEAR_PCI_TX_DESC_CONTENT(pdesc, sizeof(struct tx_desc_92d));
         if (ieee80211_is_nullfunc(fc) || ieee80211_is_ctl(fc)) {
                 firstseg = true;
@@ -740,6 +745,11 @@ void rtl92de_tx_fill_cmddesc(struct ieee80211_hw *hw,
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)(skb->data);
         __le16 fc = hdr->frame_control;
 
+        if (pci_dma_mapping_error(rtlpci->pdev, mapping)) {
+                RT_TRACE(rtlpriv, COMP_SEND, DBG_TRACE,
+                         "DMA mapping error");
+                return;
+        }
         CLEAR_PCI_TX_DESC_CONTENT(pdesc, TX_DESC_SIZE);
         if (firstseg)
                 SET_TX_DESC_OFFSET(pdesc, USB_HWDESC_HEADER_LEN);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/trx.c b/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
index 0e9f6ebf078a..f8431a3c2c9d 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
@@ -480,7 +480,7 @@ static void _rtl92se_translate_rx_signal_stuff(struct ieee80211_hw *hw,
         u8 *praddr;
         __le16 fc;
         u16 type, cfc;
-        bool packet_matchbssid, packet_toself, packet_beacon;
+        bool packet_matchbssid, packet_toself, packet_beacon = false;
 
         tmp_buf = skb->data + pstats->rx_drvinfo_size + pstats->rx_bufshift;
 
@@ -611,6 +611,11 @@ void rtl92se_tx_fill_desc(struct ieee80211_hw *hw,
                     PCI_DMA_TODEVICE);
         u8 bw_40 = 0;
 
+        if (pci_dma_mapping_error(rtlpci->pdev, mapping)) {
+                RT_TRACE(rtlpriv, COMP_SEND, DBG_TRACE,
+                         "DMA mapping error");
+                return;
+        }
         if (mac->opmode == NL80211_IFTYPE_STATION) {
                 bw_40 = mac->bw_40;
         } else if (mac->opmode == NL80211_IFTYPE_AP ||
@@ -763,6 +768,7 @@ void rtl92se_tx_fill_desc(struct ieee80211_hw *hw,
 void rtl92se_tx_fill_cmddesc(struct ieee80211_hw *hw, u8 *pdesc,
         bool firstseg, bool lastseg, struct sk_buff *skb)
 {
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
         struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
         struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
         struct rtl_tcb_desc *tcb_desc = (struct rtl_tcb_desc *)(skb->cb);
@@ -770,7 +776,12 @@ void rtl92se_tx_fill_cmddesc(struct ieee80211_hw *hw, u8 *pdesc,
         dma_addr_t mapping = pci_map_single(rtlpci->pdev, skb->data, skb->len,
                         PCI_DMA_TODEVICE);
 
-    /* Clear all status */
+        if (pci_dma_mapping_error(rtlpci->pdev, mapping)) {
+                RT_TRACE(rtlpriv, COMP_SEND, DBG_TRACE,
+                         "DMA mapping error");
+                return;
+        }
+        /* Clear all status     */
         CLEAR_PCI_TX_DESC_CONTENT(pdesc, TX_CMDDESC_SIZE_RTL8192S);
 
         /* This bit indicate this packet is used for FW download. */
diff --git a/drivers/net/wireless/rtlwifi/rtl8723ae/fw.c b/drivers/net/wireless/rtlwifi/rtl8723ae/fw.c
index f55b1767ef57..3b71dab4f3b2 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723ae/fw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723ae/fw.c
@@ -252,7 +252,7 @@ static void _rtl8723ae_fill_h2c_command(struct ieee80211_hw *hw,
         u16 box_reg = 0, box_extreg = 0;
         u8 u1tmp;
         bool isfw_rd = false;
-        bool bwrite_sucess = false;
+        bool bwrite_success = false;
         u8 wait_h2c_limmit = 100;
         u8 wait_writeh2c_limmit = 100;
         u8 boxcontent[4], boxextcontent[2];
@@ -291,7 +291,7 @@ static void _rtl8723ae_fill_h2c_command(struct ieee80211_hw *hw,
                 }
         }
 
-        while (!bwrite_sucess) {
+        while (!bwrite_success) {
                 wait_writeh2c_limmit--;
                 if (wait_writeh2c_limmit == 0) {
                         RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
@@ -429,7 +429,7 @@ static void _rtl8723ae_fill_h2c_command(struct ieee80211_hw *hw,
                         break;
                 }
 
-                bwrite_sucess = true;
+                bwrite_success = true;
 
                 rtlhal->last_hmeboxnum = boxnum + 1;
                 if (rtlhal->last_hmeboxnum == 4)
diff --git a/drivers/net/wireless/rtlwifi/rtl8723ae/phy.c b/drivers/net/wireless/rtlwifi/rtl8723ae/phy.c
index 39cc7938eedf..3d8536bb0d2b 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723ae/phy.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723ae/phy.c
@@ -1106,7 +1106,7 @@ u8 rtl8723ae_phy_sw_chnl(struct ieee80211_hw *hw)
         if (!(is_hal_stop(rtlhal)) && !(RT_CANNOT_IO(hw))) {
                 rtl8723ae_phy_sw_chnl_callback(hw);
                 RT_TRACE(rtlpriv, COMP_CHAN, DBG_LOUD,
-                         "sw_chnl_inprogress false schdule workitem\n");
+                         "sw_chnl_inprogress false schedule workitem\n");
                 rtlphy->sw_chnl_inprogress = false;
         } else {
                 RT_TRACE(rtlpriv, COMP_CHAN, DBG_LOUD,
diff --git a/drivers/net/wireless/rtlwifi/rtl8723ae/trx.c b/drivers/net/wireless/rtlwifi/rtl8723ae/trx.c
index 87331d826d73..ce8ad12bce5b 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723ae/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723ae/trx.c
@@ -247,7 +247,7 @@ static void _rtl8723ae_translate_rx_signal_stuff(struct ieee80211_hw *hw,
         u8 *psaddr;
         __le16 fc;
         u16 type;
-        bool packet_matchbssid, packet_toself, packet_beacon;
+        bool packet_matchbssid, packet_toself, packet_beacon = false;
 
         tmp_buf = skb->data + pstatus->rx_drvinfo_size + pstatus->rx_bufshift;
 
@@ -387,6 +387,11 @@ void rtl8723ae_tx_fill_desc(struct ieee80211_hw *hw,
                                             PCI_DMA_TODEVICE);
         u8 bw_40 = 0;
 
+        if (pci_dma_mapping_error(rtlpci->pdev, mapping)) {
+                RT_TRACE(rtlpriv, COMP_SEND, DBG_TRACE,
+                         "DMA mapping error");
+                return;
+        }
         if (mac->opmode == NL80211_IFTYPE_STATION) {
                 bw_40 = mac->bw_40;
         } else if (mac->opmode == NL80211_IFTYPE_AP ||
@@ -542,6 +547,11 @@ void rtl8723ae_tx_fill_cmddesc(struct ieee80211_hw *hw,
                                             PCI_DMA_TODEVICE);
         __le16 fc = hdr->frame_control;
 
+        if (pci_dma_mapping_error(rtlpci->pdev, mapping)) {
+                RT_TRACE(rtlpriv, COMP_SEND, DBG_TRACE,
+                         "DMA mapping error");
+                return;
+        }
         CLEAR_PCI_TX_DESC_CONTENT(pdesc, TX_DESC_SIZE);
 
         if (firstseg)
diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
index 29f0969e4ba0..f2ecdeb3a90d 100644
--- a/drivers/net/wireless/rtlwifi/usb.c
+++ b/drivers/net/wireless/rtlwifi/usb.c
@@ -210,17 +210,16 @@ static void _usb_writeN_sync(struct rtl_priv *rtlpriv, u32 addr, void *data,
         u16 index = REALTEK_USB_VENQT_CMD_IDX;
         int pipe = usb_sndctrlpipe(udev, 0); /* write_out */
         u8 *buffer;
-        dma_addr_t dma_addr;
 
-        wvalue = (u16)(addr&0x0000ffff);
-        buffer = usb_alloc_coherent(udev, (size_t)len, GFP_ATOMIC, &dma_addr);
+        wvalue = (u16)(addr & 0x0000ffff);
+        buffer = kmalloc(len, GFP_ATOMIC);
         if (!buffer)
                 return;
         memcpy(buffer, data, len);
         usb_control_msg(udev, pipe, request, reqtype, wvalue,
                         index, buffer, len, 50);
 
-        usb_free_coherent(udev, (size_t)len, buffer, dma_addr);
+        kfree(buffer);
 }
 
 static void _rtl_usb_io_handler_init(struct device *dev,
@@ -640,6 +639,7 @@ static int _rtl_usb_receive(struct ieee80211_hw *hw)
                         RT_TRACE(rtlpriv, COMP_USB, DBG_EMERG,
                                  "Failed to prep_rx_urb!!\n");
                         err = PTR_ERR(skb);
+                        usb_free_urb(urb);
                         goto err_out;
                 }
 
diff --git a/drivers/net/wireless/ti/wl1251/Kconfig b/drivers/net/wireless/ti/wl1251/Kconfig
index 1fb65849414f..8fec4ed36ac2 100644
--- a/drivers/net/wireless/ti/wl1251/Kconfig
+++ b/drivers/net/wireless/ti/wl1251/Kconfig
@@ -1,6 +1,6 @@
 menuconfig WL1251
         tristate "TI wl1251 driver support"
-        depends on MAC80211 && EXPERIMENTAL && GENERIC_HARDIRQS
+        depends on MAC80211 && GENERIC_HARDIRQS
         select FW_LOADER
         select CRC7
         ---help---
diff --git a/drivers/net/wireless/ti/wl12xx/Makefile b/drivers/net/wireless/ti/wl12xx/Makefile
index da509aa7d009..e6a24056b3c8 100644
--- a/drivers/net/wireless/ti/wl12xx/Makefile
+++ b/drivers/net/wireless/ti/wl12xx/Makefile
@@ -1,3 +1,3 @@
-wl12xx-objs     = main.o cmd.o acx.o debugfs.o
+wl12xx-objs     = main.o cmd.o acx.o debugfs.o scan.o event.o
 
 obj-$(CONFIG_WL12XX)            += wl12xx.o
diff --git a/drivers/net/wireless/ti/wl12xx/cmd.c b/drivers/net/wireless/ti/wl12xx/cmd.c
index 622206241e83..7dc9f965037d 100644
--- a/drivers/net/wireless/ti/wl12xx/cmd.c
+++ b/drivers/net/wireless/ti/wl12xx/cmd.c
@@ -284,3 +284,40 @@ int wl128x_cmd_radio_parms(struct wl1271 *wl)
         kfree(radio_parms);
         return ret;
 }
+
+int wl12xx_cmd_channel_switch(struct wl1271 *wl,
+                              struct wl12xx_vif *wlvif,
+                              struct ieee80211_channel_switch *ch_switch)
+{
+        struct wl12xx_cmd_channel_switch *cmd;
+        int ret;
+
+        wl1271_debug(DEBUG_ACX, "cmd channel switch");
+
+        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+        if (!cmd) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        cmd->role_id = wlvif->role_id;
+        cmd->channel = ch_switch->channel->hw_value;
+        cmd->switch_time = ch_switch->count;
+        cmd->stop_tx = ch_switch->block_tx;
+
+        /* FIXME: control from mac80211 in the future */
+        /* Enable TX on the target channel */
+        cmd->post_switch_tx_disable = 0;
+
+        ret = wl1271_cmd_send(wl, CMD_CHANNEL_SWITCH, cmd, sizeof(*cmd), 0);
+        if (ret < 0) {
+                wl1271_error("failed to send channel switch command");
+                goto out_free;
+        }
+
+out_free:
+        kfree(cmd);
+
+out:
+        return ret;
+}
diff --git a/drivers/net/wireless/ti/wl12xx/cmd.h b/drivers/net/wireless/ti/wl12xx/cmd.h
index 140a0e8829d5..32cbad54e993 100644
--- a/drivers/net/wireless/ti/wl12xx/cmd.h
+++ b/drivers/net/wireless/ti/wl12xx/cmd.h
@@ -103,10 +103,30 @@ struct wl1271_ext_radio_parms_cmd {
         u8 padding[3];
 } __packed;
 
+struct wl12xx_cmd_channel_switch {
+        struct wl1271_cmd_header header;
+
+        u8 role_id;
+
+        /* The new serving channel */
+        u8 channel;
+        /* Relative time of the serving channel switch in TBTT units */
+        u8 switch_time;
+        /* Stop the role TX, should expect it after radar detection */
+        u8 stop_tx;
+        /* The target channel tx status 1-stopped 0-open*/
+        u8 post_switch_tx_disable;
+
+        u8 padding[3];
+} __packed;
+
 int wl1271_cmd_general_parms(struct wl1271 *wl);
 int wl128x_cmd_general_parms(struct wl1271 *wl);
 int wl1271_cmd_radio_parms(struct wl1271 *wl);
 int wl128x_cmd_radio_parms(struct wl1271 *wl);
 int wl1271_cmd_ext_radio_parms(struct wl1271 *wl);
+int wl12xx_cmd_channel_switch(struct wl1271 *wl,
+                              struct wl12xx_vif *wlvif,
+                              struct ieee80211_channel_switch *ch_switch);
 
 #endif /* __WL12XX_CMD_H__ */
diff --git a/drivers/net/wireless/ti/wl12xx/event.c b/drivers/net/wireless/ti/wl12xx/event.c
new file mode 100644
index 000000000000..6ac0ed751da8
--- /dev/null
+++ b/drivers/net/wireless/ti/wl12xx/event.c
@@ -0,0 +1,116 @@
+/*
+ * This file is part of wl12xx
+ *
+ * Copyright (C) 2012 Texas Instruments. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#include "event.h"
+#include "scan.h"
+#include "../wlcore/cmd.h"
+#include "../wlcore/debug.h"
+
+int wl12xx_wait_for_event(struct wl1271 *wl, enum wlcore_wait_event event,
+                          bool *timeout)
+{
+        u32 local_event;
+
+        switch (event) {
+        case WLCORE_EVENT_ROLE_STOP_COMPLETE:
+                local_event = ROLE_STOP_COMPLETE_EVENT_ID;
+                break;
+
+        case WLCORE_EVENT_PEER_REMOVE_COMPLETE:
+                local_event = PEER_REMOVE_COMPLETE_EVENT_ID;
+                break;
+
+        default:
+                /* event not implemented */
+                return 0;
+        }
+        return wlcore_cmd_wait_for_event_or_timeout(wl, local_event, timeout);
+}
+
+int wl12xx_process_mailbox_events(struct wl1271 *wl)
+{
+        struct wl12xx_event_mailbox *mbox = wl->mbox;
+        u32 vector;
+
+
+        vector = le32_to_cpu(mbox->events_vector);
+        vector &= ~(le32_to_cpu(mbox->events_mask));
+
+        wl1271_debug(DEBUG_EVENT, "MBOX vector: 0x%x", vector);
+
+        if (vector & SCAN_COMPLETE_EVENT_ID) {
+                wl1271_debug(DEBUG_EVENT, "status: 0x%x",
+                             mbox->scheduled_scan_status);
+
+                if (wl->scan_wlvif)
+                        wl12xx_scan_completed(wl, wl->scan_wlvif);
+        }
+
+        if (vector & PERIODIC_SCAN_REPORT_EVENT_ID) {
+                wl1271_debug(DEBUG_EVENT,
+                             "PERIODIC_SCAN_REPORT_EVENT (status 0x%0x)",
+                             mbox->scheduled_scan_status);
+
+                wlcore_scan_sched_scan_results(wl);
+        }
+
+        if (vector & PERIODIC_SCAN_COMPLETE_EVENT_ID)
+                wlcore_event_sched_scan_completed(wl,
+                                                  mbox->scheduled_scan_status);
+        if (vector & SOFT_GEMINI_SENSE_EVENT_ID)
+                wlcore_event_soft_gemini_sense(wl,
+                                               mbox->soft_gemini_sense_info);
+
+        if (vector & BSS_LOSE_EVENT_ID)
+                wlcore_event_beacon_loss(wl, 0xff);
+
+        if (vector & RSSI_SNR_TRIGGER_0_EVENT_ID)
+                wlcore_event_rssi_trigger(wl, mbox->rssi_snr_trigger_metric);
+
+        if (vector & BA_SESSION_RX_CONSTRAINT_EVENT_ID)
+                wlcore_event_ba_rx_constraint(wl,
+                                              BIT(mbox->role_id),
+                                              mbox->rx_ba_allowed);
+
+        if (vector & CHANNEL_SWITCH_COMPLETE_EVENT_ID)
+                wlcore_event_channel_switch(wl, 0xff,
+                                            mbox->channel_switch_status);
+
+        if (vector & DUMMY_PACKET_EVENT_ID)
+                wlcore_event_dummy_packet(wl);
+
+        /*
+         * "TX retries exceeded" has a different meaning according to mode.
+         * In AP mode the offending station is disconnected.
+         */
+        if (vector & MAX_TX_RETRY_EVENT_ID)
+                wlcore_event_max_tx_failure(wl,
+                                le16_to_cpu(mbox->sta_tx_retry_exceeded));
+
+        if (vector & INACTIVE_STA_EVENT_ID)
+                wlcore_event_inactive_sta(wl,
+                                          le16_to_cpu(mbox->sta_aging_status));
+
+        if (vector & REMAIN_ON_CHANNEL_COMPLETE_EVENT_ID)
+                wlcore_event_roc_complete(wl);
+
+        return 0;
+}
diff --git a/drivers/net/wireless/ti/wl12xx/event.h b/drivers/net/wireless/ti/wl12xx/event.h
new file mode 100644
index 000000000000..a5cc3fcd9eea
--- /dev/null
+++ b/drivers/net/wireless/ti/wl12xx/event.h
@@ -0,0 +1,111 @@
+/*
+ * This file is part of wl12xx
+ *
+ * Copyright (C) 2012 Texas Instruments. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#ifndef __WL12XX_EVENT_H__
+#define __WL12XX_EVENT_H__
+
+#include "../wlcore/wlcore.h"
+
+enum {
+        MEASUREMENT_START_EVENT_ID               = BIT(8),
+        MEASUREMENT_COMPLETE_EVENT_ID            = BIT(9),
+        SCAN_COMPLETE_EVENT_ID                   = BIT(10),
+        WFD_DISCOVERY_COMPLETE_EVENT_ID          = BIT(11),
+        AP_DISCOVERY_COMPLETE_EVENT_ID           = BIT(12),
+        RESERVED1                                = BIT(13),
+        PSPOLL_DELIVERY_FAILURE_EVENT_ID         = BIT(14),
+        ROLE_STOP_COMPLETE_EVENT_ID              = BIT(15),
+        RADAR_DETECTED_EVENT_ID                  = BIT(16),
+        CHANNEL_SWITCH_COMPLETE_EVENT_ID         = BIT(17),
+        BSS_LOSE_EVENT_ID                        = BIT(18),
+        REGAINED_BSS_EVENT_ID                    = BIT(19),
+        MAX_TX_RETRY_EVENT_ID                    = BIT(20),
+        DUMMY_PACKET_EVENT_ID                    = BIT(21),
+        SOFT_GEMINI_SENSE_EVENT_ID               = BIT(22),
+        CHANGE_AUTO_MODE_TIMEOUT_EVENT_ID        = BIT(23),
+        SOFT_GEMINI_AVALANCHE_EVENT_ID           = BIT(24),
+        PLT_RX_CALIBRATION_COMPLETE_EVENT_ID     = BIT(25),
+        INACTIVE_STA_EVENT_ID                    = BIT(26),
+        PEER_REMOVE_COMPLETE_EVENT_ID            = BIT(27),
+        PERIODIC_SCAN_COMPLETE_EVENT_ID          = BIT(28),
+        PERIODIC_SCAN_REPORT_EVENT_ID            = BIT(29),
+        BA_SESSION_RX_CONSTRAINT_EVENT_ID        = BIT(30),
+        REMAIN_ON_CHANNEL_COMPLETE_EVENT_ID      = BIT(31),
+};
+
+struct wl12xx_event_mailbox {
+        __le32 events_vector;
+        __le32 events_mask;
+        __le32 reserved_1;
+        __le32 reserved_2;
+
+        u8 number_of_scan_results;
+        u8 scan_tag;
+        u8 completed_scan_status;
+        u8 reserved_3;
+
+        u8 soft_gemini_sense_info;
+        u8 soft_gemini_protective_info;
+        s8 rssi_snr_trigger_metric[NUM_OF_RSSI_SNR_TRIGGERS];
+        u8 change_auto_mode_timeout;
+        u8 scheduled_scan_status;
+        u8 reserved4;
+        /* tuned channel (roc) */
+        u8 roc_channel;
+
+        __le16 hlid_removed_bitmap;
+
+        /* bitmap of aged stations (by HLID) */
+        __le16 sta_aging_status;
+
+        /* bitmap of stations (by HLID) which exceeded max tx retries */
+        __le16 sta_tx_retry_exceeded;
+
+        /* discovery completed results */
+        u8 discovery_tag;
+        u8 number_of_preq_results;
+        u8 number_of_prsp_results;
+        u8 reserved_5;
+
+        /* rx ba constraint */
+        u8 role_id; /* 0xFF means any role. */
+        u8 rx_ba_allowed;
+        u8 reserved_6[2];
+
+        /* Channel switch results */
+
+        u8 channel_switch_role_id;
+        u8 channel_switch_status;
+        u8 reserved_7[2];
+
+        u8 ps_poll_delivery_failure_role_ids;
+        u8 stopped_role_ids;
+        u8 started_role_ids;
+
+        u8 reserved_8[9];
+} __packed;
+
+int wl12xx_wait_for_event(struct wl1271 *wl, enum wlcore_wait_event event,
+                          bool *timeout);
+int wl12xx_process_mailbox_events(struct wl1271 *wl);
+
+#endif
+
diff --git a/drivers/net/wireless/ti/wl12xx/main.c b/drivers/net/wireless/ti/wl12xx/main.c
index e5f5f8f39144..3254bfc81a2a 100644
--- a/drivers/net/wireless/ti/wl12xx/main.c
+++ b/drivers/net/wireless/ti/wl12xx/main.c
@@ -38,6 +38,8 @@
 #include "reg.h"
 #include "cmd.h"
 #include "acx.h"
+#include "scan.h"
+#include "event.h"
 #include "debugfs.h"
 
 static char *fref_param;
@@ -208,6 +210,8 @@ static struct wlcore_conf wl12xx_conf = {
                 .tmpl_short_retry_limit      = 10,
                 .tmpl_long_retry_limit       = 10,
                 .tx_watchdog_timeout         = 5000,
+                .slow_link_thold             = 3,
+                .fast_link_thold             = 10,
         },
         .conn = {
                 .wake_up_event               = CONF_WAKE_UP_EVENT_DTIM,
@@ -265,8 +269,10 @@ static struct wlcore_conf wl12xx_conf = {
         .scan = {
                 .min_dwell_time_active        = 7500,
                 .max_dwell_time_active        = 30000,
-                .min_dwell_time_passive       = 100000,
-                .max_dwell_time_passive       = 100000,
+                .min_dwell_time_active_long   = 25000,
+                .max_dwell_time_active_long   = 50000,
+                .dwell_time_passive           = 100000,
+                .dwell_time_dfs               = 150000,
                 .num_probe_reqs               = 2,
                 .split_scan_timeout           = 50000,
         },
@@ -368,6 +374,10 @@ static struct wlcore_conf wl12xx_conf = {
                 .increase_time              = 1,
                 .window_size                = 16,
         },
+        .recovery = {
+                .bug_on_recovery            = 0,
+                .no_recovery                = 0,
+        },
 };
 
 static struct wl12xx_priv_conf wl12xx_default_priv_conf = {
@@ -601,9 +611,9 @@ static int wl127x_prepare_read(struct wl1271 *wl, u32 rx_desc, u32 len)
 {
         int ret;
 
-        if (wl->chip.id != CHIP_ID_1283_PG20) {
+        if (wl->chip.id != CHIP_ID_128X_PG20) {
                 struct wl1271_acx_mem_map *wl_mem_map = wl->target_mem_map;
-                struct wl127x_rx_mem_pool_addr rx_mem_addr;
+                struct wl12xx_priv *priv = wl->priv;
 
                 /*
                  * Choose the block we want to read
@@ -612,13 +622,13 @@ static int wl127x_prepare_read(struct wl1271 *wl, u32 rx_desc, u32 len)
                  */
                 u32 mem_block = rx_desc & RX_MEM_BLOCK_MASK;
 
-                rx_mem_addr.addr = (mem_block << 8) +
+                priv->rx_mem_addr->addr = (mem_block << 8) +
                         le32_to_cpu(wl_mem_map->packet_memory_pool_start);
 
-                rx_mem_addr.addr_extra = rx_mem_addr.addr + 4;
+                priv->rx_mem_addr->addr_extra = priv->rx_mem_addr->addr + 4;
 
-                ret = wlcore_write(wl, WL1271_SLV_REG_DATA, &rx_mem_addr,
-                                   sizeof(rx_mem_addr), false);
+                ret = wlcore_write(wl, WL1271_SLV_REG_DATA, priv->rx_mem_addr,
+                                   sizeof(*priv->rx_mem_addr), false);
                 if (ret < 0)
                         return ret;
         }
@@ -631,13 +641,15 @@ static int wl12xx_identify_chip(struct wl1271 *wl)
         int ret = 0;
 
         switch (wl->chip.id) {
-        case CHIP_ID_1271_PG10:
+        case CHIP_ID_127X_PG10:
                 wl1271_warning("chip id 0x%x (1271 PG10) support is obsolete",
                                wl->chip.id);
 
                 wl->quirks |= WLCORE_QUIRK_LEGACY_NVS |
                               WLCORE_QUIRK_DUAL_PROBE_TMPL |
-                              WLCORE_QUIRK_TKIP_HEADER_SPACE;
+                              WLCORE_QUIRK_TKIP_HEADER_SPACE |
+                              WLCORE_QUIRK_START_STA_FAILS |
+                              WLCORE_QUIRK_AP_ZERO_SESSION_ID;
                 wl->sr_fw_name = WL127X_FW_NAME_SINGLE;
                 wl->mr_fw_name = WL127X_FW_NAME_MULTI;
                 memcpy(&wl->conf.mem, &wl12xx_default_priv_conf.mem_wl127x,
@@ -646,18 +658,22 @@ static int wl12xx_identify_chip(struct wl1271 *wl)
                 /* read data preparation is only needed by wl127x */
                 wl->ops->prepare_read = wl127x_prepare_read;
 
-                wlcore_set_min_fw_ver(wl, WL127X_CHIP_VER, WL127X_IFTYPE_VER,
-                                      WL127X_MAJOR_VER, WL127X_SUBTYPE_VER,
-                                      WL127X_MINOR_VER);
+                wlcore_set_min_fw_ver(wl, WL127X_CHIP_VER,
+                              WL127X_IFTYPE_SR_VER,  WL127X_MAJOR_SR_VER,
+                              WL127X_SUBTYPE_SR_VER, WL127X_MINOR_SR_VER,
+                              WL127X_IFTYPE_MR_VER,  WL127X_MAJOR_MR_VER,
+                              WL127X_SUBTYPE_MR_VER, WL127X_MINOR_MR_VER);
                 break;
 
-        case CHIP_ID_1271_PG20:
+        case CHIP_ID_127X_PG20:
                 wl1271_debug(DEBUG_BOOT, "chip id 0x%x (1271 PG20)",
                              wl->chip.id);
 
                 wl->quirks |= WLCORE_QUIRK_LEGACY_NVS |
                               WLCORE_QUIRK_DUAL_PROBE_TMPL |
-                              WLCORE_QUIRK_TKIP_HEADER_SPACE;
+                              WLCORE_QUIRK_TKIP_HEADER_SPACE |
+                              WLCORE_QUIRK_START_STA_FAILS |
+                              WLCORE_QUIRK_AP_ZERO_SESSION_ID;
                 wl->plt_fw_name = WL127X_PLT_FW_NAME;
                 wl->sr_fw_name = WL127X_FW_NAME_SINGLE;
                 wl->mr_fw_name = WL127X_FW_NAME_MULTI;
@@ -667,12 +683,14 @@ static int wl12xx_identify_chip(struct wl1271 *wl)
                 /* read data preparation is only needed by wl127x */
                 wl->ops->prepare_read = wl127x_prepare_read;
 
-                wlcore_set_min_fw_ver(wl, WL127X_CHIP_VER, WL127X_IFTYPE_VER,
-                                      WL127X_MAJOR_VER, WL127X_SUBTYPE_VER,
-                                      WL127X_MINOR_VER);
+                wlcore_set_min_fw_ver(wl, WL127X_CHIP_VER,
+                              WL127X_IFTYPE_SR_VER,  WL127X_MAJOR_SR_VER,
+                              WL127X_SUBTYPE_SR_VER, WL127X_MINOR_SR_VER,
+                              WL127X_IFTYPE_MR_VER,  WL127X_MAJOR_MR_VER,
+                              WL127X_SUBTYPE_MR_VER, WL127X_MINOR_MR_VER);
                 break;
 
-        case CHIP_ID_1283_PG20:
+        case CHIP_ID_128X_PG20:
                 wl1271_debug(DEBUG_BOOT, "chip id 0x%x (1283 PG20)",
                              wl->chip.id);
                 wl->plt_fw_name = WL128X_PLT_FW_NAME;
@@ -682,19 +700,29 @@ static int wl12xx_identify_chip(struct wl1271 *wl)
                 /* wl128x requires TX blocksize alignment */
                 wl->quirks |= WLCORE_QUIRK_TX_BLOCKSIZE_ALIGN |
                               WLCORE_QUIRK_DUAL_PROBE_TMPL |
-                              WLCORE_QUIRK_TKIP_HEADER_SPACE;
-
-                wlcore_set_min_fw_ver(wl, WL128X_CHIP_VER, WL128X_IFTYPE_VER,
-                                      WL128X_MAJOR_VER, WL128X_SUBTYPE_VER,
-                                      WL128X_MINOR_VER);
+                              WLCORE_QUIRK_TKIP_HEADER_SPACE |
+                              WLCORE_QUIRK_START_STA_FAILS |
+                              WLCORE_QUIRK_AP_ZERO_SESSION_ID;
+
+                wlcore_set_min_fw_ver(wl, WL128X_CHIP_VER,
+                              WL128X_IFTYPE_SR_VER,  WL128X_MAJOR_SR_VER,
+                              WL128X_SUBTYPE_SR_VER, WL128X_MINOR_SR_VER,
+                              WL128X_IFTYPE_MR_VER,  WL128X_MAJOR_MR_VER,
+                              WL128X_SUBTYPE_MR_VER, WL128X_MINOR_MR_VER);
                 break;
-        case CHIP_ID_1283_PG10:
+        case CHIP_ID_128X_PG10:
         default:
                 wl1271_warning("unsupported chip id: 0x%x", wl->chip.id);
                 ret = -ENODEV;
                 goto out;
         }
 
+        /* common settings */
+        wl->scan_templ_id_2_4 = CMD_TEMPL_APP_PROBE_REQ_2_4_LEGACY;
+        wl->scan_templ_id_5 = CMD_TEMPL_APP_PROBE_REQ_5_LEGACY;
+        wl->sched_scan_templ_id_2_4 = CMD_TEMPL_CFG_PROBE_REQ_2_4;
+        wl->sched_scan_templ_id_5 = CMD_TEMPL_CFG_PROBE_REQ_5;
+        wl->max_channels_5 = WL12XX_MAX_CHANNELS_5GHZ;
 out:
         return ret;
 }
@@ -1067,7 +1095,7 @@ static int wl12xx_pre_boot(struct wl1271 *wl)
         u32 clk;
         int selected_clock = -1;
 
-        if (wl->chip.id == CHIP_ID_1283_PG20) {
+        if (wl->chip.id == CHIP_ID_128X_PG20) {
                 ret = wl128x_boot_clk(wl, &selected_clock);
                 if (ret < 0)
                         goto out;
@@ -1098,7 +1126,7 @@ static int wl12xx_pre_boot(struct wl1271 *wl)
 
         wl1271_debug(DEBUG_BOOT, "clk2 0x%x", clk);
 
-        if (wl->chip.id == CHIP_ID_1283_PG20)
+        if (wl->chip.id == CHIP_ID_128X_PG20)
                 clk |= ((selected_clock & 0x3) << 1) << 4;
         else
                 clk |= (priv->ref_clock << 1) << 4;
@@ -1152,7 +1180,7 @@ static int wl12xx_pre_upload(struct wl1271 *wl)
         /* WL1271: The reference driver skips steps 7 to 10 (jumps directly
          * to upload_fw) */
 
-        if (wl->chip.id == CHIP_ID_1283_PG20) {
+        if (wl->chip.id == CHIP_ID_128X_PG20) {
                 ret = wl12xx_top_reg_write(wl, SDIO_IO_DS, HCI_IO_DS_6MA);
                 if (ret < 0)
                         goto out;
@@ -1219,6 +1247,23 @@ static int wl12xx_boot(struct wl1271 *wl)
         if (ret < 0)
                 goto out;
 
+        wl->event_mask = BSS_LOSE_EVENT_ID |
+                REGAINED_BSS_EVENT_ID |
+                SCAN_COMPLETE_EVENT_ID |
+                ROLE_STOP_COMPLETE_EVENT_ID |
+                RSSI_SNR_TRIGGER_0_EVENT_ID |
+                PSPOLL_DELIVERY_FAILURE_EVENT_ID |
+                SOFT_GEMINI_SENSE_EVENT_ID |
+                PERIODIC_SCAN_REPORT_EVENT_ID |
+                PERIODIC_SCAN_COMPLETE_EVENT_ID |
+                DUMMY_PACKET_EVENT_ID |
+                PEER_REMOVE_COMPLETE_EVENT_ID |
+                BA_SESSION_RX_CONSTRAINT_EVENT_ID |
+                REMAIN_ON_CHANNEL_COMPLETE_EVENT_ID |
+                INACTIVE_STA_EVENT_ID |
+                MAX_TX_RETRY_EVENT_ID |
+                CHANNEL_SWITCH_COMPLETE_EVENT_ID;
+
         ret = wlcore_boot_run_firmware(wl);
         if (ret < 0)
                 goto out;
@@ -1261,7 +1306,7 @@ static void
 wl12xx_set_tx_desc_blocks(struct wl1271 *wl, struct wl1271_tx_hw_descr *desc,
                           u32 blks, u32 spare_blks)
 {
-        if (wl->chip.id == CHIP_ID_1283_PG20) {
+        if (wl->chip.id == CHIP_ID_128X_PG20) {
                 desc->wl128x_mem.total_mem_blocks = blks;
         } else {
                 desc->wl127x_mem.extra_blocks = spare_blks;
@@ -1275,7 +1320,7 @@ wl12xx_set_tx_desc_data_len(struct wl1271 *wl, struct wl1271_tx_hw_descr *desc,
 {
         u32 aligned_len = wlcore_calc_packet_alignment(wl, skb->len);
 
-        if (wl->chip.id == CHIP_ID_1283_PG20) {
+        if (wl->chip.id == CHIP_ID_128X_PG20) {
                 desc->wl128x_mem.extra_bytes = aligned_len - skb->len;
                 desc->length = cpu_to_le16(aligned_len >> 2);
 
@@ -1339,7 +1384,7 @@ static int wl12xx_hw_init(struct wl1271 *wl)
 {
         int ret;
 
-        if (wl->chip.id == CHIP_ID_1283_PG20) {
+        if (wl->chip.id == CHIP_ID_128X_PG20) {
                 u32 host_cfg_bitmap = HOST_IF_CFG_RX_FIFO_ENABLE;
 
                 ret = wl128x_cmd_general_parms(wl);
@@ -1394,22 +1439,6 @@ static u32 wl12xx_sta_get_ap_rate_mask(struct wl1271 *wl,
         return wlvif->rate_set;
 }
 
-static int wl12xx_identify_fw(struct wl1271 *wl)
-{
-        unsigned int *fw_ver = wl->chip.fw_ver;
-
-        /* Only new station firmwares support routing fw logs to the host */
-        if ((fw_ver[FW_VER_IF_TYPE] == FW_VER_IF_TYPE_STA) &&
-            (fw_ver[FW_VER_MINOR] < FW_VER_MINOR_FWLOG_STA_MIN))
-                wl->quirks |= WLCORE_QUIRK_FWLOG_NOT_IMPLEMENTED;
-
-        /* This feature is not yet supported for AP mode */
-        if (fw_ver[FW_VER_IF_TYPE] == FW_VER_IF_TYPE_AP)
-                wl->quirks |= WLCORE_QUIRK_FWLOG_NOT_IMPLEMENTED;
-
-        return 0;
-}
-
 static void wl12xx_conf_init(struct wl1271 *wl)
 {
         struct wl12xx_priv *priv = wl->priv;
@@ -1426,7 +1455,7 @@ static bool wl12xx_mac_in_fuse(struct wl1271 *wl)
         bool supported = false;
         u8 major, minor;
 
-        if (wl->chip.id == CHIP_ID_1283_PG20) {
+        if (wl->chip.id == CHIP_ID_128X_PG20) {
                 major = WL128X_PG_GET_MAJOR(wl->hw_pg_ver);
                 minor = WL128X_PG_GET_MINOR(wl->hw_pg_ver);
 
@@ -1482,7 +1511,7 @@ static int wl12xx_get_pg_ver(struct wl1271 *wl, s8 *ver)
         u16 die_info;
         int ret;
 
-        if (wl->chip.id == CHIP_ID_1283_PG20)
+        if (wl->chip.id == CHIP_ID_128X_PG20)
                 ret = wl12xx_top_reg_read(wl, WL128X_REG_FUSE_DATA_2_1,
                                           &die_info);
         else
@@ -1589,16 +1618,46 @@ static int wl12xx_set_key(struct wl1271 *wl, enum set_key_cmd cmd,
         return wlcore_set_key(wl, cmd, vif, sta, key_conf);
 }
 
+static int wl12xx_set_peer_cap(struct wl1271 *wl,
+                               struct ieee80211_sta_ht_cap *ht_cap,
+                               bool allow_ht_operation,
+                               u32 rate_set, u8 hlid)
+{
+        return wl1271_acx_set_ht_capabilities(wl, ht_cap, allow_ht_operation,
+                                              hlid);
+}
+
+static bool wl12xx_lnk_high_prio(struct wl1271 *wl, u8 hlid,
+                                 struct wl1271_link *lnk)
+{
+        u8 thold;
+
+        if (test_bit(hlid, (unsigned long *)&wl->fw_fast_lnk_map))
+                thold = wl->conf.tx.fast_link_thold;
+        else
+                thold = wl->conf.tx.slow_link_thold;
+
+        return lnk->allocated_pkts < thold;
+}
+
+static bool wl12xx_lnk_low_prio(struct wl1271 *wl, u8 hlid,
+                                struct wl1271_link *lnk)
+{
+        /* any link is good for low priority */
+        return true;
+}
+
 static int wl12xx_setup(struct wl1271 *wl);
 
 static struct wlcore_ops wl12xx_ops = {
         .setup                  = wl12xx_setup,
         .identify_chip          = wl12xx_identify_chip,
-        .identify_fw            = wl12xx_identify_fw,
         .boot                   = wl12xx_boot,
         .plt_init               = wl12xx_plt_init,
         .trigger_cmd            = wl12xx_trigger_cmd,
         .ack_event              = wl12xx_ack_event,
+        .wait_for_event         = wl12xx_wait_for_event,
+        .process_mailbox_events = wl12xx_process_mailbox_events,
         .calc_tx_blocks         = wl12xx_calc_tx_blocks,
         .set_tx_desc_blocks     = wl12xx_set_tx_desc_blocks,
         .set_tx_desc_data_len   = wl12xx_set_tx_desc_data_len,
@@ -1615,9 +1674,17 @@ static struct wlcore_ops wl12xx_ops = {
         .set_rx_csum            = NULL,
         .ap_get_mimo_wide_rate_mask = NULL,
         .debugfs_init           = wl12xx_debugfs_add_files,
+        .scan_start             = wl12xx_scan_start,
+        .scan_stop              = wl12xx_scan_stop,
+        .sched_scan_start       = wl12xx_sched_scan_start,
+        .sched_scan_stop        = wl12xx_scan_sched_scan_stop,
         .get_spare_blocks       = wl12xx_get_spare_blocks,
         .set_key                = wl12xx_set_key,
+        .channel_switch         = wl12xx_cmd_channel_switch,
         .pre_pkt_send           = NULL,
+        .set_peer_cap           = wl12xx_set_peer_cap,
+        .lnk_high_prio          = wl12xx_lnk_high_prio,
+        .lnk_low_prio           = wl12xx_lnk_low_prio,
 };
 
 static struct ieee80211_sta_ht_cap wl12xx_ht_cap = {
@@ -1641,6 +1708,7 @@ static int wl12xx_setup(struct wl1271 *wl)
         wl->rtable = wl12xx_rtable;
         wl->num_tx_desc = WL12XX_NUM_TX_DESCRIPTORS;
         wl->num_rx_desc = WL12XX_NUM_RX_DESCRIPTORS;
+        wl->num_channels = 1;
         wl->num_mac_addr = WL12XX_NUM_MAC_ADDRESSES;
         wl->band_rate_to_idx = wl12xx_band_rate_to_idx;
         wl->hw_tx_rate_tbl_size = WL12XX_CONF_HW_RXTX_RATE_MAX;
@@ -1693,6 +1761,10 @@ static int wl12xx_setup(struct wl1271 *wl)
                         wl1271_error("Invalid tcxo parameter %s", tcxo_param);
         }
 
+        priv->rx_mem_addr = kmalloc(sizeof(*priv->rx_mem_addr), GFP_KERNEL);
+        if (!priv->rx_mem_addr)
+                return -ENOMEM;
+
         return 0;
 }
 
@@ -1703,7 +1775,8 @@ static int wl12xx_probe(struct platform_device *pdev)
         int ret;
 
         hw = wlcore_alloc_hw(sizeof(struct wl12xx_priv),
-                             WL12XX_AGGR_BUFFER_SIZE);
+                             WL12XX_AGGR_BUFFER_SIZE,
+                             sizeof(struct wl12xx_event_mailbox));
         if (IS_ERR(hw)) {
                 wl1271_error("can't allocate hw");
                 ret = PTR_ERR(hw);
@@ -1725,6 +1798,21 @@ out:
         return ret;
 }
 
+static int wl12xx_remove(struct platform_device *pdev)
+{
+        struct wl1271 *wl = platform_get_drvdata(pdev);
+        struct wl12xx_priv *priv;
+
+        if (!wl)
+                goto out;
+        priv = wl->priv;
+
+        kfree(priv->rx_mem_addr);
+
+out:
+        return wlcore_remove(pdev);
+}
+
 static const struct platform_device_id wl12xx_id_table[] = {
         { "wl12xx", 0 },
         {  } /* Terminating Entry */
@@ -1733,7 +1821,7 @@ MODULE_DEVICE_TABLE(platform, wl12xx_id_table);
 
 static struct platform_driver wl12xx_driver = {
         .probe          = wl12xx_probe,
-        .remove         = wlcore_remove,
+        .remove         = wl12xx_remove,
         .id_table       = wl12xx_id_table,
         .driver = {
                 .name   = "wl12xx_driver",
diff --git a/drivers/net/wireless/ti/wl12xx/scan.c b/drivers/net/wireless/ti/wl12xx/scan.c
new file mode 100644
index 000000000000..affdb3ec6225
--- /dev/null
+++ b/drivers/net/wireless/ti/wl12xx/scan.c
@@ -0,0 +1,501 @@
+/*
+ * This file is part of wl12xx
+ *
+ * Copyright (C) 2012 Texas Instruments. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#include <linux/ieee80211.h>
+#include "scan.h"
+#include "../wlcore/debug.h"
+#include "../wlcore/tx.h"
+
+static int wl1271_get_scan_channels(struct wl1271 *wl,
+                                    struct cfg80211_scan_request *req,
+                                    struct basic_scan_channel_params *channels,
+                                    enum ieee80211_band band, bool passive)
+{
+        struct conf_scan_settings *c = &wl->conf.scan;
+        int i, j;
+        u32 flags;
+
+        for (i = 0, j = 0;
+             i < req->n_channels && j < WL1271_SCAN_MAX_CHANNELS;
+             i++) {
+                flags = req->channels[i]->flags;
+
+                if (!test_bit(i, wl->scan.scanned_ch) &&
+                    !(flags & IEEE80211_CHAN_DISABLED) &&
+                    (req->channels[i]->band == band) &&
+                    /*
+                     * In passive scans, we scan all remaining
+                     * channels, even if not marked as such.
+                     * In active scans, we only scan channels not
+                     * marked as passive.
+                     */
+                    (passive || !(flags & IEEE80211_CHAN_PASSIVE_SCAN))) {
+                        wl1271_debug(DEBUG_SCAN, "band %d, center_freq %d ",
+                                     req->channels[i]->band,
+                                     req->channels[i]->center_freq);
+                        wl1271_debug(DEBUG_SCAN, "hw_value %d, flags %X",
+                                     req->channels[i]->hw_value,
+                                     req->channels[i]->flags);
+                        wl1271_debug(DEBUG_SCAN,
+                                     "max_antenna_gain %d, max_power %d",
+                                     req->channels[i]->max_antenna_gain,
+                                     req->channels[i]->max_power);
+                        wl1271_debug(DEBUG_SCAN, "beacon_found %d",
+                                     req->channels[i]->beacon_found);
+
+                        if (!passive) {
+                                channels[j].min_duration =
+                                        cpu_to_le32(c->min_dwell_time_active);
+                                channels[j].max_duration =
+                                        cpu_to_le32(c->max_dwell_time_active);
+                        } else {
+                                channels[j].min_duration =
+                                        cpu_to_le32(c->dwell_time_passive);
+                                channels[j].max_duration =
+                                        cpu_to_le32(c->dwell_time_passive);
+                        }
+                        channels[j].early_termination = 0;
+                        channels[j].tx_power_att = req->channels[i]->max_power;
+                        channels[j].channel = req->channels[i]->hw_value;
+
+                        memset(&channels[j].bssid_lsb, 0xff, 4);
+                        memset(&channels[j].bssid_msb, 0xff, 2);
+
+                        /* Mark the channels we already used */
+                        set_bit(i, wl->scan.scanned_ch);
+
+                        j++;
+                }
+        }
+
+        return j;
+}
+
+#define WL1271_NOTHING_TO_SCAN 1
+
+static int wl1271_scan_send(struct wl1271 *wl, struct wl12xx_vif *wlvif,
+                            enum ieee80211_band band,
+                            bool passive, u32 basic_rate)
+{
+        struct ieee80211_vif *vif = wl12xx_wlvif_to_vif(wlvif);
+        struct wl1271_cmd_scan *cmd;
+        struct wl1271_cmd_trigger_scan_to *trigger;
+        int ret;
+        u16 scan_options = 0;
+
+        /* skip active scans if we don't have SSIDs */
+        if (!passive && wl->scan.req->n_ssids == 0)
+                return WL1271_NOTHING_TO_SCAN;
+
+        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+        trigger = kzalloc(sizeof(*trigger), GFP_KERNEL);
+        if (!cmd || !trigger) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        if (wl->conf.scan.split_scan_timeout)
+                scan_options |= WL1271_SCAN_OPT_SPLIT_SCAN;
+
+        if (passive)
+                scan_options |= WL1271_SCAN_OPT_PASSIVE;
+
+        cmd->params.role_id = wlvif->role_id;
+
+        if (WARN_ON(cmd->params.role_id == WL12XX_INVALID_ROLE_ID)) {
+                ret = -EINVAL;
+                goto out;
+        }
+
+        cmd->params.scan_options = cpu_to_le16(scan_options);
+
+        cmd->params.n_ch = wl1271_get_scan_channels(wl, wl->scan.req,
+                                                    cmd->channels,
+                                                    band, passive);
+        if (cmd->params.n_ch == 0) {
+                ret = WL1271_NOTHING_TO_SCAN;
+                goto out;
+        }
+
+        cmd->params.tx_rate = cpu_to_le32(basic_rate);
+        cmd->params.n_probe_reqs = wl->conf.scan.num_probe_reqs;
+        cmd->params.tid_trigger = CONF_TX_AC_ANY_TID;
+        cmd->params.scan_tag = WL1271_SCAN_DEFAULT_TAG;
+
+        if (band == IEEE80211_BAND_2GHZ)
+                cmd->params.band = WL1271_SCAN_BAND_2_4_GHZ;
+        else
+                cmd->params.band = WL1271_SCAN_BAND_5_GHZ;
+
+        if (wl->scan.ssid_len && wl->scan.ssid) {
+                cmd->params.ssid_len = wl->scan.ssid_len;
+                memcpy(cmd->params.ssid, wl->scan.ssid, wl->scan.ssid_len);
+        }
+
+        memcpy(cmd->addr, vif->addr, ETH_ALEN);
+
+        ret = wl12xx_cmd_build_probe_req(wl, wlvif,
+                                         cmd->params.role_id, band,
+                                         wl->scan.ssid, wl->scan.ssid_len,
+                                         wl->scan.req->ie,
+                                         wl->scan.req->ie_len, false);
+        if (ret < 0) {
+                wl1271_error("PROBE request template failed");
+                goto out;
+        }
+
+        trigger->timeout = cpu_to_le32(wl->conf.scan.split_scan_timeout);
+        ret = wl1271_cmd_send(wl, CMD_TRIGGER_SCAN_TO, trigger,
+                              sizeof(*trigger), 0);
+        if (ret < 0) {
+                wl1271_error("trigger scan to failed for hw scan");
+                goto out;
+        }
+
+        wl1271_dump(DEBUG_SCAN, "SCAN: ", cmd, sizeof(*cmd));
+
+        ret = wl1271_cmd_send(wl, CMD_SCAN, cmd, sizeof(*cmd), 0);
+        if (ret < 0) {
+                wl1271_error("SCAN failed");
+                goto out;
+        }
+
+out:
+        kfree(cmd);
+        kfree(trigger);
+        return ret;
+}
+
+int wl12xx_scan_stop(struct wl1271 *wl, struct wl12xx_vif *wlvif)
+{
+        struct wl1271_cmd_header *cmd = NULL;
+        int ret = 0;
+
+        if (WARN_ON(wl->scan.state == WL1271_SCAN_STATE_IDLE))
+                return -EINVAL;
+
+        wl1271_debug(DEBUG_CMD, "cmd scan stop");
+
+        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+        if (!cmd) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        ret = wl1271_cmd_send(wl, CMD_STOP_SCAN, cmd,
+                              sizeof(*cmd), 0);
+        if (ret < 0) {
+                wl1271_error("cmd stop_scan failed");
+                goto out;
+        }
+out:
+        kfree(cmd);
+        return ret;
+}
+
+void wl1271_scan_stm(struct wl1271 *wl, struct wl12xx_vif *wlvif)
+{
+        int ret = 0;
+        enum ieee80211_band band;
+        u32 rate, mask;
+
+        switch (wl->scan.state) {
+        case WL1271_SCAN_STATE_IDLE:
+                break;
+
+        case WL1271_SCAN_STATE_2GHZ_ACTIVE:
+                band = IEEE80211_BAND_2GHZ;
+                mask = wlvif->bitrate_masks[band];
+                if (wl->scan.req->no_cck) {
+                        mask &= ~CONF_TX_CCK_RATES;
+                        if (!mask)
+                                mask = CONF_TX_RATE_MASK_BASIC_P2P;
+                }
+                rate = wl1271_tx_min_rate_get(wl, mask);
+                ret = wl1271_scan_send(wl, wlvif, band, false, rate);
+                if (ret == WL1271_NOTHING_TO_SCAN) {
+                        wl->scan.state = WL1271_SCAN_STATE_2GHZ_PASSIVE;
+                        wl1271_scan_stm(wl, wlvif);
+                }
+
+                break;
+
+        case WL1271_SCAN_STATE_2GHZ_PASSIVE:
+                band = IEEE80211_BAND_2GHZ;
+                mask = wlvif->bitrate_masks[band];
+                if (wl->scan.req->no_cck) {
+                        mask &= ~CONF_TX_CCK_RATES;
+                        if (!mask)
+                                mask = CONF_TX_RATE_MASK_BASIC_P2P;
+                }
+                rate = wl1271_tx_min_rate_get(wl, mask);
+                ret = wl1271_scan_send(wl, wlvif, band, true, rate);
+                if (ret == WL1271_NOTHING_TO_SCAN) {
+                        if (wl->enable_11a)
+                                wl->scan.state = WL1271_SCAN_STATE_5GHZ_ACTIVE;
+                        else
+                                wl->scan.state = WL1271_SCAN_STATE_DONE;
+                        wl1271_scan_stm(wl, wlvif);
+                }
+
+                break;
+
+        case WL1271_SCAN_STATE_5GHZ_ACTIVE:
+                band = IEEE80211_BAND_5GHZ;
+                rate = wl1271_tx_min_rate_get(wl, wlvif->bitrate_masks[band]);
+                ret = wl1271_scan_send(wl, wlvif, band, false, rate);
+                if (ret == WL1271_NOTHING_TO_SCAN) {
+                        wl->scan.state = WL1271_SCAN_STATE_5GHZ_PASSIVE;
+                        wl1271_scan_stm(wl, wlvif);
+                }
+
+                break;
+
+        case WL1271_SCAN_STATE_5GHZ_PASSIVE:
+                band = IEEE80211_BAND_5GHZ;
+                rate = wl1271_tx_min_rate_get(wl, wlvif->bitrate_masks[band]);
+                ret = wl1271_scan_send(wl, wlvif, band, true, rate);
+                if (ret == WL1271_NOTHING_TO_SCAN) {
+                        wl->scan.state = WL1271_SCAN_STATE_DONE;
+                        wl1271_scan_stm(wl, wlvif);
+                }
+
+                break;
+
+        case WL1271_SCAN_STATE_DONE:
+                wl->scan.failed = false;
+                cancel_delayed_work(&wl->scan_complete_work);
+                ieee80211_queue_delayed_work(wl->hw, &wl->scan_complete_work,
+                                             msecs_to_jiffies(0));
+                break;
+
+        default:
+                wl1271_error("invalid scan state");
+                break;
+        }
+
+        if (ret < 0) {
+                cancel_delayed_work(&wl->scan_complete_work);
+                ieee80211_queue_delayed_work(wl->hw, &wl->scan_complete_work,
+                                             msecs_to_jiffies(0));
+        }
+}
+
+static void wl12xx_adjust_channels(struct wl1271_cmd_sched_scan_config *cmd,
+                                   struct wlcore_scan_channels *cmd_channels)
+{
+        memcpy(cmd->passive, cmd_channels->passive, sizeof(cmd->passive));
+        memcpy(cmd->active, cmd_channels->active, sizeof(cmd->active));
+        cmd->dfs = cmd_channels->dfs;
+        cmd->n_pactive_ch = cmd_channels->passive_active;
+
+        memcpy(cmd->channels_2, cmd_channels->channels_2,
+               sizeof(cmd->channels_2));
+        memcpy(cmd->channels_5, cmd_channels->channels_5,
+               sizeof(cmd->channels_2));
+        /* channels_4 are not supported, so no need to copy them */
+}
+
+int wl1271_scan_sched_scan_config(struct wl1271 *wl,
+                                  struct wl12xx_vif *wlvif,
+                                  struct cfg80211_sched_scan_request *req,
+                                  struct ieee80211_sched_scan_ies *ies)
+{
+        struct wl1271_cmd_sched_scan_config *cfg = NULL;
+        struct wlcore_scan_channels *cfg_channels = NULL;
+        struct conf_sched_scan_settings *c = &wl->conf.sched_scan;
+        int i, ret;
+        bool force_passive = !req->n_ssids;
+
+        wl1271_debug(DEBUG_CMD, "cmd sched_scan scan config");
+
+        cfg = kzalloc(sizeof(*cfg), GFP_KERNEL);
+        if (!cfg)
+                return -ENOMEM;
+
+        cfg->role_id = wlvif->role_id;
+        cfg->rssi_threshold = c->rssi_threshold;
+        cfg->snr_threshold  = c->snr_threshold;
+        cfg->n_probe_reqs = c->num_probe_reqs;
+        /* cycles set to 0 it means infinite (until manually stopped) */
+        cfg->cycles = 0;
+        /* report APs when at least 1 is found */
+        cfg->report_after = 1;
+        /* don't stop scanning automatically when something is found */
+        cfg->terminate = 0;
+        cfg->tag = WL1271_SCAN_DEFAULT_TAG;
+        /* don't filter on BSS type */
+        cfg->bss_type = SCAN_BSS_TYPE_ANY;
+        /* currently NL80211 supports only a single interval */
+        for (i = 0; i < SCAN_MAX_CYCLE_INTERVALS; i++)
+                cfg->intervals[i] = cpu_to_le32(req->interval);
+
+        cfg->ssid_len = 0;
+        ret = wlcore_scan_sched_scan_ssid_list(wl, wlvif, req);
+        if (ret < 0)
+                goto out;
+
+        cfg->filter_type = ret;
+
+        wl1271_debug(DEBUG_SCAN, "filter_type = %d", cfg->filter_type);
+
+        cfg_channels = kzalloc(sizeof(*cfg_channels), GFP_KERNEL);
+        if (!cfg_channels) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        if (!wlcore_set_scan_chan_params(wl, cfg_channels, req->channels,
+                                         req->n_channels, req->n_ssids,
+                                         SCAN_TYPE_PERIODIC)) {
+                wl1271_error("scan channel list is empty");
+                ret = -EINVAL;
+                goto out;
+        }
+        wl12xx_adjust_channels(cfg, cfg_channels);
+
+        if (!force_passive && cfg->active[0]) {
+                u8 band = IEEE80211_BAND_2GHZ;
+                ret = wl12xx_cmd_build_probe_req(wl, wlvif,
+                                                 wlvif->role_id, band,
+                                                 req->ssids[0].ssid,
+                                                 req->ssids[0].ssid_len,
+                                                 ies->ie[band],
+                                                 ies->len[band], true);
+                if (ret < 0) {
+                        wl1271_error("2.4GHz PROBE request template failed");
+                        goto out;
+                }
+        }
+
+        if (!force_passive && cfg->active[1]) {
+                u8 band = IEEE80211_BAND_5GHZ;
+                ret = wl12xx_cmd_build_probe_req(wl, wlvif,
+                                                 wlvif->role_id, band,
+                                                 req->ssids[0].ssid,
+                                                 req->ssids[0].ssid_len,
+                                                 ies->ie[band],
+                                                 ies->len[band], true);
+                if (ret < 0) {
+                        wl1271_error("5GHz PROBE request template failed");
+                        goto out;
+                }
+        }
+
+        wl1271_dump(DEBUG_SCAN, "SCAN_CFG: ", cfg, sizeof(*cfg));
+
+        ret = wl1271_cmd_send(wl, CMD_CONNECTION_SCAN_CFG, cfg,
+                              sizeof(*cfg), 0);
+        if (ret < 0) {
+                wl1271_error("SCAN configuration failed");
+                goto out;
+        }
+out:
+        kfree(cfg_channels);
+        kfree(cfg);
+        return ret;
+}
+
+int wl1271_scan_sched_scan_start(struct wl1271 *wl, struct wl12xx_vif *wlvif)
+{
+        struct wl1271_cmd_sched_scan_start *start;
+        int ret = 0;
+
+        wl1271_debug(DEBUG_CMD, "cmd periodic scan start");
+
+        if (wlvif->bss_type != BSS_TYPE_STA_BSS)
+                return -EOPNOTSUPP;
+
+        if ((wl->quirks & WLCORE_QUIRK_NO_SCHED_SCAN_WHILE_CONN) &&
+            test_bit(WLVIF_FLAG_IN_USE, &wlvif->flags))
+                return -EBUSY;
+
+        start = kzalloc(sizeof(*start), GFP_KERNEL);
+        if (!start)
+                return -ENOMEM;
+
+        start->role_id = wlvif->role_id;
+        start->tag = WL1271_SCAN_DEFAULT_TAG;
+
+        ret = wl1271_cmd_send(wl, CMD_START_PERIODIC_SCAN, start,
+                              sizeof(*start), 0);
+        if (ret < 0) {
+                wl1271_error("failed to send scan start command");
+                goto out_free;
+        }
+
+out_free:
+        kfree(start);
+        return ret;
+}
+
+int wl12xx_sched_scan_start(struct wl1271 *wl, struct wl12xx_vif  *wlvif,
+                            struct cfg80211_sched_scan_request *req,
+                            struct ieee80211_sched_scan_ies *ies)
+{
+        int ret;
+
+        ret = wl1271_scan_sched_scan_config(wl, wlvif, req, ies);
+        if (ret < 0)
+                return ret;
+
+        return wl1271_scan_sched_scan_start(wl, wlvif);
+}
+
+void wl12xx_scan_sched_scan_stop(struct wl1271 *wl,  struct wl12xx_vif *wlvif)
+{
+        struct wl1271_cmd_sched_scan_stop *stop;
+        int ret = 0;
+
+        wl1271_debug(DEBUG_CMD, "cmd periodic scan stop");
+
+        /* FIXME: what to do if alloc'ing to stop fails? */
+        stop = kzalloc(sizeof(*stop), GFP_KERNEL);
+        if (!stop) {
+                wl1271_error("failed to alloc memory to send sched scan stop");
+                return;
+        }
+
+        stop->role_id = wlvif->role_id;
+        stop->tag = WL1271_SCAN_DEFAULT_TAG;
+
+        ret = wl1271_cmd_send(wl, CMD_STOP_PERIODIC_SCAN, stop,
+                              sizeof(*stop), 0);
+        if (ret < 0) {
+                wl1271_error("failed to send sched scan stop command");
+                goto out_free;
+        }
+
+out_free:
+        kfree(stop);
+}
+
+int wl12xx_scan_start(struct wl1271 *wl, struct wl12xx_vif *wlvif,
+                      struct cfg80211_scan_request *req)
+{
+        wl1271_scan_stm(wl, wlvif);
+        return 0;
+}
+
+void wl12xx_scan_completed(struct wl1271 *wl, struct wl12xx_vif *wlvif)
+{
+        wl1271_scan_stm(wl, wlvif);
+}
diff --git a/drivers/net/wireless/ti/wl12xx/scan.h b/drivers/net/wireless/ti/wl12xx/scan.h
new file mode 100644
index 000000000000..264af7ac2785
--- /dev/null
+++ b/drivers/net/wireless/ti/wl12xx/scan.h
@@ -0,0 +1,140 @@
+/*
+ * This file is part of wl12xx
+ *
+ * Copyright (C) 2012 Texas Instruments. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#ifndef __WL12XX_SCAN_H__
+#define __WL12XX_SCAN_H__
+
+#include "../wlcore/wlcore.h"
+#include "../wlcore/cmd.h"
+#include "../wlcore/scan.h"
+
+#define WL12XX_MAX_CHANNELS_5GHZ 23
+
+struct basic_scan_params {
+        /* Scan option flags (WL1271_SCAN_OPT_*) */
+        __le16 scan_options;
+        u8 role_id;
+        /* Number of scan channels in the list (maximum 30) */
+        u8 n_ch;
+        /* This field indicates the number of probe requests to send
+           per channel for an active scan */
+        u8 n_probe_reqs;
+        u8 tid_trigger;
+        u8 ssid_len;
+        u8 use_ssid_list;
+
+        /* Rate bit field for sending the probes */
+        __le32 tx_rate;
+
+        u8 ssid[IEEE80211_MAX_SSID_LEN];
+        /* Band to scan */
+        u8 band;
+
+        u8 scan_tag;
+        u8 padding2[2];
+} __packed;
+
+struct basic_scan_channel_params {
+        /* Duration in TU to wait for frames on a channel for active scan */
+        __le32 min_duration;
+        __le32 max_duration;
+        __le32 bssid_lsb;
+        __le16 bssid_msb;
+        u8 early_termination;
+        u8 tx_power_att;
+        u8 channel;
+        /* FW internal use only! */
+        u8 dfs_candidate;
+        u8 activity_detected;
+        u8 pad;
+} __packed;
+
+struct wl1271_cmd_scan {
+        struct wl1271_cmd_header header;
+
+        struct basic_scan_params params;
+        struct basic_scan_channel_params channels[WL1271_SCAN_MAX_CHANNELS];
+
+        /* src mac address */
+        u8 addr[ETH_ALEN];
+        u8 padding[2];
+} __packed;
+
+struct wl1271_cmd_sched_scan_config {
+        struct wl1271_cmd_header header;
+
+        __le32 intervals[SCAN_MAX_CYCLE_INTERVALS];
+
+        s8 rssi_threshold; /* for filtering (in dBm) */
+        s8 snr_threshold;  /* for filtering (in dB) */
+
+        u8 cycles;       /* maximum number of scan cycles */
+        u8 report_after; /* report when this number of results are received */
+        u8 terminate;    /* stop scanning after reporting */
+
+        u8 tag;
+        u8 bss_type; /* for filtering */
+        u8 filter_type;
+
+        u8 ssid_len;     /* For SCAN_SSID_FILTER_SPECIFIC */
+        u8 ssid[IEEE80211_MAX_SSID_LEN];
+
+        u8 n_probe_reqs; /* Number of probes requests per channel */
+
+        u8 passive[SCAN_MAX_BANDS];
+        u8 active[SCAN_MAX_BANDS];
+
+        u8 dfs;
+
+        u8 n_pactive_ch; /* number of pactive (passive until fw detects energy)
+                            channels in BG band */
+        u8 role_id;
+        u8 padding[1];
+        struct conn_scan_ch_params channels_2[MAX_CHANNELS_2GHZ];
+        struct conn_scan_ch_params channels_5[WL12XX_MAX_CHANNELS_5GHZ];
+        struct conn_scan_ch_params channels_4[MAX_CHANNELS_4GHZ];
+} __packed;
+
+struct wl1271_cmd_sched_scan_start {
+        struct wl1271_cmd_header header;
+
+        u8 tag;
+        u8 role_id;
+        u8 padding[2];
+} __packed;
+
+struct wl1271_cmd_sched_scan_stop {
+        struct wl1271_cmd_header header;
+
+        u8 tag;
+        u8 role_id;
+        u8 padding[2];
+} __packed;
+
+int wl12xx_scan_start(struct wl1271 *wl, struct wl12xx_vif *wlvif,
+                      struct cfg80211_scan_request *req);
+int wl12xx_scan_stop(struct wl1271 *wl, struct wl12xx_vif *wlvif);
+void wl12xx_scan_completed(struct wl1271 *wl, struct wl12xx_vif *wlvif);
+int wl12xx_sched_scan_start(struct wl1271 *wl, struct wl12xx_vif  *wlvif,
+                            struct cfg80211_sched_scan_request *req,
+                            struct ieee80211_sched_scan_ies *ies);
+void wl12xx_scan_sched_scan_stop(struct wl1271 *wl,  struct wl12xx_vif *wlvif);
+#endif
diff --git a/drivers/net/wireless/ti/wl12xx/wl12xx.h b/drivers/net/wireless/ti/wl12xx/wl12xx.h
index 7182bbf6625d..d4552857480c 100644
--- a/drivers/net/wireless/ti/wl12xx/wl12xx.h
+++ b/drivers/net/wireless/ti/wl12xx/wl12xx.h
@@ -24,19 +24,37 @@
 
 #include "conf.h"
 
-/* minimum FW required for driver for wl127x */
+/* WiLink 6/7 chip IDs */
+#define CHIP_ID_127X_PG10              (0x04030101)
+#define CHIP_ID_127X_PG20              (0x04030111)
+#define CHIP_ID_128X_PG10              (0x05030101)
+#define CHIP_ID_128X_PG20              (0x05030111)
+
+/* FW chip version for wl127x */
 #define WL127X_CHIP_VER         6
-#define WL127X_IFTYPE_VER       3
-#define WL127X_MAJOR_VER        10
-#define WL127X_SUBTYPE_VER      2
-#define WL127X_MINOR_VER        115
+/* minimum single-role FW version for wl127x */
+#define WL127X_IFTYPE_SR_VER    3
+#define WL127X_MAJOR_SR_VER     10
+#define WL127X_SUBTYPE_SR_VER   WLCORE_FW_VER_IGNORE
+#define WL127X_MINOR_SR_VER     115
+/* minimum multi-role FW version for wl127x */
+#define WL127X_IFTYPE_MR_VER    5
+#define WL127X_MAJOR_MR_VER     7
+#define WL127X_SUBTYPE_MR_VER   WLCORE_FW_VER_IGNORE
+#define WL127X_MINOR_MR_VER     115
 
-/* minimum FW required for driver for wl128x */
+/* FW chip version for wl128x */
 #define WL128X_CHIP_VER         7
-#define WL128X_IFTYPE_VER       3
-#define WL128X_MAJOR_VER        10
-#define WL128X_SUBTYPE_VER      2
-#define WL128X_MINOR_VER        115
+/* minimum single-role FW version for wl128x */
+#define WL128X_IFTYPE_SR_VER    3
+#define WL128X_MAJOR_SR_VER     10
+#define WL128X_SUBTYPE_SR_VER   WLCORE_FW_VER_IGNORE
+#define WL128X_MINOR_SR_VER     115
+/* minimum multi-role FW version for wl128x */
+#define WL128X_IFTYPE_MR_VER    5
+#define WL128X_MAJOR_MR_VER     7
+#define WL128X_SUBTYPE_MR_VER   WLCORE_FW_VER_IGNORE
+#define WL128X_MINOR_MR_VER     42
 
 #define WL12XX_AGGR_BUFFER_SIZE (4 * PAGE_SIZE)
 
@@ -55,6 +73,8 @@ struct wl12xx_priv {
 
         int ref_clock;
         int tcxo_clock;
+
+        struct wl127x_rx_mem_pool_addr *rx_mem_addr;
 };
 
 #endif /* __WL12XX_PRIV_H__ */
diff --git a/drivers/net/wireless/ti/wl18xx/Makefile b/drivers/net/wireless/ti/wl18xx/Makefile
index 67c098734c7f..ae2b81735785 100644
--- a/drivers/net/wireless/ti/wl18xx/Makefile
+++ b/drivers/net/wireless/ti/wl18xx/Makefile
@@ -1,3 +1,3 @@
-wl18xx-objs     = main.o acx.o tx.o io.o debugfs.o
+wl18xx-objs     = main.o acx.o tx.o io.o debugfs.o scan.o cmd.o event.o
 
 obj-$(CONFIG_WL18XX)            += wl18xx.o
diff --git a/drivers/net/wireless/ti/wl18xx/acx.c b/drivers/net/wireless/ti/wl18xx/acx.c
index 72840e23bf59..a169bb5a5dbf 100644
--- a/drivers/net/wireless/ti/wl18xx/acx.c
+++ b/drivers/net/wireless/ti/wl18xx/acx.c
@@ -75,7 +75,7 @@ int wl18xx_acx_set_checksum_state(struct wl1271 *wl)
 
         acx->checksum_state = CHECKSUM_OFFLOAD_ENABLED;
 
-        ret = wl1271_cmd_configure(wl, ACX_CHECKSUM_CONFIG, acx, sizeof(*acx));
+        ret = wl1271_cmd_configure(wl, ACX_CSUM_CONFIG, acx, sizeof(*acx));
         if (ret < 0) {
                 wl1271_warning("failed to set Tx checksum state: %d", ret);
                 goto out;
@@ -109,3 +109,88 @@ out:
         kfree(acx);
         return ret;
 }
+
+int wl18xx_acx_peer_ht_operation_mode(struct wl1271 *wl, u8 hlid, bool wide)
+{
+        struct wlcore_peer_ht_operation_mode *acx;
+        int ret;
+
+        wl1271_debug(DEBUG_ACX, "acx peer ht operation mode hlid %d bw %d",
+                     hlid, wide);
+
+        acx = kzalloc(sizeof(*acx), GFP_KERNEL);
+        if (!acx) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        acx->hlid = hlid;
+        acx->bandwidth = wide ? WLCORE_BANDWIDTH_40MHZ : WLCORE_BANDWIDTH_20MHZ;
+
+        ret = wl1271_cmd_configure(wl, ACX_PEER_HT_OPERATION_MODE_CFG, acx,
+                                   sizeof(*acx));
+
+        if (ret < 0) {
+                wl1271_warning("acx peer ht operation mode failed: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(acx);
+        return ret;
+
+}
+
+/*
+ * this command is basically the same as wl1271_acx_ht_capabilities,
+ * with the addition of supported rates. they should be unified in
+ * the next fw api change
+ */
+int wl18xx_acx_set_peer_cap(struct wl1271 *wl,
+                            struct ieee80211_sta_ht_cap *ht_cap,
+                            bool allow_ht_operation,
+                            u32 rate_set, u8 hlid)
+{
+        struct wlcore_acx_peer_cap *acx;
+        int ret = 0;
+        u32 ht_capabilites = 0;
+
+        wl1271_debug(DEBUG_ACX,
+                     "acx set cap ht_supp: %d ht_cap: %d rates: 0x%x",
+                     ht_cap->ht_supported, ht_cap->cap, rate_set);
+
+        acx = kzalloc(sizeof(*acx), GFP_KERNEL);
+        if (!acx) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        if (allow_ht_operation && ht_cap->ht_supported) {
+                /* no need to translate capabilities - use the spec values */
+                ht_capabilites = ht_cap->cap;
+
+                /*
+                 * this bit is not employed by the spec but only by FW to
+                 * indicate peer HT support
+                 */
+                ht_capabilites |= WL12XX_HT_CAP_HT_OPERATION;
+
+                /* get data from A-MPDU parameters field */
+                acx->ampdu_max_length = ht_cap->ampdu_factor;
+                acx->ampdu_min_spacing = ht_cap->ampdu_density;
+        }
+
+        acx->hlid = hlid;
+        acx->ht_capabilites = cpu_to_le32(ht_capabilites);
+        acx->supported_rates = cpu_to_le32(rate_set);
+
+        ret = wl1271_cmd_configure(wl, ACX_PEER_CAP, acx, sizeof(*acx));
+        if (ret < 0) {
+                wl1271_warning("acx ht capabilities setting failed: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(acx);
+        return ret;
+}
diff --git a/drivers/net/wireless/ti/wl18xx/acx.h b/drivers/net/wireless/ti/wl18xx/acx.h
index e2609a6b7341..0e636def1217 100644
--- a/drivers/net/wireless/ti/wl18xx/acx.h
+++ b/drivers/net/wireless/ti/wl18xx/acx.h
@@ -26,7 +26,13 @@
 #include "../wlcore/acx.h"
 
 enum {
-        ACX_CLEAR_STATISTICS             = 0x0047,
+        ACX_NS_IPV6_FILTER               = 0x0050,
+        ACX_PEER_HT_OPERATION_MODE_CFG   = 0x0051,
+        ACX_CSUM_CONFIG                  = 0x0052,
+        ACX_SIM_CONFIG                   = 0x0053,
+        ACX_CLEAR_STATISTICS             = 0x0054,
+        ACX_AUTO_RX_STREAMING            = 0x0055,
+        ACX_PEER_CAP                     = 0x0056
 };
 
 /* numbers of bits the length field takes (add 1 for the actual number) */
@@ -278,10 +284,57 @@ struct wl18xx_acx_clear_statistics {
         struct acx_header header;
 };
 
+enum wlcore_bandwidth {
+        WLCORE_BANDWIDTH_20MHZ,
+        WLCORE_BANDWIDTH_40MHZ,
+};
+
+struct wlcore_peer_ht_operation_mode {
+        struct acx_header header;
+
+        u8 hlid;
+        u8 bandwidth; /* enum wlcore_bandwidth */
+        u8 padding[2];
+};
+
+/*
+ * ACX_PEER_CAP
+ * this struct is very similar to wl1271_acx_ht_capabilities, with the
+ * addition of supported rates
+ */
+struct wlcore_acx_peer_cap {
+        struct acx_header header;
+
+        /* bitmask of capability bits supported by the peer */
+        __le32 ht_capabilites;
+
+        /* rates supported by the remote peer */
+        __le32 supported_rates;
+
+        /* Indicates to which link these capabilities apply. */
+        u8 hlid;
+
+        /*
+         * This the maximum A-MPDU length supported by the AP. The FW may not
+         * exceed this length when sending A-MPDUs
+         */
+        u8 ampdu_max_length;
+
+        /* This is the minimal spacing required when sending A-MPDUs to the AP*/
+        u8 ampdu_min_spacing;
+
+        u8 padding;
+} __packed;
+
 int wl18xx_acx_host_if_cfg_bitmap(struct wl1271 *wl, u32 host_cfg_bitmap,
                                   u32 sdio_blk_size, u32 extra_mem_blks,
                                   u32 len_field_size);
 int wl18xx_acx_set_checksum_state(struct wl1271 *wl);
 int wl18xx_acx_clear_statistics(struct wl1271 *wl);
+int wl18xx_acx_peer_ht_operation_mode(struct wl1271 *wl, u8 hlid, bool wide);
+int wl18xx_acx_set_peer_cap(struct wl1271 *wl,
+                            struct ieee80211_sta_ht_cap *ht_cap,
+                            bool allow_ht_operation,
+                            u32 rate_set, u8 hlid);
 
 #endif /* __WL18XX_ACX_H__ */
diff --git a/drivers/net/wireless/ti/wl18xx/cmd.c b/drivers/net/wireless/ti/wl18xx/cmd.c
new file mode 100644
index 000000000000..1d1f6cc7a50a
--- /dev/null
+++ b/drivers/net/wireless/ti/wl18xx/cmd.c
@@ -0,0 +1,80 @@
+/*
+ * This file is part of wl18xx
+ *
+ * Copyright (C) 2011 Texas Instruments Inc.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#include "../wlcore/cmd.h"
+#include "../wlcore/debug.h"
+#include "../wlcore/hw_ops.h"
+
+#include "cmd.h"
+
+int wl18xx_cmd_channel_switch(struct wl1271 *wl,
+                              struct wl12xx_vif *wlvif,
+                              struct ieee80211_channel_switch *ch_switch)
+{
+        struct wl18xx_cmd_channel_switch *cmd;
+        u32 supported_rates;
+        int ret;
+
+        wl1271_debug(DEBUG_ACX, "cmd channel switch");
+
+        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+        if (!cmd) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        cmd->role_id = wlvif->role_id;
+        cmd->channel = ch_switch->channel->hw_value;
+        cmd->switch_time = ch_switch->count;
+        cmd->stop_tx = ch_switch->block_tx;
+
+        switch (ch_switch->channel->band) {
+        case IEEE80211_BAND_2GHZ:
+                cmd->band = WLCORE_BAND_2_4GHZ;
+                break;
+        case IEEE80211_BAND_5GHZ:
+                cmd->band = WLCORE_BAND_5GHZ;
+                break;
+        default:
+                wl1271_error("invalid channel switch band: %d",
+                             ch_switch->channel->band);
+                ret = -EINVAL;
+                goto out_free;
+        }
+
+        supported_rates = CONF_TX_ENABLED_RATES | CONF_TX_MCS_RATES |
+                          wlcore_hw_sta_get_ap_rate_mask(wl, wlvif);
+        if (wlvif->p2p)
+                supported_rates &= ~CONF_TX_CCK_RATES;
+        cmd->local_supported_rates = cpu_to_le32(supported_rates);
+        cmd->channel_type = wlvif->channel_type;
+
+        ret = wl1271_cmd_send(wl, CMD_CHANNEL_SWITCH, cmd, sizeof(*cmd), 0);
+        if (ret < 0) {
+                wl1271_error("failed to send channel switch command");
+                goto out_free;
+        }
+
+out_free:
+        kfree(cmd);
+out:
+        return ret;
+}
diff --git a/drivers/net/wireless/ti/wl18xx/cmd.h b/drivers/net/wireless/ti/wl18xx/cmd.h
new file mode 100644
index 000000000000..6687d10899ac
--- /dev/null
+++ b/drivers/net/wireless/ti/wl18xx/cmd.h
@@ -0,0 +1,52 @@
+/*
+ * This file is part of wl18xx
+ *
+ * Copyright (C) 2011 Texas Instruments. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#ifndef __WL18XX_CMD_H__
+#define __WL18XX_CMD_H__
+
+#include "../wlcore/wlcore.h"
+#include "../wlcore/acx.h"
+
+struct wl18xx_cmd_channel_switch {
+        struct wl1271_cmd_header header;
+
+        u8 role_id;
+
+        /* The new serving channel */
+        u8 channel;
+        /* Relative time of the serving channel switch in TBTT units */
+        u8 switch_time;
+        /* Stop the role TX, should expect it after radar detection */
+        u8 stop_tx;
+
+        __le32 local_supported_rates;
+
+        u8 channel_type;
+        u8 band;
+
+        u8 padding[2];
+} __packed;
+
+int wl18xx_cmd_channel_switch(struct wl1271 *wl,
+                              struct wl12xx_vif *wlvif,
+                              struct ieee80211_channel_switch *ch_switch);
+
+#endif
diff --git a/drivers/net/wireless/ti/wl18xx/conf.h b/drivers/net/wireless/ti/wl18xx/conf.h
index 4d426cc20274..b5f114857191 100644
--- a/drivers/net/wireless/ti/wl18xx/conf.h
+++ b/drivers/net/wireless/ti/wl18xx/conf.h
@@ -23,20 +23,21 @@
 #define __WL18XX_CONF_H__
 
 #define WL18XX_CONF_MAGIC       0x10e100ca
-#define WL18XX_CONF_VERSION     (WLCORE_CONF_VERSION | 0x0003)
+#define WL18XX_CONF_VERSION     (WLCORE_CONF_VERSION | 0x0005)
 #define WL18XX_CONF_MASK        0x0000ffff
 #define WL18XX_CONF_SIZE        (WLCORE_CONF_SIZE + \
                                  sizeof(struct wl18xx_priv_conf))
 
 #define NUM_OF_CHANNELS_11_ABG 150
 #define NUM_OF_CHANNELS_11_P 7
-#define WL18XX_NUM_OF_SUB_BANDS 9
 #define SRF_TABLE_LEN 16
 #define PIN_MUXING_SIZE 2
+#define WL18XX_TRACE_LOSS_GAPS_TX 10
+#define WL18XX_TRACE_LOSS_GAPS_RX 18
 
 struct wl18xx_mac_and_phy_params {
         u8 phy_standalone;
-        u8 rdl;
+        u8 spare0;
         u8 enable_clpc;
         u8 enable_tx_low_pwr_on_siso_rdl;
         u8 auto_detect;
@@ -69,18 +70,26 @@ struct wl18xx_mac_and_phy_params {
         u8 pwr_limit_reference_11_abg;
         u8 per_chan_pwr_limit_arr_11p[NUM_OF_CHANNELS_11_P];
         u8 pwr_limit_reference_11p;
-        u8 per_sub_band_tx_trace_loss[WL18XX_NUM_OF_SUB_BANDS];
-        u8 per_sub_band_rx_trace_loss[WL18XX_NUM_OF_SUB_BANDS];
+        u8 spare1[9];
+        u8 spare2[9];
         u8 primary_clock_setting_time;
         u8 clock_valid_on_wake_up;
         u8 secondary_clock_setting_time;
         u8 board_type;
         /* enable point saturation */
         u8 psat;
-        /* low/medium/high Tx power in dBm */
+        /* low/medium/high Tx power in dBm for STA-HP BG */
         s8 low_power_val;
         s8 med_power_val;
         s8 high_power_val;
+        s8 per_sub_band_tx_trace_loss[WL18XX_TRACE_LOSS_GAPS_TX];
+        s8 per_sub_band_rx_trace_loss[WL18XX_TRACE_LOSS_GAPS_RX];
+        u8 tx_rf_margin;
+        /* low/medium/high Tx power in dBm for other role */
+        s8 low_power_val_2nd;
+        s8 med_power_val_2nd;
+        s8 high_power_val_2nd;
+
         u8 padding[1];
 } __packed;
 
diff --git a/drivers/net/wireless/ti/wl18xx/event.c b/drivers/net/wireless/ti/wl18xx/event.c
new file mode 100644
index 000000000000..c9199d7804c6
--- /dev/null
+++ b/drivers/net/wireless/ti/wl18xx/event.c
@@ -0,0 +1,111 @@
+/*
+ * This file is part of wl12xx
+ *
+ * Copyright (C) 2012 Texas Instruments. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#include "event.h"
+#include "scan.h"
+#include "../wlcore/cmd.h"
+#include "../wlcore/debug.h"
+
+int wl18xx_wait_for_event(struct wl1271 *wl, enum wlcore_wait_event event,
+                          bool *timeout)
+{
+        u32 local_event;
+
+        switch (event) {
+        case WLCORE_EVENT_PEER_REMOVE_COMPLETE:
+                local_event = PEER_REMOVE_COMPLETE_EVENT_ID;
+                break;
+
+        case WLCORE_EVENT_DFS_CONFIG_COMPLETE:
+                local_event = DFS_CHANNELS_CONFIG_COMPLETE_EVENT;
+                break;
+
+        default:
+                /* event not implemented */
+                return 0;
+        }
+        return wlcore_cmd_wait_for_event_or_timeout(wl, local_event, timeout);
+}
+
+int wl18xx_process_mailbox_events(struct wl1271 *wl)
+{
+        struct wl18xx_event_mailbox *mbox = wl->mbox;
+        u32 vector;
+
+        vector = le32_to_cpu(mbox->events_vector);
+        wl1271_debug(DEBUG_EVENT, "MBOX vector: 0x%x", vector);
+
+        if (vector & SCAN_COMPLETE_EVENT_ID) {
+                wl1271_debug(DEBUG_EVENT, "scan results: %d",
+                             mbox->number_of_scan_results);
+
+                if (wl->scan_wlvif)
+                        wl18xx_scan_completed(wl, wl->scan_wlvif);
+        }
+
+        if (vector & PERIODIC_SCAN_REPORT_EVENT_ID) {
+                wl1271_debug(DEBUG_EVENT,
+                             "PERIODIC_SCAN_REPORT_EVENT (results %d)",
+                             mbox->number_of_sched_scan_results);
+
+                wlcore_scan_sched_scan_results(wl);
+        }
+
+        if (vector & PERIODIC_SCAN_COMPLETE_EVENT_ID)
+                wlcore_event_sched_scan_completed(wl, 1);
+
+        if (vector & RSSI_SNR_TRIGGER_0_EVENT_ID)
+                wlcore_event_rssi_trigger(wl, mbox->rssi_snr_trigger_metric);
+
+        if (vector & BA_SESSION_RX_CONSTRAINT_EVENT_ID)
+                wlcore_event_ba_rx_constraint(wl,
+                                le16_to_cpu(mbox->rx_ba_role_id_bitmap),
+                                le16_to_cpu(mbox->rx_ba_allowed_bitmap));
+
+        if (vector & BSS_LOSS_EVENT_ID)
+                wlcore_event_beacon_loss(wl,
+                                         le16_to_cpu(mbox->bss_loss_bitmap));
+
+        if (vector & CHANNEL_SWITCH_COMPLETE_EVENT_ID)
+                wlcore_event_channel_switch(wl,
+                        le16_to_cpu(mbox->channel_switch_role_id_bitmap),
+                        true);
+
+        if (vector & DUMMY_PACKET_EVENT_ID)
+                wlcore_event_dummy_packet(wl);
+
+        /*
+         * "TX retries exceeded" has a different meaning according to mode.
+         * In AP mode the offending station is disconnected.
+         */
+        if (vector & MAX_TX_FAILURE_EVENT_ID)
+                wlcore_event_max_tx_failure(wl,
+                                le32_to_cpu(mbox->tx_retry_exceeded_bitmap));
+
+        if (vector & INACTIVE_STA_EVENT_ID)
+                wlcore_event_inactive_sta(wl,
+                                le32_to_cpu(mbox->inactive_sta_bitmap));
+
+        if (vector & REMAIN_ON_CHANNEL_COMPLETE_EVENT_ID)
+                wlcore_event_roc_complete(wl);
+
+        return 0;
+}
diff --git a/drivers/net/wireless/ti/wl18xx/event.h b/drivers/net/wireless/ti/wl18xx/event.h
new file mode 100644
index 000000000000..398f3d2c0a6c
--- /dev/null
+++ b/drivers/net/wireless/ti/wl18xx/event.h
@@ -0,0 +1,77 @@
+/*
+ * This file is part of wl18xx
+ *
+ * Copyright (C) 2012 Texas Instruments. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#ifndef __WL18XX_EVENT_H__
+#define __WL18XX_EVENT_H__
+
+#include "../wlcore/wlcore.h"
+
+enum {
+        SCAN_COMPLETE_EVENT_ID                   = BIT(8),
+        RADAR_DETECTED_EVENT_ID                  = BIT(9),
+        CHANNEL_SWITCH_COMPLETE_EVENT_ID         = BIT(10),
+        BSS_LOSS_EVENT_ID                        = BIT(11),
+        MAX_TX_FAILURE_EVENT_ID                  = BIT(12),
+        DUMMY_PACKET_EVENT_ID                    = BIT(13),
+        INACTIVE_STA_EVENT_ID                    = BIT(14),
+        PEER_REMOVE_COMPLETE_EVENT_ID            = BIT(15),
+        PERIODIC_SCAN_COMPLETE_EVENT_ID          = BIT(16),
+        BA_SESSION_RX_CONSTRAINT_EVENT_ID        = BIT(17),
+        REMAIN_ON_CHANNEL_COMPLETE_EVENT_ID      = BIT(18),
+        DFS_CHANNELS_CONFIG_COMPLETE_EVENT       = BIT(19),
+        PERIODIC_SCAN_REPORT_EVENT_ID            = BIT(20),
+};
+
+struct wl18xx_event_mailbox {
+        __le32 events_vector;
+
+        u8 number_of_scan_results;
+        u8 number_of_sched_scan_results;
+
+        __le16 channel_switch_role_id_bitmap;
+
+        s8 rssi_snr_trigger_metric[NUM_OF_RSSI_SNR_TRIGGERS];
+
+        /* bitmap of removed links */
+        __le32 hlid_removed_bitmap;
+
+        /* rx ba constraint */
+        __le16 rx_ba_role_id_bitmap; /* 0xfff means any role. */
+        __le16 rx_ba_allowed_bitmap;
+
+        /* bitmap of roc completed (by role id) */
+        __le16 roc_completed_bitmap;
+
+        /* bitmap of stations (by role id) with bss loss */
+        __le16 bss_loss_bitmap;
+
+        /* bitmap of stations (by HLID) which exceeded max tx retries */
+        __le32 tx_retry_exceeded_bitmap;
+
+        /* bitmap of inactive stations (by HLID) */
+        __le32 inactive_sta_bitmap;
+} __packed;
+
+int wl18xx_wait_for_event(struct wl1271 *wl, enum wlcore_wait_event event,
+                          bool *timeout);
+int wl18xx_process_mailbox_events(struct wl1271 *wl);
+
+#endif
diff --git a/drivers/net/wireless/ti/wl18xx/main.c b/drivers/net/wireless/ti/wl18xx/main.c
index 8d8c1f8c63b7..0be1cfc17a86 100644
--- a/drivers/net/wireless/ti/wl18xx/main.c
+++ b/drivers/net/wireless/ti/wl18xx/main.c
@@ -34,10 +34,13 @@
 
 #include "reg.h"
 #include "conf.h"
+#include "cmd.h"
 #include "acx.h"
 #include "tx.h"
 #include "wl18xx.h"
 #include "io.h"
+#include "scan.h"
+#include "event.h"
 #include "debugfs.h"
 
 #define WL18XX_RX_CHECKSUM_MASK      0x40
@@ -334,6 +337,8 @@ static struct wlcore_conf wl18xx_conf = {
                 .tmpl_short_retry_limit      = 10,
                 .tmpl_long_retry_limit       = 10,
                 .tx_watchdog_timeout         = 5000,
+                .slow_link_thold             = 3,
+                .fast_link_thold             = 30,
         },
         .conn = {
                 .wake_up_event               = CONF_WAKE_UP_EVENT_DTIM,
@@ -391,8 +396,10 @@ static struct wlcore_conf wl18xx_conf = {
         .scan = {
                 .min_dwell_time_active        = 7500,
                 .max_dwell_time_active        = 30000,
-                .min_dwell_time_passive       = 100000,
-                .max_dwell_time_passive       = 100000,
+                .min_dwell_time_active_long   = 25000,
+                .max_dwell_time_active_long   = 50000,
+                .dwell_time_passive           = 100000,
+                .dwell_time_dfs               = 150000,
                 .num_probe_reqs               = 2,
                 .split_scan_timeout           = 50000,
         },
@@ -489,6 +496,10 @@ static struct wlcore_conf wl18xx_conf = {
                 .increase_time              = 1,
                 .window_size                = 16,
         },
+        .recovery = {
+                .bug_on_recovery            = 0,
+                .no_recovery                = 0,
+        },
 };
 
 static struct wl18xx_priv_conf wl18xx_default_priv_conf = {
@@ -501,7 +512,6 @@ static struct wl18xx_priv_conf wl18xx_default_priv_conf = {
                 .clock_valid_on_wake_up         = 0x00,
                 .secondary_clock_setting_time   = 0x05,
                 .board_type                     = BOARD_TYPE_HDK_18XX,
-                .rdl                            = 0x01,
                 .auto_detect                    = 0x00,
                 .dedicated_fem                  = FEM_NONE,
                 .low_band_component             = COMPONENT_3_WAY_SWITCH,
@@ -517,14 +527,39 @@ static struct wl18xx_priv_conf wl18xx_default_priv_conf = {
                 .enable_clpc                    = 0x00,
                 .enable_tx_low_pwr_on_siso_rdl  = 0x00,
                 .rx_profile                     = 0x00,
-                .pwr_limit_reference_11_abg     = 0xc8,
+                .pwr_limit_reference_11_abg     = 0x64,
+                .per_chan_pwr_limit_arr_11abg   = {
+                        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+                        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+                        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+                        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+                        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+                        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+                        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+                        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+                        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+                        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+                        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+                        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+                        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+                        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+                        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+                        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+                        0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
+                .pwr_limit_reference_11p        = 0x64,
+                .per_chan_pwr_limit_arr_11p     = { 0xff, 0xff, 0xff, 0xff,
+                                                    0xff, 0xff, 0xff },
                 .psat                           = 0,
-                .low_power_val                  = 0x00,
-                .med_power_val                  = 0x0a,
-                .high_power_val                 = 0x1e,
+                .low_power_val                  = 0x08,
+                .med_power_val                  = 0x12,
+                .high_power_val                 = 0x18,
+                .low_power_val_2nd              = 0x05,
+                .med_power_val_2nd              = 0x0a,
+                .high_power_val_2nd             = 0x14,
                 .external_pa_dc2dc              = 0,
-                .number_of_assembled_ant2_4     = 1,
+                .number_of_assembled_ant2_4     = 2,
                 .number_of_assembled_ant5       = 1,
+                .tx_rf_margin                   = 1,
         },
 };
 
@@ -595,7 +630,7 @@ static const struct wl18xx_clk_cfg wl18xx_clk_table[NUM_CLOCK_CONFIGS] = {
 };
 
 /* TODO: maybe move to a new header file? */
-#define WL18XX_FW_NAME "ti-connectivity/wl18xx-fw.bin"
+#define WL18XX_FW_NAME "ti-connectivity/wl18xx-fw-2.bin"
 
 static int wl18xx_identify_chip(struct wl1271 *wl)
 {
@@ -608,15 +643,18 @@ static int wl18xx_identify_chip(struct wl1271 *wl)
                 wl->sr_fw_name = WL18XX_FW_NAME;
                 /* wl18xx uses the same firmware for PLT */
                 wl->plt_fw_name = WL18XX_FW_NAME;
-                wl->quirks |= WLCORE_QUIRK_NO_ELP |
-                              WLCORE_QUIRK_RX_BLOCKSIZE_ALIGN |
+                wl->quirks |= WLCORE_QUIRK_RX_BLOCKSIZE_ALIGN |
                               WLCORE_QUIRK_TX_BLOCKSIZE_ALIGN |
                               WLCORE_QUIRK_NO_SCHED_SCAN_WHILE_CONN |
-                              WLCORE_QUIRK_TX_PAD_LAST_FRAME;
-
-                wlcore_set_min_fw_ver(wl, WL18XX_CHIP_VER, WL18XX_IFTYPE_VER,
-                                      WL18XX_MAJOR_VER, WL18XX_SUBTYPE_VER,
-                                      WL18XX_MINOR_VER);
+                              WLCORE_QUIRK_TX_PAD_LAST_FRAME |
+                              WLCORE_QUIRK_REGDOMAIN_CONF |
+                              WLCORE_QUIRK_DUAL_PROBE_TMPL;
+
+                wlcore_set_min_fw_ver(wl, WL18XX_CHIP_VER,
+                                      WL18XX_IFTYPE_VER,  WL18XX_MAJOR_VER,
+                                      WL18XX_SUBTYPE_VER, WL18XX_MINOR_VER,
+                                      /* there's no separate multi-role FW */
+                                      0, 0, 0, 0);
                 break;
         case CHIP_ID_185x_PG10:
                 wl1271_warning("chip id 0x%x (185x PG10) is deprecated",
@@ -630,6 +668,11 @@ static int wl18xx_identify_chip(struct wl1271 *wl)
                 goto out;
         }
 
+        wl->scan_templ_id_2_4 = CMD_TEMPL_CFG_PROBE_REQ_2_4;
+        wl->scan_templ_id_5 = CMD_TEMPL_CFG_PROBE_REQ_5;
+        wl->sched_scan_templ_id_2_4 = CMD_TEMPL_PROBE_REQ_2_4_PERIODIC;
+        wl->sched_scan_templ_id_5 = CMD_TEMPL_PROBE_REQ_5_PERIODIC;
+        wl->max_channels_5 = WL18XX_MAX_CHANNELS_5GHZ;
 out:
         return ret;
 }
@@ -843,6 +886,20 @@ static int wl18xx_boot(struct wl1271 *wl)
         if (ret < 0)
                 goto out;
 
+        wl->event_mask = BSS_LOSS_EVENT_ID |
+                SCAN_COMPLETE_EVENT_ID |
+                RSSI_SNR_TRIGGER_0_EVENT_ID |
+                PERIODIC_SCAN_COMPLETE_EVENT_ID |
+                PERIODIC_SCAN_REPORT_EVENT_ID |
+                DUMMY_PACKET_EVENT_ID |
+                PEER_REMOVE_COMPLETE_EVENT_ID |
+                BA_SESSION_RX_CONSTRAINT_EVENT_ID |
+                REMAIN_ON_CHANNEL_COMPLETE_EVENT_ID |
+                INACTIVE_STA_EVENT_ID |
+                MAX_TX_FAILURE_EVENT_ID |
+                CHANNEL_SWITCH_COMPLETE_EVENT_ID |
+                DFS_CHANNELS_CONFIG_COMPLETE_EVENT;
+
         ret = wlcore_boot_run_firmware(wl);
         if (ret < 0)
                 goto out;
@@ -964,7 +1021,7 @@ static int wl18xx_hw_init(struct wl1271 *wl)
 
         /* (re)init private structures. Relevant on recovery as well. */
         priv->last_fw_rls_idx = 0;
-        priv->extra_spare_vif_count = 0;
+        priv->extra_spare_key_count = 0;
 
         /* set the default amount of spare blocks in the bitmap */
         ret = wl18xx_set_host_cfg_bitmap(wl, WL18XX_TX_HW_BLOCK_SPARE);
@@ -1022,7 +1079,12 @@ static bool wl18xx_is_mimo_supported(struct wl1271 *wl)
 {
         struct wl18xx_priv *priv = wl->priv;
 
-        return priv->conf.phy.number_of_assembled_ant2_4 >= 2;
+        /* only support MIMO with multiple antennas, and when SISO
+         * is not forced through config
+         */
+        return (priv->conf.phy.number_of_assembled_ant2_4 >= 2) &&
+               (priv->conf.ht.mode != HT_MODE_WIDE) &&
+               (priv->conf.ht.mode != HT_MODE_SISO20);
 }
 
 /*
@@ -1223,8 +1285,8 @@ static int wl18xx_get_spare_blocks(struct wl1271 *wl, bool is_gem)
 {
         struct wl18xx_priv *priv = wl->priv;
 
-        /* If we have VIFs requiring extra spare, indulge them */
-        if (priv->extra_spare_vif_count)
+        /* If we have keys requiring extra spare, indulge them */
+        if (priv->extra_spare_key_count)
                 return WL18XX_TX_HW_EXTRA_BLOCK_SPARE;
 
         return WL18XX_TX_HW_BLOCK_SPARE;
@@ -1236,42 +1298,48 @@ static int wl18xx_set_key(struct wl1271 *wl, enum set_key_cmd cmd,
                           struct ieee80211_key_conf *key_conf)
 {
         struct wl18xx_priv *priv = wl->priv;
-        bool change_spare = false;
+        bool change_spare = false, special_enc;
         int ret;
 
+        wl1271_debug(DEBUG_CRYPT, "extra spare keys before: %d",
+                     priv->extra_spare_key_count);
+
+        special_enc = key_conf->cipher == WL1271_CIPHER_SUITE_GEM ||
+                      key_conf->cipher == WLAN_CIPHER_SUITE_TKIP;
+
+        ret = wlcore_set_key(wl, cmd, vif, sta, key_conf);
+        if (ret < 0)
+                goto out;
+
         /*
-         * when adding the first or removing the last GEM/TKIP interface,
+         * when adding the first or removing the last GEM/TKIP key,
          * we have to adjust the number of spare blocks.
          */
-        change_spare = (key_conf->cipher == WL1271_CIPHER_SUITE_GEM ||
-                key_conf->cipher == WLAN_CIPHER_SUITE_TKIP) &&
-                ((priv->extra_spare_vif_count == 0 && cmd == SET_KEY) ||
-                 (priv->extra_spare_vif_count == 1 && cmd == DISABLE_KEY));
+        if (special_enc) {
+                if (cmd == SET_KEY) {
+                        /* first key */
+                        change_spare = (priv->extra_spare_key_count == 0);
+                        priv->extra_spare_key_count++;
+                } else if (cmd == DISABLE_KEY) {
+                        /* last key */
+                        change_spare = (priv->extra_spare_key_count == 1);
+                        priv->extra_spare_key_count--;
+                }
+        }
 
-        /* no need to change spare - just regular set_key */
-        if (!change_spare)
-                return wlcore_set_key(wl, cmd, vif, sta, key_conf);
+        wl1271_debug(DEBUG_CRYPT, "extra spare keys after: %d",
+                     priv->extra_spare_key_count);
 
-        ret = wlcore_set_key(wl, cmd, vif, sta, key_conf);
-        if (ret < 0)
+        if (!change_spare)
                 goto out;
 
         /* key is now set, change the spare blocks */
-        if (cmd == SET_KEY) {
+        if (priv->extra_spare_key_count)
                 ret = wl18xx_set_host_cfg_bitmap(wl,
                                         WL18XX_TX_HW_EXTRA_BLOCK_SPARE);
-                if (ret < 0)
-                        goto out;
-
-                priv->extra_spare_vif_count++;
-        } else {
+        else
                 ret = wl18xx_set_host_cfg_bitmap(wl,
                                         WL18XX_TX_HW_BLOCK_SPARE);
-                if (ret < 0)
-                        goto out;
-
-                priv->extra_spare_vif_count--;
-        }
 
 out:
         return ret;
@@ -1296,6 +1364,92 @@ static u32 wl18xx_pre_pkt_send(struct wl1271 *wl,
         return buf_offset;
 }
 
+static void wl18xx_sta_rc_update(struct wl1271 *wl,
+                                 struct wl12xx_vif *wlvif,
+                                 struct ieee80211_sta *sta,
+                                 u32 changed)
+{
+        bool wide = sta->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+
+        wl1271_debug(DEBUG_MAC80211, "mac80211 sta_rc_update wide %d", wide);
+
+        if (!(changed & IEEE80211_RC_BW_CHANGED))
+                return;
+
+        mutex_lock(&wl->mutex);
+
+        /* sanity */
+        if (WARN_ON(wlvif->bss_type != BSS_TYPE_STA_BSS))
+                goto out;
+
+        /* ignore the change before association */
+        if (!test_bit(WLVIF_FLAG_STA_ASSOCIATED, &wlvif->flags))
+                goto out;
+
+        /*
+         * If we started out as wide, we can change the operation mode. If we
+         * thought this was a 20mhz AP, we have to reconnect
+         */
+        if (wlvif->sta.role_chan_type == NL80211_CHAN_HT40MINUS ||
+            wlvif->sta.role_chan_type == NL80211_CHAN_HT40PLUS)
+                wl18xx_acx_peer_ht_operation_mode(wl, wlvif->sta.hlid, wide);
+        else
+                ieee80211_connection_loss(wl12xx_wlvif_to_vif(wlvif));
+
+out:
+        mutex_unlock(&wl->mutex);
+}
+
+static int wl18xx_set_peer_cap(struct wl1271 *wl,
+                               struct ieee80211_sta_ht_cap *ht_cap,
+                               bool allow_ht_operation,
+                               u32 rate_set, u8 hlid)
+{
+        return wl18xx_acx_set_peer_cap(wl, ht_cap, allow_ht_operation,
+                                       rate_set, hlid);
+}
+
+static bool wl18xx_lnk_high_prio(struct wl1271 *wl, u8 hlid,
+                                 struct wl1271_link *lnk)
+{
+        u8 thold;
+        struct wl18xx_fw_status_priv *status_priv =
+                (struct wl18xx_fw_status_priv *)wl->fw_status_2->priv;
+        u32 suspend_bitmap = le32_to_cpu(status_priv->link_suspend_bitmap);
+
+        /* suspended links are never high priority */
+        if (test_bit(hlid, (unsigned long *)&suspend_bitmap))
+                return false;
+
+        /* the priority thresholds are taken from FW */
+        if (test_bit(hlid, (unsigned long *)&wl->fw_fast_lnk_map) &&
+            !test_bit(hlid, (unsigned long *)&wl->ap_fw_ps_map))
+                thold = status_priv->tx_fast_link_prio_threshold;
+        else
+                thold = status_priv->tx_slow_link_prio_threshold;
+
+        return lnk->allocated_pkts < thold;
+}
+
+static bool wl18xx_lnk_low_prio(struct wl1271 *wl, u8 hlid,
+                                struct wl1271_link *lnk)
+{
+        u8 thold;
+        struct wl18xx_fw_status_priv *status_priv =
+                (struct wl18xx_fw_status_priv *)wl->fw_status_2->priv;
+        u32 suspend_bitmap = le32_to_cpu(status_priv->link_suspend_bitmap);
+
+        if (test_bit(hlid, (unsigned long *)&suspend_bitmap))
+                thold = status_priv->tx_suspend_threshold;
+        else if (test_bit(hlid, (unsigned long *)&wl->fw_fast_lnk_map) &&
+                 !test_bit(hlid, (unsigned long *)&wl->ap_fw_ps_map))
+                thold = status_priv->tx_fast_stop_threshold;
+        else
+                thold = status_priv->tx_slow_stop_threshold;
+
+        return lnk->allocated_pkts < thold;
+}
+
 static int wl18xx_setup(struct wl1271 *wl);
 
 static struct wlcore_ops wl18xx_ops = {
@@ -1305,6 +1459,8 @@ static struct wlcore_ops wl18xx_ops = {
         .plt_init       = wl18xx_plt_init,
         .trigger_cmd    = wl18xx_trigger_cmd,
         .ack_event      = wl18xx_ack_event,
+        .wait_for_event = wl18xx_wait_for_event,
+        .process_mailbox_events = wl18xx_process_mailbox_events,
         .calc_tx_blocks = wl18xx_calc_tx_blocks,
         .set_tx_desc_blocks = wl18xx_set_tx_desc_blocks,
         .set_tx_desc_data_len = wl18xx_set_tx_desc_data_len,
@@ -1320,16 +1476,26 @@ static struct wlcore_ops wl18xx_ops = {
         .ap_get_mimo_wide_rate_mask = wl18xx_ap_get_mimo_wide_rate_mask,
         .get_mac        = wl18xx_get_mac,
         .debugfs_init   = wl18xx_debugfs_add_files,
+        .scan_start     = wl18xx_scan_start,
+        .scan_stop      = wl18xx_scan_stop,
+        .sched_scan_start       = wl18xx_sched_scan_start,
+        .sched_scan_stop        = wl18xx_scan_sched_scan_stop,
         .handle_static_data     = wl18xx_handle_static_data,
         .get_spare_blocks = wl18xx_get_spare_blocks,
         .set_key        = wl18xx_set_key,
+        .channel_switch = wl18xx_cmd_channel_switch,
         .pre_pkt_send   = wl18xx_pre_pkt_send,
+        .sta_rc_update  = wl18xx_sta_rc_update,
+        .set_peer_cap   = wl18xx_set_peer_cap,
+        .lnk_high_prio  = wl18xx_lnk_high_prio,
+        .lnk_low_prio   = wl18xx_lnk_low_prio,
 };
 
 /* HT cap appropriate for wide channels in 2Ghz */
 static struct ieee80211_sta_ht_cap wl18xx_siso40_ht_cap_2ghz = {
         .cap = IEEE80211_HT_CAP_SGI_20 | IEEE80211_HT_CAP_SGI_40 |
-               IEEE80211_HT_CAP_SUP_WIDTH_20_40 | IEEE80211_HT_CAP_DSSSCCK40,
+               IEEE80211_HT_CAP_SUP_WIDTH_20_40 | IEEE80211_HT_CAP_DSSSCCK40 |
+               IEEE80211_HT_CAP_GRN_FLD,
         .ht_supported = true,
         .ampdu_factor = IEEE80211_HT_MAX_AMPDU_16K,
         .ampdu_density = IEEE80211_HT_MPDU_DENSITY_16,
@@ -1343,7 +1509,8 @@ static struct ieee80211_sta_ht_cap wl18xx_siso40_ht_cap_2ghz = {
 /* HT cap appropriate for wide channels in 5Ghz */
 static struct ieee80211_sta_ht_cap wl18xx_siso40_ht_cap_5ghz = {
         .cap = IEEE80211_HT_CAP_SGI_20 | IEEE80211_HT_CAP_SGI_40 |
-               IEEE80211_HT_CAP_SUP_WIDTH_20_40,
+               IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
+               IEEE80211_HT_CAP_GRN_FLD,
         .ht_supported = true,
         .ampdu_factor = IEEE80211_HT_MAX_AMPDU_16K,
         .ampdu_density = IEEE80211_HT_MPDU_DENSITY_16,
@@ -1356,7 +1523,8 @@ static struct ieee80211_sta_ht_cap wl18xx_siso40_ht_cap_5ghz = {
 
 /* HT cap appropriate for SISO 20 */
 static struct ieee80211_sta_ht_cap wl18xx_siso20_ht_cap = {
-        .cap = IEEE80211_HT_CAP_SGI_20,
+        .cap = IEEE80211_HT_CAP_SGI_20 |
+               IEEE80211_HT_CAP_GRN_FLD,
         .ht_supported = true,
         .ampdu_factor = IEEE80211_HT_MAX_AMPDU_16K,
         .ampdu_density = IEEE80211_HT_MPDU_DENSITY_16,
@@ -1369,7 +1537,8 @@ static struct ieee80211_sta_ht_cap wl18xx_siso20_ht_cap = {
 
 /* HT cap appropriate for MIMO rates in 20mhz channel */
 static struct ieee80211_sta_ht_cap wl18xx_mimo_ht_cap_2ghz = {
-        .cap = IEEE80211_HT_CAP_SGI_20,
+        .cap = IEEE80211_HT_CAP_SGI_20 |
+               IEEE80211_HT_CAP_GRN_FLD,
         .ht_supported = true,
         .ampdu_factor = IEEE80211_HT_MAX_AMPDU_16K,
         .ampdu_density = IEEE80211_HT_MPDU_DENSITY_16,
@@ -1387,7 +1556,8 @@ static int wl18xx_setup(struct wl1271 *wl)
 
         wl->rtable = wl18xx_rtable;
         wl->num_tx_desc = WL18XX_NUM_TX_DESCRIPTORS;
-        wl->num_rx_desc = WL18XX_NUM_TX_DESCRIPTORS;
+        wl->num_rx_desc = WL18XX_NUM_RX_DESCRIPTORS;
+        wl->num_channels = 2;
         wl->num_mac_addr = WL18XX_NUM_MAC_ADDRESSES;
         wl->band_rate_to_idx = wl18xx_band_rate_to_idx;
         wl->hw_tx_rate_tbl_size = WL18XX_CONF_HW_RXTX_RATE_MAX;
@@ -1506,7 +1676,8 @@ static int wl18xx_probe(struct platform_device *pdev)
         int ret;
 
         hw = wlcore_alloc_hw(sizeof(struct wl18xx_priv),
-                             WL18XX_AGGR_BUFFER_SIZE);
+                             WL18XX_AGGR_BUFFER_SIZE,
+                             sizeof(struct wl18xx_event_mailbox));
         if (IS_ERR(hw)) {
                 wl1271_error("can't allocate hw");
                 ret = PTR_ERR(hw);
diff --git a/drivers/net/wireless/ti/wl18xx/scan.c b/drivers/net/wireless/ti/wl18xx/scan.c
new file mode 100644
index 000000000000..09d944505ac0
--- /dev/null
+++ b/drivers/net/wireless/ti/wl18xx/scan.c
@@ -0,0 +1,326 @@
+/*
+ * This file is part of wl18xx
+ *
+ * Copyright (C) 2012 Texas Instruments. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#include <linux/ieee80211.h>
+#include "scan.h"
+#include "../wlcore/debug.h"
+
+static void wl18xx_adjust_channels(struct wl18xx_cmd_scan_params *cmd,
+                                   struct wlcore_scan_channels *cmd_channels)
+{
+        memcpy(cmd->passive, cmd_channels->passive, sizeof(cmd->passive));
+        memcpy(cmd->active, cmd_channels->active, sizeof(cmd->active));
+        cmd->dfs = cmd_channels->dfs;
+        cmd->passive_active = cmd_channels->passive_active;
+
+        memcpy(cmd->channels_2, cmd_channels->channels_2,
+               sizeof(cmd->channels_2));
+        memcpy(cmd->channels_5, cmd_channels->channels_5,
+               sizeof(cmd->channels_2));
+        /* channels_4 are not supported, so no need to copy them */
+}
+
+static int wl18xx_scan_send(struct wl1271 *wl, struct wl12xx_vif *wlvif,
+                            struct cfg80211_scan_request *req)
+{
+        struct wl18xx_cmd_scan_params *cmd;
+        struct wlcore_scan_channels *cmd_channels = NULL;
+        int ret;
+
+        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+        if (!cmd) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        cmd->role_id = wlvif->role_id;
+
+        if (WARN_ON(cmd->role_id == WL12XX_INVALID_ROLE_ID)) {
+                ret = -EINVAL;
+                goto out;
+        }
+
+        cmd->scan_type = SCAN_TYPE_SEARCH;
+        cmd->rssi_threshold = -127;
+        cmd->snr_threshold = 0;
+
+        cmd->bss_type = SCAN_BSS_TYPE_ANY;
+
+        cmd->ssid_from_list = 0;
+        cmd->filter = 0;
+        cmd->add_broadcast = 0;
+
+        cmd->urgency = 0;
+        cmd->protect = 0;
+
+        cmd->n_probe_reqs = wl->conf.scan.num_probe_reqs;
+        cmd->terminate_after = 0;
+
+        /* configure channels */
+        WARN_ON(req->n_ssids > 1);
+
+        cmd_channels = kzalloc(sizeof(*cmd_channels), GFP_KERNEL);
+        if (!cmd_channels) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        wlcore_set_scan_chan_params(wl, cmd_channels, req->channels,
+                                    req->n_channels, req->n_ssids,
+                                    SCAN_TYPE_SEARCH);
+        wl18xx_adjust_channels(cmd, cmd_channels);
+
+        /*
+         * all the cycles params (except total cycles) should
+         * remain 0 for normal scan
+         */
+        cmd->total_cycles = 1;
+
+        if (req->no_cck)
+                cmd->rate = WL18XX_SCAN_RATE_6;
+
+        cmd->tag = WL1271_SCAN_DEFAULT_TAG;
+
+        if (req->n_ssids) {
+                cmd->ssid_len = req->ssids[0].ssid_len;
+                memcpy(cmd->ssid, req->ssids[0].ssid, cmd->ssid_len);
+        }
+
+        /* TODO: per-band ies? */
+        if (cmd->active[0]) {
+                u8 band = IEEE80211_BAND_2GHZ;
+                ret = wl12xx_cmd_build_probe_req(wl, wlvif,
+                                 cmd->role_id, band,
+                                 req->ssids ? req->ssids[0].ssid : NULL,
+                                 req->ssids ? req->ssids[0].ssid_len : 0,
+                                 req->ie,
+                                 req->ie_len,
+                                 false);
+                if (ret < 0) {
+                        wl1271_error("2.4GHz PROBE request template failed");
+                        goto out;
+                }
+        }
+
+        if (cmd->active[1] || cmd->dfs) {
+                u8 band = IEEE80211_BAND_5GHZ;
+                ret = wl12xx_cmd_build_probe_req(wl, wlvif,
+                                 cmd->role_id, band,
+                                 req->ssids ? req->ssids[0].ssid : NULL,
+                                 req->ssids ? req->ssids[0].ssid_len : 0,
+                                 req->ie,
+                                 req->ie_len,
+                                 false);
+                if (ret < 0) {
+                        wl1271_error("5GHz PROBE request template failed");
+                        goto out;
+                }
+        }
+
+        wl1271_dump(DEBUG_SCAN, "SCAN: ", cmd, sizeof(*cmd));
+
+        ret = wl1271_cmd_send(wl, CMD_SCAN, cmd, sizeof(*cmd), 0);
+        if (ret < 0) {
+                wl1271_error("SCAN failed");
+                goto out;
+        }
+
+out:
+        kfree(cmd_channels);
+        kfree(cmd);
+        return ret;
+}
+
+void wl18xx_scan_completed(struct wl1271 *wl, struct wl12xx_vif *wlvif)
+{
+        wl->scan.failed = false;
+        cancel_delayed_work(&wl->scan_complete_work);
+        ieee80211_queue_delayed_work(wl->hw, &wl->scan_complete_work,
+                                     msecs_to_jiffies(0));
+}
+
+static
+int wl18xx_scan_sched_scan_config(struct wl1271 *wl,
+                                  struct wl12xx_vif *wlvif,
+                                  struct cfg80211_sched_scan_request *req,
+                                  struct ieee80211_sched_scan_ies *ies)
+{
+        struct wl18xx_cmd_scan_params *cmd;
+        struct wlcore_scan_channels *cmd_channels = NULL;
+        struct conf_sched_scan_settings *c = &wl->conf.sched_scan;
+        int ret;
+        int filter_type;
+
+        wl1271_debug(DEBUG_CMD, "cmd sched_scan scan config");
+
+        filter_type = wlcore_scan_sched_scan_ssid_list(wl, wlvif, req);
+        if (filter_type < 0)
+                return filter_type;
+
+        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+        if (!cmd) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        cmd->role_id = wlvif->role_id;
+
+        if (WARN_ON(cmd->role_id == WL12XX_INVALID_ROLE_ID)) {
+                ret = -EINVAL;
+                goto out;
+        }
+
+        cmd->scan_type = SCAN_TYPE_PERIODIC;
+        cmd->rssi_threshold = c->rssi_threshold;
+        cmd->snr_threshold = c->snr_threshold;
+
+        /* don't filter on BSS type */
+        cmd->bss_type = SCAN_BSS_TYPE_ANY;
+
+        cmd->ssid_from_list = 1;
+        if (filter_type == SCAN_SSID_FILTER_LIST)
+                cmd->filter = 1;
+        cmd->add_broadcast = 0;
+
+        cmd->urgency = 0;
+        cmd->protect = 0;
+
+        cmd->n_probe_reqs = c->num_probe_reqs;
+        /* don't stop scanning automatically when something is found */
+        cmd->terminate_after = 0;
+
+        cmd_channels = kzalloc(sizeof(*cmd_channels), GFP_KERNEL);
+        if (!cmd_channels) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        /* configure channels */
+        wlcore_set_scan_chan_params(wl, cmd_channels, req->channels,
+                                    req->n_channels, req->n_ssids,
+                                    SCAN_TYPE_PERIODIC);
+        wl18xx_adjust_channels(cmd, cmd_channels);
+
+        cmd->short_cycles_sec = 0;
+        cmd->long_cycles_sec = cpu_to_le16(req->interval);
+        cmd->short_cycles_count = 0;
+
+        cmd->total_cycles = 0;
+
+        cmd->tag = WL1271_SCAN_DEFAULT_TAG;
+
+        /* create a PERIODIC_SCAN_REPORT_EVENT whenever we've got a match */
+        cmd->report_threshold = 1;
+        cmd->terminate_on_report = 0;
+
+        if (cmd->active[0]) {
+                u8 band = IEEE80211_BAND_2GHZ;
+                ret = wl12xx_cmd_build_probe_req(wl, wlvif,
+                                 cmd->role_id, band,
+                                 req->ssids ? req->ssids[0].ssid : NULL,
+                                 req->ssids ? req->ssids[0].ssid_len : 0,
+                                 ies->ie[band],
+                                 ies->len[band],
+                                 true);
+                if (ret < 0) {
+                        wl1271_error("2.4GHz PROBE request template failed");
+                        goto out;
+                }
+        }
+
+        if (cmd->active[1] || cmd->dfs) {
+                u8 band = IEEE80211_BAND_5GHZ;
+                ret = wl12xx_cmd_build_probe_req(wl, wlvif,
+                                 cmd->role_id, band,
+                                 req->ssids ? req->ssids[0].ssid : NULL,
+                                 req->ssids ? req->ssids[0].ssid_len : 0,
+                                 ies->ie[band],
+                                 ies->len[band],
+                                 true);
+                if (ret < 0) {
+                        wl1271_error("5GHz PROBE request template failed");
+                        goto out;
+                }
+        }
+
+        wl1271_dump(DEBUG_SCAN, "SCAN: ", cmd, sizeof(*cmd));
+
+        ret = wl1271_cmd_send(wl, CMD_SCAN, cmd, sizeof(*cmd), 0);
+        if (ret < 0) {
+                wl1271_error("SCAN failed");
+                goto out;
+        }
+
+out:
+        kfree(cmd_channels);
+        kfree(cmd);
+        return ret;
+}
+
+int wl18xx_sched_scan_start(struct wl1271 *wl, struct wl12xx_vif *wlvif,
+                            struct cfg80211_sched_scan_request *req,
+                            struct ieee80211_sched_scan_ies *ies)
+{
+        return wl18xx_scan_sched_scan_config(wl, wlvif, req, ies);
+}
+
+static int __wl18xx_scan_stop(struct wl1271 *wl, struct wl12xx_vif *wlvif,
+                               u8 scan_type)
+{
+        struct wl18xx_cmd_scan_stop *stop;
+        int ret;
+
+        wl1271_debug(DEBUG_CMD, "cmd periodic scan stop");
+
+        stop = kzalloc(sizeof(*stop), GFP_KERNEL);
+        if (!stop) {
+                wl1271_error("failed to alloc memory to send sched scan stop");
+                return -ENOMEM;
+        }
+
+        stop->role_id = wlvif->role_id;
+        stop->scan_type = scan_type;
+
+        ret = wl1271_cmd_send(wl, CMD_STOP_SCAN, stop, sizeof(*stop), 0);
+        if (ret < 0) {
+                wl1271_error("failed to send sched scan stop command");
+                goto out_free;
+        }
+
+out_free:
+        kfree(stop);
+        return ret;
+}
+
+void wl18xx_scan_sched_scan_stop(struct wl1271 *wl, struct wl12xx_vif *wlvif)
+{
+        __wl18xx_scan_stop(wl, wlvif, SCAN_TYPE_PERIODIC);
+}
+int wl18xx_scan_start(struct wl1271 *wl, struct wl12xx_vif *wlvif,
+                      struct cfg80211_scan_request *req)
+{
+        return wl18xx_scan_send(wl, wlvif, req);
+}
+
+int wl18xx_scan_stop(struct wl1271 *wl, struct wl12xx_vif *wlvif)
+{
+        return __wl18xx_scan_stop(wl, wlvif, SCAN_TYPE_SEARCH);
+}
diff --git a/drivers/net/wireless/ti/wl18xx/scan.h b/drivers/net/wireless/ti/wl18xx/scan.h
new file mode 100644
index 000000000000..eadee42689d1
--- /dev/null
+++ b/drivers/net/wireless/ti/wl18xx/scan.h
@@ -0,0 +1,127 @@
+/*
+ * This file is part of wl18xx
+ *
+ * Copyright (C) 2012 Texas Instruments. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#ifndef __WL18XX_SCAN_H__
+#define __WL18XX_SCAN_H__
+
+#include "../wlcore/wlcore.h"
+#include "../wlcore/cmd.h"
+#include "../wlcore/scan.h"
+
+struct tracking_ch_params {
+        struct conn_scan_ch_params channel;
+
+        __le32 bssid_lsb;
+        __le16 bssid_msb;
+
+        u8 padding[2];
+} __packed;
+
+/* probe request rate */
+enum
+{
+        WL18XX_SCAN_RATE_1      = 0,
+        WL18XX_SCAN_RATE_5_5    = 1,
+        WL18XX_SCAN_RATE_6      = 2,
+};
+
+#define WL18XX_MAX_CHANNELS_5GHZ 32
+
+struct wl18xx_cmd_scan_params {
+        struct wl1271_cmd_header header;
+
+        u8 role_id;
+        u8 scan_type;
+
+        s8 rssi_threshold; /* for filtering (in dBm) */
+        s8 snr_threshold;  /* for filtering (in dB) */
+
+        u8 bss_type;       /* for filtering */
+        u8 ssid_from_list; /* use ssid from configured ssid list */
+        u8 filter;         /* forward only results with matching ssids */
+
+        /*
+         * add broadcast ssid in addition to the configured ssids.
+         * the driver should add dummy entry for it (?).
+         */
+        u8 add_broadcast;
+
+        u8 urgency;
+        u8 protect;      /* ??? */
+        u8 n_probe_reqs;    /* Number of probes requests per channel */
+        u8 terminate_after; /* early terminate scan operation */
+
+        u8 passive[SCAN_MAX_BANDS]; /* number of passive scan channels */
+        u8 active[SCAN_MAX_BANDS];  /* number of active scan channels */
+        u8 dfs;            /* number of dfs channels in 5ghz */
+        u8 passive_active; /* number of passive before active channels 2.4ghz */
+
+        __le16 short_cycles_sec;
+        __le16 long_cycles_sec;
+        u8 short_cycles_count;
+        u8 total_cycles; /* 0 - infinite */
+        u8 padding[2];
+
+        union {
+                struct {
+                        struct conn_scan_ch_params channels_2[MAX_CHANNELS_2GHZ];
+                        struct conn_scan_ch_params channels_5[WL18XX_MAX_CHANNELS_5GHZ];
+                        struct conn_scan_ch_params channels_4[MAX_CHANNELS_4GHZ];
+                };
+                struct tracking_ch_params channels_tracking[WL1271_SCAN_MAX_CHANNELS];
+        } ;
+
+        u8 ssid[IEEE80211_MAX_SSID_LEN];
+        u8 ssid_len;     /* For SCAN_SSID_FILTER_SPECIFIC */
+        u8 tag;
+        u8 rate;
+
+        /* send SCAN_REPORT_EVENT in periodic scans after each cycle
+        * if number of results >= report_threshold. Must be 0 for
+        * non periodic scans
+        */
+        u8 report_threshold;
+
+        /* Should periodic scan stop after a report event was created.
+        * Must be 0 for non periodic scans.
+        */
+        u8 terminate_on_report;
+
+        u8 padding1[3];
+} __packed;
+
+struct wl18xx_cmd_scan_stop {
+        struct wl1271_cmd_header header;
+
+        u8 role_id;
+        u8 scan_type;
+        u8 padding[2];
+} __packed;
+
+int wl18xx_scan_start(struct wl1271 *wl, struct wl12xx_vif *wlvif,
+                      struct cfg80211_scan_request *req);
+int wl18xx_scan_stop(struct wl1271 *wl, struct wl12xx_vif *wlvif);
+void wl18xx_scan_completed(struct wl1271 *wl, struct wl12xx_vif *wlvif);
+int wl18xx_sched_scan_start(struct wl1271 *wl, struct wl12xx_vif *wlvif,
+                            struct cfg80211_sched_scan_request *req,
+                            struct ieee80211_sched_scan_ies *ies);
+void wl18xx_scan_sched_scan_stop(struct wl1271 *wl, struct wl12xx_vif *wlvif);
+#endif
diff --git a/drivers/net/wireless/ti/wl18xx/tx.c b/drivers/net/wireless/ti/wl18xx/tx.c
index 5b1fb10d9fd7..57c694396647 100644
--- a/drivers/net/wireless/ti/wl18xx/tx.c
+++ b/drivers/net/wireless/ti/wl18xx/tx.c
@@ -28,6 +28,49 @@
 #include "wl18xx.h"
 #include "tx.h"
 
+static
+void wl18xx_get_last_tx_rate(struct wl1271 *wl, struct ieee80211_vif *vif,
+                             struct ieee80211_tx_rate *rate)
+{
+        u8 fw_rate = wl->fw_status_2->counters.tx_last_rate;
+
+        if (fw_rate > CONF_HW_RATE_INDEX_MAX) {
+                wl1271_error("last Tx rate invalid: %d", fw_rate);
+                rate->idx = 0;
+                rate->flags = 0;
+                return;
+        }
+
+        if (fw_rate <= CONF_HW_RATE_INDEX_54MBPS) {
+                rate->idx = fw_rate;
+                rate->flags = 0;
+        } else {
+                rate->flags = IEEE80211_TX_RC_MCS;
+                rate->idx = fw_rate - CONF_HW_RATE_INDEX_MCS0;
+
+                /* SGI modifier is counted as a separate rate */
+                if (fw_rate >= CONF_HW_RATE_INDEX_MCS7_SGI)
+                        (rate->idx)--;
+                if (fw_rate == CONF_HW_RATE_INDEX_MCS15_SGI)
+                        (rate->idx)--;
+
+                /* this also covers the 40Mhz SGI case (= MCS15) */
+                if (fw_rate == CONF_HW_RATE_INDEX_MCS7_SGI ||
+                    fw_rate == CONF_HW_RATE_INDEX_MCS15_SGI)
+                        rate->flags |= IEEE80211_TX_RC_SHORT_GI;
+
+                if (fw_rate > CONF_HW_RATE_INDEX_MCS7_SGI && vif) {
+                        struct wl12xx_vif *wlvif = wl12xx_vif_to_data(vif);
+                        if (wlvif->channel_type == NL80211_CHAN_HT40MINUS ||
+                            wlvif->channel_type == NL80211_CHAN_HT40PLUS) {
+                                /* adjustment needed for range 0-7 */
+                                rate->idx -= 8;
+                                rate->flags |= IEEE80211_TX_RC_40_MHZ_WIDTH;
+                        }
+                }
+        }
+}
+
 static void wl18xx_tx_complete_packet(struct wl1271 *wl, u8 tx_stat_byte)
 {
         struct ieee80211_tx_info *info;
@@ -44,7 +87,6 @@ static void wl18xx_tx_complete_packet(struct wl1271 *wl, u8 tx_stat_byte)
         /* a zero bit indicates Tx success */
         tx_success = !(tx_stat_byte & BIT(WL18XX_TX_STATUS_STAT_BIT_IDX));
 
-
         skb = wl->tx_frames[id];
         info = IEEE80211_SKB_CB(skb);
 
@@ -56,11 +98,13 @@ static void wl18xx_tx_complete_packet(struct wl1271 *wl, u8 tx_stat_byte)
         /* update the TX status info */
         if (tx_success && !(info->flags & IEEE80211_TX_CTL_NO_ACK))
                 info->flags |= IEEE80211_TX_STAT_ACK;
+        /*
+         * first pass info->control.vif while it's valid, and then fill out
+         * the info->status structures
+         */
+        wl18xx_get_last_tx_rate(wl, info->control.vif, &info->status.rates[0]);
 
-        /* no real data about Tx completion */
-        info->status.rates[0].idx = -1;
-        info->status.rates[0].count = 0;
-        info->status.rates[0].flags = 0;
+        info->status.rates[0].count = 1; /* no data about retries */
         info->status.ack_signal = -1;
 
         if (!tx_success)
diff --git a/drivers/net/wireless/ti/wl18xx/wl18xx.h b/drivers/net/wireless/ti/wl18xx/wl18xx.h
index 96a1e438d677..b6739e79efcf 100644
--- a/drivers/net/wireless/ti/wl18xx/wl18xx.h
+++ b/drivers/net/wireless/ti/wl18xx/wl18xx.h
@@ -26,10 +26,10 @@
 
 /* minimum FW required for driver */
 #define WL18XX_CHIP_VER         8
-#define WL18XX_IFTYPE_VER       2
-#define WL18XX_MAJOR_VER        0
-#define WL18XX_SUBTYPE_VER      0
-#define WL18XX_MINOR_VER        100
+#define WL18XX_IFTYPE_VER       5
+#define WL18XX_MAJOR_VER        WLCORE_FW_VER_IGNORE
+#define WL18XX_SUBTYPE_VER      WLCORE_FW_VER_IGNORE
+#define WL18XX_MINOR_VER        28
 
 #define WL18XX_CMD_MAX_SIZE          740
 
@@ -49,8 +49,8 @@ struct wl18xx_priv {
         /* Index of last released Tx desc in FW */
         u8 last_fw_rls_idx;
 
-        /* number of VIFs requiring extra spare mem-blocks */
-        int extra_spare_vif_count;
+        /* number of keys requiring extra spare mem-blocks */
+        int extra_spare_key_count;
 };
 
 #define WL18XX_FW_MAX_TX_STATUS_DESC 33
@@ -68,7 +68,43 @@ struct wl18xx_fw_status_priv {
          */
         u8 released_tx_desc[WL18XX_FW_MAX_TX_STATUS_DESC];
 
-        u8 padding[2];
+        /* A bitmap representing the currently suspended links. The suspend
+         * is short lived, for multi-channel Tx requirements.
+         */
+        __le32 link_suspend_bitmap;
+
+        /* packet threshold for an "almost empty" AC,
+         * for Tx schedulng purposes
+         */
+        u8 tx_ac_threshold;
+
+        /* number of packets to queue up for a link in PS */
+        u8 tx_ps_threshold;
+
+        /* number of packet to queue up for a suspended link */
+        u8 tx_suspend_threshold;
+
+        /* Should have less than this number of packets in queue of a slow
+         * link to qualify as high priority link
+         */
+        u8 tx_slow_link_prio_threshold;
+
+        /* Should have less than this number of packets in queue of a fast
+         * link to qualify as high priority link
+         */
+        u8 tx_fast_link_prio_threshold;
+
+        /* Should have less than this number of packets in queue of a slow
+         * link before we stop queuing up packets for it.
+         */
+        u8 tx_slow_stop_threshold;
+
+        /* Should have less than this number of packets in queue of a fast
+         * link before we stop queuing up packets for it.
+         */
+        u8 tx_fast_stop_threshold;
+
+        u8 padding[3];
 };
 
 #define WL18XX_PHY_VERSION_MAX_LEN 20
diff --git a/drivers/net/wireless/ti/wlcore/acx.c b/drivers/net/wireless/ti/wlcore/acx.c
index ce108a736bd0..c79654323396 100644
--- a/drivers/net/wireless/ti/wlcore/acx.c
+++ b/drivers/net/wireless/ti/wlcore/acx.c
@@ -1340,6 +1340,8 @@ out:
         kfree(acx);
         return ret;
 }
+EXPORT_SYMBOL_GPL(wl1271_acx_set_ht_capabilities);
+
 
 int wl1271_acx_set_ht_information(struct wl1271 *wl,
                                    struct wl12xx_vif *wlvif,
@@ -1433,13 +1435,22 @@ int wl12xx_acx_set_ba_receiver_session(struct wl1271 *wl, u8 tid_index,
         acx->win_size = wl->conf.ht.rx_ba_win_size;
         acx->ssn = ssn;
 
-        ret = wl1271_cmd_configure(wl, ACX_BA_SESSION_RX_SETUP, acx,
-                                   sizeof(*acx));
+        ret = wlcore_cmd_configure_failsafe(wl, ACX_BA_SESSION_RX_SETUP, acx,
+                                            sizeof(*acx),
+                                            BIT(CMD_STATUS_NO_RX_BA_SESSION));
         if (ret < 0) {
                 wl1271_warning("acx ba receiver session failed: %d", ret);
                 goto out;
         }
 
+        /* sometimes we can't start the session */
+        if (ret == CMD_STATUS_NO_RX_BA_SESSION) {
+                wl1271_warning("no fw rx ba on tid %d", tid_index);
+                ret = -EBUSY;
+                goto out;
+        }
+
+        ret = 0;
 out:
         kfree(acx);
         return ret;
diff --git a/drivers/net/wireless/ti/wlcore/acx.h b/drivers/net/wireless/ti/wlcore/acx.h
index d03215d6b3bd..126536c6a393 100644
--- a/drivers/net/wireless/ti/wlcore/acx.h
+++ b/drivers/net/wireless/ti/wlcore/acx.h
@@ -1025,7 +1025,6 @@ enum {
         ACX_CONFIG_HANGOVER              = 0x0042,
         ACX_FEATURE_CFG                  = 0x0043,
         ACX_PROTECTION_CFG               = 0x0044,
-        ACX_CHECKSUM_CONFIG              = 0x0045,
 };
 
 
diff --git a/drivers/net/wireless/ti/wlcore/boot.c b/drivers/net/wireless/ti/wlcore/boot.c
index 375ea574eafb..b58ae5fc1487 100644
--- a/drivers/net/wireless/ti/wlcore/boot.c
+++ b/drivers/net/wireless/ti/wlcore/boot.c
@@ -84,47 +84,57 @@ out:
 static int wlcore_validate_fw_ver(struct wl1271 *wl)
 {
         unsigned int *fw_ver = wl->chip.fw_ver;
-        unsigned int *min_ver = wl->min_fw_ver;
+        unsigned int *min_ver = (wl->fw_type == WL12XX_FW_TYPE_NORMAL) ?
+                wl->min_sr_fw_ver : wl->min_mr_fw_ver;
+        char min_fw_str[32] = "";
+        int i;
 
         /* the chip must be exactly equal */
-        if (min_ver[FW_VER_CHIP] != fw_ver[FW_VER_CHIP])
+        if ((min_ver[FW_VER_CHIP] != WLCORE_FW_VER_IGNORE) &&
+            (min_ver[FW_VER_CHIP] != fw_ver[FW_VER_CHIP]))
                 goto fail;
 
-        /* always check the next digit if all previous ones are equal */
-
-        if (min_ver[FW_VER_IF_TYPE] < fw_ver[FW_VER_IF_TYPE])
-                goto out;
-        else if (min_ver[FW_VER_IF_TYPE] > fw_ver[FW_VER_IF_TYPE])
+        /* the firmware type must be equal */
+        if ((min_ver[FW_VER_IF_TYPE] != WLCORE_FW_VER_IGNORE) &&
+            (min_ver[FW_VER_IF_TYPE] != fw_ver[FW_VER_IF_TYPE]))
                 goto fail;
 
-        if (min_ver[FW_VER_MAJOR] < fw_ver[FW_VER_MAJOR])
-                goto out;
-        else if (min_ver[FW_VER_MAJOR] > fw_ver[FW_VER_MAJOR])
+        /* the project number must be equal */
+        if ((min_ver[FW_VER_SUBTYPE] != WLCORE_FW_VER_IGNORE) &&
+            (min_ver[FW_VER_SUBTYPE] != fw_ver[FW_VER_SUBTYPE]))
                 goto fail;
 
-        if (min_ver[FW_VER_SUBTYPE] < fw_ver[FW_VER_SUBTYPE])
-                goto out;
-        else if (min_ver[FW_VER_SUBTYPE] > fw_ver[FW_VER_SUBTYPE])
+        /* the API version must be greater or equal */
+        if ((min_ver[FW_VER_MAJOR] != WLCORE_FW_VER_IGNORE) &&
+                 (min_ver[FW_VER_MAJOR] > fw_ver[FW_VER_MAJOR]))
                 goto fail;
 
-        if (min_ver[FW_VER_MINOR] < fw_ver[FW_VER_MINOR])
-                goto out;
-        else if (min_ver[FW_VER_MINOR] > fw_ver[FW_VER_MINOR])
+        /* if the API version is equal... */
+        if (((min_ver[FW_VER_MAJOR] == WLCORE_FW_VER_IGNORE) ||
+             (min_ver[FW_VER_MAJOR] == fw_ver[FW_VER_MAJOR])) &&
+            /* ...the minor must be greater or equal */
+            ((min_ver[FW_VER_MINOR] != WLCORE_FW_VER_IGNORE) &&
+             (min_ver[FW_VER_MINOR] > fw_ver[FW_VER_MINOR])))
                 goto fail;
 
-out:
         return 0;
 
 fail:
-        wl1271_error("Your WiFi FW version (%u.%u.%u.%u.%u) is outdated.\n"
-                     "Please use at least FW %u.%u.%u.%u.%u.\n"
-                     "You can get more information at:\n"
-                     "http://wireless.kernel.org/en/users/Drivers/wl12xx",
+        for (i = 0; i < NUM_FW_VER; i++)
+                if (min_ver[i] == WLCORE_FW_VER_IGNORE)
+                        snprintf(min_fw_str, sizeof(min_fw_str),
+                                  "%s*.", min_fw_str);
+                else
+                        snprintf(min_fw_str, sizeof(min_fw_str),
+                                  "%s%u.", min_fw_str, min_ver[i]);
+
+        wl1271_error("Your WiFi FW version (%u.%u.%u.%u.%u) is invalid.\n"
+                     "Please use at least FW %s\n"
+                     "You can get the latest firmwares at:\n"
+                     "git://github.com/TI-OpenLink/firmwares.git",
                      fw_ver[FW_VER_CHIP], fw_ver[FW_VER_IF_TYPE],
                      fw_ver[FW_VER_MAJOR], fw_ver[FW_VER_SUBTYPE],
-                     fw_ver[FW_VER_MINOR], min_ver[FW_VER_CHIP],
-                     min_ver[FW_VER_IF_TYPE], min_ver[FW_VER_MAJOR],
-                     min_ver[FW_VER_SUBTYPE], min_ver[FW_VER_MINOR]);
+                     fw_ver[FW_VER_MINOR], min_fw_str);
         return -EINVAL;
 }
 
@@ -491,7 +501,7 @@ int wlcore_boot_run_firmware(struct wl1271 *wl)
         if (ret < 0)
                 return ret;
 
-        wl->mbox_ptr[1] = wl->mbox_ptr[0] + sizeof(struct event_mailbox);
+        wl->mbox_ptr[1] = wl->mbox_ptr[0] + wl->mbox_size;
 
         wl1271_debug(DEBUG_MAILBOX, "MBOX ptrs: 0x%x 0x%x",
                      wl->mbox_ptr[0], wl->mbox_ptr[1]);
@@ -508,23 +518,6 @@ int wlcore_boot_run_firmware(struct wl1271 *wl)
          */
 
         /* unmask required mbox events  */
-        wl->event_mask = BSS_LOSE_EVENT_ID |
-                REGAINED_BSS_EVENT_ID |
-                SCAN_COMPLETE_EVENT_ID |
-                ROLE_STOP_COMPLETE_EVENT_ID |
-                RSSI_SNR_TRIGGER_0_EVENT_ID |
-                PSPOLL_DELIVERY_FAILURE_EVENT_ID |
-                SOFT_GEMINI_SENSE_EVENT_ID |
-                PERIODIC_SCAN_REPORT_EVENT_ID |
-                PERIODIC_SCAN_COMPLETE_EVENT_ID |
-                DUMMY_PACKET_EVENT_ID |
-                PEER_REMOVE_COMPLETE_EVENT_ID |
-                BA_SESSION_RX_CONSTRAINT_EVENT_ID |
-                REMAIN_ON_CHANNEL_COMPLETE_EVENT_ID |
-                INACTIVE_STA_EVENT_ID |
-                MAX_TX_RETRY_EVENT_ID |
-                CHANNEL_SWITCH_COMPLETE_EVENT_ID;
-
         ret = wl1271_event_unmask(wl);
         if (ret < 0) {
                 wl1271_error("EVENT mask setting failed");
diff --git a/drivers/net/wireless/ti/wlcore/cmd.c b/drivers/net/wireless/ti/wlcore/cmd.c
index 27f83f72a93b..1201aca9c89a 100644
--- a/drivers/net/wireless/ti/wlcore/cmd.c
+++ b/drivers/net/wireless/ti/wlcore/cmd.c
@@ -48,14 +48,15 @@
  * @id: command id
  * @buf: buffer containing the command, must work with dma
  * @len: length of the buffer
+ * return the cmd status code on success.
  */
-int wl1271_cmd_send(struct wl1271 *wl, u16 id, void *buf, size_t len,
-                    size_t res_len)
+static int __wlcore_cmd_send(struct wl1271 *wl, u16 id, void *buf,
+                             size_t len, size_t res_len)
 {
         struct wl1271_cmd_header *cmd;
         unsigned long timeout;
         u32 intr;
-        int ret = 0;
+        int ret;
         u16 status;
         u16 poll_count = 0;
 
@@ -71,7 +72,7 @@ int wl1271_cmd_send(struct wl1271 *wl, u16 id, void *buf, size_t len,
 
         ret = wlcore_write(wl, wl->cmd_box_addr, buf, len, false);
         if (ret < 0)
-                goto fail;
+                return ret;
 
         /*
          * TODO: we just need this because one bit is in a different
@@ -79,19 +80,18 @@ int wl1271_cmd_send(struct wl1271 *wl, u16 id, void *buf, size_t len,
          */
         ret = wl->ops->trigger_cmd(wl, wl->cmd_box_addr, buf, len);
         if (ret < 0)
-                goto fail;
+                return ret;
 
         timeout = jiffies + msecs_to_jiffies(WL1271_COMMAND_TIMEOUT);
 
         ret = wlcore_read_reg(wl, REG_INTERRUPT_NO_CLEAR, &intr);
         if (ret < 0)
-                goto fail;
+                return ret;
 
         while (!(intr & WL1271_ACX_INTR_CMD_COMPLETE)) {
                 if (time_after(jiffies, timeout)) {
                         wl1271_error("command complete timeout");
-                        ret = -ETIMEDOUT;
-                        goto fail;
+                        return -ETIMEDOUT;
                 }
 
                 poll_count++;
@@ -102,7 +102,7 @@ int wl1271_cmd_send(struct wl1271 *wl, u16 id, void *buf, size_t len,
 
                 ret = wlcore_read_reg(wl, REG_INTERRUPT_NO_CLEAR, &intr);
                 if (ret < 0)
-                        goto fail;
+                        return ret;
         }
 
         /* read back the status code of the command */
@@ -111,33 +111,66 @@ int wl1271_cmd_send(struct wl1271 *wl, u16 id, void *buf, size_t len,
 
         ret = wlcore_read(wl, wl->cmd_box_addr, cmd, res_len, false);
         if (ret < 0)
-                goto fail;
+                return ret;
 
         status = le16_to_cpu(cmd->status);
-        if (status != CMD_STATUS_SUCCESS) {
-                wl1271_error("command execute failure %d", status);
-                ret = -EIO;
-                goto fail;
-        }
 
         ret = wlcore_write_reg(wl, REG_INTERRUPT_ACK,
                                WL1271_ACX_INTR_CMD_COMPLETE);
         if (ret < 0)
+                return ret;
+
+        return status;
+}
+
+/*
+ * send command to fw and return cmd status on success
+ * valid_rets contains a bitmap of allowed error codes
+ */
+int wlcore_cmd_send_failsafe(struct wl1271 *wl, u16 id, void *buf, size_t len,
+                             size_t res_len, unsigned long valid_rets)
+{
+        int ret = __wlcore_cmd_send(wl, id, buf, len, res_len);
+
+        if (ret < 0)
                 goto fail;
 
-        return 0;
+        /* success is always a valid status */
+        valid_rets |= BIT(CMD_STATUS_SUCCESS);
 
+        if (ret >= MAX_COMMAND_STATUS ||
+            !test_bit(ret, &valid_rets)) {
+                wl1271_error("command execute failure %d", ret);
+                ret = -EIO;
+                goto fail;
+        }
+        return ret;
 fail:
         wl12xx_queue_recovery_work(wl);
         return ret;
 }
+EXPORT_SYMBOL_GPL(wl1271_cmd_send);
+
+/*
+ * wrapper for wlcore_cmd_send that accept only CMD_STATUS_SUCCESS
+ * return 0 on success.
+ */
+int wl1271_cmd_send(struct wl1271 *wl, u16 id, void *buf, size_t len,
+                    size_t res_len)
+{
+        int ret = wlcore_cmd_send_failsafe(wl, id, buf, len, res_len, 0);
+
+        if (ret < 0)
+                return ret;
+        return 0;
+}
 
 /*
  * Poll the mailbox event field until any of the bits in the mask is set or a
  * timeout occurs (WL1271_EVENT_TIMEOUT in msecs)
  */
-static int wl1271_cmd_wait_for_event_or_timeout(struct wl1271 *wl,
-                                                u32 mask, bool *timeout)
+int wlcore_cmd_wait_for_event_or_timeout(struct wl1271 *wl,
+                                         u32 mask, bool *timeout)
 {
         u32 *events_vector;
         u32 event;
@@ -187,20 +220,7 @@ out:
         kfree(events_vector);
         return ret;
 }
-
-static int wl1271_cmd_wait_for_event(struct wl1271 *wl, u32 mask)
-{
-        int ret;
-        bool timeout = false;
-
-        ret = wl1271_cmd_wait_for_event_or_timeout(wl, mask, &timeout);
-        if (ret != 0 || timeout) {
-                wl12xx_queue_recovery_work(wl);
-                return ret;
-        }
-
-        return 0;
-}
+EXPORT_SYMBOL_GPL(wlcore_cmd_wait_for_event_or_timeout);
 
 int wl12xx_cmd_role_enable(struct wl1271 *wl, u8 *addr, u8 role_type,
                            u8 *role_id)
@@ -278,6 +298,16 @@ out:
         return ret;
 }
 
+static int wlcore_get_new_session_id(struct wl1271 *wl, u8 hlid)
+{
+        if (wl->session_ids[hlid] >= SESSION_COUNTER_MAX)
+                wl->session_ids[hlid] = 0;
+
+        wl->session_ids[hlid]++;
+
+        return wl->session_ids[hlid];
+}
+
 int wl12xx_allocate_link(struct wl1271 *wl, struct wl12xx_vif *wlvif, u8 *hlid)
 {
         unsigned long flags;
@@ -285,12 +315,21 @@ int wl12xx_allocate_link(struct wl1271 *wl, struct wl12xx_vif *wlvif, u8 *hlid)
         if (link >= WL12XX_MAX_LINKS)
                 return -EBUSY;
 
+        wl->session_ids[link] = wlcore_get_new_session_id(wl, link);
+
         /* these bits are used by op_tx */
         spin_lock_irqsave(&wl->wl_lock, flags);
         __set_bit(link, wl->links_map);
         __set_bit(link, wlvif->links_map);
         spin_unlock_irqrestore(&wl->wl_lock, flags);
+
+        /* take the last "freed packets" value from the current FW status */
+        wl->links[link].prev_freed_pkts =
+                        wl->fw_status_2->counters.tx_lnk_free_pkts[link];
+        wl->links[link].wlvif = wlvif;
         *hlid = link;
+
+        wl->active_link_count++;
         return 0;
 }
 
@@ -307,24 +346,21 @@ void wl12xx_free_link(struct wl1271 *wl, struct wl12xx_vif *wlvif, u8 *hlid)
         __clear_bit(*hlid, wlvif->links_map);
         spin_unlock_irqrestore(&wl->wl_lock, flags);
 
+        wl->links[*hlid].allocated_pkts = 0;
+        wl->links[*hlid].prev_freed_pkts = 0;
+        wl->links[*hlid].ba_bitmap = 0;
+        memset(wl->links[*hlid].addr, 0, ETH_ALEN);
+
         /*
          * At this point op_tx() will not add more packets to the queues. We
          * can purge them.
          */
         wl1271_tx_reset_link_queues(wl, *hlid);
+        wl->links[*hlid].wlvif = NULL;
 
         *hlid = WL12XX_INVALID_LINK_ID;
-}
-
-static int wl12xx_get_new_session_id(struct wl1271 *wl,
-                                     struct wl12xx_vif *wlvif)
-{
-        if (wlvif->session_counter >= SESSION_COUNTER_MAX)
-                wlvif->session_counter = 0;
-
-        wlvif->session_counter++;
-
-        return wlvif->session_counter;
+        wl->active_link_count--;
+        WARN_ON_ONCE(wl->active_link_count < 0);
 }
 
 static u8 wlcore_get_native_channel_type(u8 nl_channel_type)
@@ -345,7 +381,9 @@ static u8 wlcore_get_native_channel_type(u8 nl_channel_type)
 }
 
 static int wl12xx_cmd_role_start_dev(struct wl1271 *wl,
-                                     struct wl12xx_vif *wlvif)
+                                     struct wl12xx_vif *wlvif,
+                                     enum ieee80211_band band,
+                                     int channel)
 {
         struct wl12xx_cmd_role_start *cmd;
         int ret;
@@ -359,9 +397,9 @@ static int wl12xx_cmd_role_start_dev(struct wl1271 *wl,
         wl1271_debug(DEBUG_CMD, "cmd role start dev %d", wlvif->dev_role_id);
 
         cmd->role_id = wlvif->dev_role_id;
-        if (wlvif->band == IEEE80211_BAND_5GHZ)
+        if (band == IEEE80211_BAND_5GHZ)
                 cmd->band = WLCORE_BAND_5GHZ;
-        cmd->channel = wlvif->channel;
+        cmd->channel = channel;
 
         if (wlvif->dev_hlid == WL12XX_INVALID_LINK_ID) {
                 ret = wl12xx_allocate_link(wl, wlvif, &wlvif->dev_hlid);
@@ -369,7 +407,7 @@ static int wl12xx_cmd_role_start_dev(struct wl1271 *wl,
                         goto out_free;
         }
         cmd->device.hlid = wlvif->dev_hlid;
-        cmd->device.session = wl12xx_get_new_session_id(wl, wlvif);
+        cmd->device.session = wl->session_ids[wlvif->dev_hlid];
 
         wl1271_debug(DEBUG_CMD, "role start: roleid=%d, hlid=%d, session=%d",
                      cmd->role_id, cmd->device.hlid, cmd->device.session);
@@ -420,12 +458,6 @@ static int wl12xx_cmd_role_stop_dev(struct wl1271 *wl,
                 goto out_free;
         }
 
-        ret = wl1271_cmd_wait_for_event(wl, ROLE_STOP_COMPLETE_EVENT_ID);
-        if (ret < 0) {
-                wl1271_error("cmd role stop dev event completion error");
-                goto out_free;
-        }
-
         wl12xx_free_link(wl, wlvif, &wlvif->dev_hlid);
 
 out_free:
@@ -439,6 +471,7 @@ int wl12xx_cmd_role_start_sta(struct wl1271 *wl, struct wl12xx_vif *wlvif)
 {
         struct ieee80211_vif *vif = wl12xx_wlvif_to_vif(wlvif);
         struct wl12xx_cmd_role_start *cmd;
+        u32 supported_rates;
         int ret;
 
         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
@@ -459,7 +492,14 @@ int wl12xx_cmd_role_start_sta(struct wl1271 *wl, struct wl12xx_vif *wlvif)
         cmd->sta.ssid_len = wlvif->ssid_len;
         memcpy(cmd->sta.ssid, wlvif->ssid, wlvif->ssid_len);
         memcpy(cmd->sta.bssid, vif->bss_conf.bssid, ETH_ALEN);
-        cmd->sta.local_rates = cpu_to_le32(wlvif->rate_set);
+
+        supported_rates = CONF_TX_ENABLED_RATES | CONF_TX_MCS_RATES |
+                          wlcore_hw_sta_get_ap_rate_mask(wl, wlvif);
+        if (wlvif->p2p)
+                supported_rates &= ~CONF_TX_CCK_RATES;
+
+        cmd->sta.local_rates = cpu_to_le32(supported_rates);
+
         cmd->channel_type = wlcore_get_native_channel_type(wlvif->channel_type);
 
         if (wlvif->sta.hlid == WL12XX_INVALID_LINK_ID) {
@@ -468,7 +508,11 @@ int wl12xx_cmd_role_start_sta(struct wl1271 *wl, struct wl12xx_vif *wlvif)
                         goto out_free;
         }
         cmd->sta.hlid = wlvif->sta.hlid;
-        cmd->sta.session = wl12xx_get_new_session_id(wl, wlvif);
+        cmd->sta.session = wl->session_ids[wlvif->sta.hlid];
+        /*
+         * We don't have the correct remote rates in this stage. the rates
+         * will be reconfigured later, after authorization.
+         */
         cmd->sta.remote_rates = cpu_to_le32(wlvif->rate_set);
 
         wl1271_debug(DEBUG_CMD, "role start: roleid=%d, hlid=%d, session=%d "
@@ -482,6 +526,7 @@ int wl12xx_cmd_role_start_sta(struct wl1271 *wl, struct wl12xx_vif *wlvif)
                 goto err_hlid;
         }
 
+        wlvif->sta.role_chan_type = wlvif->channel_type;
         goto out_free;
 
 err_hlid:
@@ -500,7 +545,6 @@ int wl12xx_cmd_role_stop_sta(struct wl1271 *wl, struct wl12xx_vif *wlvif)
 {
         struct wl12xx_cmd_role_stop *cmd;
         int ret;
-        bool timeout = false;
 
         if (WARN_ON(wlvif->sta.hlid == WL12XX_INVALID_LINK_ID))
                 return -EINVAL;
@@ -523,17 +567,6 @@ int wl12xx_cmd_role_stop_sta(struct wl1271 *wl, struct wl12xx_vif *wlvif)
                 goto out_free;
         }
 
-        /*
-         * Sometimes the firmware doesn't send this event, so we just
-         * time out without failing.  Queue recovery for other
-         * failures.
-         */
-        ret = wl1271_cmd_wait_for_event_or_timeout(wl,
-                                                   ROLE_STOP_COMPLETE_EVENT_ID,
-                                                   &timeout);
-        if (ret)
-                wl12xx_queue_recovery_work(wl);
-
         wl12xx_free_link(wl, wlvif, &wlvif->sta.hlid);
 
 out_free:
@@ -579,12 +612,15 @@ int wl12xx_cmd_role_start_ap(struct wl1271 *wl, struct wl12xx_vif *wlvif)
         cmd->ap.bss_index = WL1271_AP_BSS_INDEX;
         cmd->ap.global_hlid = wlvif->ap.global_hlid;
         cmd->ap.broadcast_hlid = wlvif->ap.bcast_hlid;
+        cmd->ap.global_session_id = wl->session_ids[wlvif->ap.global_hlid];
+        cmd->ap.bcast_session_id = wl->session_ids[wlvif->ap.bcast_hlid];
         cmd->ap.basic_rate_set = cpu_to_le32(wlvif->basic_rate_set);
         cmd->ap.beacon_interval = cpu_to_le16(wlvif->beacon_int);
         cmd->ap.dtim_interval = bss_conf->dtim_period;
         cmd->ap.beacon_expiry = WL1271_AP_DEF_BEACON_EXP;
         /* FIXME: Change when adding DFS */
         cmd->ap.reset_tsf = 1;  /* By default reset AP TSF */
+        cmd->ap.wmm = wlvif->wmm_enabled;
         cmd->channel = wlvif->channel;
         cmd->channel_type = wlcore_get_native_channel_type(wlvif->channel_type);
 
@@ -599,8 +635,10 @@ int wl12xx_cmd_role_start_ap(struct wl1271 *wl, struct wl12xx_vif *wlvif)
                 memcpy(cmd->ap.ssid, bss_conf->ssid, bss_conf->ssid_len);
         }
 
-        supported_rates = CONF_TX_AP_ENABLED_RATES | CONF_TX_MCS_RATES |
+        supported_rates = CONF_TX_ENABLED_RATES | CONF_TX_MCS_RATES |
                 wlcore_hw_ap_get_mimo_wide_rate_mask(wl, wlvif);
+        if (wlvif->p2p)
+                supported_rates &= ~CONF_TX_CCK_RATES;
 
         wl1271_debug(DEBUG_CMD, "cmd role start ap with supported_rates 0x%08x",
                      supported_rates);
@@ -799,8 +837,11 @@ int wl1271_cmd_interrogate(struct wl1271 *wl, u16 id, void *buf, size_t len)
  * @id: acx id
  * @buf: buffer containing acx, including all headers, must work with dma
  * @len: length of buf
+ * @valid_rets: bitmap of valid cmd status codes (i.e. return values).
+ * return the cmd status on success.
  */
-int wl1271_cmd_configure(struct wl1271 *wl, u16 id, void *buf, size_t len)
+int wlcore_cmd_configure_failsafe(struct wl1271 *wl, u16 id, void *buf,
+                                  size_t len, unsigned long valid_rets)
 {
         struct acx_header *acx = buf;
         int ret;
@@ -812,12 +853,26 @@ int wl1271_cmd_configure(struct wl1271 *wl, u16 id, void *buf, size_t len)
         /* payload length, does not include any headers */
         acx->len = cpu_to_le16(len - sizeof(*acx));
 
-        ret = wl1271_cmd_send(wl, CMD_CONFIGURE, acx, len, 0);
+        ret = wlcore_cmd_send_failsafe(wl, CMD_CONFIGURE, acx, len, 0,
+                                       valid_rets);
         if (ret < 0) {
                 wl1271_warning("CONFIGURE command NOK");
                 return ret;
         }
 
+        return ret;
+}
+
+/*
+ * wrapper for wlcore_cmd_configure that accepts only success status.
+ * return 0 on success
+ */
+int wl1271_cmd_configure(struct wl1271 *wl, u16 id, void *buf, size_t len)
+{
+        int ret = wlcore_cmd_configure_failsafe(wl, id, buf, len, 0);
+
+        if (ret < 0)
+                return ret;
         return 0;
 }
 EXPORT_SYMBOL_GPL(wl1271_cmd_configure);
@@ -1034,8 +1089,8 @@ int wl12xx_cmd_build_probe_req(struct wl1271 *wl, struct wl12xx_vif *wlvif,
         struct sk_buff *skb;
         int ret;
         u32 rate;
-        u16 template_id_2_4 = CMD_TEMPL_CFG_PROBE_REQ_2_4;
-        u16 template_id_5 = CMD_TEMPL_CFG_PROBE_REQ_5;
+        u16 template_id_2_4 = wl->scan_templ_id_2_4;
+        u16 template_id_5 = wl->scan_templ_id_5;
 
         skb = ieee80211_probereq_get(wl->hw, vif, ssid, ssid_len,
                                      ie_len);
@@ -1048,10 +1103,10 @@ int wl12xx_cmd_build_probe_req(struct wl1271 *wl, struct wl12xx_vif *wlvif,
 
         wl1271_dump(DEBUG_SCAN, "PROBE REQ: ", skb->data, skb->len);
 
-        if (!sched_scan &&
+        if (sched_scan &&
             (wl->quirks & WLCORE_QUIRK_DUAL_PROBE_TMPL)) {
-                template_id_2_4 = CMD_TEMPL_APP_PROBE_REQ_2_4;
-                template_id_5 = CMD_TEMPL_APP_PROBE_REQ_5;
+                template_id_2_4 = wl->sched_scan_templ_id_2_4;
+                template_id_5 = wl->sched_scan_templ_id_5;
         }
 
         rate = wl1271_tx_min_rate_get(wl, wlvif->bitrate_masks[band]);
@@ -1068,6 +1123,7 @@ out:
         dev_kfree_skb(skb);
         return ret;
 }
+EXPORT_SYMBOL_GPL(wl12xx_cmd_build_probe_req);
 
 struct sk_buff *wl1271_cmd_build_ap_probe_req(struct wl1271 *wl,
                                               struct wl12xx_vif *wlvif,
@@ -1379,7 +1435,8 @@ out:
         return ret;
 }
 
-int wl12xx_cmd_set_peer_state(struct wl1271 *wl, u8 hlid)
+int wl12xx_cmd_set_peer_state(struct wl1271 *wl, struct wl12xx_vif *wlvif,
+                              u8 hlid)
 {
         struct wl12xx_cmd_set_peer_state *cmd;
         int ret = 0;
@@ -1395,6 +1452,10 @@ int wl12xx_cmd_set_peer_state(struct wl1271 *wl, u8 hlid)
         cmd->hlid = hlid;
         cmd->state = WL1271_CMD_STA_STATE_CONNECTED;
 
+        /* wmm param is valid only for station role */
+        if (wlvif->bss_type == BSS_TYPE_STA_BSS)
+                cmd->wmm = wlvif->wmm_enabled;
+
         ret = wl1271_cmd_send(wl, CMD_SET_PEER_STATE, cmd, sizeof(*cmd), 0);
         if (ret < 0) {
                 wl1271_error("failed to send set peer state command");
@@ -1429,6 +1490,7 @@ int wl12xx_cmd_add_peer(struct wl1271 *wl, struct wl12xx_vif *wlvif,
         cmd->hlid = hlid;
         cmd->sp_len = sta->max_sp;
         cmd->wmm = sta->wme ? 1 : 0;
+        cmd->session_id = wl->session_ids[hlid];
 
         for (i = 0; i < NUM_ACCESS_CATEGORIES_COPY; i++)
                 if (sta->wme && (sta->uapsd_queues & BIT(i)))
@@ -1490,9 +1552,10 @@ int wl12xx_cmd_remove_peer(struct wl1271 *wl, u8 hlid)
                 goto out_free;
         }
 
-        ret = wl1271_cmd_wait_for_event_or_timeout(wl,
-                                           PEER_REMOVE_COMPLETE_EVENT_ID,
-                                           &timeout);
+        ret = wl->ops->wait_for_event(wl,
+                                      WLCORE_EVENT_PEER_REMOVE_COMPLETE,
+                                      &timeout);
+
         /*
          * We are ok with a timeout here. The event is sometimes not sent
          * due to a firmware bug. In case of another error (like SDIO timeout)
@@ -1508,6 +1571,131 @@ out:
         return ret;
 }
 
+static int wlcore_get_reg_conf_ch_idx(enum ieee80211_band band, u16 ch)
+{
+        int idx = -1;
+
+        switch (band) {
+        case IEEE80211_BAND_5GHZ:
+                if (ch >= 8 && ch <= 16)
+                        idx = ((ch-8)/4 + 18);
+                else if (ch >= 34 && ch <= 64)
+                        idx = ((ch-34)/2 + 3 + 18);
+                else if (ch >= 100 && ch <= 140)
+                        idx = ((ch-100)/4 + 15 + 18);
+                else if (ch >= 149 && ch <= 165)
+                        idx = ((ch-149)/4 + 26 + 18);
+                else
+                        idx = -1;
+                break;
+        case IEEE80211_BAND_2GHZ:
+                if (ch >= 1 && ch <= 14)
+                        idx = ch - 1;
+                else
+                        idx = -1;
+                break;
+        default:
+                wl1271_error("get reg conf ch idx - unknown band: %d",
+                             (int)band);
+        }
+
+        return idx;
+}
+
+void wlcore_set_pending_regdomain_ch(struct wl1271 *wl, u16 channel,
+                                     enum ieee80211_band band)
+{
+        int ch_bit_idx = 0;
+
+        if (!(wl->quirks & WLCORE_QUIRK_REGDOMAIN_CONF))
+                return;
+
+        ch_bit_idx = wlcore_get_reg_conf_ch_idx(band, channel);
+
+        if (ch_bit_idx > 0 && ch_bit_idx <= WL1271_MAX_CHANNELS)
+                set_bit(ch_bit_idx, (long *)wl->reg_ch_conf_pending);
+}
+
+int wlcore_cmd_regdomain_config_locked(struct wl1271 *wl)
+{
+        struct wl12xx_cmd_regdomain_dfs_config *cmd = NULL;
+        int ret = 0, i, b, ch_bit_idx;
+        struct ieee80211_channel *channel;
+        u32 tmp_ch_bitmap[2];
+        u16 ch;
+        struct wiphy *wiphy = wl->hw->wiphy;
+        struct ieee80211_supported_band *band;
+        bool timeout = false;
+
+        if (!(wl->quirks & WLCORE_QUIRK_REGDOMAIN_CONF))
+                return 0;
+
+        wl1271_debug(DEBUG_CMD, "cmd reg domain config");
+
+        memset(tmp_ch_bitmap, 0, sizeof(tmp_ch_bitmap));
+
+        for (b = IEEE80211_BAND_2GHZ; b <= IEEE80211_BAND_5GHZ; b++) {
+                band = wiphy->bands[b];
+                for (i = 0; i < band->n_channels; i++) {
+                        channel = &band->channels[i];
+                        ch = channel->hw_value;
+
+                        if (channel->flags & (IEEE80211_CHAN_DISABLED |
+                                              IEEE80211_CHAN_RADAR |
+                                              IEEE80211_CHAN_PASSIVE_SCAN))
+                                continue;
+
+                        ch_bit_idx = wlcore_get_reg_conf_ch_idx(b, ch);
+                        if (ch_bit_idx < 0)
+                                continue;
+
+                        set_bit(ch_bit_idx, (long *)tmp_ch_bitmap);
+                }
+        }
+
+        tmp_ch_bitmap[0] |= wl->reg_ch_conf_pending[0];
+        tmp_ch_bitmap[1] |= wl->reg_ch_conf_pending[1];
+
+        if (!memcmp(tmp_ch_bitmap, wl->reg_ch_conf_last, sizeof(tmp_ch_bitmap)))
+                goto out;
+
+        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+        if (!cmd) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        cmd->ch_bit_map1 = cpu_to_le32(tmp_ch_bitmap[0]);
+        cmd->ch_bit_map2 = cpu_to_le32(tmp_ch_bitmap[1]);
+
+        wl1271_debug(DEBUG_CMD,
+                     "cmd reg domain bitmap1: 0x%08x, bitmap2: 0x%08x",
+                     cmd->ch_bit_map1, cmd->ch_bit_map2);
+
+        ret = wl1271_cmd_send(wl, CMD_DFS_CHANNEL_CONFIG, cmd, sizeof(*cmd), 0);
+        if (ret < 0) {
+                wl1271_error("failed to send reg domain dfs config");
+                goto out;
+        }
+
+        ret = wl->ops->wait_for_event(wl,
+                                      WLCORE_EVENT_DFS_CONFIG_COMPLETE,
+                                      &timeout);
+        if (ret < 0 || timeout) {
+                wl1271_error("reg domain conf %serror",
+                             timeout ? "completion " : "");
+                ret = timeout ? -ETIMEDOUT : ret;
+                goto out;
+        }
+
+        memcpy(wl->reg_ch_conf_last, tmp_ch_bitmap, sizeof(tmp_ch_bitmap));
+        memset(wl->reg_ch_conf_pending, 0, sizeof(wl->reg_ch_conf_pending));
+
+out:
+        kfree(cmd);
+        return ret;
+}
+
 int wl12xx_cmd_config_fwlog(struct wl1271 *wl)
 {
         struct wl12xx_cmd_config_fwlog *cmd;
@@ -1593,12 +1781,12 @@ out:
 }
 
 static int wl12xx_cmd_roc(struct wl1271 *wl, struct wl12xx_vif *wlvif,
-                          u8 role_id)
+                          u8 role_id, enum ieee80211_band band, u8 channel)
 {
         struct wl12xx_cmd_roc *cmd;
         int ret = 0;
 
-        wl1271_debug(DEBUG_CMD, "cmd roc %d (%d)", wlvif->channel, role_id);
+        wl1271_debug(DEBUG_CMD, "cmd roc %d (%d)", channel, role_id);
 
         if (WARN_ON(role_id == WL12XX_INVALID_ROLE_ID))
                 return -EINVAL;
@@ -1610,8 +1798,8 @@ static int wl12xx_cmd_roc(struct wl1271 *wl, struct wl12xx_vif *wlvif,
         }
 
         cmd->role_id = role_id;
-        cmd->channel = wlvif->channel;
-        switch (wlvif->band) {
+        cmd->channel = channel;
+        switch (band) {
         case IEEE80211_BAND_2GHZ:
                 cmd->band = WLCORE_BAND_2_4GHZ;
                 break;
@@ -1666,30 +1854,18 @@ out:
         return ret;
 }
 
-int wl12xx_roc(struct wl1271 *wl, struct wl12xx_vif *wlvif, u8 role_id)
+int wl12xx_roc(struct wl1271 *wl, struct wl12xx_vif *wlvif, u8 role_id,
+               enum ieee80211_band band, u8 channel)
 {
         int ret = 0;
-        bool is_first_roc;
 
         if (WARN_ON(test_bit(role_id, wl->roc_map)))
                 return 0;
 
-        is_first_roc = (find_first_bit(wl->roc_map, WL12XX_MAX_ROLES) >=
-                        WL12XX_MAX_ROLES);
-
-        ret = wl12xx_cmd_roc(wl, wlvif, role_id);
+        ret = wl12xx_cmd_roc(wl, wlvif, role_id, band, channel);
         if (ret < 0)
                 goto out;
 
-        if (is_first_roc) {
-                ret = wl1271_cmd_wait_for_event(wl,
-                                           REMAIN_ON_CHANNEL_COMPLETE_EVENT_ID);
-                if (ret < 0) {
-                        wl1271_error("cmd roc event completion error");
-                        goto out;
-                }
-        }
-
         __set_bit(role_id, wl->roc_map);
 out:
         return ret;
@@ -1719,43 +1895,7 @@ out:
         return ret;
 }
 
-int wl12xx_cmd_channel_switch(struct wl1271 *wl,
-                              struct wl12xx_vif *wlvif,
-                              struct ieee80211_channel_switch *ch_switch)
-{
-        struct wl12xx_cmd_channel_switch *cmd;
-        int ret;
-
-        wl1271_debug(DEBUG_ACX, "cmd channel switch");
-
-        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
-        if (!cmd) {
-                ret = -ENOMEM;
-                goto out;
-        }
-
-        cmd->role_id = wlvif->role_id;
-        cmd->channel = ch_switch->channel->hw_value;
-        cmd->switch_time = ch_switch->count;
-        cmd->stop_tx = ch_switch->block_tx;
-
-        /* FIXME: control from mac80211 in the future */
-        cmd->post_switch_tx_disable = 0;  /* Enable TX on the target channel */
-
-        ret = wl1271_cmd_send(wl, CMD_CHANNEL_SWITCH, cmd, sizeof(*cmd), 0);
-        if (ret < 0) {
-                wl1271_error("failed to send channel switch command");
-                goto out_free;
-        }
-
-out_free:
-        kfree(cmd);
-
-out:
-        return ret;
-}
-
-int wl12xx_cmd_stop_channel_switch(struct wl1271 *wl)
+int wl12xx_cmd_stop_channel_switch(struct wl1271 *wl, struct wl12xx_vif *wlvif)
 {
         struct wl12xx_cmd_stop_channel_switch *cmd;
         int ret;
@@ -1768,6 +1908,8 @@ int wl12xx_cmd_stop_channel_switch(struct wl1271 *wl)
                 goto out;
         }
 
+        cmd->role_id = wlvif->role_id;
+
         ret = wl1271_cmd_send(wl, CMD_STOP_CHANNEL_SWICTH, cmd, sizeof(*cmd), 0);
         if (ret < 0) {
                 wl1271_error("failed to stop channel switch command");
@@ -1782,7 +1924,8 @@ out:
 }
 
 /* start dev role and roc on its channel */
-int wl12xx_start_dev(struct wl1271 *wl, struct wl12xx_vif *wlvif)
+int wl12xx_start_dev(struct wl1271 *wl, struct wl12xx_vif *wlvif,
+                     enum ieee80211_band band, int channel)
 {
         int ret;
 
@@ -1797,11 +1940,11 @@ int wl12xx_start_dev(struct wl1271 *wl, struct wl12xx_vif *wlvif)
         if (ret < 0)
                 goto out;
 
-        ret = wl12xx_cmd_role_start_dev(wl, wlvif);
+        ret = wl12xx_cmd_role_start_dev(wl, wlvif, band, channel);
         if (ret < 0)
                 goto out_disable;
 
-        ret = wl12xx_roc(wl, wlvif, wlvif->dev_role_id);
+        ret = wl12xx_roc(wl, wlvif, wlvif->dev_role_id, band, channel);
         if (ret < 0)
                 goto out_stop;
 
diff --git a/drivers/net/wireless/ti/wlcore/cmd.h b/drivers/net/wireless/ti/wlcore/cmd.h
index 2409f3d71f63..fd34123047cd 100644
--- a/drivers/net/wireless/ti/wlcore/cmd.h
+++ b/drivers/net/wireless/ti/wlcore/cmd.h
@@ -31,6 +31,8 @@ struct acx_header;
 
 int wl1271_cmd_send(struct wl1271 *wl, u16 id, void *buf, size_t len,
                     size_t res_len);
+int wlcore_cmd_send_failsafe(struct wl1271 *wl, u16 id, void *buf, size_t len,
+                             size_t res_len, unsigned long valid_rets);
 int wl12xx_cmd_role_enable(struct wl1271 *wl, u8 *addr, u8 role_type,
                            u8 *role_id);
 int wl12xx_cmd_role_disable(struct wl1271 *wl, u8 *role_id);
@@ -39,11 +41,14 @@ int wl12xx_cmd_role_stop_sta(struct wl1271 *wl, struct wl12xx_vif *wlvif);
 int wl12xx_cmd_role_start_ap(struct wl1271 *wl, struct wl12xx_vif *wlvif);
 int wl12xx_cmd_role_stop_ap(struct wl1271 *wl, struct wl12xx_vif *wlvif);
 int wl12xx_cmd_role_start_ibss(struct wl1271 *wl, struct wl12xx_vif *wlvif);
-int wl12xx_start_dev(struct wl1271 *wl, struct wl12xx_vif *wlvif);
+int wl12xx_start_dev(struct wl1271 *wl, struct wl12xx_vif *wlvif,
+                     enum ieee80211_band band, int channel);
 int wl12xx_stop_dev(struct wl1271 *wl, struct wl12xx_vif *wlvif);
 int wl1271_cmd_test(struct wl1271 *wl, void *buf, size_t buf_len, u8 answer);
 int wl1271_cmd_interrogate(struct wl1271 *wl, u16 id, void *buf, size_t len);
 int wl1271_cmd_configure(struct wl1271 *wl, u16 id, void *buf, size_t len);
+int wlcore_cmd_configure_failsafe(struct wl1271 *wl, u16 id, void *buf,
+                                  size_t len, unsigned long valid_rets);
 int wl1271_cmd_data_path(struct wl1271 *wl, bool enable);
 int wl1271_cmd_ps_mode(struct wl1271 *wl, struct wl12xx_vif *wlvif,
                        u8 ps_mode, u16 auto_ps_timeout);
@@ -75,22 +80,30 @@ int wl1271_cmd_set_ap_key(struct wl1271 *wl, struct wl12xx_vif *wlvif,
                           u16 action, u8 id, u8 key_type,
                           u8 key_size, const u8 *key, u8 hlid, u32 tx_seq_32,
                           u16 tx_seq_16);
-int wl12xx_cmd_set_peer_state(struct wl1271 *wl, u8 hlid);
-int wl12xx_roc(struct wl1271 *wl, struct wl12xx_vif *wlvif, u8 role_id);
+int wl12xx_cmd_set_peer_state(struct wl1271 *wl, struct wl12xx_vif *wlvif,
+                              u8 hlid);
+int wl12xx_roc(struct wl1271 *wl, struct wl12xx_vif *wlvif, u8 role_id,
+               enum ieee80211_band band, u8 channel);
 int wl12xx_croc(struct wl1271 *wl, u8 role_id);
 int wl12xx_cmd_add_peer(struct wl1271 *wl, struct wl12xx_vif *wlvif,
                         struct ieee80211_sta *sta, u8 hlid);
 int wl12xx_cmd_remove_peer(struct wl1271 *wl, u8 hlid);
+void wlcore_set_pending_regdomain_ch(struct wl1271 *wl, u16 channel,
+                                     enum ieee80211_band band);
+int wlcore_cmd_regdomain_config_locked(struct wl1271 *wl);
 int wl12xx_cmd_config_fwlog(struct wl1271 *wl);
 int wl12xx_cmd_start_fwlog(struct wl1271 *wl);
 int wl12xx_cmd_stop_fwlog(struct wl1271 *wl);
 int wl12xx_cmd_channel_switch(struct wl1271 *wl,
                               struct wl12xx_vif *wlvif,
                               struct ieee80211_channel_switch *ch_switch);
-int wl12xx_cmd_stop_channel_switch(struct wl1271 *wl);
+int wl12xx_cmd_stop_channel_switch(struct wl1271 *wl,
+                                   struct wl12xx_vif *wlvif);
 int wl12xx_allocate_link(struct wl1271 *wl, struct wl12xx_vif *wlvif,
                          u8 *hlid);
 void wl12xx_free_link(struct wl1271 *wl, struct wl12xx_vif *wlvif, u8 *hlid);
+int wlcore_cmd_wait_for_event_or_timeout(struct wl1271 *wl,
+                                         u32 mask, bool *timeout);
 
 enum wl1271_commands {
         CMD_INTERROGATE = 1, /* use this to read information elements */
@@ -149,8 +162,11 @@ enum wl1271_commands {
         CMD_WFD_START_DISCOVERY = 45,
         CMD_WFD_STOP_DISCOVERY  = 46,
         CMD_WFD_ATTRIBUTE_CONFIG        = 47,
-        CMD_NOP                 = 48,
-        CMD_LAST_COMMAND,
+        CMD_GENERIC_CFG                 = 48,
+        CMD_NOP                         = 49,
+
+        /* start of 18xx specific commands */
+        CMD_DFS_CHANNEL_CONFIG          = 60,
 
         MAX_COMMAND_ID = 0xFFFF,
 };
@@ -167,8 +183,8 @@ enum cmd_templ {
         CMD_TEMPL_PS_POLL,
         CMD_TEMPL_KLV,
         CMD_TEMPL_DISCONNECT,
-        CMD_TEMPL_APP_PROBE_REQ_2_4,
-        CMD_TEMPL_APP_PROBE_REQ_5,
+        CMD_TEMPL_APP_PROBE_REQ_2_4_LEGACY,
+        CMD_TEMPL_APP_PROBE_REQ_5_LEGACY,
         CMD_TEMPL_BAR,           /* for firmware internal use only */
         CMD_TEMPL_CTS,           /*
                                   * For CTS-to-self (FastCTS) mechanism
@@ -179,6 +195,8 @@ enum cmd_templ {
         CMD_TEMPL_DEAUTH_AP,
         CMD_TEMPL_TEMPORARY,
         CMD_TEMPL_LINK_MEASUREMENT_REPORT,
+        CMD_TEMPL_PROBE_REQ_2_4_PERIODIC,
+        CMD_TEMPL_PROBE_REQ_5_PERIODIC,
 
         CMD_TEMPL_MAX = 0xff
 };
@@ -220,7 +238,8 @@ enum {
         CMD_STATUS_FW_RESET             = 22, /* Driver internal use.*/
         CMD_STATUS_TEMPLATE_OOM         = 23,
         CMD_STATUS_NO_RX_BA_SESSION     = 24,
-        MAX_COMMAND_STATUS              = 0xff
+
+        MAX_COMMAND_STATUS
 };
 
 #define CMDMBOX_HEADER_LEN 4
@@ -345,7 +364,15 @@ struct wl12xx_cmd_role_start {
 
                         u8 reset_tsf;
 
-                        u8 padding_1[4];
+                        /*
+                         * ap supports wmm (note that there is additional
+                         * per-sta wmm configuration)
+                         */
+                        u8 wmm;
+
+                        u8 bcast_session_id;
+                        u8 global_session_id;
+                        u8 padding_1[1];
                 } __packed ap;
         };
 } __packed;
@@ -515,7 +542,14 @@ struct wl12xx_cmd_set_peer_state {
 
         u8 hlid;
         u8 state;
-        u8 padding[2];
+
+        /*
+         * wmm is relevant for sta role only.
+         * ap role configures the per-sta wmm params in
+         * the add_peer command.
+         */
+        u8 wmm;
+        u8 padding[1];
 } __packed;
 
 struct wl12xx_cmd_roc {
@@ -558,7 +592,7 @@ struct wl12xx_cmd_add_peer {
         u8 bss_index;
         u8 sp_len;
         u8 wmm;
-        u8 padding1;
+        u8 session_id;
 } __packed;
 
 struct wl12xx_cmd_remove_peer {
@@ -597,6 +631,13 @@ enum wl12xx_fwlogger_output {
         WL12XX_FWLOG_OUTPUT_HOST,
 };
 
+struct wl12xx_cmd_regdomain_dfs_config {
+        struct wl1271_cmd_header header;
+
+        __le32 ch_bit_map1;
+        __le32 ch_bit_map2;
+} __packed;
+
 struct wl12xx_cmd_config_fwlog {
         struct wl1271_cmd_header header;
 
@@ -626,27 +667,13 @@ struct wl12xx_cmd_stop_fwlog {
         struct wl1271_cmd_header header;
 } __packed;
 
-struct wl12xx_cmd_channel_switch {
+struct wl12xx_cmd_stop_channel_switch {
         struct wl1271_cmd_header header;
 
         u8 role_id;
-
-        /* The new serving channel */
-        u8 channel;
-        /* Relative time of the serving channel switch in TBTT units */
-        u8 switch_time;
-        /* Stop the role TX, should expect it after radar detection */
-        u8 stop_tx;
-        /* The target channel tx status 1-stopped 0-open*/
-        u8 post_switch_tx_disable;
-
         u8 padding[3];
 } __packed;
 
-struct wl12xx_cmd_stop_channel_switch {
-        struct wl1271_cmd_header header;
-} __packed;
-
 /* Used to check radio status after calibration */
 #define MAX_TLV_LENGTH          500
 #define TEST_CMD_P2G_CAL        2       /* TX BiP */
diff --git a/drivers/net/wireless/ti/wlcore/conf.h b/drivers/net/wireless/ti/wlcore/conf.h
index 9e40760bafe1..2b96ff821341 100644
--- a/drivers/net/wireless/ti/wlcore/conf.h
+++ b/drivers/net/wireless/ti/wlcore/conf.h
@@ -57,20 +57,49 @@ enum {
 };
 
 enum {
-        CONF_HW_RATE_INDEX_1MBPS   = 0,
-        CONF_HW_RATE_INDEX_2MBPS   = 1,
-        CONF_HW_RATE_INDEX_5_5MBPS = 2,
-        CONF_HW_RATE_INDEX_6MBPS   = 3,
-        CONF_HW_RATE_INDEX_9MBPS   = 4,
-        CONF_HW_RATE_INDEX_11MBPS  = 5,
-        CONF_HW_RATE_INDEX_12MBPS  = 6,
-        CONF_HW_RATE_INDEX_18MBPS  = 7,
-        CONF_HW_RATE_INDEX_22MBPS  = 8,
-        CONF_HW_RATE_INDEX_24MBPS  = 9,
-        CONF_HW_RATE_INDEX_36MBPS  = 10,
-        CONF_HW_RATE_INDEX_48MBPS  = 11,
-        CONF_HW_RATE_INDEX_54MBPS  = 12,
-        CONF_HW_RATE_INDEX_MAX     = CONF_HW_RATE_INDEX_54MBPS,
+        CONF_HW_RATE_INDEX_1MBPS      = 0,
+        CONF_HW_RATE_INDEX_2MBPS      = 1,
+        CONF_HW_RATE_INDEX_5_5MBPS    = 2,
+        CONF_HW_RATE_INDEX_11MBPS     = 3,
+        CONF_HW_RATE_INDEX_6MBPS      = 4,
+        CONF_HW_RATE_INDEX_9MBPS      = 5,
+        CONF_HW_RATE_INDEX_12MBPS     = 6,
+        CONF_HW_RATE_INDEX_18MBPS     = 7,
+        CONF_HW_RATE_INDEX_24MBPS     = 8,
+        CONF_HW_RATE_INDEX_36MBPS     = 9,
+        CONF_HW_RATE_INDEX_48MBPS     = 10,
+        CONF_HW_RATE_INDEX_54MBPS     = 11,
+        CONF_HW_RATE_INDEX_MCS0       = 12,
+        CONF_HW_RATE_INDEX_MCS1       = 13,
+        CONF_HW_RATE_INDEX_MCS2       = 14,
+        CONF_HW_RATE_INDEX_MCS3       = 15,
+        CONF_HW_RATE_INDEX_MCS4       = 16,
+        CONF_HW_RATE_INDEX_MCS5       = 17,
+        CONF_HW_RATE_INDEX_MCS6       = 18,
+        CONF_HW_RATE_INDEX_MCS7       = 19,
+        CONF_HW_RATE_INDEX_MCS7_SGI   = 20,
+        CONF_HW_RATE_INDEX_MCS0_40MHZ = 21,
+        CONF_HW_RATE_INDEX_MCS1_40MHZ = 22,
+        CONF_HW_RATE_INDEX_MCS2_40MHZ = 23,
+        CONF_HW_RATE_INDEX_MCS3_40MHZ = 24,
+        CONF_HW_RATE_INDEX_MCS4_40MHZ = 25,
+        CONF_HW_RATE_INDEX_MCS5_40MHZ = 26,
+        CONF_HW_RATE_INDEX_MCS6_40MHZ = 27,
+        CONF_HW_RATE_INDEX_MCS7_40MHZ = 28,
+        CONF_HW_RATE_INDEX_MCS7_40MHZ_SGI = 29,
+
+        /* MCS8+ rates overlap with 40Mhz rates */
+        CONF_HW_RATE_INDEX_MCS8       = 21,
+        CONF_HW_RATE_INDEX_MCS9       = 22,
+        CONF_HW_RATE_INDEX_MCS10      = 23,
+        CONF_HW_RATE_INDEX_MCS11      = 24,
+        CONF_HW_RATE_INDEX_MCS12      = 25,
+        CONF_HW_RATE_INDEX_MCS13      = 26,
+        CONF_HW_RATE_INDEX_MCS14      = 27,
+        CONF_HW_RATE_INDEX_MCS15      = 28,
+        CONF_HW_RATE_INDEX_MCS15_SGI  = 29,
+
+        CONF_HW_RATE_INDEX_MAX        = CONF_HW_RATE_INDEX_MCS7_40MHZ_SGI,
 };
 
 #define CONF_HW_RXTX_RATE_UNSUPPORTED 0xff
@@ -415,11 +444,11 @@ struct conf_rx_settings {
 #define CONF_TX_RATE_MASK_BASIC_P2P    CONF_HW_BIT_RATE_6MBPS
 
 /*
- * Rates supported for data packets when operating as AP. Note the absence
+ * Rates supported for data packets when operating as STA/AP. Note the absence
  * of the 22Mbps rate. There is a FW limitation on 12 rates so we must drop
  * one. The rate dropped is not mandatory under any operating mode.
  */
-#define CONF_TX_AP_ENABLED_RATES       (CONF_HW_BIT_RATE_1MBPS | \
+#define CONF_TX_ENABLED_RATES       (CONF_HW_BIT_RATE_1MBPS |    \
         CONF_HW_BIT_RATE_2MBPS | CONF_HW_BIT_RATE_5_5MBPS |      \
         CONF_HW_BIT_RATE_6MBPS | CONF_HW_BIT_RATE_9MBPS |        \
         CONF_HW_BIT_RATE_11MBPS | CONF_HW_BIT_RATE_12MBPS |      \
@@ -677,6 +706,18 @@ struct conf_tx_settings {
 
         /* Time in ms for Tx watchdog timer to expire */
         u32 tx_watchdog_timeout;
+
+        /*
+         * when a slow link has this much packets pending, it becomes a low
+         * priority link, scheduling-wise
+         */
+        u8 slow_link_thold;
+
+        /*
+         * when a fast link has this much packets pending, it becomes a low
+         * priority link, scheduling-wise
+         */
+        u8 fast_link_thold;
 } __packed;
 
 enum {
@@ -1047,6 +1088,7 @@ struct conf_roam_trigger_settings {
 struct conf_scan_settings {
         /*
          * The minimum time to wait on each channel for active scans
+         * This value will be used whenever there's a connected interface.
          *
          * Range: u32 tu/1000
          */
@@ -1054,24 +1096,37 @@ struct conf_scan_settings {
 
         /*
          * The maximum time to wait on each channel for active scans
+         * This value will be currently used whenever there's a
+         * connected interface. It shouldn't exceed 30000 (~30ms) to avoid
+         * possible interference of voip traffic going on while scanning.
          *
          * Range: u32 tu/1000
          */
         u32 max_dwell_time_active;
 
-        /*
-         * The minimum time to wait on each channel for passive scans
+        /* The minimum time to wait on each channel for active scans
+         * when it's possible to have longer scan dwell times.
+         * Currently this is used whenever we're idle on all interfaces.
+         * Longer dwell times improve detection of networks within a
+         * single scan.
          *
          * Range: u32 tu/1000
          */
-        u32 min_dwell_time_passive;
+        u32 min_dwell_time_active_long;
 
-        /*
-         * The maximum time to wait on each channel for passive scans
+        /* The maximum time to wait on each channel for active scans
+         * when it's possible to have longer scan dwell times.
+         * See min_dwell_time_active_long
          *
          * Range: u32 tu/1000
          */
-        u32 max_dwell_time_passive;
+        u32 max_dwell_time_active_long;
+
+        /* time to wait on the channel for passive scans (in TU/1000) */
+        u32 dwell_time_passive;
+
+        /* time to wait on the channel for DFS scans (in TU/1000) */
+        u32 dwell_time_dfs;
 
         /*
          * Number of probe requests to transmit on each active scan channel
@@ -1276,12 +1331,20 @@ struct conf_hangover_settings {
         u8 window_size;
 } __packed;
 
+struct conf_recovery_settings {
+        /* BUG() on fw recovery */
+        u8 bug_on_recovery;
+
+        /* Prevent HW recovery. FW will remain stuck. */
+        u8 no_recovery;
+} __packed;
+
 /*
  * The conf version consists of 4 bytes.  The two MSB are the wlcore
  * version, the two LSB are the lower driver's private conf
  * version.
  */
-#define WLCORE_CONF_VERSION     (0x0002 << 16)
+#define WLCORE_CONF_VERSION     (0x0005 << 16)
 #define WLCORE_CONF_MASK        0xffff0000
 #define WLCORE_CONF_SIZE        (sizeof(struct wlcore_conf_header) +    \
                                  sizeof(struct wlcore_conf))
@@ -1309,6 +1372,7 @@ struct wlcore_conf {
         struct conf_fwlog fwlog;
         struct conf_rate_policy_settings rate;
         struct conf_hangover_settings hangover;
+        struct conf_recovery_settings recovery;
 } __packed;
 
 struct wlcore_conf_file {
diff --git a/drivers/net/wireless/ti/wlcore/debugfs.c b/drivers/net/wireless/ti/wlcore/debugfs.c
index c86bb00c2488..e70a7c864865 100644
--- a/drivers/net/wireless/ti/wlcore/debugfs.c
+++ b/drivers/net/wireless/ti/wlcore/debugfs.c
@@ -490,7 +490,7 @@ static ssize_t driver_state_read(struct file *file, char __user *user_buf,
         DRIVER_STATE_PRINT_HEX(chip.id);
         DRIVER_STATE_PRINT_STR(chip.fw_ver_str);
         DRIVER_STATE_PRINT_STR(chip.phy_fw_ver_str);
-        DRIVER_STATE_PRINT_INT(sched_scanning);
+        DRIVER_STATE_PRINT_INT(recovery_count);
 
 #undef DRIVER_STATE_PRINT_INT
 #undef DRIVER_STATE_PRINT_LONG
@@ -560,7 +560,6 @@ static ssize_t vifs_state_read(struct file *file, char __user *user_buf,
                 if (wlvif->bss_type == BSS_TYPE_STA_BSS ||
                     wlvif->bss_type == BSS_TYPE_IBSS) {
                         VIF_STATE_PRINT_INT(sta.hlid);
-                        VIF_STATE_PRINT_INT(sta.ba_rx_bitmap);
                         VIF_STATE_PRINT_INT(sta.basic_rate_idx);
                         VIF_STATE_PRINT_INT(sta.ap_rate_idx);
                         VIF_STATE_PRINT_INT(sta.p2p_rate_idx);
@@ -577,6 +576,10 @@ static ssize_t vifs_state_read(struct file *file, char __user *user_buf,
                         VIF_STATE_PRINT_INT(ap.ucast_rate_idx[3]);
                 }
                 VIF_STATE_PRINT_INT(last_tx_hlid);
+                VIF_STATE_PRINT_INT(tx_queue_count[0]);
+                VIF_STATE_PRINT_INT(tx_queue_count[1]);
+                VIF_STATE_PRINT_INT(tx_queue_count[2]);
+                VIF_STATE_PRINT_INT(tx_queue_count[3]);
                 VIF_STATE_PRINT_LHEX(links_map[0]);
                 VIF_STATE_PRINT_NSTR(ssid, wlvif->ssid_len);
                 VIF_STATE_PRINT_INT(band);
@@ -589,7 +592,6 @@ static ssize_t vifs_state_read(struct file *file, char __user *user_buf,
                 VIF_STATE_PRINT_INT(beacon_int);
                 VIF_STATE_PRINT_INT(default_key);
                 VIF_STATE_PRINT_INT(aid);
-                VIF_STATE_PRINT_INT(session_counter);
                 VIF_STATE_PRINT_INT(psm_entry_retry);
                 VIF_STATE_PRINT_INT(power_level);
                 VIF_STATE_PRINT_INT(rssi_thold);
@@ -993,7 +995,7 @@ static ssize_t sleep_auth_write(struct file *file,
                 return -EINVAL;
         }
 
-        if (value < 0 || value > WL1271_PSM_MAX) {
+        if (value > WL1271_PSM_MAX) {
                 wl1271_warning("sleep_auth must be between 0 and %d",
                                WL1271_PSM_MAX);
                 return -ERANGE;
diff --git a/drivers/net/wireless/ti/wlcore/event.c b/drivers/net/wireless/ti/wlcore/event.c
index 48907054d493..70f289aa1bc6 100644
--- a/drivers/net/wireless/ti/wlcore/event.c
+++ b/drivers/net/wireless/ti/wlcore/event.c
@@ -29,34 +29,39 @@
 #include "scan.h"
 #include "wl12xx_80211.h"
 
-static void wl1271_event_rssi_trigger(struct wl1271 *wl,
-                                      struct wl12xx_vif *wlvif,
-                                      struct event_mailbox *mbox)
+void wlcore_event_rssi_trigger(struct wl1271 *wl, s8 *metric_arr)
 {
-        struct ieee80211_vif *vif = wl12xx_wlvif_to_vif(wlvif);
+        struct wl12xx_vif *wlvif;
+        struct ieee80211_vif *vif;
         enum nl80211_cqm_rssi_threshold_event event;
-        s8 metric = mbox->rssi_snr_trigger_metric[0];
+        s8 metric = metric_arr[0];
 
         wl1271_debug(DEBUG_EVENT, "RSSI trigger metric: %d", metric);
 
-        if (metric <= wlvif->rssi_thold)
-                event = NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW;
-        else
-                event = NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH;
-
-        if (event != wlvif->last_rssi_event)
-                ieee80211_cqm_rssi_notify(vif, event, GFP_KERNEL);
-        wlvif->last_rssi_event = event;
+        /* TODO: check actual multi-role support */
+        wl12xx_for_each_wlvif_sta(wl, wlvif) {
+                if (metric <= wlvif->rssi_thold)
+                        event = NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW;
+                else
+                        event = NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH;
+
+                vif = wl12xx_wlvif_to_vif(wlvif);
+                if (event != wlvif->last_rssi_event)
+                        ieee80211_cqm_rssi_notify(vif, event, GFP_KERNEL);
+                wlvif->last_rssi_event = event;
+        }
 }
+EXPORT_SYMBOL_GPL(wlcore_event_rssi_trigger);
 
 static void wl1271_stop_ba_event(struct wl1271 *wl, struct wl12xx_vif *wlvif)
 {
         struct ieee80211_vif *vif = wl12xx_wlvif_to_vif(wlvif);
 
         if (wlvif->bss_type != BSS_TYPE_AP_BSS) {
-                if (!wlvif->sta.ba_rx_bitmap)
+                u8 hlid = wlvif->sta.hlid;
+                if (!wl->links[hlid].ba_bitmap)
                         return;
-                ieee80211_stop_rx_ba_session(vif, wlvif->sta.ba_rx_bitmap,
+                ieee80211_stop_rx_ba_session(vif, wl->links[hlid].ba_bitmap,
                                              vif->bss_conf.bssid);
         } else {
                 u8 hlid;
@@ -74,8 +79,7 @@ static void wl1271_stop_ba_event(struct wl1271 *wl, struct wl12xx_vif *wlvif)
         }
 }
 
-static void wl12xx_event_soft_gemini_sense(struct wl1271 *wl,
-                                               u8 enable)
+void wlcore_event_soft_gemini_sense(struct wl1271 *wl, u8 enable)
 {
         struct wl12xx_vif *wlvif;
 
@@ -87,201 +91,169 @@ static void wl12xx_event_soft_gemini_sense(struct wl1271 *wl,
                         wl1271_recalc_rx_streaming(wl, wlvif);
                 }
         }
-
 }
+EXPORT_SYMBOL_GPL(wlcore_event_soft_gemini_sense);
 
-static void wl1271_event_mbox_dump(struct event_mailbox *mbox)
+void wlcore_event_sched_scan_completed(struct wl1271 *wl,
+                                       u8 status)
 {
-        wl1271_debug(DEBUG_EVENT, "MBOX DUMP:");
-        wl1271_debug(DEBUG_EVENT, "\tvector: 0x%x", mbox->events_vector);
-        wl1271_debug(DEBUG_EVENT, "\tmask: 0x%x", mbox->events_mask);
+        wl1271_debug(DEBUG_EVENT, "PERIODIC_SCAN_COMPLETE_EVENT (status 0x%0x)",
+                     status);
+
+        if (wl->sched_vif) {
+                ieee80211_sched_scan_stopped(wl->hw);
+                wl->sched_vif = NULL;
+        }
 }
+EXPORT_SYMBOL_GPL(wlcore_event_sched_scan_completed);
 
-static int wl1271_event_process(struct wl1271 *wl)
+void wlcore_event_ba_rx_constraint(struct wl1271 *wl,
+                                   unsigned long roles_bitmap,
+                                   unsigned long allowed_bitmap)
 {
-        struct event_mailbox *mbox = wl->mbox;
-        struct ieee80211_vif *vif;
         struct wl12xx_vif *wlvif;
-        u32 vector;
-        bool disconnect_sta = false;
-        unsigned long sta_bitmap = 0;
-        int ret;
-
-        wl1271_event_mbox_dump(mbox);
-
-        vector = le32_to_cpu(mbox->events_vector);
-        vector &= ~(le32_to_cpu(mbox->events_mask));
-        wl1271_debug(DEBUG_EVENT, "vector: 0x%x", vector);
 
-        if (vector & SCAN_COMPLETE_EVENT_ID) {
-                wl1271_debug(DEBUG_EVENT, "status: 0x%x",
-                             mbox->scheduled_scan_status);
-
-                wl1271_scan_stm(wl, wl->scan_vif);
-        }
+        wl1271_debug(DEBUG_EVENT, "%s: roles=0x%lx allowed=0x%lx",
+                     __func__, roles_bitmap, allowed_bitmap);
 
-        if (vector & PERIODIC_SCAN_REPORT_EVENT_ID) {
-                wl1271_debug(DEBUG_EVENT, "PERIODIC_SCAN_REPORT_EVENT "
-                             "(status 0x%0x)", mbox->scheduled_scan_status);
+        wl12xx_for_each_wlvif(wl, wlvif) {
+                if (wlvif->role_id == WL12XX_INVALID_ROLE_ID ||
+                    !test_bit(wlvif->role_id , &roles_bitmap))
+                        continue;
 
-                wl1271_scan_sched_scan_results(wl);
+                wlvif->ba_allowed = !!test_bit(wlvif->role_id,
+                                               &allowed_bitmap);
+                if (!wlvif->ba_allowed)
+                        wl1271_stop_ba_event(wl, wlvif);
         }
+}
+EXPORT_SYMBOL_GPL(wlcore_event_ba_rx_constraint);
 
-        if (vector & PERIODIC_SCAN_COMPLETE_EVENT_ID) {
-                wl1271_debug(DEBUG_EVENT, "PERIODIC_SCAN_COMPLETE_EVENT "
-                             "(status 0x%0x)", mbox->scheduled_scan_status);
-                if (wl->sched_scanning) {
-                        ieee80211_sched_scan_stopped(wl->hw);
-                        wl->sched_scanning = false;
-                }
-        }
+void wlcore_event_channel_switch(struct wl1271 *wl,
+                                 unsigned long roles_bitmap,
+                                 bool success)
+{
+        struct wl12xx_vif *wlvif;
+        struct ieee80211_vif *vif;
 
-        if (vector & SOFT_GEMINI_SENSE_EVENT_ID)
-                wl12xx_event_soft_gemini_sense(wl,
-                                               mbox->soft_gemini_sense_info);
+        wl1271_debug(DEBUG_EVENT, "%s: roles=0x%lx success=%d",
+                     __func__, roles_bitmap, success);
 
-        /*
-         * We are HW_MONITOR device. On beacon loss - queue
-         * connection loss work. Cancel it on REGAINED event.
-         */
-        if (vector & BSS_LOSE_EVENT_ID) {
-                /* TODO: check for multi-role */
-                int delay = wl->conf.conn.synch_fail_thold *
-                                        wl->conf.conn.bss_lose_timeout;
-                wl1271_info("Beacon loss detected.");
+        wl12xx_for_each_wlvif_sta(wl, wlvif) {
+                if (wlvif->role_id == WL12XX_INVALID_ROLE_ID ||
+                    !test_bit(wlvif->role_id , &roles_bitmap))
+                        continue;
 
-                /*
-                 * if the work is already queued, it should take place. We
-                 * don't want to delay the connection loss indication
-                 * any more.
-                 */
-                ieee80211_queue_delayed_work(wl->hw, &wl->connection_loss_work,
-                                             msecs_to_jiffies(delay));
+                if (!test_and_clear_bit(WLVIF_FLAG_CS_PROGRESS,
+                                        &wlvif->flags))
+                        continue;
 
-                wl12xx_for_each_wlvif_sta(wl, wlvif) {
-                        vif = wl12xx_wlvif_to_vif(wlvif);
+                vif = wl12xx_wlvif_to_vif(wlvif);
 
-                        ieee80211_cqm_rssi_notify(
-                                        vif,
-                                        NL80211_CQM_RSSI_BEACON_LOSS_EVENT,
-                                        GFP_KERNEL);
-                }
+                ieee80211_chswitch_done(vif, success);
+                cancel_delayed_work(&wlvif->channel_switch_work);
         }
+}
+EXPORT_SYMBOL_GPL(wlcore_event_channel_switch);
 
-        if (vector & REGAINED_BSS_EVENT_ID) {
-                /* TODO: check for multi-role */
-                wl1271_info("Beacon regained.");
-                cancel_delayed_work(&wl->connection_loss_work);
-
-                /* sanity check - we can't lose and gain the beacon together */
-                WARN(vector & BSS_LOSE_EVENT_ID,
-                     "Concurrent beacon loss and gain from FW");
-        }
+void wlcore_event_dummy_packet(struct wl1271 *wl)
+{
+        wl1271_debug(DEBUG_EVENT, "DUMMY_PACKET_ID_EVENT_ID");
+        wl1271_tx_dummy_packet(wl);
+}
+EXPORT_SYMBOL_GPL(wlcore_event_dummy_packet);
 
-        if (vector & RSSI_SNR_TRIGGER_0_EVENT_ID) {
-                /* TODO: check actual multi-role support */
-                wl1271_debug(DEBUG_EVENT, "RSSI_SNR_TRIGGER_0_EVENT");
-                wl12xx_for_each_wlvif_sta(wl, wlvif) {
-                        wl1271_event_rssi_trigger(wl, wlvif, mbox);
+static void wlcore_disconnect_sta(struct wl1271 *wl, unsigned long sta_bitmap)
+{
+        u32 num_packets = wl->conf.tx.max_tx_retries;
+        struct wl12xx_vif *wlvif;
+        struct ieee80211_vif *vif;
+        struct ieee80211_sta *sta;
+        const u8 *addr;
+        int h;
+
+        for_each_set_bit(h, &sta_bitmap, WL12XX_MAX_LINKS) {
+                bool found = false;
+                /* find the ap vif connected to this sta */
+                wl12xx_for_each_wlvif_ap(wl, wlvif) {
+                        if (!test_bit(h, wlvif->ap.sta_hlid_map))
+                                continue;
+                        found = true;
+                        break;
                 }
-        }
+                if (!found)
+                        continue;
 
-        if (vector & BA_SESSION_RX_CONSTRAINT_EVENT_ID) {
-                u8 role_id = mbox->role_id;
-                wl1271_debug(DEBUG_EVENT, "BA_SESSION_RX_CONSTRAINT_EVENT_ID. "
-                             "ba_allowed = 0x%x, role_id=%d",
-                             mbox->rx_ba_allowed, role_id);
+                vif = wl12xx_wlvif_to_vif(wlvif);
+                addr = wl->links[h].addr;
 
-                wl12xx_for_each_wlvif(wl, wlvif) {
-                        if (role_id != 0xff && role_id != wlvif->role_id)
-                                continue;
-
-                        wlvif->ba_allowed = !!mbox->rx_ba_allowed;
-                        if (!wlvif->ba_allowed)
-                                wl1271_stop_ba_event(wl, wlvif);
+                rcu_read_lock();
+                sta = ieee80211_find_sta(vif, addr);
+                if (sta) {
+                        wl1271_debug(DEBUG_EVENT, "remove sta %d", h);
+                        ieee80211_report_low_ack(sta, num_packets);
                 }
+                rcu_read_unlock();
         }
+}
 
-        if (vector & CHANNEL_SWITCH_COMPLETE_EVENT_ID) {
-                wl1271_debug(DEBUG_EVENT, "CHANNEL_SWITCH_COMPLETE_EVENT_ID. "
-                                          "status = 0x%x",
-                                          mbox->channel_switch_status);
-                /*
-                 * That event uses for two cases:
-                 * 1) channel switch complete with status=0
-                 * 2) channel switch failed status=1
-                 */
-
-                /* TODO: configure only the relevant vif */
-                wl12xx_for_each_wlvif_sta(wl, wlvif) {
-                        bool success;
-
-                        if (!test_and_clear_bit(WLVIF_FLAG_CS_PROGRESS,
-                                                &wlvif->flags))
-                                continue;
-
-                        success = mbox->channel_switch_status ? false : true;
-                        vif = wl12xx_wlvif_to_vif(wlvif);
+void wlcore_event_max_tx_failure(struct wl1271 *wl, unsigned long sta_bitmap)
+{
+        wl1271_debug(DEBUG_EVENT, "MAX_TX_FAILURE_EVENT_ID");
+        wlcore_disconnect_sta(wl, sta_bitmap);
+}
+EXPORT_SYMBOL_GPL(wlcore_event_max_tx_failure);
 
-                        ieee80211_chswitch_done(vif, success);
-                }
-        }
+void wlcore_event_inactive_sta(struct wl1271 *wl, unsigned long sta_bitmap)
+{
+        wl1271_debug(DEBUG_EVENT, "INACTIVE_STA_EVENT_ID");
+        wlcore_disconnect_sta(wl, sta_bitmap);
+}
+EXPORT_SYMBOL_GPL(wlcore_event_inactive_sta);
 
-        if ((vector & DUMMY_PACKET_EVENT_ID)) {
-                wl1271_debug(DEBUG_EVENT, "DUMMY_PACKET_ID_EVENT_ID");
-                ret = wl1271_tx_dummy_packet(wl);
-                if (ret < 0)
-                        return ret;
-        }
+void wlcore_event_roc_complete(struct wl1271 *wl)
+{
+        wl1271_debug(DEBUG_EVENT, "REMAIN_ON_CHANNEL_COMPLETE_EVENT_ID");
+        if (wl->roc_vif)
+                ieee80211_ready_on_channel(wl->hw);
+}
+EXPORT_SYMBOL_GPL(wlcore_event_roc_complete);
 
+void wlcore_event_beacon_loss(struct wl1271 *wl, unsigned long roles_bitmap)
+{
         /*
-         * "TX retries exceeded" has a different meaning according to mode.
-         * In AP mode the offending station is disconnected.
+         * We are HW_MONITOR device. On beacon loss - queue
+         * connection loss work. Cancel it on REGAINED event.
          */
-        if (vector & MAX_TX_RETRY_EVENT_ID) {
-                wl1271_debug(DEBUG_EVENT, "MAX_TX_RETRY_EVENT_ID");
-                sta_bitmap |= le16_to_cpu(mbox->sta_tx_retry_exceeded);
-                disconnect_sta = true;
-        }
+        struct wl12xx_vif *wlvif;
+        struct ieee80211_vif *vif;
+        int delay = wl->conf.conn.synch_fail_thold *
+                                wl->conf.conn.bss_lose_timeout;
 
-        if (vector & INACTIVE_STA_EVENT_ID) {
-                wl1271_debug(DEBUG_EVENT, "INACTIVE_STA_EVENT_ID");
-                sta_bitmap |= le16_to_cpu(mbox->sta_aging_status);
-                disconnect_sta = true;
-        }
+        wl1271_info("Beacon loss detected. roles:0x%lx", roles_bitmap);
 
-        if (disconnect_sta) {
-                u32 num_packets = wl->conf.tx.max_tx_retries;
-                struct ieee80211_sta *sta;
-                const u8 *addr;
-                int h;
-
-                for_each_set_bit(h, &sta_bitmap, WL12XX_MAX_LINKS) {
-                        bool found = false;
-                        /* find the ap vif connected to this sta */
-                        wl12xx_for_each_wlvif_ap(wl, wlvif) {
-                                if (!test_bit(h, wlvif->ap.sta_hlid_map))
-                                        continue;
-                                found = true;
-                                break;
-                        }
-                        if (!found)
-                                continue;
+        wl12xx_for_each_wlvif_sta(wl, wlvif) {
+                if (wlvif->role_id == WL12XX_INVALID_ROLE_ID ||
+                    !test_bit(wlvif->role_id , &roles_bitmap))
+                        continue;
 
-                        vif = wl12xx_wlvif_to_vif(wlvif);
-                        addr = wl->links[h].addr;
+                /*
+                 * if the work is already queued, it should take place.
+                 * We don't want to delay the connection loss
+                 * indication any more.
+                 */
+                ieee80211_queue_delayed_work(wl->hw,
+                                             &wlvif->connection_loss_work,
+                                             msecs_to_jiffies(delay));
 
-                        rcu_read_lock();
-                        sta = ieee80211_find_sta(vif, addr);
-                        if (sta) {
-                                wl1271_debug(DEBUG_EVENT, "remove sta %d", h);
-                                ieee80211_report_low_ack(sta, num_packets);
-                        }
-                        rcu_read_unlock();
-                }
+                vif = wl12xx_wlvif_to_vif(wlvif);
+                ieee80211_cqm_rssi_notify(
+                                vif,
+                                NL80211_CQM_RSSI_BEACON_LOSS_EVENT,
+                                GFP_KERNEL);
         }
-        return 0;
 }
+EXPORT_SYMBOL_GPL(wlcore_event_beacon_loss);
 
 int wl1271_event_unmask(struct wl1271 *wl)
 {
@@ -305,12 +277,12 @@ int wl1271_event_handle(struct wl1271 *wl, u8 mbox_num)
 
         /* first we read the mbox descriptor */
         ret = wlcore_read(wl, wl->mbox_ptr[mbox_num], wl->mbox,
-                          sizeof(*wl->mbox), false);
+                          wl->mbox_size, false);
         if (ret < 0)
                 return ret;
 
         /* process the descriptor */
-        ret = wl1271_event_process(wl);
+        ret = wl->ops->process_mailbox_events(wl);
         if (ret < 0)
                 return ret;
 
diff --git a/drivers/net/wireless/ti/wlcore/event.h b/drivers/net/wireless/ti/wlcore/event.h
index 8adf18d6c58f..acc7a59d3828 100644
--- a/drivers/net/wireless/ti/wlcore/event.h
+++ b/drivers/net/wireless/ti/wlcore/event.h
@@ -46,33 +46,17 @@ enum {
         RSSI_SNR_TRIGGER_5_EVENT_ID              = BIT(5),
         RSSI_SNR_TRIGGER_6_EVENT_ID              = BIT(6),
         RSSI_SNR_TRIGGER_7_EVENT_ID              = BIT(7),
-        MEASUREMENT_START_EVENT_ID               = BIT(8),
-        MEASUREMENT_COMPLETE_EVENT_ID            = BIT(9),
-        SCAN_COMPLETE_EVENT_ID                   = BIT(10),
-        WFD_DISCOVERY_COMPLETE_EVENT_ID          = BIT(11),
-        AP_DISCOVERY_COMPLETE_EVENT_ID           = BIT(12),
-        RESERVED1                                = BIT(13),
-        PSPOLL_DELIVERY_FAILURE_EVENT_ID         = BIT(14),
-        ROLE_STOP_COMPLETE_EVENT_ID              = BIT(15),
-        RADAR_DETECTED_EVENT_ID                  = BIT(16),
-        CHANNEL_SWITCH_COMPLETE_EVENT_ID         = BIT(17),
-        BSS_LOSE_EVENT_ID                        = BIT(18),
-        REGAINED_BSS_EVENT_ID                    = BIT(19),
-        MAX_TX_RETRY_EVENT_ID                    = BIT(20),
-        DUMMY_PACKET_EVENT_ID                    = BIT(21),
-        SOFT_GEMINI_SENSE_EVENT_ID               = BIT(22),
-        CHANGE_AUTO_MODE_TIMEOUT_EVENT_ID        = BIT(23),
-        SOFT_GEMINI_AVALANCHE_EVENT_ID           = BIT(24),
-        PLT_RX_CALIBRATION_COMPLETE_EVENT_ID     = BIT(25),
-        INACTIVE_STA_EVENT_ID                    = BIT(26),
-        PEER_REMOVE_COMPLETE_EVENT_ID            = BIT(27),
-        PERIODIC_SCAN_COMPLETE_EVENT_ID          = BIT(28),
-        PERIODIC_SCAN_REPORT_EVENT_ID            = BIT(29),
-        BA_SESSION_RX_CONSTRAINT_EVENT_ID        = BIT(30),
-        REMAIN_ON_CHANNEL_COMPLETE_EVENT_ID      = BIT(31),
+
         EVENT_MBOX_ALL_EVENT_ID                  = 0x7fffffff,
 };
 
+/* events the driver might want to wait for */
+enum wlcore_wait_event {
+        WLCORE_EVENT_ROLE_STOP_COMPLETE,
+        WLCORE_EVENT_PEER_REMOVE_COMPLETE,
+        WLCORE_EVENT_DFS_CONFIG_COMPLETE
+};
+
 enum {
         EVENT_ENTER_POWER_SAVE_FAIL = 0,
         EVENT_ENTER_POWER_SAVE_SUCCESS,
@@ -80,61 +64,24 @@ enum {
 
 #define NUM_OF_RSSI_SNR_TRIGGERS 8
 
-struct event_mailbox {
-        __le32 events_vector;
-        __le32 events_mask;
-        __le32 reserved_1;
-        __le32 reserved_2;
-
-        u8 number_of_scan_results;
-        u8 scan_tag;
-        u8 completed_scan_status;
-        u8 reserved_3;
-
-        u8 soft_gemini_sense_info;
-        u8 soft_gemini_protective_info;
-        s8 rssi_snr_trigger_metric[NUM_OF_RSSI_SNR_TRIGGERS];
-        u8 change_auto_mode_timeout;
-        u8 scheduled_scan_status;
-        u8 reserved4;
-        /* tuned channel (roc) */
-        u8 roc_channel;
-
-        __le16 hlid_removed_bitmap;
-
-        /* bitmap of aged stations (by HLID) */
-        __le16 sta_aging_status;
-
-        /* bitmap of stations (by HLID) which exceeded max tx retries */
-        __le16 sta_tx_retry_exceeded;
-
-        /* discovery completed results */
-        u8 discovery_tag;
-        u8 number_of_preq_results;
-        u8 number_of_prsp_results;
-        u8 reserved_5;
-
-        /* rx ba constraint */
-        u8 role_id; /* 0xFF means any role. */
-        u8 rx_ba_allowed;
-        u8 reserved_6[2];
-
-        /* Channel switch results */
-
-        u8 channel_switch_role_id;
-        u8 channel_switch_status;
-        u8 reserved_7[2];
-
-        u8 ps_poll_delivery_failure_role_ids;
-        u8 stopped_role_ids;
-        u8 started_role_ids;
-
-        u8 reserved_8[9];
-} __packed;
-
 struct wl1271;
 
 int wl1271_event_unmask(struct wl1271 *wl);
 int wl1271_event_handle(struct wl1271 *wl, u8 mbox);
 
+void wlcore_event_soft_gemini_sense(struct wl1271 *wl, u8 enable);
+void wlcore_event_sched_scan_completed(struct wl1271 *wl,
+                                       u8 status);
+void wlcore_event_ba_rx_constraint(struct wl1271 *wl,
+                                   unsigned long roles_bitmap,
+                                   unsigned long allowed_bitmap);
+void wlcore_event_channel_switch(struct wl1271 *wl,
+                                 unsigned long roles_bitmap,
+                                 bool success);
+void wlcore_event_beacon_loss(struct wl1271 *wl, unsigned long roles_bitmap);
+void wlcore_event_dummy_packet(struct wl1271 *wl);
+void wlcore_event_max_tx_failure(struct wl1271 *wl, unsigned long sta_bitmap);
+void wlcore_event_inactive_sta(struct wl1271 *wl, unsigned long sta_bitmap);
+void wlcore_event_roc_complete(struct wl1271 *wl);
+void wlcore_event_rssi_trigger(struct wl1271 *wl, s8 *metric_arr);
 #endif
diff --git a/drivers/net/wireless/ti/wlcore/hw_ops.h b/drivers/net/wireless/ti/wlcore/hw_ops.h
index 2673d783ec1e..7fd260c02a0a 100644
--- a/drivers/net/wireless/ti/wlcore/hw_ops.h
+++ b/drivers/net/wireless/ti/wlcore/hw_ops.h
@@ -201,4 +201,45 @@ wlcore_hw_pre_pkt_send(struct wl1271 *wl, u32 buf_offset, u32 last_len)
         return buf_offset;
 }
 
+static inline void
+wlcore_hw_sta_rc_update(struct wl1271 *wl, struct wl12xx_vif *wlvif,
+                        struct ieee80211_sta *sta, u32 changed)
+{
+        if (wl->ops->sta_rc_update)
+                wl->ops->sta_rc_update(wl, wlvif, sta, changed);
+}
+
+static inline int
+wlcore_hw_set_peer_cap(struct wl1271 *wl,
+                       struct ieee80211_sta_ht_cap *ht_cap,
+                       bool allow_ht_operation,
+                       u32 rate_set, u8 hlid)
+{
+        if (wl->ops->set_peer_cap)
+                return wl->ops->set_peer_cap(wl, ht_cap, allow_ht_operation,
+                                             rate_set, hlid);
+
+        return 0;
+}
+
+static inline bool
+wlcore_hw_lnk_high_prio(struct wl1271 *wl, u8 hlid,
+                        struct wl1271_link *lnk)
+{
+        if (!wl->ops->lnk_high_prio)
+                BUG_ON(1);
+
+        return wl->ops->lnk_high_prio(wl, hlid, lnk);
+}
+
+static inline bool
+wlcore_hw_lnk_low_prio(struct wl1271 *wl, u8 hlid,
+                       struct wl1271_link *lnk)
+{
+        if (!wl->ops->lnk_low_prio)
+                BUG_ON(1);
+
+        return wl->ops->lnk_low_prio(wl, hlid, lnk);
+}
+
 #endif
diff --git a/drivers/net/wireless/ti/wlcore/init.c b/drivers/net/wireless/ti/wlcore/init.c
index 32d157f62f31..5c6f11e157d9 100644
--- a/drivers/net/wireless/ti/wlcore/init.c
+++ b/drivers/net/wireless/ti/wlcore/init.c
@@ -41,14 +41,14 @@ int wl1271_init_templates_config(struct wl1271 *wl)
 
         /* send empty templates for fw memory reservation */
         ret = wl1271_cmd_template_set(wl, WL12XX_INVALID_ROLE_ID,
-                                      CMD_TEMPL_CFG_PROBE_REQ_2_4, NULL,
+                                      wl->scan_templ_id_2_4, NULL,
                                       WL1271_CMD_TEMPL_MAX_SIZE,
                                       0, WL1271_RATE_AUTOMATIC);
         if (ret < 0)
                 return ret;
 
         ret = wl1271_cmd_template_set(wl, WL12XX_INVALID_ROLE_ID,
-                                      CMD_TEMPL_CFG_PROBE_REQ_5,
+                                      wl->scan_templ_id_5,
                                       NULL, WL1271_CMD_TEMPL_MAX_SIZE, 0,
                                       WL1271_RATE_AUTOMATIC);
         if (ret < 0)
@@ -56,14 +56,16 @@ int wl1271_init_templates_config(struct wl1271 *wl)
 
         if (wl->quirks & WLCORE_QUIRK_DUAL_PROBE_TMPL) {
                 ret = wl1271_cmd_template_set(wl, WL12XX_INVALID_ROLE_ID,
-                                              CMD_TEMPL_APP_PROBE_REQ_2_4, NULL,
+                                              wl->sched_scan_templ_id_2_4,
+                                              NULL,
                                               WL1271_CMD_TEMPL_MAX_SIZE,
                                               0, WL1271_RATE_AUTOMATIC);
                 if (ret < 0)
                         return ret;
 
                 ret = wl1271_cmd_template_set(wl, WL12XX_INVALID_ROLE_ID,
-                                              CMD_TEMPL_APP_PROBE_REQ_5, NULL,
+                                              wl->sched_scan_templ_id_5,
+                                              NULL,
                                               WL1271_CMD_TEMPL_MAX_SIZE,
                                               0, WL1271_RATE_AUTOMATIC);
                 if (ret < 0)
@@ -463,7 +465,7 @@ int wl1271_init_ap_rates(struct wl1271 *wl, struct wl12xx_vif *wlvif)
         if ((wlvif->basic_rate_set & CONF_TX_OFDM_RATES))
                 supported_rates = CONF_TX_OFDM_RATES;
         else
-                supported_rates = CONF_TX_AP_ENABLED_RATES;
+                supported_rates = CONF_TX_ENABLED_RATES;
 
         /* unconditionally enable HT rates */
         supported_rates |= CONF_TX_MCS_RATES;
@@ -575,9 +577,6 @@ int wl1271_init_vif_specific(struct wl1271 *wl, struct ieee80211_vif *vif)
                 /* Configure for power according to debugfs */
                 if (sta_auth != WL1271_PSM_ILLEGAL)
                         ret = wl1271_acx_sleep_auth(wl, sta_auth);
-                /* Configure for power always on */
-                else if (wl->quirks & WLCORE_QUIRK_NO_ELP)
-                        ret = wl1271_acx_sleep_auth(wl, WL1271_PSM_CAM);
                 /* Configure for ELP power saving */
                 else
                         ret = wl1271_acx_sleep_auth(wl, WL1271_PSM_ELP);
@@ -679,6 +678,10 @@ int wl1271_hw_init(struct wl1271 *wl)
         if (ret < 0)
                 return ret;
 
+        ret = wlcore_cmd_regdomain_config_locked(wl);
+        if (ret < 0)
+                return ret;
+
         /* Bluetooth WLAN coexistence */
         ret = wl1271_init_pta(wl);
         if (ret < 0)
diff --git a/drivers/net/wireless/ti/wlcore/io.h b/drivers/net/wireless/ti/wlcore/io.h
index f48530fec14f..af7d9f9b3b4d 100644
--- a/drivers/net/wireless/ti/wlcore/io.h
+++ b/drivers/net/wireless/ti/wlcore/io.h
@@ -105,13 +105,13 @@ static inline int __must_check wlcore_raw_read32(struct wl1271 *wl, int addr,
 {
         int ret;
 
-        ret = wlcore_raw_read(wl, addr, &wl->buffer_32,
-                              sizeof(wl->buffer_32), false);
+        ret = wlcore_raw_read(wl, addr, wl->buffer_32,
+                              sizeof(*wl->buffer_32), false);
         if (ret < 0)
                 return ret;
 
         if (val)
-                *val = le32_to_cpu(wl->buffer_32);
+                *val = le32_to_cpu(*wl->buffer_32);
 
         return 0;
 }
@@ -119,9 +119,9 @@ static inline int __must_check wlcore_raw_read32(struct wl1271 *wl, int addr,
 static inline int __must_check wlcore_raw_write32(struct wl1271 *wl, int addr,
                                                   u32 val)
 {
-        wl->buffer_32 = cpu_to_le32(val);
-        return wlcore_raw_write(wl, addr, &wl->buffer_32,
-                                sizeof(wl->buffer_32), false);
+        *wl->buffer_32 = cpu_to_le32(val);
+        return wlcore_raw_write(wl, addr, wl->buffer_32,
+                                sizeof(*wl->buffer_32), false);
 }
 
 static inline int __must_check wlcore_read(struct wl1271 *wl, int addr,
diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c
index ea9d8e011bc9..e1dfdf94d0f7 100644
--- a/drivers/net/wireless/ti/wlcore/main.c
+++ b/drivers/net/wireless/ti/wlcore/main.c
@@ -56,8 +56,8 @@
 #define WL1271_BOOT_RETRIES 3
 
 static char *fwlog_param;
-static bool bug_on_recovery;
-static bool no_recovery;
+static int bug_on_recovery = -1;
+static int no_recovery     = -1;
 
 static void __wl1271_op_remove_interface(struct wl1271 *wl,
                                          struct ieee80211_vif *vif,
@@ -79,22 +79,22 @@ static int wl12xx_set_authorized(struct wl1271 *wl,
         if (test_and_set_bit(WLVIF_FLAG_STA_STATE_SENT, &wlvif->flags))
                 return 0;
 
-        ret = wl12xx_cmd_set_peer_state(wl, wlvif->sta.hlid);
+        ret = wl12xx_cmd_set_peer_state(wl, wlvif, wlvif->sta.hlid);
         if (ret < 0)
                 return ret;
 
-        wl12xx_croc(wl, wlvif->role_id);
-
         wl1271_info("Association completed.");
         return 0;
 }
 
-static int wl1271_reg_notify(struct wiphy *wiphy,
-                             struct regulatory_request *request)
+static void wl1271_reg_notify(struct wiphy *wiphy,
+                              struct regulatory_request *request)
 {
         struct ieee80211_supported_band *band;
         struct ieee80211_channel *ch;
         int i;
+        struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
+        struct wl1271 *wl = hw->priv;
 
         band = wiphy->bands[IEEE80211_BAND_5GHZ];
         for (i = 0; i < band->n_channels; i++) {
@@ -108,7 +108,8 @@ static int wl1271_reg_notify(struct wiphy *wiphy,
 
         }
 
-        return 0;
+        if (likely(wl->state == WLCORE_STATE_ON))
+                wlcore_regdomain_config(wl);
 }
 
 static int wl1271_set_rx_streaming(struct wl1271 *wl, struct wl12xx_vif *wlvif,
@@ -303,6 +304,7 @@ out:
 static void wlcore_adjust_conf(struct wl1271 *wl)
 {
         /* Adjust settings according to optional module parameters */
+
         if (fwlog_param) {
                 if (!strcmp(fwlog_param, "continuous")) {
                         wl->conf.fwlog.mode = WL12XX_FWLOG_CONTINUOUS;
@@ -318,16 +320,22 @@ static void wlcore_adjust_conf(struct wl1271 *wl)
                         wl1271_error("Unknown fwlog parameter %s", fwlog_param);
                 }
         }
+
+        if (bug_on_recovery != -1)
+                wl->conf.recovery.bug_on_recovery = (u8) bug_on_recovery;
+
+        if (no_recovery != -1)
+                wl->conf.recovery.no_recovery = (u8) no_recovery;
 }
 
 static void wl12xx_irq_ps_regulate_link(struct wl1271 *wl,
                                         struct wl12xx_vif *wlvif,
                                         u8 hlid, u8 tx_pkts)
 {
-        bool fw_ps, single_sta;
+        bool fw_ps, single_link;
 
         fw_ps = test_bit(hlid, (unsigned long *)&wl->ap_fw_ps_map);
-        single_sta = (wl->active_sta_count == 1);
+        single_link = (wl->active_link_count == 1);
 
         /*
          * Wake up from high level PS if the STA is asleep with too little
@@ -338,10 +346,10 @@ static void wl12xx_irq_ps_regulate_link(struct wl1271 *wl,
 
         /*
          * Start high-level PS if the STA is asleep with enough blocks in FW.
-         * Make an exception if this is the only connected station. In this
-         * case FW-memory congestion is not a problem.
+         * Make an exception if this is the only connected link. In this
+         * case FW-memory congestion is less of a problem.
          */
-        else if (!single_sta && fw_ps && tx_pkts >= WL1271_PS_STA_MAX_PACKETS)
+        else if (!single_link && fw_ps && tx_pkts >= WL1271_PS_STA_MAX_PACKETS)
                 wl12xx_ps_link_start(wl, wlvif, hlid, true);
 }
 
@@ -349,11 +357,8 @@ static void wl12xx_irq_update_links_status(struct wl1271 *wl,
                                            struct wl12xx_vif *wlvif,
                                            struct wl_fw_status_2 *status)
 {
-        struct wl1271_link *lnk;
         u32 cur_fw_ps_map;
-        u8 hlid, cnt;
-
-        /* TODO: also use link_fast_bitmap here */
+        u8 hlid;
 
         cur_fw_ps_map = le32_to_cpu(status->link_ps_bitmap);
         if (wl->ap_fw_ps_map != cur_fw_ps_map) {
@@ -365,17 +370,9 @@ static void wl12xx_irq_update_links_status(struct wl1271 *wl,
                 wl->ap_fw_ps_map = cur_fw_ps_map;
         }
 
-        for_each_set_bit(hlid, wlvif->ap.sta_hlid_map, WL12XX_MAX_LINKS) {
-                lnk = &wl->links[hlid];
-                cnt = status->counters.tx_lnk_free_pkts[hlid] -
-                        lnk->prev_freed_pkts;
-
-                lnk->prev_freed_pkts = status->counters.tx_lnk_free_pkts[hlid];
-                lnk->allocated_pkts -= cnt;
-
+        for_each_set_bit(hlid, wlvif->ap.sta_hlid_map, WL12XX_MAX_LINKS)
                 wl12xx_irq_ps_regulate_link(wl, wlvif, hlid,
-                                            lnk->allocated_pkts);
-        }
+                                            wl->links[hlid].allocated_pkts);
 }
 
 static int wlcore_fw_status(struct wl1271 *wl,
@@ -389,6 +386,7 @@ static int wlcore_fw_status(struct wl1271 *wl,
         int i;
         size_t status_len;
         int ret;
+        struct wl1271_link *lnk;
 
         status_len = WLCORE_FW_STATUS_1_LEN(wl->num_rx_desc) +
                 sizeof(*status_2) + wl->fw_status_priv_len;
@@ -414,6 +412,17 @@ static int wlcore_fw_status(struct wl1271 *wl,
                 wl->tx_pkts_freed[i] = status_2->counters.tx_released_pkts[i];
         }
 
+
+        for_each_set_bit(i, wl->links_map, WL12XX_MAX_LINKS) {
+                lnk = &wl->links[i];
+                /* prevent wrap-around in freed-packets counter */
+                lnk->allocated_pkts -=
+                        (status_2->counters.tx_lnk_free_pkts[i] -
+                         lnk->prev_freed_pkts) & 0xff;
+
+                lnk->prev_freed_pkts = status_2->counters.tx_lnk_free_pkts[i];
+        }
+
         /* prevent wrap-around in total blocks counter */
         if (likely(wl->tx_blocks_freed <=
                    le32_to_cpu(status_2->total_released_blks)))
@@ -466,6 +475,8 @@ static int wlcore_fw_status(struct wl1271 *wl,
         wl->time_offset = (timespec_to_ns(&ts) >> 10) -
                 (s64)le32_to_cpu(status_2->fw_localtime);
 
+        wl->fw_fast_lnk_map = le32_to_cpu(status_2->link_fast_bitmap);
+
         return 0;
 }
 
@@ -802,11 +813,13 @@ static void wl12xx_read_fwlog_panic(struct wl1271 *wl)
 
         /*
          * Make sure the chip is awake and the logger isn't active.
-         * Do not send a stop fwlog command if the fw is hanged.
+         * Do not send a stop fwlog command if the fw is hanged or if
+         * dbgpins are used (due to some fw bug).
          */
         if (wl1271_ps_elp_wakeup(wl))
                 goto out;
-        if (!wl->watchdog_recovery)
+        if (!wl->watchdog_recovery &&
+            wl->conf.fwlog.output != WL12XX_FWLOG_OUTPUT_DBG_PINS)
                 wl12xx_cmd_stop_fwlog(wl);
 
         /* Read the first memory block address */
@@ -874,7 +887,8 @@ static void wlcore_print_recovery(struct wl1271 *wl)
         if (ret < 0)
                 return;
 
-        wl1271_info("pc: 0x%x, hint_sts: 0x%08x", pc, hint_sts);
+        wl1271_info("pc: 0x%x, hint_sts: 0x%08x count: %d",
+                                pc, hint_sts, ++wl->recovery_count);
 
         wlcore_set_partition(wl, &wl->ptable[PART_WORK]);
 }
@@ -897,10 +911,10 @@ static void wl1271_recovery_work(struct work_struct *work)
                 wlcore_print_recovery(wl);
         }
 
-        BUG_ON(bug_on_recovery &&
+        BUG_ON(wl->conf.recovery.bug_on_recovery &&
                !test_bit(WL1271_FLAG_INTENDED_FW_RECOVERY, &wl->flags));
 
-        if (no_recovery) {
+        if (wl->conf.recovery.no_recovery) {
                 wl1271_info("No recovery (chosen on module load). Fw will remain stuck.");
                 goto out_unlock;
         }
@@ -920,11 +934,6 @@ static void wl1271_recovery_work(struct work_struct *work)
         /* Prevent spurious TX during FW restart */
         wlcore_stop_queues(wl, WLCORE_QUEUE_STOP_REASON_FW_RESTART);
 
-        if (wl->sched_scanning) {
-                ieee80211_sched_scan_stopped(wl->hw);
-                wl->sched_scanning = false;
-        }
-
         /* reboot the chipset */
         while (!list_empty(&wl->wlvif_list)) {
                 wlvif = list_first_entry(&wl->wlvif_list,
@@ -1141,7 +1150,6 @@ int wl1271_plt_stop(struct wl1271 *wl)
         cancel_work_sync(&wl->recovery_work);
         cancel_delayed_work_sync(&wl->elp_work);
         cancel_delayed_work_sync(&wl->tx_watchdog_work);
-        cancel_delayed_work_sync(&wl->connection_loss_work);
 
         mutex_lock(&wl->mutex);
         wl1271_power_off(wl);
@@ -1169,9 +1177,13 @@ static void wl1271_op_tx(struct ieee80211_hw *hw,
         int q, mapping;
         u8 hlid;
 
-        if (vif)
-                wlvif = wl12xx_vif_to_data(vif);
+        if (!vif) {
+                wl1271_debug(DEBUG_TX, "DROP skb with no vif");
+                ieee80211_free_txskb(hw, skb);
+                return;
+        }
 
+        wlvif = wl12xx_vif_to_data(vif);
         mapping = skb_get_queue_mapping(skb);
         q = wl1271_tx_get_queue(mapping);
 
@@ -1185,9 +1197,9 @@ static void wl1271_op_tx(struct ieee80211_hw *hw,
          * allow these packets through.
          */
         if (hlid == WL12XX_INVALID_LINK_ID ||
-            (wlvif && !test_bit(hlid, wlvif->links_map)) ||
-             (wlcore_is_queue_stopped(wl, q) &&
-              !wlcore_is_queue_stopped_by_reason(wl, q,
+            (!test_bit(hlid, wlvif->links_map)) ||
+             (wlcore_is_queue_stopped_locked(wl, wlvif, q) &&
+              !wlcore_is_queue_stopped_by_reason_locked(wl, wlvif, q,
                         WLCORE_QUEUE_STOP_REASON_WATERMARK))) {
                 wl1271_debug(DEBUG_TX, "DROP skb hlid %d q %d", hlid, q);
                 ieee80211_free_txskb(hw, skb);
@@ -1199,16 +1211,17 @@ static void wl1271_op_tx(struct ieee80211_hw *hw,
         skb_queue_tail(&wl->links[hlid].tx_queue[q], skb);
 
         wl->tx_queue_count[q]++;
+        wlvif->tx_queue_count[q]++;
 
         /*
          * The workqueue is slow to process the tx_queue and we need stop
          * the queue here, otherwise the queue will get too long.
          */
-        if (wl->tx_queue_count[q] >= WL1271_TX_QUEUE_HIGH_WATERMARK &&
-            !wlcore_is_queue_stopped_by_reason(wl, q,
+        if (wlvif->tx_queue_count[q] >= WL1271_TX_QUEUE_HIGH_WATERMARK &&
+            !wlcore_is_queue_stopped_by_reason_locked(wl, wlvif, q,
                                         WLCORE_QUEUE_STOP_REASON_WATERMARK)) {
                 wl1271_debug(DEBUG_TX, "op_tx: stopping queues for q %d", q);
-                wlcore_stop_queue_locked(wl, q,
+                wlcore_stop_queue_locked(wl, wlvif, q,
                                          WLCORE_QUEUE_STOP_REASON_WATERMARK);
         }
 
@@ -1843,11 +1856,10 @@ static void wlcore_op_stop_locked(struct wl1271 *wl)
         cancel_work_sync(&wl->tx_work);
         cancel_delayed_work_sync(&wl->elp_work);
         cancel_delayed_work_sync(&wl->tx_watchdog_work);
-        cancel_delayed_work_sync(&wl->connection_loss_work);
 
         /* let's notify MAC80211 about the remaining pending TX frames */
-        wl12xx_tx_reset(wl);
         mutex_lock(&wl->mutex);
+        wl12xx_tx_reset(wl);
 
         wl1271_power_off(wl);
         /*
@@ -1870,14 +1882,17 @@ static void wlcore_op_stop_locked(struct wl1271 *wl)
         wl->time_offset = 0;
         wl->ap_fw_ps_map = 0;
         wl->ap_ps_map = 0;
-        wl->sched_scanning = false;
         wl->sleep_auth = WL1271_PSM_ILLEGAL;
         memset(wl->roles_map, 0, sizeof(wl->roles_map));
         memset(wl->links_map, 0, sizeof(wl->links_map));
         memset(wl->roc_map, 0, sizeof(wl->roc_map));
+        memset(wl->session_ids, 0, sizeof(wl->session_ids));
         wl->active_sta_count = 0;
+        wl->active_link_count = 0;
 
         /* The system link is always allocated */
+        wl->links[WL12XX_SYSTEM_HLID].allocated_pkts = 0;
+        wl->links[WL12XX_SYSTEM_HLID].prev_freed_pkts = 0;
         __set_bit(WL12XX_SYSTEM_HLID, wl->links_map);
 
         /*
@@ -1903,6 +1918,12 @@ static void wlcore_op_stop_locked(struct wl1271 *wl)
         wl->tx_res_if = NULL;
         kfree(wl->target_mem_map);
         wl->target_mem_map = NULL;
+
+        /*
+         * FW channels must be re-calibrated after recovery,
+         * clear the last Reg-Domain channel configuration.
+         */
+        memset(wl->reg_ch_conf_last, 0, sizeof(wl->reg_ch_conf_last));
 }
 
 static void wlcore_op_stop(struct ieee80211_hw *hw)
@@ -1918,6 +1939,71 @@ static void wlcore_op_stop(struct ieee80211_hw *hw)
         mutex_unlock(&wl->mutex);
 }
 
+static void wlcore_channel_switch_work(struct work_struct *work)
+{
+        struct delayed_work *dwork;
+        struct wl1271 *wl;
+        struct ieee80211_vif *vif;
+        struct wl12xx_vif *wlvif;
+        int ret;
+
+        dwork = container_of(work, struct delayed_work, work);
+        wlvif = container_of(dwork, struct wl12xx_vif, channel_switch_work);
+        wl = wlvif->wl;
+
+        wl1271_info("channel switch failed (role_id: %d).", wlvif->role_id);
+
+        mutex_lock(&wl->mutex);
+
+        if (unlikely(wl->state != WLCORE_STATE_ON))
+                goto out;
+
+        /* check the channel switch is still ongoing */
+        if (!test_and_clear_bit(WLVIF_FLAG_CS_PROGRESS, &wlvif->flags))
+                goto out;
+
+        vif = wl12xx_wlvif_to_vif(wlvif);
+        ieee80211_chswitch_done(vif, false);
+
+        ret = wl1271_ps_elp_wakeup(wl);
+        if (ret < 0)
+                goto out;
+
+        wl12xx_cmd_stop_channel_switch(wl, wlvif);
+
+        wl1271_ps_elp_sleep(wl);
+out:
+        mutex_unlock(&wl->mutex);
+}
+
+static void wlcore_connection_loss_work(struct work_struct *work)
+{
+        struct delayed_work *dwork;
+        struct wl1271 *wl;
+        struct ieee80211_vif *vif;
+        struct wl12xx_vif *wlvif;
+
+        dwork = container_of(work, struct delayed_work, work);
+        wlvif = container_of(dwork, struct wl12xx_vif, connection_loss_work);
+        wl = wlvif->wl;
+
+        wl1271_info("Connection loss work (role_id: %d).", wlvif->role_id);
+
+        mutex_lock(&wl->mutex);
+
+        if (unlikely(wl->state != WLCORE_STATE_ON))
+                goto out;
+
+        /* Call mac80211 connection loss */
+        if (!test_bit(WLVIF_FLAG_STA_ASSOCIATED, &wlvif->flags))
+                goto out;
+
+        vif = wl12xx_wlvif_to_vif(wlvif);
+        ieee80211_connection_loss(vif);
+out:
+        mutex_unlock(&wl->mutex);
+}
+
 static int wl12xx_allocate_rate_policy(struct wl1271 *wl, u8 *idx)
 {
         u8 policy = find_first_zero_bit(wl->rate_policies_map,
@@ -2037,15 +2123,15 @@ static int wl12xx_init_vif_data(struct wl1271 *wl, struct ieee80211_vif *vif)
                 for (i = 0; i < CONF_TX_MAX_AC_COUNT; i++)
                         wl12xx_allocate_rate_policy(wl,
                                                 &wlvif->ap.ucast_rate_idx[i]);
-                wlvif->basic_rate_set = CONF_TX_AP_ENABLED_RATES;
+                wlvif->basic_rate_set = CONF_TX_ENABLED_RATES;
                 /*
                  * TODO: check if basic_rate shouldn't be
                  * wl1271_tx_min_rate_get(wl, wlvif->basic_rate_set);
                  * instead (the same thing for STA above).
                 */
-                wlvif->basic_rate = CONF_TX_AP_ENABLED_RATES;
+                wlvif->basic_rate = CONF_TX_ENABLED_RATES;
                 /* TODO: this seems to be used only for STA, check it */
-                wlvif->rate_set = CONF_TX_AP_ENABLED_RATES;
+                wlvif->rate_set = CONF_TX_ENABLED_RATES;
         }
 
         wlvif->bitrate_masks[IEEE80211_BAND_2GHZ] = wl->conf.tx.basic_rate;
@@ -2065,6 +2151,10 @@ static int wl12xx_init_vif_data(struct wl1271 *wl, struct ieee80211_vif *vif)
                   wl1271_rx_streaming_enable_work);
         INIT_WORK(&wlvif->rx_streaming_disable_work,
                   wl1271_rx_streaming_disable_work);
+        INIT_DELAYED_WORK(&wlvif->channel_switch_work,
+                          wlcore_channel_switch_work);
+        INIT_DELAYED_WORK(&wlvif->connection_loss_work,
+                          wlcore_connection_loss_work);
         INIT_LIST_HEAD(&wlvif->list);
 
         setup_timer(&wlvif->rx_streaming_timer, wl1271_rx_streaming_timer,
@@ -2198,6 +2288,81 @@ static void wl12xx_force_active_psm(struct wl1271 *wl)
         }
 }
 
+struct wlcore_hw_queue_iter_data {
+        unsigned long hw_queue_map[BITS_TO_LONGS(WLCORE_NUM_MAC_ADDRESSES)];
+        /* current vif */
+        struct ieee80211_vif *vif;
+        /* is the current vif among those iterated */
+        bool cur_running;
+};
+
+static void wlcore_hw_queue_iter(void *data, u8 *mac,
+                                 struct ieee80211_vif *vif)
+{
+        struct wlcore_hw_queue_iter_data *iter_data = data;
+
+        if (WARN_ON_ONCE(vif->hw_queue[0] == IEEE80211_INVAL_HW_QUEUE))
+                return;
+
+        if (iter_data->cur_running || vif == iter_data->vif) {
+                iter_data->cur_running = true;
+                return;
+        }
+
+        __set_bit(vif->hw_queue[0] / NUM_TX_QUEUES, iter_data->hw_queue_map);
+}
+
+static int wlcore_allocate_hw_queue_base(struct wl1271 *wl,
+                                         struct wl12xx_vif *wlvif)
+{
+        struct ieee80211_vif *vif = wl12xx_wlvif_to_vif(wlvif);
+        struct wlcore_hw_queue_iter_data iter_data = {};
+        int i, q_base;
+
+        iter_data.vif = vif;
+
+        /* mark all bits taken by active interfaces */
+        ieee80211_iterate_active_interfaces_atomic(wl->hw,
+                                        IEEE80211_IFACE_ITER_RESUME_ALL,
+                                        wlcore_hw_queue_iter, &iter_data);
+
+        /* the current vif is already running in mac80211 (resume/recovery) */
+        if (iter_data.cur_running) {
+                wlvif->hw_queue_base = vif->hw_queue[0];
+                wl1271_debug(DEBUG_MAC80211,
+                             "using pre-allocated hw queue base %d",
+                             wlvif->hw_queue_base);
+
+                /* interface type might have changed type */
+                goto adjust_cab_queue;
+        }
+
+        q_base = find_first_zero_bit(iter_data.hw_queue_map,
+                                     WLCORE_NUM_MAC_ADDRESSES);
+        if (q_base >= WLCORE_NUM_MAC_ADDRESSES)
+                return -EBUSY;
+
+        wlvif->hw_queue_base = q_base * NUM_TX_QUEUES;
+        wl1271_debug(DEBUG_MAC80211, "allocating hw queue base: %d",
+                     wlvif->hw_queue_base);
+
+        for (i = 0; i < NUM_TX_QUEUES; i++) {
+                wl->queue_stop_reasons[wlvif->hw_queue_base + i] = 0;
+                /* register hw queues in mac80211 */
+                vif->hw_queue[i] = wlvif->hw_queue_base + i;
+        }
+
+adjust_cab_queue:
+        /* the last places are reserved for cab queues per interface */
+        if (wlvif->bss_type == BSS_TYPE_AP_BSS)
+                vif->cab_queue = NUM_TX_QUEUES * WLCORE_NUM_MAC_ADDRESSES +
+                                 wlvif->hw_queue_base / NUM_TX_QUEUES;
+        else
+                vif->cab_queue = IEEE80211_INVAL_HW_QUEUE;
+
+        return 0;
+}
+
 static int wl1271_op_add_interface(struct ieee80211_hw *hw,
                                    struct ieee80211_vif *vif)
 {
@@ -2244,6 +2409,10 @@ static int wl1271_op_add_interface(struct ieee80211_hw *hw,
                 goto out;
         }
 
+        ret = wlcore_allocate_hw_queue_base(wl, wlvif);
+        if (ret < 0)
+                goto out;
+
         if (wl12xx_need_fw_change(wl, vif_count, true)) {
                 wl12xx_force_active_psm(wl);
                 set_bit(WL1271_FLAG_INTENDED_FW_RECOVERY, &wl->flags);
@@ -2314,7 +2483,7 @@ static void __wl1271_op_remove_interface(struct wl1271 *wl,
         wl1271_info("down");
 
         if (wl->scan.state != WL1271_SCAN_STATE_IDLE &&
-            wl->scan_vif == vif) {
+            wl->scan_wlvif == wlvif) {
                 /*
                  * Rearm the tx watchdog just before idling scan. This
                  * prevents just-finished scans from triggering the watchdog
@@ -2323,11 +2492,21 @@ static void __wl1271_op_remove_interface(struct wl1271 *wl,
 
                 wl->scan.state = WL1271_SCAN_STATE_IDLE;
                 memset(wl->scan.scanned_ch, 0, sizeof(wl->scan.scanned_ch));
-                wl->scan_vif = NULL;
+                wl->scan_wlvif = NULL;
                 wl->scan.req = NULL;
                 ieee80211_scan_completed(wl->hw, true);
         }
 
+        if (wl->sched_vif == wlvif) {
+                ieee80211_sched_scan_stopped(wl->hw);
+                wl->sched_vif = NULL;
+        }
+
+        if (wl->roc_vif == vif) {
+                wl->roc_vif = NULL;
+                ieee80211_remain_on_channel_expired(wl->hw);
+        }
+
         if (!test_bit(WL1271_FLAG_RECOVERY_IN_PROGRESS, &wl->flags)) {
                 /* disable active roles */
                 ret = wl1271_ps_elp_wakeup(wl);
@@ -2396,9 +2575,6 @@ deinit:
                 /* Configure for power according to debugfs */
                 if (sta_auth != WL1271_PSM_ILLEGAL)
                         wl1271_acx_sleep_auth(wl, sta_auth);
-                /* Configure for power always on */
-                else if (wl->quirks & WLCORE_QUIRK_NO_ELP)
-                        wl1271_acx_sleep_auth(wl, WL1271_PSM_CAM);
                 /* Configure for ELP power saving */
                 else
                         wl1271_acx_sleep_auth(wl, WL1271_PSM_ELP);
@@ -2410,6 +2586,7 @@ unlock:
         del_timer_sync(&wlvif->rx_streaming_timer);
         cancel_work_sync(&wlvif->rx_streaming_enable_work);
         cancel_work_sync(&wlvif->rx_streaming_disable_work);
+        cancel_delayed_work_sync(&wlvif->connection_loss_work);
 
         mutex_lock(&wl->mutex);
 }
@@ -2468,8 +2645,7 @@ static int wl12xx_op_change_interface(struct ieee80211_hw *hw,
         return ret;
 }
 
-static int wl1271_join(struct wl1271 *wl, struct wl12xx_vif *wlvif,
-                          bool set_assoc)
+static int wlcore_join(struct wl1271 *wl, struct wl12xx_vif *wlvif)
 {
         int ret;
         bool is_ibss = (wlvif->bss_type == BSS_TYPE_IBSS);
@@ -2489,18 +2665,111 @@ static int wl1271_join(struct wl1271 *wl, struct wl12xx_vif *wlvif,
         /* clear encryption type */
         wlvif->encryption_type = KEY_NONE;
 
-        if (set_assoc)
-                set_bit(WLVIF_FLAG_STA_ASSOCIATED, &wlvif->flags);
-
         if (is_ibss)
                 ret = wl12xx_cmd_role_start_ibss(wl, wlvif);
-        else
+        else {
+                if (wl->quirks & WLCORE_QUIRK_START_STA_FAILS) {
+                        /*
+                         * TODO: this is an ugly workaround for wl12xx fw
+                         * bug - we are not able to tx/rx after the first
+                         * start_sta, so make dummy start+stop calls,
+                         * and then call start_sta again.
+                         * this should be fixed in the fw.
+                         */
+                        wl12xx_cmd_role_start_sta(wl, wlvif);
+                        wl12xx_cmd_role_stop_sta(wl, wlvif);
+                }
+
                 ret = wl12xx_cmd_role_start_sta(wl, wlvif);
+        }
+
+        return ret;
+}
+
+static int wl1271_ssid_set(struct wl12xx_vif *wlvif, struct sk_buff *skb,
+                            int offset)
+{
+        u8 ssid_len;
+        const u8 *ptr = cfg80211_find_ie(WLAN_EID_SSID, skb->data + offset,
+                                         skb->len - offset);
+
+        if (!ptr) {
+                wl1271_error("No SSID in IEs!");
+                return -ENOENT;
+        }
+
+        ssid_len = ptr[1];
+        if (ssid_len > IEEE80211_MAX_SSID_LEN) {
+                wl1271_error("SSID is too long!");
+                return -EINVAL;
+        }
+
+        wlvif->ssid_len = ssid_len;
+        memcpy(wlvif->ssid, ptr+2, ssid_len);
+        return 0;
+}
+
+static int wlcore_set_ssid(struct wl1271 *wl, struct wl12xx_vif *wlvif)
+{
+        struct ieee80211_vif *vif = wl12xx_wlvif_to_vif(wlvif);
+        struct sk_buff *skb;
+        int ieoffset;
+
+        /* we currently only support setting the ssid from the ap probe req */
+        if (wlvif->bss_type != BSS_TYPE_STA_BSS)
+                return -EINVAL;
+
+        skb = ieee80211_ap_probereq_get(wl->hw, vif);
+        if (!skb)
+                return -EINVAL;
+
+        ieoffset = offsetof(struct ieee80211_mgmt,
+                            u.probe_req.variable);
+        wl1271_ssid_set(wlvif, skb, ieoffset);
+        dev_kfree_skb(skb);
+
+        return 0;
+}
+
+static int wlcore_set_assoc(struct wl1271 *wl, struct wl12xx_vif *wlvif,
+                            struct ieee80211_bss_conf *bss_conf,
+                            u32 sta_rate_set)
+{
+        int ieoffset;
+        int ret;
+
+        wlvif->aid = bss_conf->aid;
+        wlvif->channel_type = cfg80211_get_chandef_type(&bss_conf->chandef);
+        wlvif->beacon_int = bss_conf->beacon_int;
+        wlvif->wmm_enabled = bss_conf->qos;
+
+        set_bit(WLVIF_FLAG_STA_ASSOCIATED, &wlvif->flags);
+
+        /*
+         * with wl1271, we don't need to update the
+         * beacon_int and dtim_period, because the firmware
+         * updates it by itself when the first beacon is
+         * received after a join.
+         */
+        ret = wl1271_cmd_build_ps_poll(wl, wlvif, wlvif->aid);
         if (ret < 0)
-                goto out;
+                return ret;
 
-        if (!test_bit(WLVIF_FLAG_STA_ASSOCIATED, &wlvif->flags))
-                goto out;
+        /*
+         * Get a template for hardware connection maintenance
+         */
+        dev_kfree_skb(wlvif->probereq);
+        wlvif->probereq = wl1271_cmd_build_ap_probe_req(wl,
+                                                        wlvif,
+                                                        NULL);
+        ieoffset = offsetof(struct ieee80211_mgmt,
+                            u.probe_req.variable);
+        wl1271_ssid_set(wlvif, wlvif->probereq, ieoffset);
+
+        /* enable the connection monitoring feature */
+        ret = wl1271_acx_conn_monit_params(wl, wlvif, true);
+        if (ret < 0)
+                return ret;
 
         /*
          * The join command disable the keep-alive mode, shut down its process,
@@ -2510,35 +2779,83 @@ static int wl1271_join(struct wl1271 *wl, struct wl12xx_vif *wlvif,
          */
         ret = wl1271_acx_keep_alive_mode(wl, wlvif, true);
         if (ret < 0)
-                goto out;
+                return ret;
 
         ret = wl1271_acx_aid(wl, wlvif, wlvif->aid);
         if (ret < 0)
-                goto out;
+                return ret;
 
         ret = wl12xx_cmd_build_klv_null_data(wl, wlvif);
         if (ret < 0)
-                goto out;
+                return ret;
 
         ret = wl1271_acx_keep_alive_config(wl, wlvif,
                                            wlvif->sta.klv_template_id,
                                            ACX_KEEP_ALIVE_TPL_VALID);
         if (ret < 0)
-                goto out;
+                return ret;
+
+        /*
+         * The default fw psm configuration is AUTO, while mac80211 default
+         * setting is off (ACTIVE), so sync the fw with the correct value.
+         */
+        ret = wl1271_ps_set_mode(wl, wlvif, STATION_ACTIVE_MODE);
+        if (ret < 0)
+                return ret;
+
+        if (sta_rate_set) {
+                wlvif->rate_set =
+                        wl1271_tx_enabled_rates_get(wl,
+                                                    sta_rate_set,
+                                                    wlvif->band);
+                ret = wl1271_acx_sta_rate_policies(wl, wlvif);
+                if (ret < 0)
+                        return ret;
+        }
 
-out:
         return ret;
 }
 
-static int wl1271_unjoin(struct wl1271 *wl, struct wl12xx_vif *wlvif)
+static int wlcore_unset_assoc(struct wl1271 *wl, struct wl12xx_vif *wlvif)
 {
         int ret;
+        bool sta = wlvif->bss_type == BSS_TYPE_STA_BSS;
+
+        /* make sure we are connected (sta) joined */
+        if (sta &&
+            !test_and_clear_bit(WLVIF_FLAG_STA_ASSOCIATED, &wlvif->flags))
+                return false;
+
+        /* make sure we are joined (ibss) */
+        if (!sta &&
+            test_and_clear_bit(WLVIF_FLAG_IBSS_JOINED, &wlvif->flags))
+                return false;
+
+        if (sta) {
+                /* use defaults when not associated */
+                wlvif->aid = 0;
+
+                /* free probe-request template */
+                dev_kfree_skb(wlvif->probereq);
+                wlvif->probereq = NULL;
+
+                /* disable connection monitor features */
+                ret = wl1271_acx_conn_monit_params(wl, wlvif, false);
+                if (ret < 0)
+                        return ret;
+
+                /* Disable the keep-alive feature */
+                ret = wl1271_acx_keep_alive_mode(wl, wlvif, false);
+                if (ret < 0)
+                        return ret;
+        }
 
         if (test_and_clear_bit(WLVIF_FLAG_CS_PROGRESS, &wlvif->flags)) {
                 struct ieee80211_vif *vif = wl12xx_wlvif_to_vif(wlvif);
 
-                wl12xx_cmd_stop_channel_switch(wl);
+                wl12xx_cmd_stop_channel_switch(wl, wlvif);
                 ieee80211_chswitch_done(vif, false);
+                cancel_delayed_work(&wlvif->channel_switch_work);
         }
 
         /* invalidate keep-alive template */
@@ -2546,17 +2863,11 @@ static int wl1271_unjoin(struct wl1271 *wl, struct wl12xx_vif *wlvif)
                                      wlvif->sta.klv_template_id,
                                      ACX_KEEP_ALIVE_TPL_INVALID);
 
-        /* to stop listening to a channel, we disconnect */
-        ret = wl12xx_cmd_role_stop_sta(wl, wlvif);
-        if (ret < 0)
-                goto out;
-
         /* reset TX security counters on a clean disconnect */
         wlvif->tx_security_last_seq_lsb = 0;
         wlvif->tx_security_seq = 0;
 
-out:
-        return ret;
+        return 0;
 }
 
 static void wl1271_set_band_rate(struct wl1271 *wl, struct wl12xx_vif *wlvif)
@@ -2565,147 +2876,10 @@ static void wl1271_set_band_rate(struct wl1271 *wl, struct wl12xx_vif *wlvif)
         wlvif->rate_set = wlvif->basic_rate_set;
 }
 
-static int wl1271_sta_handle_idle(struct wl1271 *wl, struct wl12xx_vif *wlvif,
-                                  bool idle)
-{
-        int ret;
-        bool cur_idle = !test_bit(WLVIF_FLAG_IN_USE, &wlvif->flags);
-
-        if (idle == cur_idle)
-                return 0;
-
-        if (idle) {
-                /* no need to croc if we weren't busy (e.g. during boot) */
-                if (wl12xx_dev_role_started(wlvif)) {
-                        ret = wl12xx_stop_dev(wl, wlvif);
-                        if (ret < 0)
-                                goto out;
-                }
-                wlvif->rate_set =
-                        wl1271_tx_min_rate_get(wl, wlvif->basic_rate_set);
-                ret = wl1271_acx_sta_rate_policies(wl, wlvif);
-                if (ret < 0)
-                        goto out;
-                clear_bit(WLVIF_FLAG_IN_USE, &wlvif->flags);
-        } else {
-                /* The current firmware only supports sched_scan in idle */
-                if (wl->sched_scanning) {
-                        wl1271_scan_sched_scan_stop(wl, wlvif);
-                        ieee80211_sched_scan_stopped(wl->hw);
-                }
-
-                ret = wl12xx_start_dev(wl, wlvif);
-                if (ret < 0)
-                        goto out;
-                set_bit(WLVIF_FLAG_IN_USE, &wlvif->flags);
-        }
-
-out:
-        return ret;
-}
-
 static int wl12xx_config_vif(struct wl1271 *wl, struct wl12xx_vif *wlvif,
                              struct ieee80211_conf *conf, u32 changed)
 {
-        bool is_ap = (wlvif->bss_type == BSS_TYPE_AP_BSS);
-        int channel, ret;
-
-        channel = ieee80211_frequency_to_channel(conf->channel->center_freq);
-
-        /* if the channel changes while joined, join again */
-        if (changed & IEEE80211_CONF_CHANGE_CHANNEL &&
-            ((wlvif->band != conf->channel->band) ||
-             (wlvif->channel != channel) ||
-             (wlvif->channel_type != conf->channel_type))) {
-                /* send all pending packets */
-                ret = wlcore_tx_work_locked(wl);
-                if (ret < 0)
-                        return ret;
-
-                wlvif->band = conf->channel->band;
-                wlvif->channel = channel;
-                wlvif->channel_type = conf->channel_type;
-
-                if (is_ap) {
-                        wl1271_set_band_rate(wl, wlvif);
-                        ret = wl1271_init_ap_rates(wl, wlvif);
-                        if (ret < 0)
-                                wl1271_error("AP rate policy change failed %d",
-                                             ret);
-                } else {
-                        /*
-                         * FIXME: the mac80211 should really provide a fixed
-                         * rate to use here. for now, just use the smallest
-                         * possible rate for the band as a fixed rate for
-                         * association frames and other control messages.
-                         */
-                        if (!test_bit(WLVIF_FLAG_STA_ASSOCIATED, &wlvif->flags))
-                                wl1271_set_band_rate(wl, wlvif);
-
-                        wlvif->basic_rate =
-                                wl1271_tx_min_rate_get(wl,
-                                                       wlvif->basic_rate_set);
-                        ret = wl1271_acx_sta_rate_policies(wl, wlvif);
-                        if (ret < 0)
-                                wl1271_warning("rate policy for channel "
-                                               "failed %d", ret);
-
-                        /*
-                         * change the ROC channel. do it only if we are
-                         * not idle. otherwise, CROC will be called
-                         * anyway.
-                         */
-                        if (!test_bit(WLVIF_FLAG_STA_ASSOCIATED,
-                                      &wlvif->flags) &&
-                            wl12xx_dev_role_started(wlvif) &&
-                            !(conf->flags & IEEE80211_CONF_IDLE)) {
-                                ret = wl12xx_stop_dev(wl, wlvif);
-                                if (ret < 0)
-                                        return ret;
-
-                                ret = wl12xx_start_dev(wl, wlvif);
-                                if (ret < 0)
-                                        return ret;
-                        }
-                }
-        }
-
-        if ((changed & IEEE80211_CONF_CHANGE_PS) && !is_ap) {
-
-                if ((conf->flags & IEEE80211_CONF_PS) &&
-                    test_bit(WLVIF_FLAG_STA_ASSOCIATED, &wlvif->flags) &&
-                    !test_bit(WLVIF_FLAG_IN_PS, &wlvif->flags)) {
-
-                        int ps_mode;
-                        char *ps_mode_str;
-
-                        if (wl->conf.conn.forced_ps) {
-                                ps_mode = STATION_POWER_SAVE_MODE;
-                                ps_mode_str = "forced";
-                        } else {
-                                ps_mode = STATION_AUTO_PS_MODE;
-                                ps_mode_str = "auto";
-                        }
-
-                        wl1271_debug(DEBUG_PSM, "%s ps enabled", ps_mode_str);
-
-                        ret = wl1271_ps_set_mode(wl, wlvif, ps_mode);
-
-                        if (ret < 0)
-                                wl1271_warning("enter %s ps failed %d",
-                                               ps_mode_str, ret);
-
-                } else if (!(conf->flags & IEEE80211_CONF_PS) &&
-                           test_bit(WLVIF_FLAG_IN_PS, &wlvif->flags)) {
-
-                        wl1271_debug(DEBUG_PSM, "auto ps disabled");
-
-                        ret = wl1271_ps_set_mode(wl, wlvif,
-                                                 STATION_ACTIVE_MODE);
-                        if (ret < 0)
-                                wl1271_warning("exit auto ps failed %d", ret);
-                }
-        }
+        int ret;
 
         if (conf->power_level != wlvif->power_level) {
                 ret = wl1271_acx_tx_power(wl, wlvif, conf->power_level);
@@ -2723,37 +2897,17 @@ static int wl1271_op_config(struct ieee80211_hw *hw, u32 changed)
         struct wl1271 *wl = hw->priv;
         struct wl12xx_vif *wlvif;
         struct ieee80211_conf *conf = &hw->conf;
-        int channel, ret = 0;
-
-        channel = ieee80211_frequency_to_channel(conf->channel->center_freq);
+        int ret = 0;
 
-        wl1271_debug(DEBUG_MAC80211, "mac80211 config ch %d psm %s power %d %s"
+        wl1271_debug(DEBUG_MAC80211, "mac80211 config psm %s power %d %s"
                      " changed 0x%x",
-                     channel,
                      conf->flags & IEEE80211_CONF_PS ? "on" : "off",
                      conf->power_level,
                      conf->flags & IEEE80211_CONF_IDLE ? "idle" : "in use",
                          changed);
 
-        /*
-         * mac80211 will go to idle nearly immediately after transmitting some
-         * frames, such as the deauth. To make sure those frames reach the air,
-         * wait here until the TX queue is fully flushed.
-         */
-        if ((changed & IEEE80211_CONF_CHANGE_CHANNEL) ||
-            ((changed & IEEE80211_CONF_CHANGE_IDLE) &&
-             (conf->flags & IEEE80211_CONF_IDLE)))
-                wl1271_tx_flush(wl);
-
         mutex_lock(&wl->mutex);
 
-        /* we support configuring the channel and band even while off */
-        if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
-                wl->band = conf->channel->band;
-                wl->channel = channel;
-                wl->channel_type = conf->channel_type;
-        }
-
         if (changed & IEEE80211_CONF_CHANGE_POWER)
                 wl->power_level = conf->power_level;
 
@@ -3073,10 +3227,7 @@ static int wlcore_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                  * stop the queues and flush to ensure the next packets are
                  * in sync with FW spare block accounting
                  */
-                mutex_lock(&wl->mutex);
                 wlcore_stop_queues(wl, WLCORE_QUEUE_STOP_REASON_SPARE_BLK);
-                mutex_unlock(&wl->mutex);
-
                 wl1271_tx_flush(wl);
         }
 
@@ -3202,6 +3353,29 @@ int wlcore_set_key(struct wl1271 *wl, enum set_key_cmd cmd,
 }
 EXPORT_SYMBOL_GPL(wlcore_set_key);
 
+void wlcore_regdomain_config(struct wl1271 *wl)
+{
+        int ret;
+
+        if (!(wl->quirks & WLCORE_QUIRK_REGDOMAIN_CONF))
+                return;
+
+        mutex_lock(&wl->mutex);
+        ret = wl1271_ps_elp_wakeup(wl);
+        if (ret < 0)
+                goto out;
+
+        ret = wlcore_cmd_regdomain_config_locked(wl);
+        if (ret < 0) {
+                wl12xx_queue_recovery_work(wl);
+                goto out;
+        }
+
+        wl1271_ps_elp_sleep(wl);
+out:
+        mutex_unlock(&wl->mutex);
+}
+
 static int wl1271_op_hw_scan(struct ieee80211_hw *hw,
                              struct ieee80211_vif *vif,
                              struct cfg80211_scan_request *req)
@@ -3241,7 +3415,7 @@ static int wl1271_op_hw_scan(struct ieee80211_hw *hw,
                 goto out_sleep;
         }
 
-        ret = wl1271_scan(hw->priv, vif, ssid, len, req);
+        ret = wlcore_scan(hw->priv, vif, ssid, len, req);
 out_sleep:
         wl1271_ps_elp_sleep(wl);
 out:
@@ -3254,6 +3428,7 @@ static void wl1271_op_cancel_hw_scan(struct ieee80211_hw *hw,
                                      struct ieee80211_vif *vif)
 {
         struct wl1271 *wl = hw->priv;
+        struct wl12xx_vif *wlvif = wl12xx_vif_to_data(vif);
         int ret;
 
         wl1271_debug(DEBUG_MAC80211, "mac80211 cancel hw scan");
@@ -3271,7 +3446,7 @@ static void wl1271_op_cancel_hw_scan(struct ieee80211_hw *hw,
                 goto out;
 
         if (wl->scan.state != WL1271_SCAN_STATE_DONE) {
-                ret = wl1271_scan_stop(wl);
+                ret = wl->ops->scan_stop(wl, wlvif);
                 if (ret < 0)
                         goto out_sleep;
         }
@@ -3284,7 +3459,7 @@ static void wl1271_op_cancel_hw_scan(struct ieee80211_hw *hw,
 
         wl->scan.state = WL1271_SCAN_STATE_IDLE;
         memset(wl->scan.scanned_ch, 0, sizeof(wl->scan.scanned_ch));
-        wl->scan_vif = NULL;
+        wl->scan_wlvif = NULL;
         wl->scan.req = NULL;
         ieee80211_scan_completed(wl->hw, true);
 
@@ -3318,15 +3493,11 @@ static int wl1271_op_sched_scan_start(struct ieee80211_hw *hw,
         if (ret < 0)
                 goto out;
 
-        ret = wl1271_scan_sched_scan_config(wl, wlvif, req, ies);
+        ret = wl->ops->sched_scan_start(wl, wlvif, req, ies);
         if (ret < 0)
                 goto out_sleep;
 
-        ret = wl1271_scan_sched_scan_start(wl, wlvif);
-        if (ret < 0)
-                goto out_sleep;
-
-        wl->sched_scanning = true;
+        wl->sched_vif = wlvif;
 
 out_sleep:
         wl1271_ps_elp_sleep(wl);
@@ -3353,7 +3524,7 @@ static void wl1271_op_sched_scan_stop(struct ieee80211_hw *hw,
         if (ret < 0)
                 goto out;
 
-        wl1271_scan_sched_scan_stop(wl, wlvif);
+        wl->ops->sched_scan_stop(wl, wlvif);
 
         wl1271_ps_elp_sleep(wl);
 out:
@@ -3418,30 +3589,6 @@ out:
         return ret;
 }
 
-static int wl1271_ssid_set(struct ieee80211_vif *vif, struct sk_buff *skb,
-                            int offset)
-{
-        struct wl12xx_vif *wlvif = wl12xx_vif_to_data(vif);
-        u8 ssid_len;
-        const u8 *ptr = cfg80211_find_ie(WLAN_EID_SSID, skb->data + offset,
-                                         skb->len - offset);
-
-        if (!ptr) {
-                wl1271_error("No SSID in IEs!");
-                return -ENOENT;
-        }
-
-        ssid_len = ptr[1];
-        if (ssid_len > IEEE80211_MAX_SSID_LEN) {
-                wl1271_error("SSID is too long!");
-                return -EINVAL;
-        }
-
-        wlvif->ssid_len = ssid_len;
-        memcpy(wlvif->ssid, ptr+2, ssid_len);
-        return 0;
-}
-
 static void wl12xx_remove_ie(struct sk_buff *skb, u8 eid, int ieoffset)
 {
         int len;
@@ -3622,7 +3769,7 @@ static int wlcore_set_beacon_template(struct wl1271 *wl,
 
         wl1271_debug(DEBUG_MASTER, "beacon updated");
 
-        ret = wl1271_ssid_set(vif, beacon, ieoffset);
+        ret = wl1271_ssid_set(wlvif, beacon, ieoffset);
         if (ret < 0) {
                 dev_kfree_skb(beacon);
                 goto out;
@@ -3639,6 +3786,12 @@ static int wlcore_set_beacon_template(struct wl1271 *wl,
                 goto out;
         }
 
+        wlvif->wmm_enabled =
+                cfg80211_find_vendor_ie(WLAN_OUI_MICROSOFT,
+                                        WLAN_OUI_TYPE_MICROSOFT_WMM,
+                                        beacon->data + ieoffset,
+                                        beacon->len - ieoffset);
+
         /*
          * In case we already have a probe-resp beacon set explicitly
          * by usermode, don't use the beacon data.
@@ -3692,7 +3845,7 @@ static int wl1271_bss_beacon_info_changed(struct wl1271 *wl,
         bool is_ap = (wlvif->bss_type == BSS_TYPE_AP_BSS);
         int ret = 0;
 
-        if ((changed & BSS_CHANGED_BEACON_INT)) {
+        if (changed & BSS_CHANGED_BEACON_INT) {
                 wl1271_debug(DEBUG_MASTER, "beacon interval updated: %d",
                         bss_conf->beacon_int);
 
@@ -3705,7 +3858,7 @@ static int wl1271_bss_beacon_info_changed(struct wl1271 *wl,
                 wl1271_ap_set_probe_resp_tmpl(wl, rate, vif);
         }
 
-        if ((changed & BSS_CHANGED_BEACON)) {
+        if (changed & BSS_CHANGED_BEACON) {
                 ret = wlcore_set_beacon_template(wl, vif, is_ap);
                 if (ret < 0)
                         goto out;
@@ -3726,7 +3879,7 @@ static void wl1271_bss_info_changed_ap(struct wl1271 *wl,
         struct wl12xx_vif *wlvif = wl12xx_vif_to_data(vif);
         int ret = 0;
 
-        if ((changed & BSS_CHANGED_BASIC_RATES)) {
+        if (changed & BSS_CHANGED_BASIC_RATES) {
                 u32 rates = bss_conf->basic_rates;
 
                 wlvif->basic_rate_set = wl1271_tx_enabled_rates_get(wl, rates,
@@ -3757,7 +3910,7 @@ static void wl1271_bss_info_changed_ap(struct wl1271 *wl,
         if (ret < 0)
                 goto out;
 
-        if ((changed & BSS_CHANGED_BEACON_ENABLED)) {
+        if (changed & BSS_CHANGED_BEACON_ENABLED) {
                 if (bss_conf->enable_beacon) {
                         if (!test_bit(WLVIF_FLAG_AP_STARTED, &wlvif->flags)) {
                                 ret = wl12xx_cmd_role_start_ap(wl, wlvif);
@@ -3804,6 +3957,79 @@ out:
         return;
 }
 
+static int wlcore_set_bssid(struct wl1271 *wl, struct wl12xx_vif *wlvif,
+                            struct ieee80211_bss_conf *bss_conf,
+                            u32 sta_rate_set)
+{
+        u32 rates;
+        int ret;
+
+        wl1271_debug(DEBUG_MAC80211,
+             "changed_bssid: %pM, aid: %d, bcn_int: %d, brates: 0x%x sta_rate_set: 0x%x",
+             bss_conf->bssid, bss_conf->aid,
+             bss_conf->beacon_int,
+             bss_conf->basic_rates, sta_rate_set);
+
+        wlvif->beacon_int = bss_conf->beacon_int;
+        rates = bss_conf->basic_rates;
+        wlvif->basic_rate_set =
+                wl1271_tx_enabled_rates_get(wl, rates,
+                                            wlvif->band);
+        wlvif->basic_rate =
+                wl1271_tx_min_rate_get(wl,
+                                       wlvif->basic_rate_set);
+
+        if (sta_rate_set)
+                wlvif->rate_set =
+                        wl1271_tx_enabled_rates_get(wl,
+                                                sta_rate_set,
+                                                wlvif->band);
+
+        /* we only support sched_scan while not connected */
+        if (wl->sched_vif == wlvif)
+                wl->ops->sched_scan_stop(wl, wlvif);
+
+        ret = wl1271_acx_sta_rate_policies(wl, wlvif);
+        if (ret < 0)
+                return ret;
+
+        ret = wl12xx_cmd_build_null_data(wl, wlvif);
+        if (ret < 0)
+                return ret;
+
+        ret = wl1271_build_qos_null_data(wl, wl12xx_wlvif_to_vif(wlvif));
+        if (ret < 0)
+                return ret;
+
+        wlcore_set_ssid(wl, wlvif);
+
+        set_bit(WLVIF_FLAG_IN_USE, &wlvif->flags);
+
+        return 0;
+}
+
+static int wlcore_clear_bssid(struct wl1271 *wl, struct wl12xx_vif *wlvif)
+{
+        int ret;
+
+        /* revert back to minimum rates for the current band */
+        wl1271_set_band_rate(wl, wlvif);
+        wlvif->basic_rate = wl1271_tx_min_rate_get(wl, wlvif->basic_rate_set);
+
+        ret = wl1271_acx_sta_rate_policies(wl, wlvif);
+        if (ret < 0)
+                return ret;
+
+        if (wlvif->bss_type == BSS_TYPE_STA_BSS &&
+            test_bit(WLVIF_FLAG_IN_USE, &wlvif->flags)) {
+                ret = wl12xx_cmd_role_stop_sta(wl, wlvif);
+                if (ret < 0)
+                        return ret;
+        }
+
+        clear_bit(WLVIF_FLAG_IN_USE, &wlvif->flags);
+        return 0;
+}
 /* STA/IBSS mode changes */
 static void wl1271_bss_info_changed_sta(struct wl1271 *wl,
                                         struct ieee80211_vif *vif,
@@ -3811,7 +4037,7 @@ static void wl1271_bss_info_changed_sta(struct wl1271 *wl,
                                         u32 changed)
 {
         struct wl12xx_vif *wlvif = wl12xx_vif_to_data(vif);
-        bool do_join = false, set_assoc = false;
+        bool do_join = false;
         bool is_ibss = (wlvif->bss_type == BSS_TYPE_IBSS);
         bool ibss_joined = false;
         u32 sta_rate_set = 0;
@@ -3832,9 +4058,8 @@ static void wl1271_bss_info_changed_sta(struct wl1271 *wl,
                         set_bit(WLVIF_FLAG_IBSS_JOINED, &wlvif->flags);
                         ibss_joined = true;
                 } else {
-                        if (test_and_clear_bit(WLVIF_FLAG_IBSS_JOINED,
-                                               &wlvif->flags))
-                                wl1271_unjoin(wl, wlvif);
+                        wlcore_unset_assoc(wl, wlvif);
+                        wl12xx_cmd_role_stop_sta(wl, wlvif);
                 }
         }
 
@@ -3852,13 +4077,7 @@ static void wl1271_bss_info_changed_sta(struct wl1271 *wl,
                 do_join = true;
         }
 
-        if (changed & BSS_CHANGED_IDLE && !is_ibss) {
-                ret = wl1271_sta_handle_idle(wl, wlvif, bss_conf->idle);
-                if (ret < 0)
-                        wl1271_warning("idle mode change failed %d", ret);
-        }
-
-        if ((changed & BSS_CHANGED_CQM)) {
+        if (changed & BSS_CHANGED_CQM) {
                 bool enable = false;
                 if (bss_conf->cqm_rssi_thold)
                         enable = true;
@@ -3870,150 +4089,39 @@ static void wl1271_bss_info_changed_sta(struct wl1271 *wl,
                 wlvif->rssi_thold = bss_conf->cqm_rssi_thold;
         }
 
-        if (changed & BSS_CHANGED_BSSID)
-                if (!is_zero_ether_addr(bss_conf->bssid)) {
-                        ret = wl12xx_cmd_build_null_data(wl, wlvif);
-                        if (ret < 0)
-                                goto out;
-
-                        ret = wl1271_build_qos_null_data(wl, vif);
-                        if (ret < 0)
-                                goto out;
-                }
-
-        if (changed & (BSS_CHANGED_ASSOC | BSS_CHANGED_HT)) {
+        if (changed & (BSS_CHANGED_BSSID | BSS_CHANGED_HT |
+                       BSS_CHANGED_ASSOC)) {
                 rcu_read_lock();
                 sta = ieee80211_find_sta(vif, bss_conf->bssid);
-                if (!sta)
-                        goto sta_not_found;
-
-                /* save the supp_rates of the ap */
-                sta_rate_set = sta->supp_rates[wl->hw->conf.channel->band];
-                if (sta->ht_cap.ht_supported)
-                        sta_rate_set |=
-                          (sta->ht_cap.mcs.rx_mask[0] << HW_HT_RATES_OFFSET) |
-                          (sta->ht_cap.mcs.rx_mask[1] << HW_MIMO_RATES_OFFSET);
-                sta_ht_cap = sta->ht_cap;
-                sta_exists = true;
-
-sta_not_found:
+                if (sta) {
+                        u8 *rx_mask = sta->ht_cap.mcs.rx_mask;
+
+                        /* save the supp_rates of the ap */
+                        sta_rate_set = sta->supp_rates[wlvif->band];
+                        if (sta->ht_cap.ht_supported)
+                                sta_rate_set |=
+                                        (rx_mask[0] << HW_HT_RATES_OFFSET) |
+                                        (rx_mask[1] << HW_MIMO_RATES_OFFSET);
+                        sta_ht_cap = sta->ht_cap;
+                        sta_exists = true;
+                }
+
                 rcu_read_unlock();
         }
 
-        if ((changed & BSS_CHANGED_ASSOC)) {
-                if (bss_conf->assoc) {
-                        u32 rates;
-                        int ieoffset;
-                        wlvif->aid = bss_conf->aid;
-                        wlvif->channel_type =
-                                cfg80211_get_chandef_type(&bss_conf->chandef);
-                        wlvif->beacon_int = bss_conf->beacon_int;
-                        do_join = true;
-                        set_assoc = true;
-
-                        /*
-                         * use basic rates from AP, and determine lowest rate
-                         * to use with control frames.
-                         */
-                        rates = bss_conf->basic_rates;
-                        wlvif->basic_rate_set =
-                                wl1271_tx_enabled_rates_get(wl, rates,
-                                                            wlvif->band);
-                        wlvif->basic_rate =
-                                wl1271_tx_min_rate_get(wl,
-                                                       wlvif->basic_rate_set);
-                        if (sta_rate_set)
-                                wlvif->rate_set =
-                                        wl1271_tx_enabled_rates_get(wl,
-                                                                sta_rate_set,
-                                                                wlvif->band);
-                        ret = wl1271_acx_sta_rate_policies(wl, wlvif);
-                        if (ret < 0)
-                                goto out;
-
-                        /*
-                         * with wl1271, we don't need to update the
-                         * beacon_int and dtim_period, because the firmware
-                         * updates it by itself when the first beacon is
-                         * received after a join.
-                         */
-                        ret = wl1271_cmd_build_ps_poll(wl, wlvif, wlvif->aid);
+        if (changed & BSS_CHANGED_BSSID) {
+                if (!is_zero_ether_addr(bss_conf->bssid)) {
+                        ret = wlcore_set_bssid(wl, wlvif, bss_conf,
+                                               sta_rate_set);
                         if (ret < 0)
                                 goto out;
 
-                        /*
-                         * Get a template for hardware connection maintenance
-                         */
-                        dev_kfree_skb(wlvif->probereq);
-                        wlvif->probereq = wl1271_cmd_build_ap_probe_req(wl,
-                                                                        wlvif,
-                                                                        NULL);
-                        ieoffset = offsetof(struct ieee80211_mgmt,
-                                            u.probe_req.variable);
-                        wl1271_ssid_set(vif, wlvif->probereq, ieoffset);
-
-                        /* enable the connection monitoring feature */
-                        ret = wl1271_acx_conn_monit_params(wl, wlvif, true);
-                        if (ret < 0)
-                                goto out;
+                        /* Need to update the BSSID (for filtering etc) */
+                        do_join = true;
                 } else {
-                        /* use defaults when not associated */
-                        bool was_assoc =
-                            !!test_and_clear_bit(WLVIF_FLAG_STA_ASSOCIATED,
-                                                 &wlvif->flags);
-                        bool was_ifup =
-                            !!test_and_clear_bit(WLVIF_FLAG_STA_STATE_SENT,
-                                                 &wlvif->flags);
-                        wlvif->aid = 0;
-
-                        /* free probe-request template */
-                        dev_kfree_skb(wlvif->probereq);
-                        wlvif->probereq = NULL;
-
-                        /* revert back to minimum rates for the current band */
-                        wl1271_set_band_rate(wl, wlvif);
-                        wlvif->basic_rate =
-                                wl1271_tx_min_rate_get(wl,
-                                                       wlvif->basic_rate_set);
-                        ret = wl1271_acx_sta_rate_policies(wl, wlvif);
-                        if (ret < 0)
-                                goto out;
-
-                        /* disable connection monitor features */
-                        ret = wl1271_acx_conn_monit_params(wl, wlvif, false);
-
-                        /* Disable the keep-alive feature */
-                        ret = wl1271_acx_keep_alive_mode(wl, wlvif, false);
+                        ret = wlcore_clear_bssid(wl, wlvif);
                         if (ret < 0)
                                 goto out;
-
-                        /* restore the bssid filter and go to dummy bssid */
-                        if (was_assoc) {
-                                /*
-                                 * we might have to disable roc, if there was
-                                 * no IF_OPER_UP notification.
-                                 */
-                                if (!was_ifup) {
-                                        ret = wl12xx_croc(wl, wlvif->role_id);
-                                        if (ret < 0)
-                                                goto out;
-                                }
-                                /*
-                                 * (we also need to disable roc in case of
-                                 * roaming on the same channel. until we will
-                                 * have a better flow...)
-                                 */
-                                if (test_bit(wlvif->dev_role_id, wl->roc_map)) {
-                                        ret = wl12xx_croc(wl,
-                                                          wlvif->dev_role_id);
-                                        if (ret < 0)
-                                                goto out;
-                                }
-
-                                wl1271_unjoin(wl, wlvif);
-                                if (!bss_conf->idle)
-                                        wl12xx_start_dev(wl, wlvif);
-                        }
                 }
         }
 
@@ -4043,71 +4151,87 @@ sta_not_found:
                 goto out;
 
         if (do_join) {
-                ret = wl1271_join(wl, wlvif, set_assoc);
+                ret = wlcore_join(wl, wlvif);
                 if (ret < 0) {
                         wl1271_warning("cmd join failed %d", ret);
                         goto out;
                 }
+        }
 
-                /* ROC until connected (after EAPOL exchange) */
-                if (!is_ibss) {
-                        ret = wl12xx_roc(wl, wlvif, wlvif->role_id);
+        if (changed & BSS_CHANGED_ASSOC) {
+                if (bss_conf->assoc) {
+                        ret = wlcore_set_assoc(wl, wlvif, bss_conf,
+                                               sta_rate_set);
                         if (ret < 0)
                                 goto out;
 
                         if (test_bit(WLVIF_FLAG_STA_AUTHORIZED, &wlvif->flags))
                                 wl12xx_set_authorized(wl, wlvif);
+                } else {
+                        wlcore_unset_assoc(wl, wlvif);
                 }
-                /*
-                 * stop device role if started (we might already be in
-                 * STA/IBSS role).
-                 */
-                if (wl12xx_dev_role_started(wlvif)) {
-                        ret = wl12xx_stop_dev(wl, wlvif);
+        }
+
+        if (changed & BSS_CHANGED_PS) {
+                if ((bss_conf->ps) &&
+                    test_bit(WLVIF_FLAG_STA_ASSOCIATED, &wlvif->flags) &&
+                    !test_bit(WLVIF_FLAG_IN_PS, &wlvif->flags)) {
+                        int ps_mode;
+                        char *ps_mode_str;
+
+                        if (wl->conf.conn.forced_ps) {
+                                ps_mode = STATION_POWER_SAVE_MODE;
+                                ps_mode_str = "forced";
+                        } else {
+                                ps_mode = STATION_AUTO_PS_MODE;
+                                ps_mode_str = "auto";
+                        }
+
+                        wl1271_debug(DEBUG_PSM, "%s ps enabled", ps_mode_str);
+
+                        ret = wl1271_ps_set_mode(wl, wlvif, ps_mode);
                         if (ret < 0)
-                                goto out;
+                                wl1271_warning("enter %s ps failed %d",
+                                               ps_mode_str, ret);
+                } else if (!bss_conf->ps &&
+                           test_bit(WLVIF_FLAG_IN_PS, &wlvif->flags)) {
+                        wl1271_debug(DEBUG_PSM, "auto ps disabled");
+
+                        ret = wl1271_ps_set_mode(wl, wlvif,
+                                                 STATION_ACTIVE_MODE);
+                        if (ret < 0)
+                                wl1271_warning("exit auto ps failed %d", ret);
                 }
         }
 
         /* Handle new association with HT. Do this after join. */
-        if (sta_exists) {
-                if ((changed & BSS_CHANGED_HT) &&
-                    (bss_conf->chandef.width != NL80211_CHAN_WIDTH_20_NOHT)) {
-                        ret = wl1271_acx_set_ht_capabilities(wl,
-                                                             &sta_ht_cap,
-                                                             true,
-                                                             wlvif->sta.hlid);
-                        if (ret < 0) {
-                                wl1271_warning("Set ht cap true failed %d",
-                                               ret);
-                                goto out;
-                        }
+        if (sta_exists &&
+            (changed & BSS_CHANGED_HT)) {
+                bool enabled =
+                        bss_conf->chandef.width != NL80211_CHAN_WIDTH_20_NOHT;
+
+                ret = wlcore_hw_set_peer_cap(wl,
+                                             &sta_ht_cap,
+                                             enabled,
+                                             wlvif->rate_set,
+                                             wlvif->sta.hlid);
+                if (ret < 0) {
+                        wl1271_warning("Set ht cap failed %d", ret);
+                        goto out;
+
                 }
-                /* handle new association without HT and disassociation */
-                else if (changed & BSS_CHANGED_ASSOC) {
-                        ret = wl1271_acx_set_ht_capabilities(wl,
-                                                             &sta_ht_cap,
-                                                             false,
-                                                             wlvif->sta.hlid);
+
+                if (enabled) {
+                        ret = wl1271_acx_set_ht_information(wl, wlvif,
+                                                bss_conf->ht_operation_mode);
                         if (ret < 0) {
-                                wl1271_warning("Set ht cap false failed %d",
+                                wl1271_warning("Set ht information failed %d",
                                                ret);
                                 goto out;
                         }
                 }
         }
 
-        /* Handle HT information change. Done after join. */
-        if ((changed & BSS_CHANGED_HT) &&
-            (bss_conf->chandef.width != NL80211_CHAN_WIDTH_20_NOHT)) {
-                ret = wl1271_acx_set_ht_information(wl, wlvif,
-                                        bss_conf->ht_operation_mode);
-                if (ret < 0) {
-                        wl1271_warning("Set ht information failed %d", ret);
-                        goto out;
-                }
-        }
-
         /* Handle arp filtering. Done after join. */
         if ((changed & BSS_CHANGED_ARP_FILTER) ||
             (!is_ibss && (changed & BSS_CHANGED_QOS))) {
@@ -4115,8 +4239,7 @@ sta_not_found:
                 wlvif->sta.qos = bss_conf->qos;
                 WARN_ON(wlvif->bss_type != BSS_TYPE_STA_BSS);
 
-                if (bss_conf->arp_addr_cnt == 1 &&
-                    bss_conf->arp_filter_enabled) {
+                if (bss_conf->arp_addr_cnt == 1 && bss_conf->assoc) {
                         wlvif->ip_addr = addr;
                         /*
                          * The template should have been configured only upon
@@ -4157,15 +4280,15 @@ static void wl1271_op_bss_info_changed(struct ieee80211_hw *hw,
         bool is_ap = (wlvif->bss_type == BSS_TYPE_AP_BSS);
         int ret;
 
-        wl1271_debug(DEBUG_MAC80211, "mac80211 bss info changed 0x%x",
-                     (int)changed);
+        wl1271_debug(DEBUG_MAC80211, "mac80211 bss info role %d changed 0x%x",
+                     wlvif->role_id, (int)changed);
 
         /*
          * make sure to cancel pending disconnections if our association
          * state changed
          */
         if (!is_ap && (changed & BSS_CHANGED_ASSOC))
-                cancel_delayed_work_sync(&wl->connection_loss_work);
+                cancel_delayed_work_sync(&wlvif->connection_loss_work);
 
         if (is_ap && (changed & BSS_CHANGED_BEACON_ENABLED) &&
             !bss_conf->enable_beacon)
@@ -4194,6 +4317,76 @@ out:
         mutex_unlock(&wl->mutex);
 }
 
+static int wlcore_op_add_chanctx(struct ieee80211_hw *hw,
+                                 struct ieee80211_chanctx_conf *ctx)
+{
+        wl1271_debug(DEBUG_MAC80211, "mac80211 add chanctx %d (type %d)",
+                     ieee80211_frequency_to_channel(ctx->def.chan->center_freq),
+                     cfg80211_get_chandef_type(&ctx->def));
+        return 0;
+}
+
+static void wlcore_op_remove_chanctx(struct ieee80211_hw *hw,
+                                     struct ieee80211_chanctx_conf *ctx)
+{
+        wl1271_debug(DEBUG_MAC80211, "mac80211 remove chanctx %d (type %d)",
+                     ieee80211_frequency_to_channel(ctx->def.chan->center_freq),
+                     cfg80211_get_chandef_type(&ctx->def));
+}
+
+static void wlcore_op_change_chanctx(struct ieee80211_hw *hw,
+                                     struct ieee80211_chanctx_conf *ctx,
+                                     u32 changed)
+{
+        wl1271_debug(DEBUG_MAC80211,
+                     "mac80211 change chanctx %d (type %d) changed 0x%x",
+                     ieee80211_frequency_to_channel(ctx->def.chan->center_freq),
+                     cfg80211_get_chandef_type(&ctx->def), changed);
+}
+
+static int wlcore_op_assign_vif_chanctx(struct ieee80211_hw *hw,
+                                        struct ieee80211_vif *vif,
+                                        struct ieee80211_chanctx_conf *ctx)
+{
+        struct wl1271 *wl = hw->priv;
+        struct wl12xx_vif *wlvif = wl12xx_vif_to_data(vif);
+        int channel = ieee80211_frequency_to_channel(
+                ctx->def.chan->center_freq);
+
+        wl1271_debug(DEBUG_MAC80211,
+                     "mac80211 assign chanctx (role %d) %d (type %d)",
+                     wlvif->role_id, channel, cfg80211_get_chandef_type(&ctx->def));
+
+        mutex_lock(&wl->mutex);
+
+        wlvif->band = ctx->def.chan->band;
+        wlvif->channel = channel;
+        wlvif->channel_type = cfg80211_get_chandef_type(&ctx->def);
+
+        /* update default rates according to the band */
+        wl1271_set_band_rate(wl, wlvif);
+
+        mutex_unlock(&wl->mutex);
+
+        return 0;
+}
+
+static void wlcore_op_unassign_vif_chanctx(struct ieee80211_hw *hw,
+                                           struct ieee80211_vif *vif,
+                                           struct ieee80211_chanctx_conf *ctx)
+{
+        struct wl1271 *wl = hw->priv;
+        struct wl12xx_vif *wlvif = wl12xx_vif_to_data(vif);
+
+        wl1271_debug(DEBUG_MAC80211,
+                     "mac80211 unassign chanctx (role %d) %d (type %d)",
+                     wlvif->role_id,
+                     ieee80211_frequency_to_channel(ctx->def.chan->center_freq),
+                     cfg80211_get_chandef_type(&ctx->def));
+
+        wl1271_tx_flush(wl);
+}
+
 static int wl1271_op_conf_tx(struct ieee80211_hw *hw,
                              struct ieee80211_vif *vif, u16 queue,
                              const struct ieee80211_tx_queue_params *params)
@@ -4321,8 +4514,6 @@ void wl1271_free_sta(struct wl1271 *wl, struct wl12xx_vif *wlvif, u8 hlid)
                 return;
 
         clear_bit(hlid, wlvif->ap.sta_hlid_map);
-        memset(wl->links[hlid].addr, 0, ETH_ALEN);
-        wl->links[hlid].ba_bitmap = 0;
         __clear_bit(hlid, &wl->ap_ps_map);
         __clear_bit(hlid, (unsigned long *)&wl->ap_fw_ps_map);
         wl12xx_free_link(wl, wlvif, &hlid);
@@ -4382,6 +4573,45 @@ static int wl12xx_sta_remove(struct wl1271 *wl,
         return ret;
 }
 
+static void wlcore_roc_if_possible(struct wl1271 *wl,
+                                   struct wl12xx_vif *wlvif)
+{
+        if (find_first_bit(wl->roc_map,
+                           WL12XX_MAX_ROLES) < WL12XX_MAX_ROLES)
+                return;
+
+        if (WARN_ON(wlvif->role_id == WL12XX_INVALID_ROLE_ID))
+                return;
+
+        wl12xx_roc(wl, wlvif, wlvif->role_id, wlvif->band, wlvif->channel);
+}
+
+static void wlcore_update_inconn_sta(struct wl1271 *wl,
+                                     struct wl12xx_vif *wlvif,
+                                     struct wl1271_station *wl_sta,
+                                     bool in_connection)
+{
+        if (in_connection) {
+                if (WARN_ON(wl_sta->in_connection))
+                        return;
+                wl_sta->in_connection = true;
+                if (!wlvif->inconn_count++)
+                        wlcore_roc_if_possible(wl, wlvif);
+        } else {
+                if (!wl_sta->in_connection)
+                        return;
+
+                wl_sta->in_connection = false;
+                wlvif->inconn_count--;
+                if (WARN_ON(wlvif->inconn_count < 0))
+                        return;
+
+                if (!wlvif->inconn_count)
+                        if (test_bit(wlvif->role_id, wl->roc_map))
+                                wl12xx_croc(wl, wlvif->role_id);
+        }
+}
+
 static int wl12xx_update_sta_state(struct wl1271 *wl,
                                    struct wl12xx_vif *wlvif,
                                    struct ieee80211_sta *sta,
@@ -4400,8 +4630,13 @@ static int wl12xx_update_sta_state(struct wl1271 *wl,
         /* Add station (AP mode) */
         if (is_ap &&
             old_state == IEEE80211_STA_NOTEXIST &&
-            new_state == IEEE80211_STA_NONE)
-                return wl12xx_sta_add(wl, wlvif, sta);
+            new_state == IEEE80211_STA_NONE) {
+                ret = wl12xx_sta_add(wl, wlvif, sta);
+                if (ret)
+                        return ret;
+
+                wlcore_update_inconn_sta(wl, wlvif, wl_sta, true);
+        }
 
         /* Remove station (AP mode) */
         if (is_ap &&
@@ -4409,35 +4644,59 @@ static int wl12xx_update_sta_state(struct wl1271 *wl,
             new_state == IEEE80211_STA_NOTEXIST) {
                 /* must not fail */
                 wl12xx_sta_remove(wl, wlvif, sta);
-                return 0;
+
+                wlcore_update_inconn_sta(wl, wlvif, wl_sta, false);
         }
 
         /* Authorize station (AP mode) */
         if (is_ap &&
             new_state == IEEE80211_STA_AUTHORIZED) {
-                ret = wl12xx_cmd_set_peer_state(wl, hlid);
+                ret = wl12xx_cmd_set_peer_state(wl, wlvif, hlid);
                 if (ret < 0)
                         return ret;
 
                 ret = wl1271_acx_set_ht_capabilities(wl, &sta->ht_cap, true,
                                                      hlid);
-                return ret;
+                if (ret)
+                        return ret;
+
+                wlcore_update_inconn_sta(wl, wlvif, wl_sta, false);
         }
 
         /* Authorize station */
         if (is_sta &&
             new_state == IEEE80211_STA_AUTHORIZED) {
                 set_bit(WLVIF_FLAG_STA_AUTHORIZED, &wlvif->flags);
-                return wl12xx_set_authorized(wl, wlvif);
+                ret = wl12xx_set_authorized(wl, wlvif);
+                if (ret)
+                        return ret;
         }
 
         if (is_sta &&
             old_state == IEEE80211_STA_AUTHORIZED &&
             new_state == IEEE80211_STA_ASSOC) {
                 clear_bit(WLVIF_FLAG_STA_AUTHORIZED, &wlvif->flags);
-                return 0;
+                clear_bit(WLVIF_FLAG_STA_STATE_SENT, &wlvif->flags);
         }
 
+        /* clear ROCs on failure or authorization */
+        if (is_sta &&
+            (new_state == IEEE80211_STA_AUTHORIZED ||
+             new_state == IEEE80211_STA_NOTEXIST)) {
+                if (test_bit(wlvif->role_id, wl->roc_map))
+                        wl12xx_croc(wl, wlvif->role_id);
+        }
+
+        if (is_sta &&
+            old_state == IEEE80211_STA_NOTEXIST &&
+            new_state == IEEE80211_STA_NONE) {
+                if (find_first_bit(wl->roc_map,
+                                   WL12XX_MAX_ROLES) >= WL12XX_MAX_ROLES) {
+                        WARN_ON(wlvif->role_id == WL12XX_INVALID_ROLE_ID);
+                        wl12xx_roc(wl, wlvif, wlvif->role_id,
+                                   wlvif->band, wlvif->channel);
+                }
+        }
         return 0;
 }
 
@@ -4502,18 +4761,18 @@ static int wl1271_op_ampdu_action(struct ieee80211_hw *hw,
 
         if (wlvif->bss_type == BSS_TYPE_STA_BSS) {
                 hlid = wlvif->sta.hlid;
-                ba_bitmap = &wlvif->sta.ba_rx_bitmap;
         } else if (wlvif->bss_type == BSS_TYPE_AP_BSS) {
                 struct wl1271_station *wl_sta;
 
                 wl_sta = (struct wl1271_station *)sta->drv_priv;
                 hlid = wl_sta->hlid;
-                ba_bitmap = &wl->links[hlid].ba_bitmap;
         } else {
                 ret = -EINVAL;
                 goto out;
         }
 
+        ba_bitmap = &wl->links[hlid].ba_bitmap;
+
         ret = wl1271_ps_elp_wakeup(wl);
         if (ret < 0)
                 goto out;
@@ -4575,7 +4834,9 @@ static int wl1271_op_ampdu_action(struct ieee80211_hw *hw,
          * Falling break here on purpose for all TX APDU commands.
          */
         case IEEE80211_AMPDU_TX_START:
-        case IEEE80211_AMPDU_TX_STOP:
+        case IEEE80211_AMPDU_TX_STOP_CONT:
+        case IEEE80211_AMPDU_TX_STOP_FLUSH:
+        case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
         case IEEE80211_AMPDU_TX_OPERATIONAL:
                 ret = -EINVAL;
                 break;
@@ -4665,12 +4926,23 @@ static void wl12xx_op_channel_switch(struct ieee80211_hw *hw,
 
         /* TODO: change mac80211 to pass vif as param */
         wl12xx_for_each_wlvif_sta(wl, wlvif) {
-                ret = wl12xx_cmd_channel_switch(wl, wlvif, ch_switch);
+                unsigned long delay_usec;
+
+                ret = wl->ops->channel_switch(wl, wlvif, ch_switch);
+                if (ret)
+                        goto out_sleep;
+
+                set_bit(WLVIF_FLAG_CS_PROGRESS, &wlvif->flags);
 
-                if (!ret)
-                        set_bit(WLVIF_FLAG_CS_PROGRESS, &wlvif->flags);
+                /* indicate failure 5 seconds after channel switch time */
+                delay_usec = ieee80211_tu_to_usec(wlvif->beacon_int) *
+                             ch_switch->count;
+                ieee80211_queue_delayed_work(hw, &wlvif->channel_switch_work,
+                                usecs_to_jiffies(delay_usec) +
+                                msecs_to_jiffies(5000));
         }
 
+out_sleep:
         wl1271_ps_elp_sleep(wl);
 
 out:
@@ -4684,6 +4956,144 @@ static void wlcore_op_flush(struct ieee80211_hw *hw, bool drop)
         wl1271_tx_flush(wl);
 }
 
+static int wlcore_op_remain_on_channel(struct ieee80211_hw *hw,
+                                       struct ieee80211_vif *vif,
+                                       struct ieee80211_channel *chan,
+                                       int duration)
+{
+        struct wl12xx_vif *wlvif = wl12xx_vif_to_data(vif);
+        struct wl1271 *wl = hw->priv;
+        int channel, ret = 0;
+
+        channel = ieee80211_frequency_to_channel(chan->center_freq);
+
+        wl1271_debug(DEBUG_MAC80211, "mac80211 roc %d (%d)",
+                     channel, wlvif->role_id);
+
+        mutex_lock(&wl->mutex);
+
+        if (unlikely(wl->state != WLCORE_STATE_ON))
+                goto out;
+
+        /* return EBUSY if we can't ROC right now */
+        if (WARN_ON(wl->roc_vif ||
+                    find_first_bit(wl->roc_map,
+                                   WL12XX_MAX_ROLES) < WL12XX_MAX_ROLES)) {
+                ret = -EBUSY;
+                goto out;
+        }
+
+        ret = wl1271_ps_elp_wakeup(wl);
+        if (ret < 0)
+                goto out;
+
+        ret = wl12xx_start_dev(wl, wlvif, chan->band, channel);
+        if (ret < 0)
+                goto out_sleep;
+
+        wl->roc_vif = vif;
+        ieee80211_queue_delayed_work(hw, &wl->roc_complete_work,
+                                     msecs_to_jiffies(duration));
+out_sleep:
+        wl1271_ps_elp_sleep(wl);
+out:
+        mutex_unlock(&wl->mutex);
+        return ret;
+}
+
+static int __wlcore_roc_completed(struct wl1271 *wl)
+{
+        struct wl12xx_vif *wlvif;
+        int ret;
+
+        /* already completed */
+        if (unlikely(!wl->roc_vif))
+                return 0;
+
+        wlvif = wl12xx_vif_to_data(wl->roc_vif);
+
+        if (!test_bit(WLVIF_FLAG_INITIALIZED, &wlvif->flags))
+                return -EBUSY;
+
+        ret = wl12xx_stop_dev(wl, wlvif);
+        if (ret < 0)
+                return ret;
+
+        wl->roc_vif = NULL;
+
+        return 0;
+}
+
+static int wlcore_roc_completed(struct wl1271 *wl)
+{
+        int ret;
+
+        wl1271_debug(DEBUG_MAC80211, "roc complete");
+
+        mutex_lock(&wl->mutex);
+
+        if (unlikely(wl->state != WLCORE_STATE_ON)) {
+                ret = -EBUSY;
+                goto out;
+        }
+
+        ret = wl1271_ps_elp_wakeup(wl);
+        if (ret < 0)
+                goto out;
+
+        ret = __wlcore_roc_completed(wl);
+
+        wl1271_ps_elp_sleep(wl);
+out:
+        mutex_unlock(&wl->mutex);
+
+        return ret;
+}
+
+static void wlcore_roc_complete_work(struct work_struct *work)
+{
+        struct delayed_work *dwork;
+        struct wl1271 *wl;
+        int ret;
+
+        dwork = container_of(work, struct delayed_work, work);
+        wl = container_of(dwork, struct wl1271, roc_complete_work);
+
+        ret = wlcore_roc_completed(wl);
+        if (!ret)
+                ieee80211_remain_on_channel_expired(wl->hw);
+}
+
+static int wlcore_op_cancel_remain_on_channel(struct ieee80211_hw *hw)
+{
+        struct wl1271 *wl = hw->priv;
+
+        wl1271_debug(DEBUG_MAC80211, "mac80211 croc");
+
+        /* TODO: per-vif */
+        wl1271_tx_flush(wl);
+
+        /*
+         * we can't just flush_work here, because it might deadlock
+         * (as we might get called from the same workqueue)
+         */
+        cancel_delayed_work_sync(&wl->roc_complete_work);
+        wlcore_roc_completed(wl);
+
+        return 0;
+}
+
+static void wlcore_op_sta_rc_update(struct ieee80211_hw *hw,
+                                    struct ieee80211_vif *vif,
+                                    struct ieee80211_sta *sta,
+                                    u32 changed)
+{
+        struct wl12xx_vif *wlvif = wl12xx_vif_to_data(vif);
+        struct wl1271 *wl = hw->priv;
+
+        wlcore_hw_sta_rc_update(wl, wlvif, sta, changed);
+}
+
 static bool wl1271_tx_frames_pending(struct ieee80211_hw *hw)
 {
         struct wl1271 *wl = hw->priv;
@@ -4747,20 +5157,20 @@ static struct ieee80211_rate wl1271_rates[] = {
 
 /* can't be const, mac80211 writes to this */
 static struct ieee80211_channel wl1271_channels[] = {
-        { .hw_value = 1, .center_freq = 2412, .max_power = 25 },
-        { .hw_value = 2, .center_freq = 2417, .max_power = 25 },
-        { .hw_value = 3, .center_freq = 2422, .max_power = 25 },
-        { .hw_value = 4, .center_freq = 2427, .max_power = 25 },
-        { .hw_value = 5, .center_freq = 2432, .max_power = 25 },
-        { .hw_value = 6, .center_freq = 2437, .max_power = 25 },
-        { .hw_value = 7, .center_freq = 2442, .max_power = 25 },
-        { .hw_value = 8, .center_freq = 2447, .max_power = 25 },
-        { .hw_value = 9, .center_freq = 2452, .max_power = 25 },
-        { .hw_value = 10, .center_freq = 2457, .max_power = 25 },
-        { .hw_value = 11, .center_freq = 2462, .max_power = 25 },
-        { .hw_value = 12, .center_freq = 2467, .max_power = 25 },
-        { .hw_value = 13, .center_freq = 2472, .max_power = 25 },
-        { .hw_value = 14, .center_freq = 2484, .max_power = 25 },
+        { .hw_value = 1, .center_freq = 2412, .max_power = WLCORE_MAX_TXPWR },
+        { .hw_value = 2, .center_freq = 2417, .max_power = WLCORE_MAX_TXPWR },
+        { .hw_value = 3, .center_freq = 2422, .max_power = WLCORE_MAX_TXPWR },
+        { .hw_value = 4, .center_freq = 2427, .max_power = WLCORE_MAX_TXPWR },
+        { .hw_value = 5, .center_freq = 2432, .max_power = WLCORE_MAX_TXPWR },
+        { .hw_value = 6, .center_freq = 2437, .max_power = WLCORE_MAX_TXPWR },
+        { .hw_value = 7, .center_freq = 2442, .max_power = WLCORE_MAX_TXPWR },
+        { .hw_value = 8, .center_freq = 2447, .max_power = WLCORE_MAX_TXPWR },
+        { .hw_value = 9, .center_freq = 2452, .max_power = WLCORE_MAX_TXPWR },
+        { .hw_value = 10, .center_freq = 2457, .max_power = WLCORE_MAX_TXPWR },
+        { .hw_value = 11, .center_freq = 2462, .max_power = WLCORE_MAX_TXPWR },
+        { .hw_value = 12, .center_freq = 2467, .max_power = WLCORE_MAX_TXPWR },
+        { .hw_value = 13, .center_freq = 2472, .max_power = WLCORE_MAX_TXPWR },
+        { .hw_value = 14, .center_freq = 2484, .max_power = WLCORE_MAX_TXPWR },
 };
 
 /* can't be const, mac80211 writes to this */
@@ -4801,40 +5211,40 @@ static struct ieee80211_rate wl1271_rates_5ghz[] = {
 
 /* 5 GHz band channels for WL1273 */
 static struct ieee80211_channel wl1271_channels_5ghz[] = {
-        { .hw_value = 7, .center_freq = 5035, .max_power = 25 },
-        { .hw_value = 8, .center_freq = 5040, .max_power = 25 },
-        { .hw_value = 9, .center_freq = 5045, .max_power = 25 },
-        { .hw_value = 11, .center_freq = 5055, .max_power = 25 },
-        { .hw_value = 12, .center_freq = 5060, .max_power = 25 },
-        { .hw_value = 16, .center_freq = 5080, .max_power = 25 },
-        { .hw_value = 34, .center_freq = 5170, .max_power = 25 },
-        { .hw_value = 36, .center_freq = 5180, .max_power = 25 },
-        { .hw_value = 38, .center_freq = 5190, .max_power = 25 },
-        { .hw_value = 40, .center_freq = 5200, .max_power = 25 },
-        { .hw_value = 42, .center_freq = 5210, .max_power = 25 },
-        { .hw_value = 44, .center_freq = 5220, .max_power = 25 },
-        { .hw_value = 46, .center_freq = 5230, .max_power = 25 },
-        { .hw_value = 48, .center_freq = 5240, .max_power = 25 },
-        { .hw_value = 52, .center_freq = 5260, .max_power = 25 },
-        { .hw_value = 56, .center_freq = 5280, .max_power = 25 },
-        { .hw_value = 60, .center_freq = 5300, .max_power = 25 },
-        { .hw_value = 64, .center_freq = 5320, .max_power = 25 },
-        { .hw_value = 100, .center_freq = 5500, .max_power = 25 },
-        { .hw_value = 104, .center_freq = 5520, .max_power = 25 },
-        { .hw_value = 108, .center_freq = 5540, .max_power = 25 },
-        { .hw_value = 112, .center_freq = 5560, .max_power = 25 },
-        { .hw_value = 116, .center_freq = 5580, .max_power = 25 },
-        { .hw_value = 120, .center_freq = 5600, .max_power = 25 },
-        { .hw_value = 124, .center_freq = 5620, .max_power = 25 },
-        { .hw_value = 128, .center_freq = 5640, .max_power = 25 },
-        { .hw_value = 132, .center_freq = 5660, .max_power = 25 },
-        { .hw_value = 136, .center_freq = 5680, .max_power = 25 },
-        { .hw_value = 140, .center_freq = 5700, .max_power = 25 },
-        { .hw_value = 149, .center_freq = 5745, .max_power = 25 },
-        { .hw_value = 153, .center_freq = 5765, .max_power = 25 },
-        { .hw_value = 157, .center_freq = 5785, .max_power = 25 },
-        { .hw_value = 161, .center_freq = 5805, .max_power = 25 },
-        { .hw_value = 165, .center_freq = 5825, .max_power = 25 },
+        { .hw_value = 7, .center_freq = 5035, .max_power = WLCORE_MAX_TXPWR },
+        { .hw_value = 8, .center_freq = 5040, .max_power = WLCORE_MAX_TXPWR },
+        { .hw_value = 9, .center_freq = 5045, .max_power = WLCORE_MAX_TXPWR },
+        { .hw_value = 11, .center_freq = 5055, .max_power = WLCORE_MAX_TXPWR },
+        { .hw_value = 12, .center_freq = 5060, .max_power = WLCORE_MAX_TXPWR },
+        { .hw_value = 16, .center_freq = 5080, .max_power = WLCORE_MAX_TXPWR },
+        { .hw_value = 34, .center_freq = 5170, .max_power = WLCORE_MAX_TXPWR },
+        { .hw_value = 36, .center_freq = 5180, .max_power = WLCORE_MAX_TXPWR },
+        { .hw_value = 38, .center_freq = 5190, .max_power = WLCORE_MAX_TXPWR },
+        { .hw_value = 40, .center_freq = 5200, .max_power = WLCORE_MAX_TXPWR },
+        { .hw_value = 42, .center_freq = 5210, .max_power = WLCORE_MAX_TXPWR },
+        { .hw_value = 44, .center_freq = 5220, .max_power = WLCORE_MAX_TXPWR },
+        { .hw_value = 46, .center_freq = 5230, .max_power = WLCORE_MAX_TXPWR },
+        { .hw_value = 48, .center_freq = 5240, .max_power = WLCORE_MAX_TXPWR },
+        { .hw_value = 52, .center_freq = 5260, .max_power = WLCORE_MAX_TXPWR },
+        { .hw_value = 56, .center_freq = 5280, .max_power = WLCORE_MAX_TXPWR },
+        { .hw_value = 60, .center_freq = 5300, .max_power = WLCORE_MAX_TXPWR },
+        { .hw_value = 64, .center_freq = 5320, .max_power = WLCORE_MAX_TXPWR },
+        { .hw_value = 100, .center_freq = 5500, .max_power = WLCORE_MAX_TXPWR },
+        { .hw_value = 104, .center_freq = 5520, .max_power = WLCORE_MAX_TXPWR },
+        { .hw_value = 108, .center_freq = 5540, .max_power = WLCORE_MAX_TXPWR },
+        { .hw_value = 112, .center_freq = 5560, .max_power = WLCORE_MAX_TXPWR },
+        { .hw_value = 116, .center_freq = 5580, .max_power = WLCORE_MAX_TXPWR },
+        { .hw_value = 120, .center_freq = 5600, .max_power = WLCORE_MAX_TXPWR },
+        { .hw_value = 124, .center_freq = 5620, .max_power = WLCORE_MAX_TXPWR },
+        { .hw_value = 128, .center_freq = 5640, .max_power = WLCORE_MAX_TXPWR },
+        { .hw_value = 132, .center_freq = 5660, .max_power = WLCORE_MAX_TXPWR },
+        { .hw_value = 136, .center_freq = 5680, .max_power = WLCORE_MAX_TXPWR },
+        { .hw_value = 140, .center_freq = 5700, .max_power = WLCORE_MAX_TXPWR },
+        { .hw_value = 149, .center_freq = 5745, .max_power = WLCORE_MAX_TXPWR },
+        { .hw_value = 153, .center_freq = 5765, .max_power = WLCORE_MAX_TXPWR },
+        { .hw_value = 157, .center_freq = 5785, .max_power = WLCORE_MAX_TXPWR },
+        { .hw_value = 161, .center_freq = 5805, .max_power = WLCORE_MAX_TXPWR },
+        { .hw_value = 165, .center_freq = 5825, .max_power = WLCORE_MAX_TXPWR },
 };
 
 static struct ieee80211_supported_band wl1271_band_5ghz = {
@@ -4875,6 +5285,14 @@ static const struct ieee80211_ops wl1271_ops = {
         .set_bitrate_mask = wl12xx_set_bitrate_mask,
         .channel_switch = wl12xx_op_channel_switch,
         .flush = wlcore_op_flush,
+        .remain_on_channel = wlcore_op_remain_on_channel,
+        .cancel_remain_on_channel = wlcore_op_cancel_remain_on_channel,
+        .add_chanctx = wlcore_op_add_chanctx,
+        .remove_chanctx = wlcore_op_remove_chanctx,
+        .change_chanctx = wlcore_op_change_chanctx,
+        .assign_vif_chanctx = wlcore_op_assign_vif_chanctx,
+        .unassign_vif_chanctx = wlcore_op_unassign_vif_chanctx,
+        .sta_rc_update = wlcore_op_sta_rc_update,
         CFG80211_TESTMODE_CMD(wl1271_tm_cmd)
 };
 
@@ -5044,34 +5462,6 @@ static struct bin_attribute fwlog_attr = {
         .read = wl1271_sysfs_read_fwlog,
 };
 
-static void wl1271_connection_loss_work(struct work_struct *work)
-{
-        struct delayed_work *dwork;
-        struct wl1271 *wl;
-        struct ieee80211_vif *vif;
-        struct wl12xx_vif *wlvif;
-
-        dwork = container_of(work, struct delayed_work, work);
-        wl = container_of(dwork, struct wl1271, connection_loss_work);
-
-        wl1271_info("Connection loss work.");
-
-        mutex_lock(&wl->mutex);
-
-        if (unlikely(wl->state != WLCORE_STATE_ON))
-                goto out;
-
-        /* Call mac80211 connection loss */
-        wl12xx_for_each_wlvif_sta(wl, wlvif) {
-                if (!test_bit(WLVIF_FLAG_STA_ASSOCIATED, &wlvif->flags))
-                        goto out;
-                vif = wl12xx_wlvif_to_vif(wlvif);
-                ieee80211_connection_loss(vif);
-        }
-out:
-        mutex_unlock(&wl->mutex);
-}
-
 static void wl12xx_derive_mac_addresses(struct wl1271 *wl, u32 oui, u32 nic)
 {
         int i;
@@ -5117,7 +5507,7 @@ static int wl12xx_get_hw_info(struct wl1271 *wl)
 
         ret = wl12xx_set_power_on(wl);
         if (ret < 0)
-                goto out;
+                return ret;
 
         ret = wlcore_read_reg(wl, REG_CHIP_ID_B, &wl->chip.id);
         if (ret < 0)
@@ -5207,10 +5597,9 @@ static const struct ieee80211_iface_limit wlcore_iface_limits[] = {
         },
 };
 
-static const struct ieee80211_iface_combination
+static struct ieee80211_iface_combination
 wlcore_iface_combinations[] = {
         {
-          .num_different_channels = 1,
           .max_interfaces = 3,
           .limits = wlcore_iface_limits,
           .n_limits = ARRAY_SIZE(wlcore_iface_limits),
@@ -5219,6 +5608,7 @@ wlcore_iface_combinations[] = {
 
 static int wl1271_init_ieee80211(struct wl1271 *wl)
 {
+        int i;
         static const u32 cipher_suites[] = {
                 WLAN_CIPHER_SUITE_WEP40,
                 WLAN_CIPHER_SUITE_WEP104,
@@ -5249,7 +5639,8 @@ static int wl1271_init_ieee80211(struct wl1271 *wl)
                 IEEE80211_HW_AP_LINK_PS |
                 IEEE80211_HW_AMPDU_AGGREGATION |
                 IEEE80211_HW_TX_AMPDU_SETUP_IN_HW |
-                IEEE80211_HW_SCAN_WHILE_IDLE;
+                IEEE80211_HW_SCAN_WHILE_IDLE |
+                IEEE80211_HW_QUEUE_CONTROL;
 
         wl->hw->wiphy->cipher_suites = cipher_suites;
         wl->hw->wiphy->n_cipher_suites = ARRAY_SIZE(cipher_suites);
@@ -5271,6 +5662,8 @@ static int wl1271_init_ieee80211(struct wl1271 *wl)
         wl->hw->wiphy->max_sched_scan_ie_len = WL1271_CMD_TEMPL_MAX_SIZE -
                 sizeof(struct ieee80211_header);
 
+        wl->hw->wiphy->max_remain_on_channel_duration = 5000;
+
         wl->hw->wiphy->flags |= WIPHY_FLAG_AP_UAPSD |
                                 WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
 
@@ -5279,6 +5672,22 @@ static int wl1271_init_ieee80211(struct wl1271 *wl)
                      ARRAY_SIZE(wl1271_channels_5ghz) >
                      WL1271_MAX_CHANNELS);
         /*
+        * clear channel flags from the previous usage
+        * and restore max_power & max_antenna_gain values.
+        */
+        for (i = 0; i < ARRAY_SIZE(wl1271_channels); i++) {
+                wl1271_band_2ghz.channels[i].flags = 0;
+                wl1271_band_2ghz.channels[i].max_power = WLCORE_MAX_TXPWR;
+                wl1271_band_2ghz.channels[i].max_antenna_gain = 0;
+        }
+
+        for (i = 0; i < ARRAY_SIZE(wl1271_channels_5ghz); i++) {
+                wl1271_band_5ghz.channels[i].flags = 0;
+                wl1271_band_5ghz.channels[i].max_power = WLCORE_MAX_TXPWR;
+                wl1271_band_5ghz.channels[i].max_antenna_gain = 0;
+        }
+
+        /*
          * We keep local copies of the band structs because we need to
          * modify them on a per-device basis.
          */
@@ -5298,7 +5707,14 @@ static int wl1271_init_ieee80211(struct wl1271 *wl)
         wl->hw->wiphy->bands[IEEE80211_BAND_5GHZ] =
                 &wl->bands[IEEE80211_BAND_5GHZ];
 
-        wl->hw->queues = 4;
+        /*
+         * allow 4 queues per mac address we support +
+         * 1 cab queue per mac + one global offchannel Tx queue
+         */
+        wl->hw->queues = (NUM_TX_QUEUES + 1) * WLCORE_NUM_MAC_ADDRESSES + 1;
+
+        /* the last queue is the offchannel queue */
+        wl->hw->offchannel_tx_hw_queue = wl->hw->queues - 1;
         wl->hw->max_rates = 1;
 
         wl->hw->wiphy->reg_notifier = wl1271_reg_notify;
@@ -5311,6 +5727,7 @@ static int wl1271_init_ieee80211(struct wl1271 *wl)
                 NL80211_PROBE_RESP_OFFLOAD_SUPPORT_P2P;
 
         /* allowed interface combinations */
+        wlcore_iface_combinations[0].num_different_channels = wl->num_channels;
         wl->hw->wiphy->iface_combinations = wlcore_iface_combinations;
         wl->hw->wiphy->n_iface_combinations =
                 ARRAY_SIZE(wlcore_iface_combinations);
@@ -5327,7 +5744,8 @@ static int wl1271_init_ieee80211(struct wl1271 *wl)
 
 #define WL1271_DEFAULT_CHANNEL 0
 
-struct ieee80211_hw *wlcore_alloc_hw(size_t priv_size, u32 aggr_buf_size)
+struct ieee80211_hw *wlcore_alloc_hw(size_t priv_size, u32 aggr_buf_size,
+                                     u32 mbox_size)
 {
         struct ieee80211_hw *hw;
         struct wl1271 *wl;
@@ -5369,9 +5787,8 @@ struct ieee80211_hw *wlcore_alloc_hw(size_t priv_size, u32 aggr_buf_size)
         INIT_WORK(&wl->tx_work, wl1271_tx_work);
         INIT_WORK(&wl->recovery_work, wl1271_recovery_work);
         INIT_DELAYED_WORK(&wl->scan_complete_work, wl1271_scan_complete_work);
+        INIT_DELAYED_WORK(&wl->roc_complete_work, wlcore_roc_complete_work);
         INIT_DELAYED_WORK(&wl->tx_watchdog_work, wl12xx_tx_watchdog_work);
-        INIT_DELAYED_WORK(&wl->connection_loss_work,
-                          wl1271_connection_loss_work);
 
         wl->freezable_wq = create_freezable_workqueue("wl12xx_wq");
         if (!wl->freezable_wq) {
@@ -5387,14 +5804,15 @@ struct ieee80211_hw *wlcore_alloc_hw(size_t priv_size, u32 aggr_buf_size)
         wl->flags = 0;
         wl->sg_enabled = true;
         wl->sleep_auth = WL1271_PSM_ILLEGAL;
+        wl->recovery_count = 0;
         wl->hw_pg_ver = -1;
         wl->ap_ps_map = 0;
         wl->ap_fw_ps_map = 0;
         wl->quirks = 0;
         wl->platform_quirks = 0;
-        wl->sched_scanning = false;
         wl->system_hlid = WL12XX_SYSTEM_HLID;
         wl->active_sta_count = 0;
+        wl->active_link_count = 0;
         wl->fwlog_size = 0;
         init_waitqueue_head(&wl->fwlog_waitq);
 
@@ -5434,14 +5852,24 @@ struct ieee80211_hw *wlcore_alloc_hw(size_t priv_size, u32 aggr_buf_size)
                 goto err_dummy_packet;
         }
 
-        wl->mbox = kmalloc(sizeof(*wl->mbox), GFP_KERNEL | GFP_DMA);
+        wl->mbox_size = mbox_size;
+        wl->mbox = kmalloc(wl->mbox_size, GFP_KERNEL | GFP_DMA);
         if (!wl->mbox) {
                 ret = -ENOMEM;
                 goto err_fwlog;
         }
 
+        wl->buffer_32 = kmalloc(sizeof(*wl->buffer_32), GFP_KERNEL);
+        if (!wl->buffer_32) {
+                ret = -ENOMEM;
+                goto err_mbox;
+        }
+
         return hw;
 
+err_mbox:
+        kfree(wl->mbox);
+
 err_fwlog:
         free_page((unsigned long)wl->fwlog);
 
@@ -5480,6 +5908,8 @@ int wlcore_free_hw(struct wl1271 *wl)
         device_remove_file(wl->dev, &dev_attr_hw_pg_ver);
 
         device_remove_file(wl->dev, &dev_attr_bt_coex_state);
+        kfree(wl->buffer_32);
+        kfree(wl->mbox);
         free_page((unsigned long)wl->fwlog);
         dev_kfree_skb(wl->dummy_packet);
         free_pages((unsigned long)wl->aggr_buf, get_order(wl->aggr_buf_size));
@@ -5712,10 +6142,10 @@ module_param_named(fwlog, fwlog_param, charp, 0);
 MODULE_PARM_DESC(fwlog,
                  "FW logger options: continuous, ondemand, dbgpins or disable");
 
-module_param(bug_on_recovery, bool, S_IRUSR | S_IWUSR);
+module_param(bug_on_recovery, int, S_IRUSR | S_IWUSR);
 MODULE_PARM_DESC(bug_on_recovery, "BUG() on fw recovery");
 
-module_param(no_recovery, bool, S_IRUSR | S_IWUSR);
+module_param(no_recovery, int, S_IRUSR | S_IWUSR);
 MODULE_PARM_DESC(no_recovery, "Prevent HW recovery. FW will remain stuck.");
 
 MODULE_LICENSE("GPL");
diff --git a/drivers/net/wireless/ti/wlcore/ps.c b/drivers/net/wireless/ti/wlcore/ps.c
index 4d1414a673fb..9b7b6e2e4fbc 100644
--- a/drivers/net/wireless/ti/wlcore/ps.c
+++ b/drivers/net/wireless/ti/wlcore/ps.c
@@ -151,9 +151,6 @@ int wl1271_ps_elp_wakeup(struct wl1271 *wl)
                         wl12xx_queue_recovery_work(wl);
                         ret = -ETIMEDOUT;
                         goto err;
-                } else if (ret < 0) {
-                        wl1271_error("ELP wakeup completion error.");
-                        goto err;
                 }
         }
 
@@ -242,11 +239,12 @@ static void wl1271_ps_filter_frames(struct wl1271 *wl, u8 hlid)
         struct ieee80211_tx_info *info;
         unsigned long flags;
         int filtered[NUM_TX_QUEUES];
+        struct wl1271_link *lnk = &wl->links[hlid];
 
         /* filter all frames currently in the low level queues for this hlid */
         for (i = 0; i < NUM_TX_QUEUES; i++) {
                 filtered[i] = 0;
-                while ((skb = skb_dequeue(&wl->links[hlid].tx_queue[i]))) {
+                while ((skb = skb_dequeue(&lnk->tx_queue[i]))) {
                         filtered[i]++;
 
                         if (WARN_ON(wl12xx_is_dummy_packet(wl, skb)))
@@ -260,8 +258,11 @@ static void wl1271_ps_filter_frames(struct wl1271 *wl, u8 hlid)
         }
 
         spin_lock_irqsave(&wl->wl_lock, flags);
-        for (i = 0; i < NUM_TX_QUEUES; i++)
+        for (i = 0; i < NUM_TX_QUEUES; i++) {
                 wl->tx_queue_count[i] -= filtered[i];
+                if (lnk->wlvif)
+                        lnk->wlvif->tx_queue_count[i] -= filtered[i];
+        }
         spin_unlock_irqrestore(&wl->wl_lock, flags);
 
         wl1271_handle_tx_low_watermark(wl);
diff --git a/drivers/net/wireless/ti/wlcore/rx.c b/drivers/net/wireless/ti/wlcore/rx.c
index 9ee0ec6fd1db..6791a1a6afba 100644
--- a/drivers/net/wireless/ti/wlcore/rx.c
+++ b/drivers/net/wireless/ti/wlcore/rx.c
@@ -92,11 +92,16 @@ static void wl1271_rx_status(struct wl1271 *wl,
                 status->flag |= RX_FLAG_IV_STRIPPED | RX_FLAG_MMIC_STRIPPED |
                                 RX_FLAG_DECRYPTED;
 
-                if (unlikely(desc_err_code == WL1271_RX_DESC_MIC_FAIL)) {
+                if (unlikely(desc_err_code & WL1271_RX_DESC_MIC_FAIL)) {
                         status->flag |= RX_FLAG_MMIC_ERROR;
-                        wl1271_warning("Michael MIC error");
+                        wl1271_warning("Michael MIC error. Desc: 0x%x",
+                                       desc_err_code);
                 }
         }
+
+        if (beacon)
+                wlcore_set_pending_regdomain_ch(wl, (u16)desc->channel,
+                                                status->band);
 }
 
 static int wl1271_rx_handle_data(struct wl1271 *wl, u8 *data, u32 length,
@@ -108,7 +113,7 @@ static int wl1271_rx_handle_data(struct wl1271 *wl, u8 *data, u32 length,
         u8 *buf;
         u8 beacon = 0;
         u8 is_data = 0;
-        u8 reserved = 0;
+        u8 reserved = 0, offset_to_data = 0;
         u16 seq_num;
         u32 pkt_data_len;
 
@@ -128,6 +133,8 @@ static int wl1271_rx_handle_data(struct wl1271 *wl, u8 *data, u32 length,
 
         if (rx_align == WLCORE_RX_BUF_UNALIGNED)
                 reserved = RX_BUF_ALIGN;
+        else if (rx_align == WLCORE_RX_BUF_PADDED)
+                offset_to_data = RX_BUF_ALIGN;
 
         /* the data read starts with the descriptor */
         desc = (struct wl1271_rx_descriptor *) data;
@@ -139,19 +146,15 @@ static int wl1271_rx_handle_data(struct wl1271 *wl, u8 *data, u32 length,
                 return 0;
         }
 
-        switch (desc->status & WL1271_RX_DESC_STATUS_MASK) {
         /* discard corrupted packets */
-        case WL1271_RX_DESC_DRIVER_RX_Q_FAIL:
-        case WL1271_RX_DESC_DECRYPT_FAIL:
-                wl1271_warning("corrupted packet in RX with status: 0x%x",
-                               desc->status & WL1271_RX_DESC_STATUS_MASK);
-                return -EINVAL;
-        case WL1271_RX_DESC_SUCCESS:
-        case WL1271_RX_DESC_MIC_FAIL:
-                break;
-        default:
-                wl1271_error("invalid RX descriptor status: 0x%x",
-                             desc->status & WL1271_RX_DESC_STATUS_MASK);
+        if (desc->status & WL1271_RX_DESC_DECRYPT_FAIL) {
+                hdr = (void *)(data + sizeof(*desc) + offset_to_data);
+                wl1271_warning("corrupted packet in RX: status: 0x%x len: %d",
+                               desc->status & WL1271_RX_DESC_STATUS_MASK,
+                               pkt_data_len);
+                wl1271_dump((DEBUG_RX|DEBUG_CMD), "PKT: ", data + sizeof(*desc),
+                            min(pkt_data_len,
+                                ieee80211_hdrlen(hdr->frame_control)));
                 return -EINVAL;
         }
 
diff --git a/drivers/net/wireless/ti/wlcore/rx.h b/drivers/net/wireless/ti/wlcore/rx.h
index 71eba1899915..3363f60fb7da 100644
--- a/drivers/net/wireless/ti/wlcore/rx.h
+++ b/drivers/net/wireless/ti/wlcore/rx.h
@@ -84,12 +84,11 @@
  * Bits 3-5 - process_id tag (AP mode FW)
  * Bits 6-7 - reserved
  */
-#define WL1271_RX_DESC_STATUS_MASK      0x03
+#define WL1271_RX_DESC_STATUS_MASK      0x07
 
 #define WL1271_RX_DESC_SUCCESS          0x00
 #define WL1271_RX_DESC_DECRYPT_FAIL     0x01
 #define WL1271_RX_DESC_MIC_FAIL         0x02
-#define WL1271_RX_DESC_DRIVER_RX_Q_FAIL 0x03
 
 #define RX_MEM_BLOCK_MASK            0xFF
 #define RX_BUF_SIZE_MASK             0xFFF00
diff --git a/drivers/net/wireless/ti/wlcore/scan.c b/drivers/net/wireless/ti/wlcore/scan.c
index d00501493dfe..f407101e525b 100644
--- a/drivers/net/wireless/ti/wlcore/scan.c
+++ b/drivers/net/wireless/ti/wlcore/scan.c
@@ -35,7 +35,6 @@ void wl1271_scan_complete_work(struct work_struct *work)
 {
         struct delayed_work *dwork;
         struct wl1271 *wl;
-        struct ieee80211_vif *vif;
         struct wl12xx_vif *wlvif;
         int ret;
 
@@ -52,8 +51,7 @@ void wl1271_scan_complete_work(struct work_struct *work)
         if (wl->scan.state == WL1271_SCAN_STATE_IDLE)
                 goto out;
 
-        vif = wl->scan_vif;
-        wlvif = wl12xx_vif_to_data(vif);
+        wlvif = wl->scan_wlvif;
 
         /*
          * Rearm the tx watchdog just before idling scan. This
@@ -64,7 +62,7 @@ void wl1271_scan_complete_work(struct work_struct *work)
         wl->scan.state = WL1271_SCAN_STATE_IDLE;
         memset(wl->scan.scanned_ch, 0, sizeof(wl->scan.scanned_ch));
         wl->scan.req = NULL;
-        wl->scan_vif = NULL;
+        wl->scan_wlvif = NULL;
 
         ret = wl1271_ps_elp_wakeup(wl);
         if (ret < 0)
@@ -82,6 +80,8 @@ void wl1271_scan_complete_work(struct work_struct *work)
                 wl12xx_queue_recovery_work(wl);
         }
 
+        wlcore_cmd_regdomain_config_locked(wl);
+
         ieee80211_scan_completed(wl->hw, false);
 
 out:
@@ -89,371 +89,99 @@ out:
 
 }
 
-
-static int wl1271_get_scan_channels(struct wl1271 *wl,
-                                    struct cfg80211_scan_request *req,
-                                    struct basic_scan_channel_params *channels,
-                                    enum ieee80211_band band, bool passive)
-{
-        struct conf_scan_settings *c = &wl->conf.scan;
-        int i, j;
-        u32 flags;
-
-        for (i = 0, j = 0;
-             i < req->n_channels && j < WL1271_SCAN_MAX_CHANNELS;
-             i++) {
-                flags = req->channels[i]->flags;
-
-                if (!test_bit(i, wl->scan.scanned_ch) &&
-                    !(flags & IEEE80211_CHAN_DISABLED) &&
-                    (req->channels[i]->band == band) &&
-                    /*
-                     * In passive scans, we scan all remaining
-                     * channels, even if not marked as such.
-                     * In active scans, we only scan channels not
-                     * marked as passive.
-                     */
-                    (passive || !(flags & IEEE80211_CHAN_PASSIVE_SCAN))) {
-                        wl1271_debug(DEBUG_SCAN, "band %d, center_freq %d ",
-                                     req->channels[i]->band,
-                                     req->channels[i]->center_freq);
-                        wl1271_debug(DEBUG_SCAN, "hw_value %d, flags %X",
-                                     req->channels[i]->hw_value,
-                                     req->channels[i]->flags);
-                        wl1271_debug(DEBUG_SCAN,
-                                     "max_antenna_gain %d, max_power %d",
-                                     req->channels[i]->max_antenna_gain,
-                                     req->channels[i]->max_power);
-                        wl1271_debug(DEBUG_SCAN, "beacon_found %d",
-                                     req->channels[i]->beacon_found);
-
-                        if (!passive) {
-                                channels[j].min_duration =
-                                        cpu_to_le32(c->min_dwell_time_active);
-                                channels[j].max_duration =
-                                        cpu_to_le32(c->max_dwell_time_active);
-                        } else {
-                                channels[j].min_duration =
-                                        cpu_to_le32(c->min_dwell_time_passive);
-                                channels[j].max_duration =
-                                        cpu_to_le32(c->max_dwell_time_passive);
-                        }
-                        channels[j].early_termination = 0;
-                        channels[j].tx_power_att = req->channels[i]->max_power;
-                        channels[j].channel = req->channels[i]->hw_value;
-
-                        memset(&channels[j].bssid_lsb, 0xff, 4);
-                        memset(&channels[j].bssid_msb, 0xff, 2);
-
-                        /* Mark the channels we already used */
-                        set_bit(i, wl->scan.scanned_ch);
-
-                        j++;
-                }
-        }
-
-        return j;
-}
-
-#define WL1271_NOTHING_TO_SCAN 1
-
-static int wl1271_scan_send(struct wl1271 *wl, struct ieee80211_vif *vif,
-                            enum ieee80211_band band,
-                            bool passive, u32 basic_rate)
+static void wlcore_started_vifs_iter(void *data, u8 *mac,
+                                     struct ieee80211_vif *vif)
 {
-        struct wl12xx_vif *wlvif = wl12xx_vif_to_data(vif);
-        struct wl1271_cmd_scan *cmd;
-        struct wl1271_cmd_trigger_scan_to *trigger;
-        int ret;
-        u16 scan_options = 0;
-
-        /* skip active scans if we don't have SSIDs */
-        if (!passive && wl->scan.req->n_ssids == 0)
-                return WL1271_NOTHING_TO_SCAN;
-
-        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
-        trigger = kzalloc(sizeof(*trigger), GFP_KERNEL);
-        if (!cmd || !trigger) {
-                ret = -ENOMEM;
-                goto out;
-        }
-
-        if (wl->conf.scan.split_scan_timeout)
-                scan_options |= WL1271_SCAN_OPT_SPLIT_SCAN;
-
-        if (passive)
-                scan_options |= WL1271_SCAN_OPT_PASSIVE;
-
-        cmd->params.role_id = wlvif->role_id;
-
-        if (WARN_ON(cmd->params.role_id == WL12XX_INVALID_ROLE_ID)) {
-                ret = -EINVAL;
-                goto out;
-        }
-
-        cmd->params.scan_options = cpu_to_le16(scan_options);
-
-        cmd->params.n_ch = wl1271_get_scan_channels(wl, wl->scan.req,
-                                                    cmd->channels,
-                                                    band, passive);
-        if (cmd->params.n_ch == 0) {
-                ret = WL1271_NOTHING_TO_SCAN;
-                goto out;
-        }
-
-        cmd->params.tx_rate = cpu_to_le32(basic_rate);
-        cmd->params.n_probe_reqs = wl->conf.scan.num_probe_reqs;
-        cmd->params.tid_trigger = CONF_TX_AC_ANY_TID;
-        cmd->params.scan_tag = WL1271_SCAN_DEFAULT_TAG;
-
-        if (band == IEEE80211_BAND_2GHZ)
-                cmd->params.band = WL1271_SCAN_BAND_2_4_GHZ;
-        else
-                cmd->params.band = WL1271_SCAN_BAND_5_GHZ;
-
-        if (wl->scan.ssid_len && wl->scan.ssid) {
-                cmd->params.ssid_len = wl->scan.ssid_len;
-                memcpy(cmd->params.ssid, wl->scan.ssid, wl->scan.ssid_len);
-        }
-
-        memcpy(cmd->addr, vif->addr, ETH_ALEN);
-
-        ret = wl12xx_cmd_build_probe_req(wl, wlvif,
-                                         cmd->params.role_id, band,
-                                         wl->scan.ssid, wl->scan.ssid_len,
-                                         wl->scan.req->ie,
-                                         wl->scan.req->ie_len, false);
-        if (ret < 0) {
-                wl1271_error("PROBE request template failed");
-                goto out;
-        }
-
-        trigger->timeout = cpu_to_le32(wl->conf.scan.split_scan_timeout);
-        ret = wl1271_cmd_send(wl, CMD_TRIGGER_SCAN_TO, trigger,
-                              sizeof(*trigger), 0);
-        if (ret < 0) {
-                wl1271_error("trigger scan to failed for hw scan");
-                goto out;
-        }
-
-        wl1271_dump(DEBUG_SCAN, "SCAN: ", cmd, sizeof(*cmd));
+        int *count = (int *)data;
 
-        ret = wl1271_cmd_send(wl, CMD_SCAN, cmd, sizeof(*cmd), 0);
-        if (ret < 0) {
-                wl1271_error("SCAN failed");
-                goto out;
-        }
-
-out:
-        kfree(cmd);
-        kfree(trigger);
-        return ret;
+        if (!vif->bss_conf.idle)
+                (*count)++;
 }
 
-void wl1271_scan_stm(struct wl1271 *wl, struct ieee80211_vif *vif)
+static int wlcore_count_started_vifs(struct wl1271 *wl)
 {
-        struct wl12xx_vif *wlvif = wl12xx_vif_to_data(vif);
-        int ret = 0;
-        enum ieee80211_band band;
-        u32 rate, mask;
-
-        switch (wl->scan.state) {
-        case WL1271_SCAN_STATE_IDLE:
-                break;
-
-        case WL1271_SCAN_STATE_2GHZ_ACTIVE:
-                band = IEEE80211_BAND_2GHZ;
-                mask = wlvif->bitrate_masks[band];
-                if (wl->scan.req->no_cck) {
-                        mask &= ~CONF_TX_CCK_RATES;
-                        if (!mask)
-                                mask = CONF_TX_RATE_MASK_BASIC_P2P;
-                }
-                rate = wl1271_tx_min_rate_get(wl, mask);
-                ret = wl1271_scan_send(wl, vif, band, false, rate);
-                if (ret == WL1271_NOTHING_TO_SCAN) {
-                        wl->scan.state = WL1271_SCAN_STATE_2GHZ_PASSIVE;
-                        wl1271_scan_stm(wl, vif);
-                }
-
-                break;
-
-        case WL1271_SCAN_STATE_2GHZ_PASSIVE:
-                band = IEEE80211_BAND_2GHZ;
-                mask = wlvif->bitrate_masks[band];
-                if (wl->scan.req->no_cck) {
-                        mask &= ~CONF_TX_CCK_RATES;
-                        if (!mask)
-                                mask = CONF_TX_RATE_MASK_BASIC_P2P;
-                }
-                rate = wl1271_tx_min_rate_get(wl, mask);
-                ret = wl1271_scan_send(wl, vif, band, true, rate);
-                if (ret == WL1271_NOTHING_TO_SCAN) {
-                        if (wl->enable_11a)
-                                wl->scan.state = WL1271_SCAN_STATE_5GHZ_ACTIVE;
-                        else
-                                wl->scan.state = WL1271_SCAN_STATE_DONE;
-                        wl1271_scan_stm(wl, vif);
-                }
-
-                break;
+        int count = 0;
 
-        case WL1271_SCAN_STATE_5GHZ_ACTIVE:
-                band = IEEE80211_BAND_5GHZ;
-                rate = wl1271_tx_min_rate_get(wl, wlvif->bitrate_masks[band]);
-                ret = wl1271_scan_send(wl, vif, band, false, rate);
-                if (ret == WL1271_NOTHING_TO_SCAN) {
-                        wl->scan.state = WL1271_SCAN_STATE_5GHZ_PASSIVE;
-                        wl1271_scan_stm(wl, vif);
-                }
-
-                break;
-
-        case WL1271_SCAN_STATE_5GHZ_PASSIVE:
-                band = IEEE80211_BAND_5GHZ;
-                rate = wl1271_tx_min_rate_get(wl, wlvif->bitrate_masks[band]);
-                ret = wl1271_scan_send(wl, vif, band, true, rate);
-                if (ret == WL1271_NOTHING_TO_SCAN) {
-                        wl->scan.state = WL1271_SCAN_STATE_DONE;
-                        wl1271_scan_stm(wl, vif);
-                }
-
-                break;
-
-        case WL1271_SCAN_STATE_DONE:
-                wl->scan.failed = false;
-                cancel_delayed_work(&wl->scan_complete_work);
-                ieee80211_queue_delayed_work(wl->hw, &wl->scan_complete_work,
-                                             msecs_to_jiffies(0));
-                break;
-
-        default:
-                wl1271_error("invalid scan state");
-                break;
-        }
-
-        if (ret < 0) {
-                cancel_delayed_work(&wl->scan_complete_work);
-                ieee80211_queue_delayed_work(wl->hw, &wl->scan_complete_work,
-                                             msecs_to_jiffies(0));
-        }
-}
-
-int wl1271_scan(struct wl1271 *wl, struct ieee80211_vif *vif,
-                const u8 *ssid, size_t ssid_len,
-                struct cfg80211_scan_request *req)
-{
-        /*
-         * cfg80211 should guarantee that we don't get more channels
-         * than what we have registered.
-         */
-        BUG_ON(req->n_channels > WL1271_MAX_CHANNELS);
-
-        if (wl->scan.state != WL1271_SCAN_STATE_IDLE)
-                return -EBUSY;
-
-        wl->scan.state = WL1271_SCAN_STATE_2GHZ_ACTIVE;
-
-        if (ssid_len && ssid) {
-                wl->scan.ssid_len = ssid_len;
-                memcpy(wl->scan.ssid, ssid, ssid_len);
-        } else {
-                wl->scan.ssid_len = 0;
-        }
-
-        wl->scan_vif = vif;
-        wl->scan.req = req;
-        memset(wl->scan.scanned_ch, 0, sizeof(wl->scan.scanned_ch));
-
-        /* we assume failure so that timeout scenarios are handled correctly */
-        wl->scan.failed = true;
-        ieee80211_queue_delayed_work(wl->hw, &wl->scan_complete_work,
-                                     msecs_to_jiffies(WL1271_SCAN_TIMEOUT));
-
-        wl1271_scan_stm(wl, vif);
-
-        return 0;
-}
-
-int wl1271_scan_stop(struct wl1271 *wl)
-{
-        struct wl1271_cmd_header *cmd = NULL;
-        int ret = 0;
-
-        if (WARN_ON(wl->scan.state == WL1271_SCAN_STATE_IDLE))
-                return -EINVAL;
-
-        wl1271_debug(DEBUG_CMD, "cmd scan stop");
-
-        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
-        if (!cmd) {
-                ret = -ENOMEM;
-                goto out;
-        }
-
-        ret = wl1271_cmd_send(wl, CMD_STOP_SCAN, cmd,
-                              sizeof(*cmd), 0);
-        if (ret < 0) {
-                wl1271_error("cmd stop_scan failed");
-                goto out;
-        }
-out:
-        kfree(cmd);
-        return ret;
+        ieee80211_iterate_active_interfaces_atomic(wl->hw,
+                                        IEEE80211_IFACE_ITER_RESUME_ALL,
+                                        wlcore_started_vifs_iter, &count);
+        return count;
 }
 
 static int
-wl1271_scan_get_sched_scan_channels(struct wl1271 *wl,
-                                    struct cfg80211_sched_scan_request *req,
-                                    struct conn_scan_ch_params *channels,
-                                    u32 band, bool radar, bool passive,
-                                    int start, int max_channels,
-                                    u8 *n_pactive_ch)
+wlcore_scan_get_channels(struct wl1271 *wl,
+                         struct ieee80211_channel *req_channels[],
+                         u32 n_channels,
+                         u32 n_ssids,
+                         struct conn_scan_ch_params *channels,
+                         u32 band, bool radar, bool passive,
+                         int start, int max_channels,
+                         u8 *n_pactive_ch,
+                         int scan_type)
 {
-        struct conf_sched_scan_settings *c = &wl->conf.sched_scan;
         int i, j;
         u32 flags;
-        bool force_passive = !req->n_ssids;
-        u32 min_dwell_time_active, max_dwell_time_active, delta_per_probe;
+        bool force_passive = !n_ssids;
+        u32 min_dwell_time_active, max_dwell_time_active;
         u32 dwell_time_passive, dwell_time_dfs;
 
-        if (band == IEEE80211_BAND_5GHZ)
-                delta_per_probe = c->dwell_time_delta_per_probe_5;
-        else
-                delta_per_probe = c->dwell_time_delta_per_probe;
+        /* configure dwell times according to scan type */
+        if (scan_type == SCAN_TYPE_SEARCH) {
+                struct conf_scan_settings *c = &wl->conf.scan;
+                bool active_vif_exists = !!wlcore_count_started_vifs(wl);
+
+                min_dwell_time_active = active_vif_exists ?
+                        c->min_dwell_time_active :
+                        c->min_dwell_time_active_long;
+                max_dwell_time_active = active_vif_exists ?
+                        c->max_dwell_time_active :
+                        c->max_dwell_time_active_long;
+                dwell_time_passive = c->dwell_time_passive;
+                dwell_time_dfs = c->dwell_time_dfs;
+        } else {
+                struct conf_sched_scan_settings *c = &wl->conf.sched_scan;
+                u32 delta_per_probe;
 
-        min_dwell_time_active = c->base_dwell_time +
-                 req->n_ssids * c->num_probe_reqs * delta_per_probe;
+                if (band == IEEE80211_BAND_5GHZ)
+                        delta_per_probe = c->dwell_time_delta_per_probe_5;
+                else
+                        delta_per_probe = c->dwell_time_delta_per_probe;
 
-        max_dwell_time_active = min_dwell_time_active + c->max_dwell_time_delta;
+                min_dwell_time_active = c->base_dwell_time +
+                         n_ssids * c->num_probe_reqs * delta_per_probe;
 
+                max_dwell_time_active = min_dwell_time_active +
+                                        c->max_dwell_time_delta;
+                dwell_time_passive = c->dwell_time_passive;
+                dwell_time_dfs = c->dwell_time_dfs;
+        }
         min_dwell_time_active = DIV_ROUND_UP(min_dwell_time_active, 1000);
         max_dwell_time_active = DIV_ROUND_UP(max_dwell_time_active, 1000);
-        dwell_time_passive = DIV_ROUND_UP(c->dwell_time_passive, 1000);
-        dwell_time_dfs = DIV_ROUND_UP(c->dwell_time_dfs, 1000);
+        dwell_time_passive = DIV_ROUND_UP(dwell_time_passive, 1000);
+        dwell_time_dfs = DIV_ROUND_UP(dwell_time_dfs, 1000);
 
         for (i = 0, j = start;
-             i < req->n_channels && j < max_channels;
+             i < n_channels && j < max_channels;
              i++) {
-                flags = req->channels[i]->flags;
+                flags = req_channels[i]->flags;
 
                 if (force_passive)
                         flags |= IEEE80211_CHAN_PASSIVE_SCAN;
 
-                if ((req->channels[i]->band == band) &&
+                if ((req_channels[i]->band == band) &&
                     !(flags & IEEE80211_CHAN_DISABLED) &&
                     (!!(flags & IEEE80211_CHAN_RADAR) == radar) &&
                     /* if radar is set, we ignore the passive flag */
                     (radar ||
                      !!(flags & IEEE80211_CHAN_PASSIVE_SCAN) == passive)) {
                         wl1271_debug(DEBUG_SCAN, "band %d, center_freq %d ",
-                                     req->channels[i]->band,
-                                     req->channels[i]->center_freq);
+                                     req_channels[i]->band,
+                                     req_channels[i]->center_freq);
                         wl1271_debug(DEBUG_SCAN, "hw_value %d, flags %X",
-                                     req->channels[i]->hw_value,
-                                     req->channels[i]->flags);
+                                     req_channels[i]->hw_value,
+                                     req_channels[i]->flags);
                         wl1271_debug(DEBUG_SCAN, "max_power %d",
-                                     req->channels[i]->max_power);
+                                     req_channels[i]->max_power);
                         wl1271_debug(DEBUG_SCAN, "min_dwell_time %d max dwell time %d",
                                      min_dwell_time_active,
                                      max_dwell_time_active);
@@ -473,10 +201,11 @@ wl1271_scan_get_sched_scan_channels(struct wl1271 *wl,
                         channels[j].max_duration =
                                 cpu_to_le16(max_dwell_time_active);
 
-                        channels[j].tx_power_att = req->channels[i]->max_power;
-                        channels[j].channel = req->channels[i]->hw_value;
+                        channels[j].tx_power_att = req_channels[i]->max_power;
+                        channels[j].channel = req_channels[i]->hw_value;
 
-                        if ((band == IEEE80211_BAND_2GHZ) &&
+                        if (n_pactive_ch &&
+                            (band == IEEE80211_BAND_2GHZ) &&
                             (channels[j].channel >= 12) &&
                             (channels[j].channel <= 14) &&
                             (flags & IEEE80211_CHAN_PASSIVE_SCAN) &&
@@ -500,51 +229,80 @@ wl1271_scan_get_sched_scan_channels(struct wl1271 *wl,
         return j - start;
 }
 
-static bool
-wl1271_scan_sched_scan_channels(struct wl1271 *wl,
-                                struct cfg80211_sched_scan_request *req,
-                                struct wl1271_cmd_sched_scan_config *cfg)
+bool
+wlcore_set_scan_chan_params(struct wl1271 *wl,
+                            struct wlcore_scan_channels *cfg,
+                            struct ieee80211_channel *channels[],
+                            u32 n_channels,
+                            u32 n_ssids,
+                            int scan_type)
 {
         u8 n_pactive_ch = 0;
 
         cfg->passive[0] =
-                wl1271_scan_get_sched_scan_channels(wl, req, cfg->channels_2,
-                                                    IEEE80211_BAND_2GHZ,
-                                                    false, true, 0,
-                                                    MAX_CHANNELS_2GHZ,
-                                                    &n_pactive_ch);
+                wlcore_scan_get_channels(wl,
+                                         channels,
+                                         n_channels,
+                                         n_ssids,
+                                         cfg->channels_2,
+                                         IEEE80211_BAND_2GHZ,
+                                         false, true, 0,
+                                         MAX_CHANNELS_2GHZ,
+                                         &n_pactive_ch,
+                                         scan_type);
         cfg->active[0] =
-                wl1271_scan_get_sched_scan_channels(wl, req, cfg->channels_2,
-                                                    IEEE80211_BAND_2GHZ,
-                                                    false, false,
-                                                    cfg->passive[0],
-                                                    MAX_CHANNELS_2GHZ,
-                                                    &n_pactive_ch);
+                wlcore_scan_get_channels(wl,
+                                         channels,
+                                         n_channels,
+                                         n_ssids,
+                                         cfg->channels_2,
+                                         IEEE80211_BAND_2GHZ,
+                                         false, false,
+                                         cfg->passive[0],
+                                         MAX_CHANNELS_2GHZ,
+                                         &n_pactive_ch,
+                                         scan_type);
         cfg->passive[1] =
-                wl1271_scan_get_sched_scan_channels(wl, req, cfg->channels_5,
-                                                    IEEE80211_BAND_5GHZ,
-                                                    false, true, 0,
-                                                    MAX_CHANNELS_5GHZ,
-                                                    &n_pactive_ch);
+                wlcore_scan_get_channels(wl,
+                                         channels,
+                                         n_channels,
+                                         n_ssids,
+                                         cfg->channels_5,
+                                         IEEE80211_BAND_5GHZ,
+                                         false, true, 0,
+                                         wl->max_channels_5,
+                                         &n_pactive_ch,
+                                         scan_type);
         cfg->dfs =
-                wl1271_scan_get_sched_scan_channels(wl, req, cfg->channels_5,
-                                                    IEEE80211_BAND_5GHZ,
-                                                    true, true,
-                                                    cfg->passive[1],
-                                                    MAX_CHANNELS_5GHZ,
-                                                    &n_pactive_ch);
+                wlcore_scan_get_channels(wl,
+                                         channels,
+                                         n_channels,
+                                         n_ssids,
+                                         cfg->channels_5,
+                                         IEEE80211_BAND_5GHZ,
+                                         true, true,
+                                         cfg->passive[1],
+                                         wl->max_channels_5,
+                                         &n_pactive_ch,
+                                         scan_type);
         cfg->active[1] =
-                wl1271_scan_get_sched_scan_channels(wl, req, cfg->channels_5,
-                                                    IEEE80211_BAND_5GHZ,
-                                                    false, false,
-                                                    cfg->passive[1] + cfg->dfs,
-                                                    MAX_CHANNELS_5GHZ,
-                                                    &n_pactive_ch);
+                wlcore_scan_get_channels(wl,
+                                         channels,
+                                         n_channels,
+                                         n_ssids,
+                                         cfg->channels_5,
+                                         IEEE80211_BAND_5GHZ,
+                                         false, false,
+                                         cfg->passive[1] + cfg->dfs,
+                                         wl->max_channels_5,
+                                         &n_pactive_ch,
+                                         scan_type);
+
         /* 802.11j channels are not supported yet */
         cfg->passive[2] = 0;
         cfg->active[2] = 0;
 
-        cfg->n_pactive_ch = n_pactive_ch;
+        cfg->passive_active = n_pactive_ch;
 
         wl1271_debug(DEBUG_SCAN, "    2.4GHz: active %d passive %d",
                      cfg->active[0], cfg->passive[0]);
@@ -556,10 +314,48 @@ wl1271_scan_sched_scan_channels(struct wl1271 *wl,
                 cfg->passive[1] || cfg->active[1] || cfg->dfs ||
                 cfg->passive[2] || cfg->active[2];
 }
+EXPORT_SYMBOL_GPL(wlcore_set_scan_chan_params);
+
+int wlcore_scan(struct wl1271 *wl, struct ieee80211_vif *vif,
+                const u8 *ssid, size_t ssid_len,
+                struct cfg80211_scan_request *req)
+{
+        struct wl12xx_vif *wlvif = wl12xx_vif_to_data(vif);
+
+        /*
+         * cfg80211 should guarantee that we don't get more channels
+         * than what we have registered.
+         */
+        BUG_ON(req->n_channels > WL1271_MAX_CHANNELS);
+
+        if (wl->scan.state != WL1271_SCAN_STATE_IDLE)
+                return -EBUSY;
+
+        wl->scan.state = WL1271_SCAN_STATE_2GHZ_ACTIVE;
+
+        if (ssid_len && ssid) {
+                wl->scan.ssid_len = ssid_len;
+                memcpy(wl->scan.ssid, ssid, ssid_len);
+        } else {
+                wl->scan.ssid_len = 0;
+        }
+
+        wl->scan_wlvif = wlvif;
+        wl->scan.req = req;
+        memset(wl->scan.scanned_ch, 0, sizeof(wl->scan.scanned_ch));
+
+        /* we assume failure so that timeout scenarios are handled correctly */
+        wl->scan.failed = true;
+        ieee80211_queue_delayed_work(wl->hw, &wl->scan_complete_work,
+                                     msecs_to_jiffies(WL1271_SCAN_TIMEOUT));
 
+        wl->ops->scan_start(wl, wlvif, req);
+
+        return 0;
+}
 /* Returns the scan type to be used or a negative value on error */
-static int
-wl12xx_scan_sched_scan_ssid_list(struct wl1271 *wl,
+int
+wlcore_scan_sched_scan_ssid_list(struct wl1271 *wl,
                                  struct wl12xx_vif *wlvif,
                                  struct cfg80211_sched_scan_request *req)
 {
@@ -662,160 +458,12 @@ out:
                 return ret;
         return type;
 }
+EXPORT_SYMBOL_GPL(wlcore_scan_sched_scan_ssid_list);
 
-int wl1271_scan_sched_scan_config(struct wl1271 *wl,
-                                  struct wl12xx_vif *wlvif,
-                                  struct cfg80211_sched_scan_request *req,
-                                  struct ieee80211_sched_scan_ies *ies)
-{
-        struct wl1271_cmd_sched_scan_config *cfg = NULL;
-        struct conf_sched_scan_settings *c = &wl->conf.sched_scan;
-        int i, ret;
-        bool force_passive = !req->n_ssids;
-
-        wl1271_debug(DEBUG_CMD, "cmd sched_scan scan config");
-
-        cfg = kzalloc(sizeof(*cfg), GFP_KERNEL);
-        if (!cfg)
-                return -ENOMEM;
-
-        cfg->role_id = wlvif->role_id;
-        cfg->rssi_threshold = c->rssi_threshold;
-        cfg->snr_threshold  = c->snr_threshold;
-        cfg->n_probe_reqs = c->num_probe_reqs;
-        /* cycles set to 0 it means infinite (until manually stopped) */
-        cfg->cycles = 0;
-        /* report APs when at least 1 is found */
-        cfg->report_after = 1;
-        /* don't stop scanning automatically when something is found */
-        cfg->terminate = 0;
-        cfg->tag = WL1271_SCAN_DEFAULT_TAG;
-        /* don't filter on BSS type */
-        cfg->bss_type = SCAN_BSS_TYPE_ANY;
-        /* currently NL80211 supports only a single interval */
-        for (i = 0; i < SCAN_MAX_CYCLE_INTERVALS; i++)
-                cfg->intervals[i] = cpu_to_le32(req->interval);
-
-        cfg->ssid_len = 0;
-        ret = wl12xx_scan_sched_scan_ssid_list(wl, wlvif, req);
-        if (ret < 0)
-                goto out;
-
-        cfg->filter_type = ret;
-
-        wl1271_debug(DEBUG_SCAN, "filter_type = %d", cfg->filter_type);
-
-        if (!wl1271_scan_sched_scan_channels(wl, req, cfg)) {
-                wl1271_error("scan channel list is empty");
-                ret = -EINVAL;
-                goto out;
-        }
-
-        if (!force_passive && cfg->active[0]) {
-                u8 band = IEEE80211_BAND_2GHZ;
-                ret = wl12xx_cmd_build_probe_req(wl, wlvif,
-                                                 wlvif->role_id, band,
-                                                 req->ssids[0].ssid,
-                                                 req->ssids[0].ssid_len,
-                                                 ies->ie[band],
-                                                 ies->len[band], true);
-                if (ret < 0) {
-                        wl1271_error("2.4GHz PROBE request template failed");
-                        goto out;
-                }
-        }
-
-        if (!force_passive && cfg->active[1]) {
-                u8 band = IEEE80211_BAND_5GHZ;
-                ret = wl12xx_cmd_build_probe_req(wl, wlvif,
-                                                 wlvif->role_id, band,
-                                                 req->ssids[0].ssid,
-                                                 req->ssids[0].ssid_len,
-                                                 ies->ie[band],
-                                                 ies->len[band], true);
-                if (ret < 0) {
-                        wl1271_error("5GHz PROBE request template failed");
-                        goto out;
-                }
-        }
-
-        wl1271_dump(DEBUG_SCAN, "SCAN_CFG: ", cfg, sizeof(*cfg));
-
-        ret = wl1271_cmd_send(wl, CMD_CONNECTION_SCAN_CFG, cfg,
-                              sizeof(*cfg), 0);
-        if (ret < 0) {
-                wl1271_error("SCAN configuration failed");
-                goto out;
-        }
-out:
-        kfree(cfg);
-        return ret;
-}
-
-int wl1271_scan_sched_scan_start(struct wl1271 *wl, struct wl12xx_vif *wlvif)
-{
-        struct wl1271_cmd_sched_scan_start *start;
-        int ret = 0;
-
-        wl1271_debug(DEBUG_CMD, "cmd periodic scan start");
-
-        if (wlvif->bss_type != BSS_TYPE_STA_BSS)
-                return -EOPNOTSUPP;
-
-        if ((wl->quirks & WLCORE_QUIRK_NO_SCHED_SCAN_WHILE_CONN) &&
-            test_bit(WLVIF_FLAG_IN_USE, &wlvif->flags))
-                return -EBUSY;
-
-        start = kzalloc(sizeof(*start), GFP_KERNEL);
-        if (!start)
-                return -ENOMEM;
-
-        start->role_id = wlvif->role_id;
-        start->tag = WL1271_SCAN_DEFAULT_TAG;
-
-        ret = wl1271_cmd_send(wl, CMD_START_PERIODIC_SCAN, start,
-                              sizeof(*start), 0);
-        if (ret < 0) {
-                wl1271_error("failed to send scan start command");
-                goto out_free;
-        }
-
-out_free:
-        kfree(start);
-        return ret;
-}
-
-void wl1271_scan_sched_scan_results(struct wl1271 *wl)
+void wlcore_scan_sched_scan_results(struct wl1271 *wl)
 {
         wl1271_debug(DEBUG_SCAN, "got periodic scan results");
 
         ieee80211_sched_scan_results(wl->hw);
 }
-
-void wl1271_scan_sched_scan_stop(struct wl1271 *wl,  struct wl12xx_vif *wlvif)
-{
-        struct wl1271_cmd_sched_scan_stop *stop;
-        int ret = 0;
-
-        wl1271_debug(DEBUG_CMD, "cmd periodic scan stop");
-
-        /* FIXME: what to do if alloc'ing to stop fails? */
-        stop = kzalloc(sizeof(*stop), GFP_KERNEL);
-        if (!stop) {
-                wl1271_error("failed to alloc memory to send sched scan stop");
-                return;
-        }
-
-        stop->role_id = wlvif->role_id;
-        stop->tag = WL1271_SCAN_DEFAULT_TAG;
-
-        ret = wl1271_cmd_send(wl, CMD_STOP_PERIODIC_SCAN, stop,
-                              sizeof(*stop), 0);
-        if (ret < 0) {
-                wl1271_error("failed to send sched scan stop command");
-                goto out_free;
-        }
-
-out_free:
-        kfree(stop);
-}
+EXPORT_SYMBOL_GPL(wlcore_scan_sched_scan_results);
diff --git a/drivers/net/wireless/ti/wlcore/scan.h b/drivers/net/wireless/ti/wlcore/scan.h
index 29f3c8d6b046..a6ab24b5c0f9 100644
--- a/drivers/net/wireless/ti/wlcore/scan.h
+++ b/drivers/net/wireless/ti/wlcore/scan.h
@@ -26,22 +26,20 @@
 
 #include "wlcore.h"
 
-int wl1271_scan(struct wl1271 *wl, struct ieee80211_vif *vif,
+int wlcore_scan(struct wl1271 *wl, struct ieee80211_vif *vif,
                 const u8 *ssid, size_t ssid_len,
                 struct cfg80211_scan_request *req);
-int wl1271_scan_stop(struct wl1271 *wl);
 int wl1271_scan_build_probe_req(struct wl1271 *wl,
                                 const u8 *ssid, size_t ssid_len,
                                 const u8 *ie, size_t ie_len, u8 band);
-void wl1271_scan_stm(struct wl1271 *wl, struct ieee80211_vif *vif);
+void wl1271_scan_stm(struct wl1271 *wl, struct wl12xx_vif *wlvif);
 void wl1271_scan_complete_work(struct work_struct *work);
 int wl1271_scan_sched_scan_config(struct wl1271 *wl,
                                      struct wl12xx_vif *wlvif,
                                      struct cfg80211_sched_scan_request *req,
                                      struct ieee80211_sched_scan_ies *ies);
 int wl1271_scan_sched_scan_start(struct wl1271 *wl, struct wl12xx_vif *wlvif);
-void wl1271_scan_sched_scan_stop(struct wl1271 *wl,  struct wl12xx_vif *wlvif);
-void wl1271_scan_sched_scan_results(struct wl1271 *wl);
+void wlcore_scan_sched_scan_results(struct wl1271 *wl);
 
 #define WL1271_SCAN_MAX_CHANNELS       24
 #define WL1271_SCAN_DEFAULT_TAG        1
@@ -66,56 +64,6 @@ enum {
         WL1271_SCAN_STATE_DONE
 };
 
-struct basic_scan_params {
-        /* Scan option flags (WL1271_SCAN_OPT_*) */
-        __le16 scan_options;
-        u8 role_id;
-        /* Number of scan channels in the list (maximum 30) */
-        u8 n_ch;
-        /* This field indicates the number of probe requests to send
-           per channel for an active scan */
-        u8 n_probe_reqs;
-        u8 tid_trigger;
-        u8 ssid_len;
-        u8 use_ssid_list;
-
-        /* Rate bit field for sending the probes */
-        __le32 tx_rate;
-
-        u8 ssid[IEEE80211_MAX_SSID_LEN];
-        /* Band to scan */
-        u8 band;
-
-        u8 scan_tag;
-        u8 padding2[2];
-} __packed;
-
-struct basic_scan_channel_params {
-        /* Duration in TU to wait for frames on a channel for active scan */
-        __le32 min_duration;
-        __le32 max_duration;
-        __le32 bssid_lsb;
-        __le16 bssid_msb;
-        u8 early_termination;
-        u8 tx_power_att;
-        u8 channel;
-        /* FW internal use only! */
-        u8 dfs_candidate;
-        u8 activity_detected;
-        u8 pad;
-} __packed;
-
-struct wl1271_cmd_scan {
-        struct wl1271_cmd_header header;
-
-        struct basic_scan_params params;
-        struct basic_scan_channel_params channels[WL1271_SCAN_MAX_CHANNELS];
-
-        /* src mac address */
-        u8 addr[ETH_ALEN];
-        u8 padding[2];
-} __packed;
-
 struct wl1271_cmd_trigger_scan_to {
         struct wl1271_cmd_header header;
 
@@ -123,9 +71,17 @@ struct wl1271_cmd_trigger_scan_to {
 } __packed;
 
 #define MAX_CHANNELS_2GHZ       14
-#define MAX_CHANNELS_5GHZ       23
 #define MAX_CHANNELS_4GHZ       4
 
+/*
+ * This max value here is used only for the struct definition of
+ * wlcore_scan_channels. This struct is used by both 12xx
+ * and 18xx (which have different max 5ghz channels value).
+ * In order to make sure this is large enough, just use the
+ * max possible 5ghz channels.
+ */
+#define MAX_CHANNELS_5GHZ       42
+
 #define SCAN_MAX_CYCLE_INTERVALS 16
 #define SCAN_MAX_BANDS 3
 
@@ -160,43 +116,6 @@ struct conn_scan_ch_params {
         u8  padding[3];
 } __packed;
 
-struct wl1271_cmd_sched_scan_config {
-        struct wl1271_cmd_header header;
-
-        __le32 intervals[SCAN_MAX_CYCLE_INTERVALS];
-
-        s8 rssi_threshold; /* for filtering (in dBm) */
-        s8 snr_threshold;  /* for filtering (in dB) */
-
-        u8 cycles;       /* maximum number of scan cycles */
-        u8 report_after; /* report when this number of results are received */
-        u8 terminate;    /* stop scanning after reporting */
-
-        u8 tag;
-        u8 bss_type; /* for filtering */
-        u8 filter_type;
-
-        u8 ssid_len;     /* For SCAN_SSID_FILTER_SPECIFIC */
-        u8 ssid[IEEE80211_MAX_SSID_LEN];
-
-        u8 n_probe_reqs; /* Number of probes requests per channel */
-
-        u8 passive[SCAN_MAX_BANDS];
-        u8 active[SCAN_MAX_BANDS];
-
-        u8 dfs;
-
-        u8 n_pactive_ch; /* number of pactive (passive until fw detects energy)
-                            channels in BG band */
-        u8 role_id;
-        u8 padding[1];
-
-        struct conn_scan_ch_params channels_2[MAX_CHANNELS_2GHZ];
-        struct conn_scan_ch_params channels_5[MAX_CHANNELS_5GHZ];
-        struct conn_scan_ch_params channels_4[MAX_CHANNELS_4GHZ];
-} __packed;
-
-
 #define SCHED_SCAN_MAX_SSIDS 16
 
 enum {
@@ -220,21 +139,34 @@ struct wl1271_cmd_sched_scan_ssid_list {
         u8 padding[2];
 } __packed;
 
-struct wl1271_cmd_sched_scan_start {
-        struct wl1271_cmd_header header;
+struct wlcore_scan_channels {
+        u8 passive[SCAN_MAX_BANDS]; /* number of passive scan channels */
+        u8 active[SCAN_MAX_BANDS];  /* number of active scan channels */
+        u8 dfs;            /* number of dfs channels in 5ghz */
+        u8 passive_active; /* number of passive before active channels 2.4ghz */
 
-        u8 tag;
-        u8 role_id;
-        u8 padding[2];
-} __packed;
-
-struct wl1271_cmd_sched_scan_stop {
-        struct wl1271_cmd_header header;
+        struct conn_scan_ch_params channels_2[MAX_CHANNELS_2GHZ];
+        struct conn_scan_ch_params channels_5[MAX_CHANNELS_5GHZ];
+        struct conn_scan_ch_params channels_4[MAX_CHANNELS_4GHZ];
+};
 
-        u8 tag;
-        u8 role_id;
-        u8 padding[2];
-} __packed;
+enum {
+        SCAN_TYPE_SEARCH        = 0,
+        SCAN_TYPE_PERIODIC      = 1,
+        SCAN_TYPE_TRACKING      = 2,
+};
 
+bool
+wlcore_set_scan_chan_params(struct wl1271 *wl,
+                            struct wlcore_scan_channels *cfg,
+                            struct ieee80211_channel *channels[],
+                            u32 n_channels,
+                            u32 n_ssids,
+                            int scan_type);
+
+int
+wlcore_scan_sched_scan_ssid_list(struct wl1271 *wl,
+                                 struct wl12xx_vif *wlvif,
+                                 struct cfg80211_sched_scan_request *req);
 
 #endif /* __WL1271_SCAN_H__ */
diff --git a/drivers/net/wireless/ti/wlcore/sdio.c b/drivers/net/wireless/ti/wlcore/sdio.c
index 646f703ae739..d4f184e2efed 100644
--- a/drivers/net/wireless/ti/wlcore/sdio.c
+++ b/drivers/net/wireless/ti/wlcore/sdio.c
@@ -326,8 +326,7 @@ static void wl1271_remove(struct sdio_func *func)
         /* Undo decrement done above in wl1271_probe */
         pm_runtime_get_noresume(&func->dev);
 
-        platform_device_del(glue->core);
-        platform_device_put(glue->core);
+        platform_device_unregister(glue->core);
         kfree(glue);
 }
 
diff --git a/drivers/net/wireless/ti/wlcore/spi.c b/drivers/net/wireless/ti/wlcore/spi.c
index f06f4770ce02..2d700b7ae14c 100644
--- a/drivers/net/wireless/ti/wlcore/spi.c
+++ b/drivers/net/wireless/ti/wlcore/spi.c
@@ -270,7 +270,7 @@ static int __must_check wl12xx_spi_raw_write(struct device *child, int addr,
                                              void *buf, size_t len, bool fixed)
 {
         struct wl12xx_spi_glue *glue = dev_get_drvdata(child->parent);
-        struct spi_transfer t[2 * WSPI_MAX_NUM_OF_CHUNKS];
+        struct spi_transfer t[2 * (WSPI_MAX_NUM_OF_CHUNKS + 1)];
         struct spi_message m;
         u32 commands[WSPI_MAX_NUM_OF_CHUNKS];
         u32 *cmd;
@@ -407,8 +407,7 @@ static int wl1271_remove(struct spi_device *spi)
 {
         struct wl12xx_spi_glue *glue = spi_get_drvdata(spi);
 
-        platform_device_del(glue->core);
-        platform_device_put(glue->core);
+        platform_device_unregister(glue->core);
         kfree(glue);
 
         return 0;
diff --git a/drivers/net/wireless/ti/wlcore/tx.c b/drivers/net/wireless/ti/wlcore/tx.c
index a90d3cd09408..ece392c54d9c 100644
--- a/drivers/net/wireless/ti/wlcore/tx.c
+++ b/drivers/net/wireless/ti/wlcore/tx.c
@@ -104,7 +104,7 @@ static void wl1271_tx_regulate_link(struct wl1271 *wl,
                                     struct wl12xx_vif *wlvif,
                                     u8 hlid)
 {
-        bool fw_ps, single_sta;
+        bool fw_ps, single_link;
         u8 tx_pkts;
 
         if (WARN_ON(!test_bit(hlid, wlvif->links_map)))
@@ -112,15 +112,15 @@ static void wl1271_tx_regulate_link(struct wl1271 *wl,
 
         fw_ps = test_bit(hlid, (unsigned long *)&wl->ap_fw_ps_map);
         tx_pkts = wl->links[hlid].allocated_pkts;
-        single_sta = (wl->active_sta_count == 1);
+        single_link = (wl->active_link_count == 1);
 
         /*
          * if in FW PS and there is enough data in FW we can put the link
          * into high-level PS and clean out its TX queues.
-         * Make an exception if this is the only connected station. In this
-         * case FW-memory congestion is not a problem.
+         * Make an exception if this is the only connected link. In this
+         * case FW-memory congestion is less of a problem.
          */
-        if (!single_sta && fw_ps && tx_pkts >= WL1271_PS_STA_MAX_PACKETS)
+        if (!single_link && fw_ps && tx_pkts >= WL1271_PS_STA_MAX_PACKETS)
                 wl12xx_ps_link_start(wl, wlvif, hlid, true);
 }
 
@@ -155,21 +155,18 @@ static u8 wl12xx_tx_get_hlid_ap(struct wl1271 *wl, struct wl12xx_vif *wlvif,
 u8 wl12xx_tx_get_hlid(struct wl1271 *wl, struct wl12xx_vif *wlvif,
                       struct sk_buff *skb, struct ieee80211_sta *sta)
 {
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
-
-        if (!wlvif || wl12xx_is_dummy_packet(wl, skb))
-                return wl->system_hlid;
+        struct ieee80211_tx_info *control;
 
         if (wlvif->bss_type == BSS_TYPE_AP_BSS)
                 return wl12xx_tx_get_hlid_ap(wl, wlvif, skb, sta);
 
-        if ((test_bit(WLVIF_FLAG_STA_ASSOCIATED, &wlvif->flags) ||
-             test_bit(WLVIF_FLAG_IBSS_JOINED, &wlvif->flags)) &&
-            !ieee80211_is_auth(hdr->frame_control) &&
-            !ieee80211_is_assoc_req(hdr->frame_control))
-                return wlvif->sta.hlid;
-        else
+        control = IEEE80211_SKB_CB(skb);
+        if (control->flags & IEEE80211_TX_CTL_TX_OFFCHAN) {
+                wl1271_debug(DEBUG_TX, "tx offchannel");
                 return wlvif->dev_hlid;
+        }
+
+        return wlvif->sta.hlid;
 }
 
 unsigned int wlcore_calc_packet_alignment(struct wl1271 *wl,
@@ -224,9 +221,7 @@ static int wl1271_tx_allocate(struct wl1271 *wl, struct wl12xx_vif *wlvif,
                 ac = wl1271_tx_get_queue(skb_get_queue_mapping(skb));
                 wl->tx_allocated_pkts[ac]++;
 
-                if (!wl12xx_is_dummy_packet(wl, skb) && wlvif &&
-                    wlvif->bss_type == BSS_TYPE_AP_BSS &&
-                    test_bit(hlid, wlvif->ap.sta_hlid_map))
+                if (test_bit(hlid, wl->links_map))
                         wl->links[hlid].allocated_pkts++;
 
                 ret = 0;
@@ -293,9 +288,14 @@ static void wl1271_tx_fill_hdr(struct wl1271 *wl, struct wl12xx_vif *wlvif,
 
                 tx_attr |= TX_HW_ATTR_TX_DUMMY_REQ;
         } else if (wlvif) {
+                u8 session_id = wl->session_ids[hlid];
+
+                if ((wl->quirks & WLCORE_QUIRK_AP_ZERO_SESSION_ID) &&
+                    (wlvif->bss_type == BSS_TYPE_AP_BSS))
+                        session_id = 0;
+
                 /* configure the tx attributes */
-                tx_attr = wlvif->session_counter <<
-                          TX_HW_ATTR_OFST_SESSION_COUNTER;
+                tx_attr = session_id << TX_HW_ATTR_OFST_SESSION_COUNTER;
         }
 
         desc->hlid = hlid;
@@ -452,20 +452,22 @@ u32 wl1271_tx_enabled_rates_get(struct wl1271 *wl, u32 rate_set,
 void wl1271_handle_tx_low_watermark(struct wl1271 *wl)
 {
         int i;
+        struct wl12xx_vif *wlvif;
 
-        for (i = 0; i < NUM_TX_QUEUES; i++) {
-                if (wlcore_is_queue_stopped_by_reason(wl, i,
-                        WLCORE_QUEUE_STOP_REASON_WATERMARK) &&
-                    wl->tx_queue_count[i] <= WL1271_TX_QUEUE_LOW_WATERMARK) {
-                        /* firmware buffer has space, restart queues */
-                        wlcore_wake_queue(wl, i,
-                                          WLCORE_QUEUE_STOP_REASON_WATERMARK);
+        wl12xx_for_each_wlvif(wl, wlvif) {
+                for (i = 0; i < NUM_TX_QUEUES; i++) {
+                        if (wlcore_is_queue_stopped_by_reason(wl, wlvif, i,
+                                        WLCORE_QUEUE_STOP_REASON_WATERMARK) &&
+                            wlvif->tx_queue_count[i] <=
+                                        WL1271_TX_QUEUE_LOW_WATERMARK)
+                                /* firmware buffer has space, restart queues */
+                                wlcore_wake_queue(wl, wlvif, i,
+                                        WLCORE_QUEUE_STOP_REASON_WATERMARK);
                 }
         }
 }
 
-static struct sk_buff_head *wl1271_select_queue(struct wl1271 *wl,
-                                                struct sk_buff_head *queues)
+static int wlcore_select_ac(struct wl1271 *wl)
 {
         int i, q = -1, ac;
         u32 min_pkts = 0xffffffff;
@@ -479,45 +481,60 @@ static struct sk_buff_head *wl1271_select_queue(struct wl1271 *wl,
          */
         for (i = 0; i < NUM_TX_QUEUES; i++) {
                 ac = wl1271_tx_get_queue(i);
-                if (!skb_queue_empty(&queues[ac]) &&
-                    (wl->tx_allocated_pkts[ac] < min_pkts)) {
+                if (wl->tx_queue_count[ac] &&
+                    wl->tx_allocated_pkts[ac] < min_pkts) {
                         q = ac;
                         min_pkts = wl->tx_allocated_pkts[q];
                 }
         }
 
-        if (q == -1)
-                return NULL;
-
-        return &queues[q];
+        return q;
 }
 
-static struct sk_buff *wl12xx_lnk_skb_dequeue(struct wl1271 *wl,
-                                              struct wl1271_link *lnk)
+static struct sk_buff *wlcore_lnk_dequeue(struct wl1271 *wl,
+                                          struct wl1271_link *lnk, u8 q)
 {
         struct sk_buff *skb;
         unsigned long flags;
-        struct sk_buff_head *queue;
 
-        queue = wl1271_select_queue(wl, lnk->tx_queue);
-        if (!queue)
-                return NULL;
-
-        skb = skb_dequeue(queue);
+        skb = skb_dequeue(&lnk->tx_queue[q]);
         if (skb) {
-                int q = wl1271_tx_get_queue(skb_get_queue_mapping(skb));
                 spin_lock_irqsave(&wl->wl_lock, flags);
                 WARN_ON_ONCE(wl->tx_queue_count[q] <= 0);
                 wl->tx_queue_count[q]--;
+                if (lnk->wlvif) {
+                        WARN_ON_ONCE(lnk->wlvif->tx_queue_count[q] <= 0);
+                        lnk->wlvif->tx_queue_count[q]--;
+                }
                 spin_unlock_irqrestore(&wl->wl_lock, flags);
         }
 
         return skb;
 }
 
-static struct sk_buff *wl12xx_vif_skb_dequeue(struct wl1271 *wl,
-                                              struct wl12xx_vif *wlvif,
-                                              u8 *hlid)
+static struct sk_buff *wlcore_lnk_dequeue_high_prio(struct wl1271 *wl,
+                                                    u8 hlid, u8 ac,
+                                                    u8 *low_prio_hlid)
+{
+        struct wl1271_link *lnk = &wl->links[hlid];
+
+        if (!wlcore_hw_lnk_high_prio(wl, hlid, lnk)) {
+                if (*low_prio_hlid == WL12XX_INVALID_LINK_ID &&
+                    !skb_queue_empty(&lnk->tx_queue[ac]) &&
+                    wlcore_hw_lnk_low_prio(wl, hlid, lnk))
+                        /* we found the first non-empty low priority queue */
+                        *low_prio_hlid = hlid;
+
+                return NULL;
+        }
+
+        return wlcore_lnk_dequeue(wl, lnk, ac);
+}
+
+static struct sk_buff *wlcore_vif_dequeue_high_prio(struct wl1271 *wl,
+                                                    struct wl12xx_vif *wlvif,
+                                                    u8 ac, u8 *hlid,
+                                                    u8 *low_prio_hlid)
 {
         struct sk_buff *skb = NULL;
         int i, h, start_hlid;
@@ -533,7 +550,8 @@ static struct sk_buff *wl12xx_vif_skb_dequeue(struct wl1271 *wl,
                 if (!test_bit(h, wlvif->links_map))
                         continue;
 
-                skb = wl12xx_lnk_skb_dequeue(wl, &wl->links[h]);
+                skb = wlcore_lnk_dequeue_high_prio(wl, h, ac,
+                                                   low_prio_hlid);
                 if (!skb)
                         continue;
 
@@ -553,42 +571,74 @@ static struct sk_buff *wl1271_skb_dequeue(struct wl1271 *wl, u8 *hlid)
         unsigned long flags;
         struct wl12xx_vif *wlvif = wl->last_wlvif;
         struct sk_buff *skb = NULL;
+        int ac;
+        u8 low_prio_hlid = WL12XX_INVALID_LINK_ID;
+
+        ac = wlcore_select_ac(wl);
+        if (ac < 0)
+                goto out;
 
         /* continue from last wlvif (round robin) */
         if (wlvif) {
                 wl12xx_for_each_wlvif_continue(wl, wlvif) {
-                        skb = wl12xx_vif_skb_dequeue(wl, wlvif, hlid);
-                        if (skb) {
-                                wl->last_wlvif = wlvif;
-                                break;
-                        }
+                        if (!wlvif->tx_queue_count[ac])
+                                continue;
+
+                        skb = wlcore_vif_dequeue_high_prio(wl, wlvif, ac, hlid,
+                                                           &low_prio_hlid);
+                        if (!skb)
+                                continue;
+
+                        wl->last_wlvif = wlvif;
+                        break;
                 }
         }
 
         /* dequeue from the system HLID before the restarting wlvif list */
         if (!skb) {
-                skb = wl12xx_lnk_skb_dequeue(wl, &wl->links[wl->system_hlid]);
-                *hlid = wl->system_hlid;
+                skb = wlcore_lnk_dequeue_high_prio(wl, wl->system_hlid,
+                                                   ac, &low_prio_hlid);
+                if (skb) {
+                        *hlid = wl->system_hlid;
+                        wl->last_wlvif = NULL;
+                }
         }
 
-        /* do a new pass over the wlvif list */
+        /* Do a new pass over the wlvif list. But no need to continue
+         * after last_wlvif. The previous pass should have found it. */
         if (!skb) {
                 wl12xx_for_each_wlvif(wl, wlvif) {
-                        skb = wl12xx_vif_skb_dequeue(wl, wlvif, hlid);
+                        if (!wlvif->tx_queue_count[ac])
+                                goto next;
+
+                        skb = wlcore_vif_dequeue_high_prio(wl, wlvif, ac, hlid,
+                                                           &low_prio_hlid);
                         if (skb) {
                                 wl->last_wlvif = wlvif;
                                 break;
                         }
 
-                        /*
-                         * No need to continue after last_wlvif. The previous
-                         * pass should have found it.
-                         */
+next:
                         if (wlvif == wl->last_wlvif)
                                 break;
                 }
         }
 
+        /* no high priority skbs found - but maybe a low priority one? */
+        if (!skb && low_prio_hlid != WL12XX_INVALID_LINK_ID) {
+                struct wl1271_link *lnk = &wl->links[low_prio_hlid];
+                skb = wlcore_lnk_dequeue(wl, lnk, ac);
+
+                WARN_ON(!skb); /* we checked this before */
+                *hlid = low_prio_hlid;
+
+                /* ensure proper round robin in the vif/link levels */
+                wl->last_wlvif = lnk->wlvif;
+                if (lnk->wlvif)
+                        lnk->wlvif->last_tx_hlid = low_prio_hlid;
+
+        }
+
         if (!skb &&
             test_and_clear_bit(WL1271_FLAG_DUMMY_PACKET_PENDING, &wl->flags)) {
                 int q;
@@ -602,6 +652,7 @@ static struct sk_buff *wl1271_skb_dequeue(struct wl1271 *wl, u8 *hlid)
                 spin_unlock_irqrestore(&wl->wl_lock, flags);
         }
 
+out:
         return skb;
 }
 
@@ -623,6 +674,8 @@ static void wl1271_skb_queue_head(struct wl1271 *wl, struct wl12xx_vif *wlvif,
 
         spin_lock_irqsave(&wl->wl_lock, flags);
         wl->tx_queue_count[q]++;
+        if (wlvif)
+                wlvif->tx_queue_count[q]++;
         spin_unlock_irqrestore(&wl->wl_lock, flags);
 }
 
@@ -699,7 +752,7 @@ int wlcore_tx_work_locked(struct wl1271 *wl)
                 bool has_data = false;
 
                 wlvif = NULL;
-                if (!wl12xx_is_dummy_packet(wl, skb) && info->control.vif)
+                if (!wl12xx_is_dummy_packet(wl, skb))
                         wlvif = wl12xx_vif_to_data(info->control.vif);
                 else
                         hlid = wl->system_hlid;
@@ -972,10 +1025,11 @@ void wl1271_tx_reset_link_queues(struct wl1271 *wl, u8 hlid)
         unsigned long flags;
         struct ieee80211_tx_info *info;
         int total[NUM_TX_QUEUES];
+        struct wl1271_link *lnk = &wl->links[hlid];
 
         for (i = 0; i < NUM_TX_QUEUES; i++) {
                 total[i] = 0;
-                while ((skb = skb_dequeue(&wl->links[hlid].tx_queue[i]))) {
+                while ((skb = skb_dequeue(&lnk->tx_queue[i]))) {
                         wl1271_debug(DEBUG_TX, "link freeing skb 0x%p", skb);
 
                         if (!wl12xx_is_dummy_packet(wl, skb)) {
@@ -990,8 +1044,11 @@ void wl1271_tx_reset_link_queues(struct wl1271 *wl, u8 hlid)
         }
 
         spin_lock_irqsave(&wl->wl_lock, flags);
-        for (i = 0; i < NUM_TX_QUEUES; i++)
+        for (i = 0; i < NUM_TX_QUEUES; i++) {
                 wl->tx_queue_count[i] -= total[i];
+                if (lnk->wlvif)
+                        lnk->wlvif->tx_queue_count[i] -= total[i];
+        }
         spin_unlock_irqrestore(&wl->wl_lock, flags);
 
         wl1271_handle_tx_low_watermark(wl);
@@ -1004,16 +1061,18 @@ void wl12xx_tx_reset_wlvif(struct wl1271 *wl, struct wl12xx_vif *wlvif)
 
         /* TX failure */
         for_each_set_bit(i, wlvif->links_map, WL12XX_MAX_LINKS) {
-                if (wlvif->bss_type == BSS_TYPE_AP_BSS)
+                if (wlvif->bss_type == BSS_TYPE_AP_BSS) {
+                        /* this calls wl12xx_free_link */
                         wl1271_free_sta(wl, wlvif, i);
-                else
-                        wlvif->sta.ba_rx_bitmap = 0;
-
-                wl->links[i].allocated_pkts = 0;
-                wl->links[i].prev_freed_pkts = 0;
+                } else {
+                        u8 hlid = i;
+                        wl12xx_free_link(wl, wlvif, &hlid);
+                }
         }
         wlvif->last_tx_hlid = 0;
 
+        for (i = 0; i < NUM_TX_QUEUES; i++)
+                wlvif->tx_queue_count[i] = 0;
 }
 /* caller must hold wl->mutex and TX must be stopped */
 void wl12xx_tx_reset(struct wl1271 *wl)
@@ -1023,7 +1082,7 @@ void wl12xx_tx_reset(struct wl1271 *wl)
         struct ieee80211_tx_info *info;
 
         /* only reset the queues if something bad happened */
-        if (WARN_ON_ONCE(wl1271_tx_total_queue_count(wl) != 0)) {
+        if (wl1271_tx_total_queue_count(wl) != 0) {
                 for (i = 0; i < WL12XX_MAX_LINKS; i++)
                         wl1271_tx_reset_link_queues(wl, i);
 
@@ -1135,45 +1194,48 @@ u32 wl1271_tx_min_rate_get(struct wl1271 *wl, u32 rate_set)
 
         return BIT(__ffs(rate_set));
 }
+EXPORT_SYMBOL_GPL(wl1271_tx_min_rate_get);
 
-void wlcore_stop_queue_locked(struct wl1271 *wl, u8 queue,
-                              enum wlcore_queue_stop_reason reason)
+void wlcore_stop_queue_locked(struct wl1271 *wl, struct wl12xx_vif *wlvif,
+                              u8 queue, enum wlcore_queue_stop_reason reason)
 {
-        bool stopped = !!wl->queue_stop_reasons[queue];
+        int hwq = wlcore_tx_get_mac80211_queue(wlvif, queue);
+        bool stopped = !!wl->queue_stop_reasons[hwq];
 
         /* queue should not be stopped for this reason */
-        WARN_ON(test_and_set_bit(reason, &wl->queue_stop_reasons[queue]));
+        WARN_ON_ONCE(test_and_set_bit(reason, &wl->queue_stop_reasons[hwq]));
 
         if (stopped)
                 return;
 
-        ieee80211_stop_queue(wl->hw, wl1271_tx_get_mac80211_queue(queue));
+        ieee80211_stop_queue(wl->hw, hwq);
 }
 
-void wlcore_stop_queue(struct wl1271 *wl, u8 queue,
+void wlcore_stop_queue(struct wl1271 *wl, struct wl12xx_vif *wlvif, u8 queue,
                        enum wlcore_queue_stop_reason reason)
 {
         unsigned long flags;
 
         spin_lock_irqsave(&wl->wl_lock, flags);
-        wlcore_stop_queue_locked(wl, queue, reason);
+        wlcore_stop_queue_locked(wl, wlvif, queue, reason);
         spin_unlock_irqrestore(&wl->wl_lock, flags);
 }
 
-void wlcore_wake_queue(struct wl1271 *wl, u8 queue,
+void wlcore_wake_queue(struct wl1271 *wl, struct wl12xx_vif *wlvif, u8 queue,
                        enum wlcore_queue_stop_reason reason)
 {
         unsigned long flags;
+        int hwq = wlcore_tx_get_mac80211_queue(wlvif, queue);
 
         spin_lock_irqsave(&wl->wl_lock, flags);
 
         /* queue should not be clear for this reason */
-        WARN_ON(!test_and_clear_bit(reason, &wl->queue_stop_reasons[queue]));
+        WARN_ON_ONCE(!test_and_clear_bit(reason, &wl->queue_stop_reasons[hwq]));
 
-        if (wl->queue_stop_reasons[queue])
+        if (wl->queue_stop_reasons[hwq])
                 goto out;
 
-        ieee80211_wake_queue(wl->hw, wl1271_tx_get_mac80211_queue(queue));
+        ieee80211_wake_queue(wl->hw, hwq);
 
 out:
         spin_unlock_irqrestore(&wl->wl_lock, flags);
@@ -1183,48 +1245,74 @@ void wlcore_stop_queues(struct wl1271 *wl,
                         enum wlcore_queue_stop_reason reason)
 {
         int i;
+        unsigned long flags;
 
-        for (i = 0; i < NUM_TX_QUEUES; i++)
-                wlcore_stop_queue(wl, i, reason);
+        spin_lock_irqsave(&wl->wl_lock, flags);
+
+        /* mark all possible queues as stopped */
+        for (i = 0; i < WLCORE_NUM_MAC_ADDRESSES * NUM_TX_QUEUES; i++)
+                WARN_ON_ONCE(test_and_set_bit(reason,
+                                              &wl->queue_stop_reasons[i]));
+
+        /* use the global version to make sure all vifs in mac80211 we don't
+         * know are stopped.
+         */
+        ieee80211_stop_queues(wl->hw);
+
+        spin_unlock_irqrestore(&wl->wl_lock, flags);
 }
-EXPORT_SYMBOL_GPL(wlcore_stop_queues);
 
 void wlcore_wake_queues(struct wl1271 *wl,
                         enum wlcore_queue_stop_reason reason)
 {
         int i;
+        unsigned long flags;
 
-        for (i = 0; i < NUM_TX_QUEUES; i++)
-                wlcore_wake_queue(wl, i, reason);
+        spin_lock_irqsave(&wl->wl_lock, flags);
+
+        /* mark all possible queues as awake */
+        for (i = 0; i < WLCORE_NUM_MAC_ADDRESSES * NUM_TX_QUEUES; i++)
+                WARN_ON_ONCE(!test_and_clear_bit(reason,
+                                                 &wl->queue_stop_reasons[i]));
+
+        /* use the global version to make sure all vifs in mac80211 we don't
+         * know are woken up.
+         */
+        ieee80211_wake_queues(wl->hw);
+
+        spin_unlock_irqrestore(&wl->wl_lock, flags);
 }
-EXPORT_SYMBOL_GPL(wlcore_wake_queues);
 
-void wlcore_reset_stopped_queues(struct wl1271 *wl)
+bool wlcore_is_queue_stopped_by_reason(struct wl1271 *wl,
+                                       struct wl12xx_vif *wlvif, u8 queue,
+                                       enum wlcore_queue_stop_reason reason)
 {
-        int i;
         unsigned long flags;
+        bool stopped;
 
         spin_lock_irqsave(&wl->wl_lock, flags);
-
-        for (i = 0; i < NUM_TX_QUEUES; i++) {
-                if (!wl->queue_stop_reasons[i])
-                        continue;
-
-                wl->queue_stop_reasons[i] = 0;
-                ieee80211_wake_queue(wl->hw,
-                                     wl1271_tx_get_mac80211_queue(i));
-        }
-
+        stopped = wlcore_is_queue_stopped_by_reason_locked(wl, wlvif, queue,
+                                                           reason);
         spin_unlock_irqrestore(&wl->wl_lock, flags);
+
+        return stopped;
 }
 
-bool wlcore_is_queue_stopped_by_reason(struct wl1271 *wl, u8 queue,
-                             enum wlcore_queue_stop_reason reason)
+bool wlcore_is_queue_stopped_by_reason_locked(struct wl1271 *wl,
+                                       struct wl12xx_vif *wlvif, u8 queue,
+                                       enum wlcore_queue_stop_reason reason)
 {
-        return test_bit(reason, &wl->queue_stop_reasons[queue]);
+        int hwq = wlcore_tx_get_mac80211_queue(wlvif, queue);
+
+        WARN_ON_ONCE(!spin_is_locked(&wl->wl_lock));
+        return test_bit(reason, &wl->queue_stop_reasons[hwq]);
 }
 
-bool wlcore_is_queue_stopped(struct wl1271 *wl, u8 queue)
+bool wlcore_is_queue_stopped_locked(struct wl1271 *wl, struct wl12xx_vif *wlvif,
+                                    u8 queue)
 {
-        return !!wl->queue_stop_reasons[queue];
+        int hwq = wlcore_tx_get_mac80211_queue(wlvif, queue);
+
+        WARN_ON_ONCE(!spin_is_locked(&wl->wl_lock));
+        return !!wl->queue_stop_reasons[hwq];
 }
diff --git a/drivers/net/wireless/ti/wlcore/tx.h b/drivers/net/wireless/ti/wlcore/tx.h
index 349520d8b724..55aa4acf9105 100644
--- a/drivers/net/wireless/ti/wlcore/tx.h
+++ b/drivers/net/wireless/ti/wlcore/tx.h
@@ -207,19 +207,22 @@ static inline int wl1271_tx_get_queue(int queue)
         }
 }
 
-static inline int wl1271_tx_get_mac80211_queue(int queue)
+static inline
+int wlcore_tx_get_mac80211_queue(struct wl12xx_vif *wlvif, int queue)
 {
+        int mac_queue = wlvif->hw_queue_base;
+
         switch (queue) {
         case CONF_TX_AC_VO:
-                return 0;
+                return mac_queue + 0;
         case CONF_TX_AC_VI:
-                return 1;
+                return mac_queue + 1;
         case CONF_TX_AC_BE:
-                return 2;
+                return mac_queue + 2;
         case CONF_TX_AC_BK:
-                return 3;
+                return mac_queue + 3;
         default:
-                return 2;
+                return mac_queue + 2;
         }
 }
 
@@ -252,20 +255,26 @@ void wl12xx_rearm_rx_streaming(struct wl1271 *wl, unsigned long *active_hlids);
 unsigned int wlcore_calc_packet_alignment(struct wl1271 *wl,
                                           unsigned int packet_length);
 void wl1271_free_tx_id(struct wl1271 *wl, int id);
-void wlcore_stop_queue_locked(struct wl1271 *wl, u8 queue,
-                              enum wlcore_queue_stop_reason reason);
-void wlcore_stop_queue(struct wl1271 *wl, u8 queue,
+void wlcore_stop_queue_locked(struct wl1271 *wl, struct wl12xx_vif *wlvif,
+                              u8 queue, enum wlcore_queue_stop_reason reason);
+void wlcore_stop_queue(struct wl1271 *wl, struct wl12xx_vif *wlvif, u8 queue,
                        enum wlcore_queue_stop_reason reason);
-void wlcore_wake_queue(struct wl1271 *wl, u8 queue,
+void wlcore_wake_queue(struct wl1271 *wl, struct wl12xx_vif *wlvif, u8 queue,
                        enum wlcore_queue_stop_reason reason);
 void wlcore_stop_queues(struct wl1271 *wl,
                         enum wlcore_queue_stop_reason reason);
 void wlcore_wake_queues(struct wl1271 *wl,
                         enum wlcore_queue_stop_reason reason);
-void wlcore_reset_stopped_queues(struct wl1271 *wl);
-bool wlcore_is_queue_stopped_by_reason(struct wl1271 *wl, u8 queue,
+bool wlcore_is_queue_stopped_by_reason(struct wl1271 *wl,
+                                       struct wl12xx_vif *wlvif, u8 queue,
                                        enum wlcore_queue_stop_reason reason);
-bool wlcore_is_queue_stopped(struct wl1271 *wl, u8 queue);
+bool
+wlcore_is_queue_stopped_by_reason_locked(struct wl1271 *wl,
+                                         struct wl12xx_vif *wlvif,
+                                         u8 queue,
+                                         enum wlcore_queue_stop_reason reason);
+bool wlcore_is_queue_stopped_locked(struct wl1271 *wl, struct wl12xx_vif *wlvif,
+                                    u8 queue);
 
 /* from main.c */
 void wl1271_free_sta(struct wl1271 *wl, struct wl12xx_vif *wlvif, u8 hlid);
diff --git a/drivers/net/wireless/ti/wlcore/wlcore.h b/drivers/net/wireless/ti/wlcore/wlcore.h
index c3884937c007..ebd8c6fad7cd 100644
--- a/drivers/net/wireless/ti/wlcore/wlcore.h
+++ b/drivers/net/wireless/ti/wlcore/wlcore.h
@@ -37,6 +37,9 @@
  */
 #define WLCORE_NUM_MAC_ADDRESSES 3
 
+/* wl12xx/wl18xx maximum transmission power (in dBm) */
+#define WLCORE_MAX_TXPWR        25
+
 /* forward declaration */
 struct wl1271_tx_hw_descr;
 enum wl_rx_buf_align;
@@ -51,6 +54,9 @@ struct wlcore_ops {
         int (*trigger_cmd)(struct wl1271 *wl, int cmd_box_addr,
                            void *buf, size_t len);
         int (*ack_event)(struct wl1271 *wl);
+        int (*wait_for_event)(struct wl1271 *wl, enum wlcore_wait_event event,
+                              bool *timeout);
+        int (*process_mailbox_events)(struct wl1271 *wl);
         u32 (*calc_tx_blocks)(struct wl1271 *wl, u32 len, u32 spare_blks);
         void (*set_tx_desc_blocks)(struct wl1271 *wl,
                                    struct wl1271_tx_hw_descr *desc,
@@ -82,12 +88,32 @@ struct wlcore_ops {
         int (*debugfs_init)(struct wl1271 *wl, struct dentry *rootdir);
         int (*handle_static_data)(struct wl1271 *wl,
                                   struct wl1271_static_data *static_data);
+        int (*scan_start)(struct wl1271 *wl, struct wl12xx_vif *wlvif,
+                          struct cfg80211_scan_request *req);
+        int (*scan_stop)(struct wl1271 *wl, struct wl12xx_vif *wlvif);
+        int (*sched_scan_start)(struct wl1271 *wl, struct wl12xx_vif *wlvif,
+                                struct cfg80211_sched_scan_request *req,
+                                struct ieee80211_sched_scan_ies *ies);
+        void (*sched_scan_stop)(struct wl1271 *wl, struct wl12xx_vif *wlvif);
         int (*get_spare_blocks)(struct wl1271 *wl, bool is_gem);
         int (*set_key)(struct wl1271 *wl, enum set_key_cmd cmd,
                        struct ieee80211_vif *vif,
                        struct ieee80211_sta *sta,
                        struct ieee80211_key_conf *key_conf);
+        int (*channel_switch)(struct wl1271 *wl,
+                              struct wl12xx_vif *wlvif,
+                              struct ieee80211_channel_switch *ch_switch);
         u32 (*pre_pkt_send)(struct wl1271 *wl, u32 buf_offset, u32 last_len);
+        void (*sta_rc_update)(struct wl1271 *wl, struct wl12xx_vif *wlvif,
+                              struct ieee80211_sta *sta, u32 changed);
+        int (*set_peer_cap)(struct wl1271 *wl,
+                            struct ieee80211_sta_ht_cap *ht_cap,
+                            bool allow_ht_operation,
+                            u32 rate_set, u8 hlid);
+        bool (*lnk_high_prio)(struct wl1271 *wl, u8 hlid,
+                              struct wl1271_link *lnk);
+        bool (*lnk_low_prio)(struct wl1271 *wl, u8 hlid,
+                             struct wl1271_link *lnk);
 };
 
 enum wlcore_partitions {
@@ -202,6 +228,8 @@ struct wl1271 {
         unsigned long klv_templates_map[
                         BITS_TO_LONGS(WLCORE_MAX_KLV_TEMPLATES)];
 
+        u8 session_ids[WL12XX_MAX_LINKS];
+
         struct list_head wlvif_list;
 
         u8 sta_count;
@@ -227,7 +255,8 @@ struct wl1271 {
 
         /* Frames scheduled for transmission, not handled yet */
         int tx_queue_count[NUM_TX_QUEUES];
-        unsigned long queue_stop_reasons[NUM_TX_QUEUES];
+        unsigned long queue_stop_reasons[
+                                NUM_TX_QUEUES * WLCORE_NUM_MAC_ADDRESSES];
 
         /* Frames received, not handled yet by mac80211 */
         struct sk_buff_head deferred_rx_queue;
@@ -269,24 +298,30 @@ struct wl1271 {
         struct work_struct recovery_work;
         bool watchdog_recovery;
 
+        /* Reg domain last configuration */
+        u32 reg_ch_conf_last[2];
+        /* Reg domain pending configuration */
+        u32 reg_ch_conf_pending[2];
+
         /* Pointer that holds DMA-friendly block for the mailbox */
-        struct event_mailbox *mbox;
+        void *mbox;
 
         /* The mbox event mask */
         u32 event_mask;
 
         /* Mailbox pointers */
+        u32 mbox_size;
         u32 mbox_ptr[2];
 
         /* Are we currently scanning */
-        struct ieee80211_vif *scan_vif;
+        struct wl12xx_vif *scan_wlvif;
         struct wl1271_scan scan;
         struct delayed_work scan_complete_work;
 
-        /* Connection loss work */
-        struct delayed_work connection_loss_work;
+        struct ieee80211_vif *roc_vif;
+        struct delayed_work roc_complete_work;
 
-        bool sched_scanning;
+        struct wl12xx_vif *sched_vif;
 
         /* The current band */
         enum ieee80211_band band;
@@ -299,7 +334,7 @@ struct wl1271 {
 
         struct wl1271_stats stats;
 
-        __le32 buffer_32;
+        __le32 *buffer_32;
         u32 buffer_cmd;
         u32 buffer_busyword[WL1271_BUSY_WORD_CNT];
 
@@ -314,6 +349,8 @@ struct wl1271 {
 
         bool enable_11a;
 
+        int recovery_count;
+
         /* Most recently reported noise in dBm */
         s8 noise;
 
@@ -333,6 +370,12 @@ struct wl1271 {
          */
         struct wl1271_link links[WL12XX_MAX_LINKS];
 
+        /* number of currently active links */
+        int active_link_count;
+
+        /* Fast/slow links bitmap according to FW */
+        u32 fw_fast_lnk_map;
+
         /* AP-mode - a bitmap of links currently in PS mode according to FW */
         u32 ap_fw_ps_map;
 
@@ -367,6 +410,12 @@ struct wl1271 {
         const char *sr_fw_name;
         const char *mr_fw_name;
 
+        u8 scan_templ_id_2_4;
+        u8 scan_templ_id_5;
+        u8 sched_scan_templ_id_2_4;
+        u8 sched_scan_templ_id_5;
+        u8 max_channels_5;
+
         /* per-chip-family private structure */
         void *priv;
 
@@ -408,20 +457,28 @@ struct wl1271 {
         /* the number of allocated MAC addresses in this chip */
         int num_mac_addr;
 
-        /* the minimum FW version required for the driver to work */
-        unsigned int min_fw_ver[NUM_FW_VER];
+        /* minimum FW version required for the driver to work in single-role */
+        unsigned int min_sr_fw_ver[NUM_FW_VER];
+
+        /* minimum FW version required for the driver to work in multi-role */
+        unsigned int min_mr_fw_ver[NUM_FW_VER];
 
         struct completion nvs_loading_complete;
+
+        /* number of concurrent channels the HW supports */
+        u32 num_channels;
 };
 
 int wlcore_probe(struct wl1271 *wl, struct platform_device *pdev);
 int wlcore_remove(struct platform_device *pdev);
-struct ieee80211_hw *wlcore_alloc_hw(size_t priv_size, u32 aggr_buf_size);
+struct ieee80211_hw *wlcore_alloc_hw(size_t priv_size, u32 aggr_buf_size,
+                                     u32 mbox_size);
 int wlcore_free_hw(struct wl1271 *wl);
 int wlcore_set_key(struct wl1271 *wl, enum set_key_cmd cmd,
                    struct ieee80211_vif *vif,
                    struct ieee80211_sta *sta,
                    struct ieee80211_key_conf *key_conf);
+void wlcore_regdomain_config(struct wl1271 *wl);
 
 static inline void
 wlcore_set_ht_cap(struct wl1271 *wl, enum ieee80211_band band,
@@ -430,16 +487,27 @@ wlcore_set_ht_cap(struct wl1271 *wl, enum ieee80211_band band,
         memcpy(&wl->ht_cap[band], ht_cap, sizeof(*ht_cap));
 }
 
+/* Tell wlcore not to care about this element when checking the version */
+#define WLCORE_FW_VER_IGNORE    -1
+
 static inline void
 wlcore_set_min_fw_ver(struct wl1271 *wl, unsigned int chip,
-                      unsigned int iftype, unsigned int major,
-                      unsigned int subtype, unsigned int minor)
+                      unsigned int iftype_sr, unsigned int major_sr,
+                      unsigned int subtype_sr, unsigned int minor_sr,
+                      unsigned int iftype_mr, unsigned int major_mr,
+                      unsigned int subtype_mr, unsigned int minor_mr)
 {
-        wl->min_fw_ver[FW_VER_CHIP] = chip;
-        wl->min_fw_ver[FW_VER_IF_TYPE] = iftype;
-        wl->min_fw_ver[FW_VER_MAJOR] = major;
-        wl->min_fw_ver[FW_VER_SUBTYPE] = subtype;
-        wl->min_fw_ver[FW_VER_MINOR] = minor;
+        wl->min_sr_fw_ver[FW_VER_CHIP] = chip;
+        wl->min_sr_fw_ver[FW_VER_IF_TYPE] = iftype_sr;
+        wl->min_sr_fw_ver[FW_VER_MAJOR] = major_sr;
+        wl->min_sr_fw_ver[FW_VER_SUBTYPE] = subtype_sr;
+        wl->min_sr_fw_ver[FW_VER_MINOR] = minor_sr;
+
+        wl->min_mr_fw_ver[FW_VER_CHIP] = chip;
+        wl->min_mr_fw_ver[FW_VER_IF_TYPE] = iftype_mr;
+        wl->min_mr_fw_ver[FW_VER_MAJOR] = major_mr;
+        wl->min_mr_fw_ver[FW_VER_SUBTYPE] = subtype_mr;
+        wl->min_mr_fw_ver[FW_VER_MINOR] = minor_mr;
 }
 
 /* Firmware image load chunk size */
@@ -450,6 +518,9 @@ wlcore_set_min_fw_ver(struct wl1271 *wl, unsigned int chip,
 /* Each RX/TX transaction requires an end-of-transaction transfer */
 #define WLCORE_QUIRK_END_OF_TRANSACTION         BIT(0)
 
+/* the first start_role(sta) sometimes doesn't work on wl12xx */
+#define WLCORE_QUIRK_START_STA_FAILS            BIT(1)
+
 /* wl127x and SPI don't support SDIO block size alignment */
 #define WLCORE_QUIRK_TX_BLOCKSIZE_ALIGN         BIT(2)
 
@@ -462,9 +533,6 @@ wlcore_set_min_fw_ver(struct wl1271 *wl, unsigned int chip,
 /* Older firmwares use an old NVS format */
 #define WLCORE_QUIRK_LEGACY_NVS                 BIT(5)
 
-/* Some firmwares may not support ELP */
-#define WLCORE_QUIRK_NO_ELP                     BIT(6)
-
 /* pad only the last frame in the aggregate buffer */
 #define WLCORE_QUIRK_TX_PAD_LAST_FRAME          BIT(7)
 
@@ -477,11 +545,11 @@ wlcore_set_min_fw_ver(struct wl1271 *wl, unsigned int chip,
 /* separate probe response templates for one-shot and sched scans */
 #define WLCORE_QUIRK_DUAL_PROBE_TMPL            BIT(10)
 
-/* TODO: move to the lower drivers when all usages are abstracted */
-#define CHIP_ID_1271_PG10              (0x4030101)
-#define CHIP_ID_1271_PG20              (0x4030111)
-#define CHIP_ID_1283_PG10              (0x05030101)
-#define CHIP_ID_1283_PG20              (0x05030111)
+/* Firmware requires reg domain configuration for active calibration */
+#define WLCORE_QUIRK_REGDOMAIN_CONF             BIT(11)
+
+/* The FW only support a zero session id for AP */
+#define WLCORE_QUIRK_AP_ZERO_SESSION_ID         BIT(12)
 
 /* TODO: move all these common registers and values elsewhere */
 #define HW_ACCESS_ELP_CTRL_REG          0x1FFFC
diff --git a/drivers/net/wireless/ti/wlcore/wlcore_i.h b/drivers/net/wireless/ti/wlcore/wlcore_i.h
index 6678d4b18611..20316ac328a2 100644
--- a/drivers/net/wireless/ti/wlcore/wlcore_i.h
+++ b/drivers/net/wireless/ti/wlcore/wlcore_i.h
@@ -109,17 +109,6 @@ enum {
         NUM_FW_VER
 };
 
-#define FW_VER_CHIP_WL127X 6
-#define FW_VER_CHIP_WL128X 7
-
-#define FW_VER_IF_TYPE_STA 1
-#define FW_VER_IF_TYPE_AP  2
-
-#define FW_VER_MINOR_1_SPARE_STA_MIN 58
-#define FW_VER_MINOR_1_SPARE_AP_MIN  47
-
-#define FW_VER_MINOR_FWLOG_STA_MIN 70
-
 struct wl1271_chip {
         u32 id;
         char fw_ver_str[ETHTOOL_BUSINFO_LEN];
@@ -141,7 +130,10 @@ struct wl_fw_packet_counters {
         /* Cumulative counter of released Voice memory blocks */
         u8 tx_voice_released_blks;
 
-        u8 padding[3];
+        /* Tx rate of the last transmitted packet */
+        u8 tx_last_rate;
+
+        u8 padding[2];
 } __packed;
 
 /* FW status registers */
@@ -260,6 +252,8 @@ enum wl12xx_vif_flags {
         WLVIF_FLAG_IN_USE,
 };
 
+struct wl12xx_vif;
+
 struct wl1271_link {
         /* AP-mode - TX queue per AC in link */
         struct sk_buff_head tx_queue[NUM_TX_QUEUES];
@@ -272,6 +266,9 @@ struct wl1271_link {
 
         /* bitmap of TIDs where RX BA sessions are active for this link */
         u8 ba_bitmap;
+
+        /* The wlvif this link belongs to. Might be null for global links */
+        struct wl12xx_vif *wlvif;
 };
 
 #define WL1271_MAX_RX_FILTERS 5
@@ -315,6 +312,7 @@ struct wl12xx_rx_filter {
 
 struct wl1271_station {
         u8 hlid;
+        bool in_connection;
 };
 
 struct wl12xx_vif {
@@ -332,7 +330,6 @@ struct wl12xx_vif {
         union {
                 struct {
                         u8 hlid;
-                        u8 ba_rx_bitmap;
 
                         u8 basic_rate_idx;
                         u8 ap_rate_idx;
@@ -341,6 +338,8 @@ struct wl12xx_vif {
                         u8 klv_template_id;
 
                         bool qos;
+                        /* channel type we started the STA role with */
+                        enum nl80211_channel_type role_chan_type;
                 } sta;
                 struct {
                         u8 global_hlid;
@@ -362,6 +361,9 @@ struct wl12xx_vif {
         /* the hlid of the last transmitted skb */
         int last_tx_hlid;
 
+        /* counters of packets per AC, across all links in the vif */
+        int tx_queue_count[NUM_TX_QUEUES];
+
         unsigned long links_map[BITS_TO_LONGS(WL12XX_MAX_LINKS)];
 
         u8 ssid[IEEE80211_MAX_SSID_LEN + 1];
@@ -396,9 +398,6 @@ struct wl12xx_vif {
         /* Our association ID */
         u16 aid;
 
-        /* Session counter for the chipset */
-        int session_counter;
-
         /* retry counter for PSM entries */
         u8 psm_entry_retry;
 
@@ -416,11 +415,28 @@ struct wl12xx_vif {
         bool ba_support;
         bool ba_allowed;
 
+        bool wmm_enabled;
+
         /* Rx Streaming */
         struct work_struct rx_streaming_enable_work;
         struct work_struct rx_streaming_disable_work;
         struct timer_list rx_streaming_timer;
 
+        struct delayed_work channel_switch_work;
+        struct delayed_work connection_loss_work;
+
+        /* number of in connection stations */
+        int inconn_count;
+
+        /*
+         * This vif's queues are mapped to mac80211 HW queues as:
+         * VO - hw_queue_base
+         * VI - hw_queue_base + 1
+         * BE - hw_queue_base + 2
+         * BK - hw_queue_base + 3
+         */
+        int hw_queue_base;
+
         /*
          * This struct must be last!
          * data that has to be saved acrossed reconfigs (e.g. recovery)
@@ -443,6 +459,7 @@ struct wl12xx_vif {
 
 static inline struct wl12xx_vif *wl12xx_vif_to_data(struct ieee80211_vif *vif)
 {
+        WARN_ON(!vif);
         return (struct wl12xx_vif *)vif->drv_priv;
 }
 
diff --git a/drivers/nfc/Kconfig b/drivers/nfc/Kconfig
index ec857676c39f..80c728b28828 100644
--- a/drivers/nfc/Kconfig
+++ b/drivers/nfc/Kconfig
@@ -5,19 +5,6 @@
 menu "Near Field Communication (NFC) devices"
         depends on NFC
 
-config PN544_HCI_NFC
-        tristate "HCI PN544 NFC driver"
-        depends on I2C && NFC_HCI && NFC_SHDLC
-        select CRC_CCITT
-        default n
-        ---help---
-          NXP PN544 i2c driver.
-          This is a driver based on the SHDLC and HCI NFC kernel layers and
-          will thus not work with NXP libnfc library.
-
-          To compile this driver as a module, choose m here. The module will
-          be called pn544_hci.
-
 config NFC_PN533
         tristate "NXP PN533 USB driver"
         depends on USB
@@ -39,4 +26,6 @@ config NFC_WILINK
           Say Y here to compile support for Texas Instrument's NFC WiLink driver
           into the kernel or say M to compile it as module.
 
+source "drivers/nfc/pn544/Kconfig"
+
 endmenu
diff --git a/drivers/nfc/Makefile b/drivers/nfc/Makefile
index 36c359043f54..574bbc04d97a 100644
--- a/drivers/nfc/Makefile
+++ b/drivers/nfc/Makefile
@@ -2,7 +2,7 @@
 # Makefile for nfc devices
 #
 
-obj-$(CONFIG_PN544_HCI_NFC)     += pn544/
+obj-$(CONFIG_NFC_PN544)         += pn544/
 obj-$(CONFIG_NFC_PN533)         += pn533.o
 obj-$(CONFIG_NFC_WILINK)        += nfcwilink.o
 
diff --git a/drivers/nfc/nfcwilink.c b/drivers/nfc/nfcwilink.c
index 50b1ee41afc6..3b731acbc408 100644
--- a/drivers/nfc/nfcwilink.c
+++ b/drivers/nfc/nfcwilink.c
@@ -526,7 +526,7 @@ static int nfcwilink_probe(struct platform_device *pdev)
 
         nfc_dev_dbg(&pdev->dev, "probe entry");
 
-        drv = kzalloc(sizeof(struct nfcwilink), GFP_KERNEL);
+        drv = devm_kzalloc(&pdev->dev, sizeof(struct nfcwilink), GFP_KERNEL);
         if (!drv) {
                 rc = -ENOMEM;
                 goto exit;
@@ -542,12 +542,13 @@ static int nfcwilink_probe(struct platform_device *pdev)
 
         drv->ndev = nci_allocate_device(&nfcwilink_ops,
                                         protocols,
+                                        NFC_SE_NONE,
                                         NFCWILINK_HDR_LEN,
                                         0);
         if (!drv->ndev) {
                 nfc_dev_err(&pdev->dev, "nci_allocate_device failed");
                 rc = -ENOMEM;
-                goto free_exit;
+                goto exit;
         }
 
         nci_set_parent_dev(drv->ndev, &pdev->dev);
@@ -566,9 +567,6 @@ static int nfcwilink_probe(struct platform_device *pdev)
 free_dev_exit:
         nci_free_device(drv->ndev);
 
-free_exit:
-        kfree(drv);
-
 exit:
         return rc;
 }
@@ -588,8 +586,6 @@ static int nfcwilink_remove(struct platform_device *pdev)
         nci_unregister_device(ndev);
         nci_free_device(ndev);
 
-        kfree(drv);
-
         dev_set_drvdata(&pdev->dev, NULL);
 
         return 0;
diff --git a/drivers/nfc/pn533.c b/drivers/nfc/pn533.c
index ada681b01a17..f696318cfb51 100644
--- a/drivers/nfc/pn533.c
+++ b/drivers/nfc/pn533.c
@@ -41,11 +41,6 @@
 #define SONY_VENDOR_ID         0x054c
 #define PASORI_PRODUCT_ID      0x02e1
 
-#define PN533_QUIRKS_TYPE_A          BIT(0)
-#define PN533_QUIRKS_TYPE_F          BIT(1)
-#define PN533_QUIRKS_DEP             BIT(2)
-#define PN533_QUIRKS_RAW_EXCHANGE    BIT(3)
-
 #define PN533_DEVICE_STD    0x1
 #define PN533_DEVICE_PASORI 0x2
 
@@ -84,14 +79,18 @@ MODULE_DEVICE_TABLE(usb, pn533_table);
 #define PN533_LISTEN_TIME 2
 
 /* frame definitions */
-#define PN533_NORMAL_FRAME_MAX_LEN 262  /* 6   (PREAMBLE, SOF, LEN, LCS, TFI)
-                                           254 (DATA)
-                                           2   (DCS, postamble) */
-
-#define PN533_FRAME_TAIL_SIZE 2
-#define PN533_FRAME_SIZE(f) (sizeof(struct pn533_frame) + f->datalen + \
-                                PN533_FRAME_TAIL_SIZE)
-#define PN533_FRAME_ACK_SIZE (sizeof(struct pn533_frame) + 1)
+#define PN533_FRAME_HEADER_LEN (sizeof(struct pn533_frame) \
+                                        + 2) /* data[0] TFI, data[1] CC */
+#define PN533_FRAME_TAIL_LEN 2 /* data[len] DCS, data[len + 1] postamble*/
+
+/*
+ * Max extended frame payload len, excluding TFI and CC
+ * which are already in PN533_FRAME_HEADER_LEN.
+ */
+#define PN533_FRAME_MAX_PAYLOAD_LEN 263
+
+#define PN533_FRAME_ACK_SIZE 6 /* Preamble (1), SoPC (2), ACK Code (2),
+                                  Postamble (1) */
 #define PN533_FRAME_CHECKSUM(f) (f->data[f->datalen])
 #define PN533_FRAME_POSTAMBLE(f) (f->data[f->datalen + 1])
 
@@ -105,8 +104,6 @@ MODULE_DEVICE_TABLE(usb, pn533_table);
 
 /* PN533 Commands */
 #define PN533_FRAME_CMD(f) (f->data[1])
-#define PN533_FRAME_CMD_PARAMS_PTR(f) (&f->data[2])
-#define PN533_FRAME_CMD_PARAMS_LEN(f) (f->datalen - 2)
 
 #define PN533_CMD_GET_FIRMWARE_VERSION 0x02
 #define PN533_CMD_RF_CONFIGURATION 0x32
@@ -120,6 +117,7 @@ MODULE_DEVICE_TABLE(usb, pn533_table);
 #define PN533_CMD_TG_INIT_AS_TARGET 0x8c
 #define PN533_CMD_TG_GET_DATA 0x86
 #define PN533_CMD_TG_SET_DATA 0x8e
+#define PN533_CMD_UNDEF 0xff
 
 #define PN533_CMD_RESPONSE(cmd) (cmd + 1)
 
@@ -128,13 +126,12 @@ MODULE_DEVICE_TABLE(usb, pn533_table);
 #define PN533_CMD_MI_MASK 0x40
 #define PN533_CMD_RET_SUCCESS 0x00
 
-/* PN533 status codes */
-#define PN533_STATUS_TARGET_RELEASED 0x29
-
 struct pn533;
 
-typedef int (*pn533_cmd_complete_t) (struct pn533 *dev, void *arg,
-                                        u8 *params, int params_len);
+typedef int (*pn533_cmd_complete_t) (struct pn533 *dev, void *arg, int status);
+
+typedef int (*pn533_send_async_complete_t) (struct pn533 *dev, void *arg,
+                                        struct sk_buff *resp);
 
 /* structs for pn533 commands */
 
@@ -282,11 +279,6 @@ const struct pn533_poll_modulations poll_mod[] = {
 
 /* PN533_CMD_IN_ATR */
 
-struct pn533_cmd_activate_param {
-        u8 tg;
-        u8 next;
-} __packed;
-
 struct pn533_cmd_activate_response {
         u8 status;
         u8 nfcid3t[10];
@@ -299,14 +291,6 @@ struct pn533_cmd_activate_response {
         u8 gt[];
 } __packed;
 
-/* PN533_CMD_IN_JUMP_FOR_DEP */
-struct pn533_cmd_jump_dep {
-        u8 active;
-        u8 baud;
-        u8 next;
-        u8 data[];
-} __packed;
-
 struct pn533_cmd_jump_dep_response {
         u8 status;
         u8 tg;
@@ -329,32 +313,13 @@ struct pn533_cmd_jump_dep_response {
 #define PN533_INIT_TARGET_RESP_ACTIVE     0x1
 #define PN533_INIT_TARGET_RESP_DEP        0x4
 
-struct pn533_cmd_init_target {
-        u8 mode;
-        u8 mifare[6];
-        u8 felica[18];
-        u8 nfcid3[10];
-        u8 gb_len;
-        u8 gb[];
-} __packed;
-
-struct pn533_cmd_init_target_response {
-        u8 mode;
-        u8 cmd[];
-} __packed;
-
 struct pn533 {
         struct usb_device *udev;
         struct usb_interface *interface;
         struct nfc_dev *nfc_dev;
 
         struct urb *out_urb;
-        int out_maxlen;
-        struct pn533_frame *out_frame;
-
         struct urb *in_urb;
-        int in_maxlen;
-        struct pn533_frame *in_frame;
 
         struct sk_buff_head resp_q;
 
@@ -365,12 +330,12 @@ struct pn533 {
         struct work_struct mi_work;
         struct work_struct tg_work;
         struct timer_list listen_timer;
-        struct pn533_frame *wq_in_frame;
         int wq_in_error;
         int cancel_listen;
 
         pn533_cmd_complete_t cmd_complete;
         void *cmd_complete_arg;
+        void *cmd_complete_mi_arg;
         struct mutex cmd_lock;
         u8 cmd;
 
@@ -391,16 +356,17 @@ struct pn533 {
 
         struct list_head cmd_queue;
         u8 cmd_pending;
+
+        struct pn533_frame_ops *ops;
 };
 
 struct pn533_cmd {
         struct list_head queue;
-        struct pn533_frame *out_frame;
-        struct pn533_frame *in_frame;
-        int in_frame_len;
-        pn533_cmd_complete_t cmd_complete;
+        u8 cmd_code;
+        struct sk_buff *req;
+        struct sk_buff *resp;
+        int resp_len;
         void *arg;
-        gfp_t flags;
 };
 
 struct pn533_frame {
@@ -411,6 +377,22 @@ struct pn533_frame {
         u8 data[];
 } __packed;
 
+struct pn533_frame_ops {
+        void (*tx_frame_init)(void *frame, u8 cmd_code);
+        void (*tx_frame_finish)(void *frame);
+        void (*tx_update_payload_len)(void *frame, int len);
+        int tx_header_len;
+        int tx_tail_len;
+
+        bool (*rx_is_frame_valid)(void *frame);
+        int (*rx_frame_size)(void *frame);
+        int rx_header_len;
+        int rx_tail_len;
+
+        int max_payload_len;
+        u8 (*get_cmd_code)(void *frame);
+};
+
 /* The rule: value + checksum = 0 */
 static inline u8 pn533_checksum(u8 value)
 {
@@ -429,37 +411,21 @@ static u8 pn533_data_checksum(u8 *data, int datalen)
         return pn533_checksum(sum);
 }
 
-/**
- * pn533_tx_frame_ack - create a ack frame
- * @frame:      The frame to be set as ack
- *
- * Ack is different type of standard frame. As a standard frame, it has
- * preamble and start_frame. However the checksum of this frame must fail,
- * i.e. datalen + datalen_checksum must NOT be zero. When the checksum test
- * fails and datalen = 0 and datalen_checksum = 0xFF, the frame is a ack.
- * After datalen_checksum field, the postamble is placed.
- */
-static void pn533_tx_frame_ack(struct pn533_frame *frame)
+static void pn533_tx_frame_init(void *_frame, u8 cmd_code)
 {
-        frame->preamble = 0;
-        frame->start_frame = cpu_to_be16(PN533_SOF);
-        frame->datalen = 0;
-        frame->datalen_checksum = 0xFF;
-        /* data[0] is used as postamble */
-        frame->data[0] = 0;
-}
+        struct pn533_frame *frame = _frame;
 
-static void pn533_tx_frame_init(struct pn533_frame *frame, u8 cmd)
-{
         frame->preamble = 0;
         frame->start_frame = cpu_to_be16(PN533_SOF);
         PN533_FRAME_IDENTIFIER(frame) = PN533_DIR_OUT;
-        PN533_FRAME_CMD(frame) = cmd;
+        PN533_FRAME_CMD(frame) = cmd_code;
         frame->datalen = 2;
 }
 
-static void pn533_tx_frame_finish(struct pn533_frame *frame)
+static void pn533_tx_frame_finish(void *_frame)
 {
+        struct pn533_frame *frame = _frame;
+
         frame->datalen_checksum = pn533_checksum(frame->datalen);
 
         PN533_FRAME_CHECKSUM(frame) =
@@ -468,9 +434,17 @@ static void pn533_tx_frame_finish(struct pn533_frame *frame)
         PN533_FRAME_POSTAMBLE(frame) = 0;
 }
 
-static bool pn533_rx_frame_is_valid(struct pn533_frame *frame)
+static void pn533_tx_update_payload_len(void *_frame, int len)
+{
+        struct pn533_frame *frame = _frame;
+
+        frame->datalen += len;
+}
+
+static bool pn533_rx_frame_is_valid(void *_frame)
 {
         u8 checksum;
+        struct pn533_frame *frame = _frame;
 
         if (frame->start_frame != cpu_to_be16(PN533_SOF))
                 return false;
@@ -497,28 +471,48 @@ static bool pn533_rx_frame_is_ack(struct pn533_frame *frame)
         return true;
 }
 
-static bool pn533_rx_frame_is_cmd_response(struct pn533_frame *frame, u8 cmd)
+static inline int pn533_rx_frame_size(void *frame)
+{
+        struct pn533_frame *f = frame;
+
+        return sizeof(struct pn533_frame) + f->datalen + PN533_FRAME_TAIL_LEN;
+}
+
+static u8 pn533_get_cmd_code(void *frame)
+{
+        struct pn533_frame *f = frame;
+
+        return PN533_FRAME_CMD(f);
+}
+
+struct pn533_frame_ops pn533_std_frame_ops = {
+        .tx_frame_init = pn533_tx_frame_init,
+        .tx_frame_finish = pn533_tx_frame_finish,
+        .tx_update_payload_len = pn533_tx_update_payload_len,
+        .tx_header_len = PN533_FRAME_HEADER_LEN,
+        .tx_tail_len = PN533_FRAME_TAIL_LEN,
+
+        .rx_is_frame_valid = pn533_rx_frame_is_valid,
+        .rx_frame_size = pn533_rx_frame_size,
+        .rx_header_len = PN533_FRAME_HEADER_LEN,
+        .rx_tail_len = PN533_FRAME_TAIL_LEN,
+
+        .max_payload_len =  PN533_FRAME_MAX_PAYLOAD_LEN,
+        .get_cmd_code = pn533_get_cmd_code,
+};
+
+static bool pn533_rx_frame_is_cmd_response(struct pn533 *dev, void *frame)
 {
-        return (PN533_FRAME_CMD(frame) == PN533_CMD_RESPONSE(cmd));
+        return (dev->ops->get_cmd_code(frame) == PN533_CMD_RESPONSE(dev->cmd));
 }
 
 
 static void pn533_wq_cmd_complete(struct work_struct *work)
 {
         struct pn533 *dev = container_of(work, struct pn533, cmd_complete_work);
-        struct pn533_frame *in_frame;
         int rc;
 
-        in_frame = dev->wq_in_frame;
-
-        if (dev->wq_in_error)
-                rc = dev->cmd_complete(dev, dev->cmd_complete_arg, NULL,
-                                                        dev->wq_in_error);
-        else
-                rc = dev->cmd_complete(dev, dev->cmd_complete_arg,
-                                        PN533_FRAME_CMD_PARAMS_PTR(in_frame),
-                                        PN533_FRAME_CMD_PARAMS_LEN(in_frame));
-
+        rc = dev->cmd_complete(dev, dev->cmd_complete_arg, dev->wq_in_error);
         if (rc != -EINPROGRESS)
                 queue_work(dev->wq, &dev->cmd_work);
 }
@@ -526,46 +520,47 @@ static void pn533_wq_cmd_complete(struct work_struct *work)
 static void pn533_recv_response(struct urb *urb)
 {
         struct pn533 *dev = urb->context;
-        struct pn533_frame *in_frame;
-
-        dev->wq_in_frame = NULL;
+        u8 *in_frame;
 
         switch (urb->status) {
         case 0:
-                /* success */
-                break;
+                break; /* success */
         case -ECONNRESET:
         case -ENOENT:
-        case -ESHUTDOWN:
-                nfc_dev_dbg(&dev->interface->dev, "Urb shutting down with"
-                                                " status: %d", urb->status);
+                nfc_dev_dbg(&dev->interface->dev,
+                            "The urb has been canceled (status %d)",
+                            urb->status);
                 dev->wq_in_error = urb->status;
                 goto sched_wq;
+                break;
+        case -ESHUTDOWN:
         default:
-                nfc_dev_err(&dev->interface->dev, "Nonzero urb status received:"
-                                                        " %d", urb->status);
+                nfc_dev_err(&dev->interface->dev,
+                            "Urb failure (status %d)", urb->status);
                 dev->wq_in_error = urb->status;
                 goto sched_wq;
         }
 
         in_frame = dev->in_urb->transfer_buffer;
 
-        if (!pn533_rx_frame_is_valid(in_frame)) {
+        nfc_dev_dbg(&dev->interface->dev, "Received a frame.");
+        print_hex_dump(KERN_DEBUG, "PN533 RX: ", DUMP_PREFIX_NONE, 16, 1,
+                       in_frame, dev->ops->rx_frame_size(in_frame), false);
+
+        if (!dev->ops->rx_is_frame_valid(in_frame)) {
                 nfc_dev_err(&dev->interface->dev, "Received an invalid frame");
                 dev->wq_in_error = -EIO;
                 goto sched_wq;
         }
 
-        if (!pn533_rx_frame_is_cmd_response(in_frame, dev->cmd)) {
-                nfc_dev_err(&dev->interface->dev, "The received frame is not "
-                                                "response to the last command");
+        if (!pn533_rx_frame_is_cmd_response(dev, in_frame)) {
+                nfc_dev_err(&dev->interface->dev,
+                            "It it not the response to the last command");
                 dev->wq_in_error = -EIO;
                 goto sched_wq;
         }
 
-        nfc_dev_dbg(&dev->interface->dev, "Received a valid frame");
         dev->wq_in_error = 0;
-        dev->wq_in_frame = in_frame;
 
 sched_wq:
         queue_work(dev->wq, &dev->cmd_complete_work);
@@ -586,18 +581,19 @@ static void pn533_recv_ack(struct urb *urb)
 
         switch (urb->status) {
         case 0:
-                /* success */
-                break;
+                break; /* success */
         case -ECONNRESET:
         case -ENOENT:
-        case -ESHUTDOWN:
-                nfc_dev_dbg(&dev->interface->dev, "Urb shutting down with"
-                                                " status: %d", urb->status);
+                nfc_dev_dbg(&dev->interface->dev,
+                            "The urb has been stopped (status %d)",
+                            urb->status);
                 dev->wq_in_error = urb->status;
                 goto sched_wq;
+                break;
+        case -ESHUTDOWN:
         default:
-                nfc_dev_err(&dev->interface->dev, "Nonzero urb status received:"
-                                                        " %d", urb->status);
+                nfc_dev_err(&dev->interface->dev,
+                            "Urb failure (status %d)", urb->status);
                 dev->wq_in_error = urb->status;
                 goto sched_wq;
         }
@@ -610,12 +606,10 @@ static void pn533_recv_ack(struct urb *urb)
                 goto sched_wq;
         }
 
-        nfc_dev_dbg(&dev->interface->dev, "Received a valid ack");
-
         rc = pn533_submit_urb_for_response(dev, GFP_ATOMIC);
         if (rc) {
-                nfc_dev_err(&dev->interface->dev, "usb_submit_urb failed with"
-                                                        " result %d", rc);
+                nfc_dev_err(&dev->interface->dev,
+                            "usb_submit_urb failed with result %d", rc);
                 dev->wq_in_error = rc;
                 goto sched_wq;
         }
@@ -623,7 +617,6 @@ static void pn533_recv_ack(struct urb *urb)
         return;
 
 sched_wq:
-        dev->wq_in_frame = NULL;
         queue_work(dev->wq, &dev->cmd_complete_work);
 }
 
@@ -636,47 +629,46 @@ static int pn533_submit_urb_for_ack(struct pn533 *dev, gfp_t flags)
 
 static int pn533_send_ack(struct pn533 *dev, gfp_t flags)
 {
+        u8 ack[PN533_FRAME_ACK_SIZE] = {0x00, 0x00, 0xff, 0x00, 0xff, 0x00};
+        /* spec 7.1.1.3:  Preamble, SoPC (2), ACK Code (2), Postamble */
         int rc;
 
         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
 
-        pn533_tx_frame_ack(dev->out_frame);
-
-        dev->out_urb->transfer_buffer = dev->out_frame;
-        dev->out_urb->transfer_buffer_length = PN533_FRAME_ACK_SIZE;
+        dev->out_urb->transfer_buffer = ack;
+        dev->out_urb->transfer_buffer_length = sizeof(ack);
         rc = usb_submit_urb(dev->out_urb, flags);
 
         return rc;
 }
 
-static int __pn533_send_cmd_frame_async(struct pn533 *dev,
-                                        struct pn533_frame *out_frame,
-                                        struct pn533_frame *in_frame,
-                                        int in_frame_len,
+static int __pn533_send_frame_async(struct pn533 *dev,
+                                        struct sk_buff *out,
+                                        struct sk_buff *in,
+                                        int in_len,
                                         pn533_cmd_complete_t cmd_complete,
-                                        void *arg, gfp_t flags)
+                                        void *arg)
 {
         int rc;
 
-        nfc_dev_dbg(&dev->interface->dev, "Sending command 0x%x",
-                                                PN533_FRAME_CMD(out_frame));
-
-        dev->cmd = PN533_FRAME_CMD(out_frame);
+        dev->cmd = dev->ops->get_cmd_code(out->data);
         dev->cmd_complete = cmd_complete;
         dev->cmd_complete_arg = arg;
 
-        dev->out_urb->transfer_buffer = out_frame;
-        dev->out_urb->transfer_buffer_length =
-                                PN533_FRAME_SIZE(out_frame);
+        dev->out_urb->transfer_buffer = out->data;
+        dev->out_urb->transfer_buffer_length = out->len;
 
-        dev->in_urb->transfer_buffer = in_frame;
-        dev->in_urb->transfer_buffer_length = in_frame_len;
+        dev->in_urb->transfer_buffer = in->data;
+        dev->in_urb->transfer_buffer_length = in_len;
 
-        rc = usb_submit_urb(dev->out_urb, flags);
+        print_hex_dump(KERN_DEBUG, "PN533 TX: ", DUMP_PREFIX_NONE, 16, 1,
+                       out->data, out->len, false);
+
+        rc = usb_submit_urb(dev->out_urb, GFP_KERNEL);
         if (rc)
                 return rc;
 
-        rc = pn533_submit_urb_for_ack(dev, flags);
+        rc = pn533_submit_urb_for_ack(dev, GFP_KERNEL);
         if (rc)
                 goto error;
 
@@ -687,146 +679,325 @@ error:
         return rc;
 }
 
-static void pn533_wq_cmd(struct work_struct *work)
+static void pn533_build_cmd_frame(struct pn533 *dev, u8 cmd_code,
+                                  struct sk_buff *skb)
 {
-        struct pn533 *dev = container_of(work, struct pn533, cmd_work);
-        struct pn533_cmd *cmd;
+        /* payload is already there, just update datalen */
+        int payload_len = skb->len;
+        struct pn533_frame_ops *ops = dev->ops;
 
-        mutex_lock(&dev->cmd_lock);
 
-        if (list_empty(&dev->cmd_queue)) {
-                dev->cmd_pending = 0;
-                mutex_unlock(&dev->cmd_lock);
-                return;
-        }
+        skb_push(skb, ops->tx_header_len);
+        skb_put(skb, ops->tx_tail_len);
 
-        cmd = list_first_entry(&dev->cmd_queue, struct pn533_cmd, queue);
+        ops->tx_frame_init(skb->data, cmd_code);
+        ops->tx_update_payload_len(skb->data, payload_len);
+        ops->tx_frame_finish(skb->data);
+}
 
-        list_del(&cmd->queue);
+struct pn533_send_async_complete_arg {
+        pn533_send_async_complete_t  complete_cb;
+        void *complete_cb_context;
+        struct sk_buff *resp;
+        struct sk_buff *req;
+};
 
-        mutex_unlock(&dev->cmd_lock);
+static int pn533_send_async_complete(struct pn533 *dev, void *_arg, int status)
+{
+        struct pn533_send_async_complete_arg *arg = _arg;
 
-        __pn533_send_cmd_frame_async(dev, cmd->out_frame, cmd->in_frame,
-                                     cmd->in_frame_len, cmd->cmd_complete,
-                                     cmd->arg, cmd->flags);
+        struct sk_buff *req = arg->req;
+        struct sk_buff *resp = arg->resp;
 
-        kfree(cmd);
+        int rc;
+
+        dev_kfree_skb(req);
+
+        if (status < 0) {
+                arg->complete_cb(dev, arg->complete_cb_context,
+                                 ERR_PTR(status));
+                dev_kfree_skb(resp);
+                kfree(arg);
+                return status;
+        }
+
+        skb_put(resp, dev->ops->rx_frame_size(resp->data));
+        skb_pull(resp, dev->ops->rx_header_len);
+        skb_trim(resp, resp->len - dev->ops->rx_tail_len);
+
+        rc = arg->complete_cb(dev, arg->complete_cb_context, resp);
+
+        kfree(arg);
+        return rc;
 }
 
-static int pn533_send_cmd_frame_async(struct pn533 *dev,
-                                        struct pn533_frame *out_frame,
-                                        struct pn533_frame *in_frame,
-                                        int in_frame_len,
-                                        pn533_cmd_complete_t cmd_complete,
-                                        void *arg, gfp_t flags)
+static int __pn533_send_async(struct pn533 *dev, u8 cmd_code,
+                              struct sk_buff *req, struct sk_buff *resp,
+                              int resp_len,
+                              pn533_send_async_complete_t complete_cb,
+                              void *complete_cb_context)
 {
         struct pn533_cmd *cmd;
+        struct pn533_send_async_complete_arg *arg;
         int rc = 0;
 
-        nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
+        nfc_dev_dbg(&dev->interface->dev, "Sending command 0x%x", cmd_code);
+
+        arg = kzalloc(sizeof(*arg), GFP_KERNEL);
+        if (!arg)
+                return -ENOMEM;
+
+        arg->complete_cb = complete_cb;
+        arg->complete_cb_context = complete_cb_context;
+        arg->resp = resp;
+        arg->req = req;
+
+        pn533_build_cmd_frame(dev, cmd_code, req);
 
         mutex_lock(&dev->cmd_lock);
 
         if (!dev->cmd_pending) {
-                rc = __pn533_send_cmd_frame_async(dev, out_frame, in_frame,
-                                                  in_frame_len, cmd_complete,
-                                                  arg, flags);
-                if (!rc)
-                        dev->cmd_pending = 1;
+                rc = __pn533_send_frame_async(dev, req, resp, resp_len,
+                                              pn533_send_async_complete, arg);
+                if (rc)
+                        goto error;
 
+                dev->cmd_pending = 1;
                 goto unlock;
         }
 
-        nfc_dev_dbg(&dev->interface->dev, "%s Queueing command", __func__);
+        nfc_dev_dbg(&dev->interface->dev, "%s Queueing command 0x%x", __func__,
+                    cmd_code);
 
-        cmd = kzalloc(sizeof(struct pn533_cmd), flags);
+        cmd = kzalloc(sizeof(struct pn533_cmd), GFP_KERNEL);
         if (!cmd) {
                 rc = -ENOMEM;
-                goto unlock;
+                goto error;
         }
 
         INIT_LIST_HEAD(&cmd->queue);
-        cmd->out_frame = out_frame;
-        cmd->in_frame = in_frame;
-        cmd->in_frame_len = in_frame_len;
-        cmd->cmd_complete = cmd_complete;
+        cmd->cmd_code = cmd_code;
+        cmd->req = req;
+        cmd->resp = resp;
+        cmd->resp_len = resp_len;
         cmd->arg = arg;
-        cmd->flags = flags;
 
         list_add_tail(&cmd->queue, &dev->cmd_queue);
 
+        goto unlock;
+
+error:
+        kfree(arg);
 unlock:
         mutex_unlock(&dev->cmd_lock);
+        return rc;
+}
+
+static int pn533_send_data_async(struct pn533 *dev, u8 cmd_code,
+                                 struct sk_buff *req,
+                                 pn533_send_async_complete_t complete_cb,
+                                 void *complete_cb_context)
+{
+        struct sk_buff *resp;
+        int rc;
+        int  resp_len = dev->ops->rx_header_len +
+                        dev->ops->max_payload_len +
+                        dev->ops->rx_tail_len;
+
+        resp = nfc_alloc_recv_skb(resp_len, GFP_KERNEL);
+        if (!resp)
+                return -ENOMEM;
+
+        rc = __pn533_send_async(dev, cmd_code, req, resp, resp_len, complete_cb,
+                                complete_cb_context);
+        if (rc)
+                dev_kfree_skb(resp);
 
         return rc;
 }
 
-struct pn533_sync_cmd_response {
+static int pn533_send_cmd_async(struct pn533 *dev, u8 cmd_code,
+                                struct sk_buff *req,
+                                pn533_send_async_complete_t complete_cb,
+                                void *complete_cb_context)
+{
+        struct sk_buff *resp;
         int rc;
-        struct completion done;
-};
+        int  resp_len = dev->ops->rx_header_len +
+                        dev->ops->max_payload_len +
+                        dev->ops->rx_tail_len;
+
+        resp = alloc_skb(resp_len, GFP_KERNEL);
+        if (!resp)
+                return -ENOMEM;
+
+        rc = __pn533_send_async(dev, cmd_code, req, resp, resp_len, complete_cb,
+                                complete_cb_context);
+        if (rc)
+                dev_kfree_skb(resp);
 
-static int pn533_sync_cmd_complete(struct pn533 *dev, void *_arg,
-                                        u8 *params, int params_len)
+        return rc;
+}
+
+/*
+ * pn533_send_cmd_direct_async
+ *
+ * The function sends a piority cmd directly to the chip omiting the cmd
+ * queue. It's intended to be used by chaining mechanism of received responses
+ * where the host has to request every single chunk of data before scheduling
+ * next cmd from the queue.
+ */
+static int pn533_send_cmd_direct_async(struct pn533 *dev, u8 cmd_code,
+                                       struct sk_buff *req,
+                                       pn533_send_async_complete_t complete_cb,
+                                       void *complete_cb_context)
 {
-        struct pn533_sync_cmd_response *arg = _arg;
+        struct pn533_send_async_complete_arg *arg;
+        struct sk_buff *resp;
+        int rc;
+        int resp_len = dev->ops->rx_header_len +
+                       dev->ops->max_payload_len +
+                       dev->ops->rx_tail_len;
 
-        nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
+        resp = alloc_skb(resp_len, GFP_KERNEL);
+        if (!resp)
+                return -ENOMEM;
+
+        arg = kzalloc(sizeof(*arg), GFP_KERNEL);
+        if (!arg) {
+                dev_kfree_skb(resp);
+                return -ENOMEM;
+        }
 
-        arg->rc = 0;
+        arg->complete_cb = complete_cb;
+        arg->complete_cb_context = complete_cb_context;
+        arg->resp = resp;
+        arg->req = req;
 
-        if (params_len < 0) /* error */
-                arg->rc = params_len;
+        pn533_build_cmd_frame(dev, cmd_code, req);
 
+        rc = __pn533_send_frame_async(dev, req, resp, resp_len,
+                                      pn533_send_async_complete, arg);
+        if (rc < 0) {
+                dev_kfree_skb(resp);
+                kfree(arg);
+        }
+
+        return rc;
+}
+
+static void pn533_wq_cmd(struct work_struct *work)
+{
+        struct pn533 *dev = container_of(work, struct pn533, cmd_work);
+        struct pn533_cmd *cmd;
+
+        mutex_lock(&dev->cmd_lock);
+
+        if (list_empty(&dev->cmd_queue)) {
+                dev->cmd_pending = 0;
+                mutex_unlock(&dev->cmd_lock);
+                return;
+        }
+
+        cmd = list_first_entry(&dev->cmd_queue, struct pn533_cmd, queue);
+
+        list_del(&cmd->queue);
+
+        mutex_unlock(&dev->cmd_lock);
+
+        __pn533_send_frame_async(dev, cmd->req, cmd->resp, cmd->resp_len,
+                                 pn533_send_async_complete, cmd->arg);
+
+        kfree(cmd);
+}
+
+struct pn533_sync_cmd_response {
+        struct sk_buff *resp;
+        struct completion done;
+};
+
+static int pn533_send_sync_complete(struct pn533 *dev, void *_arg,
+                                    struct sk_buff *resp)
+{
+        struct pn533_sync_cmd_response *arg = _arg;
+
+        arg->resp = resp;
         complete(&arg->done);
 
         return 0;
 }
 
-static int pn533_send_cmd_frame_sync(struct pn533 *dev,
-                                                struct pn533_frame *out_frame,
-                                                struct pn533_frame *in_frame,
-                                                int in_frame_len)
+/*  pn533_send_cmd_sync
+ *
+ *  Please note the req parameter is freed inside the function to
+ *  limit a number of return value interpretations by the caller.
+ *
+ *  1. negative in case of error during TX path -> req should be freed
+ *
+ *  2. negative in case of error during RX path -> req should not be freed
+ *     as it's been already freed at the begining of RX path by
+ *     async_complete_cb.
+ *
+ *  3. valid pointer in case of succesfult RX path
+ *
+ *  A caller has to check a return value with IS_ERR macro. If the test pass,
+ *  the returned pointer is valid.
+ *
+ * */
+static struct sk_buff *pn533_send_cmd_sync(struct pn533 *dev, u8 cmd_code,
+                                               struct sk_buff *req)
 {
         int rc;
         struct pn533_sync_cmd_response arg;
 
-        nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
-
         init_completion(&arg.done);
 
-        rc = pn533_send_cmd_frame_async(dev, out_frame, in_frame, in_frame_len,
-                                pn533_sync_cmd_complete, &arg, GFP_KERNEL);
-        if (rc)
-                return rc;
+        rc = pn533_send_cmd_async(dev, cmd_code, req,
+                                  pn533_send_sync_complete, &arg);
+        if (rc) {
+                dev_kfree_skb(req);
+                return ERR_PTR(rc);
+        }
 
         wait_for_completion(&arg.done);
 
-        return arg.rc;
+        return arg.resp;
 }
 
 static void pn533_send_complete(struct urb *urb)
 {
         struct pn533 *dev = urb->context;
 
-        nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
-
         switch (urb->status) {
         case 0:
-                /* success */
-                break;
+                break; /* success */
         case -ECONNRESET:
         case -ENOENT:
-        case -ESHUTDOWN:
-                nfc_dev_dbg(&dev->interface->dev, "Urb shutting down with"
-                                                " status: %d", urb->status);
+                nfc_dev_dbg(&dev->interface->dev,
+                            "The urb has been stopped (status %d)",
+                            urb->status);
                 break;
+        case -ESHUTDOWN:
         default:
-                nfc_dev_dbg(&dev->interface->dev, "Nonzero urb status received:"
-                                                        " %d", urb->status);
+                nfc_dev_err(&dev->interface->dev,
+                            "Urb failure (status %d)", urb->status);
         }
 }
 
+static struct sk_buff *pn533_alloc_skb(struct pn533 *dev, unsigned int size)
+{
+        struct sk_buff *skb;
+
+        skb = alloc_skb(dev->ops->tx_header_len +
+                        size +
+                        dev->ops->tx_tail_len, GFP_KERNEL);
+
+        if (skb)
+                skb_reserve(skb, dev->ops->tx_header_len);
+
+        return skb;
+}
+
 struct pn533_target_type_a {
         __be16 sens_res;
         u8 sel_res;
@@ -867,9 +1038,9 @@ static bool pn533_target_type_a_is_valid(struct pn533_target_type_a *type_a,
         platconf = PN533_TYPE_A_SENS_RES_PLATCONF(type_a->sens_res);
 
         if ((ssd == PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
-                        platconf != PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL) ||
-                        (ssd != PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
-                        platconf == PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL))
+             platconf != PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL) ||
+            (ssd != PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
+             platconf == PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL))
                 return false;
 
         /* Requirements 4.8.2.1, 4.8.2.3, 4.8.2.5 and 4.8.2.7 from NFC Forum */
@@ -884,7 +1055,7 @@ static int pn533_target_found_type_a(struct nfc_target *nfc_tgt, u8 *tgt_data,
 {
         struct pn533_target_type_a *tgt_type_a;
 
-        tgt_type_a = (struct pn533_target_type_a *) tgt_data;
+        tgt_type_a = (struct pn533_target_type_a *)tgt_data;
 
         if (!pn533_target_type_a_is_valid(tgt_type_a, tgt_data_len))
                 return -EPROTO;
@@ -942,14 +1113,13 @@ static int pn533_target_found_felica(struct nfc_target *nfc_tgt, u8 *tgt_data,
 {
         struct pn533_target_felica *tgt_felica;
 
-        tgt_felica = (struct pn533_target_felica *) tgt_data;
+        tgt_felica = (struct pn533_target_felica *)tgt_data;
 
         if (!pn533_target_felica_is_valid(tgt_felica, tgt_data_len))
                 return -EPROTO;
 
-        if (tgt_felica->nfcid2[0] == PN533_FELICA_SENSF_NFCID2_DEP_B1 &&
-                                        tgt_felica->nfcid2[1] ==
-                                        PN533_FELICA_SENSF_NFCID2_DEP_B2)
+        if ((tgt_felica->nfcid2[0] == PN533_FELICA_SENSF_NFCID2_DEP_B1) &&
+            (tgt_felica->nfcid2[1] == PN533_FELICA_SENSF_NFCID2_DEP_B2))
                 nfc_tgt->supported_protocols = NFC_PROTO_NFC_DEP_MASK;
         else
                 nfc_tgt->supported_protocols = NFC_PROTO_FELICA_MASK;
@@ -979,9 +1149,9 @@ static bool pn533_target_jewel_is_valid(struct pn533_target_jewel *jewel,
         platconf = PN533_TYPE_A_SENS_RES_PLATCONF(jewel->sens_res);
 
         if ((ssd == PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
-                        platconf != PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL) ||
-                        (ssd != PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
-                        platconf == PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL))
+             platconf != PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL) ||
+            (ssd != PN533_TYPE_A_SENS_RES_SSD_JEWEL &&
+             platconf == PN533_TYPE_A_SENS_RES_PLATCONF_JEWEL))
                 return false;
 
         return true;
@@ -992,7 +1162,7 @@ static int pn533_target_found_jewel(struct nfc_target *nfc_tgt, u8 *tgt_data,
 {
         struct pn533_target_jewel *tgt_jewel;
 
-        tgt_jewel = (struct pn533_target_jewel *) tgt_data;
+        tgt_jewel = (struct pn533_target_jewel *)tgt_data;
 
         if (!pn533_target_jewel_is_valid(tgt_jewel, tgt_data_len))
                 return -EPROTO;
@@ -1051,7 +1221,7 @@ static int pn533_target_found_type_b(struct nfc_target *nfc_tgt, u8 *tgt_data,
 {
         struct pn533_target_type_b *tgt_type_b;
 
-        tgt_type_b = (struct pn533_target_type_b *) tgt_data;
+        tgt_type_b = (struct pn533_target_type_b *)tgt_data;
 
         if (!pn533_target_type_b_is_valid(tgt_type_b, tgt_data_len))
                 return -EPROTO;
@@ -1061,50 +1231,37 @@ static int pn533_target_found_type_b(struct nfc_target *nfc_tgt, u8 *tgt_data,
         return 0;
 }
 
-struct pn533_poll_response {
-        u8 nbtg;
-        u8 tg;
-        u8 target_data[];
-} __packed;
-
-static int pn533_target_found(struct pn533 *dev,
-                        struct pn533_poll_response *resp, int resp_len)
+static int pn533_target_found(struct pn533 *dev, u8 tg, u8 *tgdata,
+                              int tgdata_len)
 {
-        int target_data_len;
         struct nfc_target nfc_tgt;
         int rc;
 
         nfc_dev_dbg(&dev->interface->dev, "%s - modulation=%d", __func__,
-                                                        dev->poll_mod_curr);
+                    dev->poll_mod_curr);
 
-        if (resp->tg != 1)
+        if (tg != 1)
                 return -EPROTO;
 
         memset(&nfc_tgt, 0, sizeof(struct nfc_target));
 
-        target_data_len = resp_len - sizeof(struct pn533_poll_response);
-
         switch (dev->poll_mod_curr) {
         case PN533_POLL_MOD_106KBPS_A:
-                rc = pn533_target_found_type_a(&nfc_tgt, resp->target_data,
-                                                        target_data_len);
+                rc = pn533_target_found_type_a(&nfc_tgt, tgdata, tgdata_len);
                 break;
         case PN533_POLL_MOD_212KBPS_FELICA:
         case PN533_POLL_MOD_424KBPS_FELICA:
-                rc = pn533_target_found_felica(&nfc_tgt, resp->target_data,
-                                                        target_data_len);
+                rc = pn533_target_found_felica(&nfc_tgt, tgdata, tgdata_len);
                 break;
         case PN533_POLL_MOD_106KBPS_JEWEL:
-                rc = pn533_target_found_jewel(&nfc_tgt, resp->target_data,
-                                                        target_data_len);
+                rc = pn533_target_found_jewel(&nfc_tgt, tgdata, tgdata_len);
                 break;
         case PN533_POLL_MOD_847KBPS_B:
-                rc = pn533_target_found_type_b(&nfc_tgt, resp->target_data,
-                                                        target_data_len);
+                rc = pn533_target_found_type_b(&nfc_tgt, tgdata, tgdata_len);
                 break;
         default:
-                nfc_dev_err(&dev->interface->dev, "Unknown current poll"
-                                                                " modulation");
+                nfc_dev_err(&dev->interface->dev,
+                            "Unknown current poll modulation");
                 return -EPROTO;
         }
 
@@ -1112,13 +1269,14 @@ static int pn533_target_found(struct pn533 *dev,
                 return rc;
 
         if (!(nfc_tgt.supported_protocols & dev->poll_protocols)) {
-                nfc_dev_dbg(&dev->interface->dev, "The target found does not"
-                                                " have the desired protocol");
+                nfc_dev_dbg(&dev->interface->dev,
+                            "The Tg found doesn't have the desired protocol");
                 return -EAGAIN;
         }
 
-        nfc_dev_dbg(&dev->interface->dev, "Target found - supported protocols: "
-                                        "0x%x", nfc_tgt.supported_protocols);
+        nfc_dev_dbg(&dev->interface->dev,
+                    "Target found - supported protocols: 0x%x",
+                    nfc_tgt.supported_protocols);
 
         dev->tgt_available_prots = nfc_tgt.supported_protocols;
 
@@ -1140,7 +1298,7 @@ static void pn533_poll_reset_mod_list(struct pn533 *dev)
 static void pn533_poll_add_mod(struct pn533 *dev, u8 mod_index)
 {
         dev->poll_mod_active[dev->poll_mod_count] =
-                (struct pn533_poll_modulations *) &poll_mod[mod_index];
+                (struct pn533_poll_modulations *)&poll_mod[mod_index];
         dev->poll_mod_count++;
 }
 
@@ -1149,13 +1307,13 @@ static void pn533_poll_create_mod_list(struct pn533 *dev,
 {
         pn533_poll_reset_mod_list(dev);
 
-        if (im_protocols & NFC_PROTO_MIFARE_MASK
-            || im_protocols & NFC_PROTO_ISO14443_MASK
-            || im_protocols & NFC_PROTO_NFC_DEP_MASK)
+        if ((im_protocols & NFC_PROTO_MIFARE_MASK) ||
+            (im_protocols & NFC_PROTO_ISO14443_MASK) ||
+            (im_protocols & NFC_PROTO_NFC_DEP_MASK))
                 pn533_poll_add_mod(dev, PN533_POLL_MOD_106KBPS_A);
 
-        if (im_protocols & NFC_PROTO_FELICA_MASK
-            || im_protocols & NFC_PROTO_NFC_DEP_MASK) {
+        if (im_protocols & NFC_PROTO_FELICA_MASK ||
+            im_protocols & NFC_PROTO_NFC_DEP_MASK) {
                 pn533_poll_add_mod(dev, PN533_POLL_MOD_212KBPS_FELICA);
                 pn533_poll_add_mod(dev, PN533_POLL_MOD_424KBPS_FELICA);
         }
@@ -1170,16 +1328,20 @@ static void pn533_poll_create_mod_list(struct pn533 *dev,
                 pn533_poll_add_mod(dev, PN533_LISTEN_MOD);
 }
 
-static int pn533_start_poll_complete(struct pn533 *dev, u8 *params, int params_len)
+static int pn533_start_poll_complete(struct pn533 *dev, struct sk_buff *resp)
 {
-        struct pn533_poll_response *resp;
-        int rc;
+        u8 nbtg, tg, *tgdata;
+        int rc, tgdata_len;
 
         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
 
-        resp = (struct pn533_poll_response *) params;
-        if (resp->nbtg) {
-                rc = pn533_target_found(dev, resp, params_len);
+        nbtg = resp->data[0];
+        tg = resp->data[1];
+        tgdata = &resp->data[2];
+        tgdata_len = resp->len - 2;  /* nbtg + tg */
+
+        if (nbtg) {
+                rc = pn533_target_found(dev, tg, tgdata, tgdata_len);
 
                 /* We must stop the poll after a valid target found */
                 if (rc == 0) {
@@ -1191,158 +1353,134 @@ static int pn533_start_poll_complete(struct pn533 *dev, u8 *params, int params_l
         return -EAGAIN;
 }
 
-static int pn533_init_target_frame(struct pn533_frame *frame,
-                                   u8 *gb, size_t gb_len)
+static struct sk_buff *pn533_alloc_poll_tg_frame(struct pn533 *dev)
 {
-        struct pn533_cmd_init_target *cmd;
-        size_t cmd_len;
+        struct sk_buff *skb;
+        u8 *felica, *nfcid3, *gb;
+
+        u8 *gbytes = dev->gb;
+        size_t gbytes_len = dev->gb_len;
+
         u8 felica_params[18] = {0x1, 0xfe, /* DEP */
                                 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, /* random */
                                 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
                                 0xff, 0xff}; /* System code */
+
         u8 mifare_params[6] = {0x1, 0x1, /* SENS_RES */
                                0x0, 0x0, 0x0,
                                0x40}; /* SEL_RES for DEP */
 
-        cmd_len = sizeof(struct pn533_cmd_init_target) + gb_len + 1;
-        cmd = kzalloc(cmd_len, GFP_KERNEL);
-        if (cmd == NULL)
-                return -ENOMEM;
+        unsigned int skb_len = 36 + /* mode (1), mifare (6),
+                                       felica (18), nfcid3 (10), gb_len (1) */
+                               gbytes_len +
+                               1;  /* len Tk*/
 
-        pn533_tx_frame_init(frame, PN533_CMD_TG_INIT_AS_TARGET);
+        skb = pn533_alloc_skb(dev, skb_len);
+        if (!skb)
+                return NULL;
 
         /* DEP support only */
-        cmd->mode |= PN533_INIT_TARGET_DEP;
+        *skb_put(skb, 1) |= PN533_INIT_TARGET_DEP;
+
+        /* MIFARE params */
+        memcpy(skb_put(skb, 6), mifare_params, 6);
 
         /* Felica params */
-        memcpy(cmd->felica, felica_params, 18);
-        get_random_bytes(cmd->felica + 2, 6);
+        felica = skb_put(skb, 18);
+        memcpy(felica, felica_params, 18);
+        get_random_bytes(felica + 2, 6);
 
         /* NFCID3 */
-        memset(cmd->nfcid3, 0, 10);
-        memcpy(cmd->nfcid3, cmd->felica, 8);
-
-        /* MIFARE params */
-        memcpy(cmd->mifare, mifare_params, 6);
+        nfcid3 = skb_put(skb, 10);
+        memset(nfcid3, 0, 10);
+        memcpy(nfcid3, felica, 8);
 
         /* General bytes */
-        cmd->gb_len = gb_len;
-        memcpy(cmd->gb, gb, gb_len);
-
-        /* Len Tk */
-        cmd->gb[gb_len] = 0;
-
-        memcpy(PN533_FRAME_CMD_PARAMS_PTR(frame), cmd, cmd_len);
+        *skb_put(skb, 1) = gbytes_len;
 
-        frame->datalen += cmd_len;
+        gb = skb_put(skb, gbytes_len);
+        memcpy(gb, gbytes, gbytes_len);
 
-        pn533_tx_frame_finish(frame);
-
-        kfree(cmd);
+        /* Len Tk */
+        *skb_put(skb, 1) = 0;
 
-        return 0;
+        return skb;
 }
 
-#define PN533_CMD_DATAEXCH_HEAD_LEN (sizeof(struct pn533_frame) + 3)
+#define PN533_CMD_DATAEXCH_HEAD_LEN 1
 #define PN533_CMD_DATAEXCH_DATA_MAXLEN 262
 static int pn533_tm_get_data_complete(struct pn533 *dev, void *arg,
-                                      u8 *params, int params_len)
+                                      struct sk_buff *resp)
 {
-        struct sk_buff *skb_resp = arg;
-        struct pn533_frame *in_frame = (struct pn533_frame *) skb_resp->data;
+        u8 status;
 
         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
 
-        if (params_len < 0) {
-                nfc_dev_err(&dev->interface->dev,
-                            "Error %d when starting as a target",
-                            params_len);
+        if (IS_ERR(resp))
+                return PTR_ERR(resp);
 
-                return params_len;
-        }
+        status = resp->data[0];
+        skb_pull(resp, sizeof(status));
 
-        if (params_len > 0 && params[0] != 0) {
+        if (status != 0) {
                 nfc_tm_deactivated(dev->nfc_dev);
-
                 dev->tgt_mode = 0;
-
-                kfree_skb(skb_resp);
+                dev_kfree_skb(resp);
                 return 0;
         }
 
-        skb_put(skb_resp, PN533_FRAME_SIZE(in_frame));
-        skb_pull(skb_resp, PN533_CMD_DATAEXCH_HEAD_LEN);
-        skb_trim(skb_resp, skb_resp->len - PN533_FRAME_TAIL_SIZE);
-
-        return nfc_tm_data_received(dev->nfc_dev, skb_resp);
+        return nfc_tm_data_received(dev->nfc_dev, resp);
 }
 
 static void pn533_wq_tg_get_data(struct work_struct *work)
 {
         struct pn533 *dev = container_of(work, struct pn533, tg_work);
-        struct pn533_frame *in_frame;
-        struct sk_buff *skb_resp;
-        size_t skb_resp_len;
 
-        nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
+        struct sk_buff *skb;
+        int rc;
 
-        skb_resp_len = PN533_CMD_DATAEXCH_HEAD_LEN +
-                PN533_CMD_DATAEXCH_DATA_MAXLEN +
-                PN533_FRAME_TAIL_SIZE;
+        nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
 
-        skb_resp = nfc_alloc_recv_skb(skb_resp_len, GFP_KERNEL);
-        if (!skb_resp)
+        skb = pn533_alloc_skb(dev, 0);
+        if (!skb)
                 return;
 
-        in_frame = (struct pn533_frame *)skb_resp->data;
+        rc = pn533_send_data_async(dev, PN533_CMD_TG_GET_DATA, skb,
+                                   pn533_tm_get_data_complete, NULL);
 
-        pn533_tx_frame_init(dev->out_frame, PN533_CMD_TG_GET_DATA);
-        pn533_tx_frame_finish(dev->out_frame);
-
-        pn533_send_cmd_frame_async(dev, dev->out_frame, in_frame,
-                                   skb_resp_len,
-                                   pn533_tm_get_data_complete,
-                                   skb_resp, GFP_KERNEL);
+        if (rc < 0)
+                dev_kfree_skb(skb);
 
         return;
 }
 
 #define ATR_REQ_GB_OFFSET 17
-static int pn533_init_target_complete(struct pn533 *dev, u8 *params, int params_len)
+static int pn533_init_target_complete(struct pn533 *dev, struct sk_buff *resp)
 {
-        struct pn533_cmd_init_target_response *resp;
-        u8 frame, comm_mode = NFC_COMM_PASSIVE, *gb;
+        u8 mode, *cmd, comm_mode = NFC_COMM_PASSIVE, *gb;
         size_t gb_len;
         int rc;
 
         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
 
-        if (params_len < 0) {
-                nfc_dev_err(&dev->interface->dev,
-                            "Error %d when starting as a target",
-                            params_len);
-
-                return params_len;
-        }
-
-        if (params_len < ATR_REQ_GB_OFFSET + 1)
+        if (resp->len < ATR_REQ_GB_OFFSET + 1)
                 return -EINVAL;
 
-        resp = (struct pn533_cmd_init_target_response *) params;
+        mode = resp->data[0];
+        cmd = &resp->data[1];
 
-        nfc_dev_dbg(&dev->interface->dev, "Target mode 0x%x param len %d\n",
-                    resp->mode, params_len);
+        nfc_dev_dbg(&dev->interface->dev, "Target mode 0x%x len %d\n",
+                    mode, resp->len);
 
-        frame = resp->mode & PN533_INIT_TARGET_RESP_FRAME_MASK;
-        if (frame == PN533_INIT_TARGET_RESP_ACTIVE)
+        if ((mode & PN533_INIT_TARGET_RESP_FRAME_MASK) ==
+            PN533_INIT_TARGET_RESP_ACTIVE)
                 comm_mode = NFC_COMM_ACTIVE;
 
-        /* Again, only DEP */
-        if ((resp->mode & PN533_INIT_TARGET_RESP_DEP) == 0)
+        if ((mode & PN533_INIT_TARGET_RESP_DEP) == 0)  /* Only DEP supported */
                 return -EOPNOTSUPP;
 
-        gb = resp->cmd + ATR_REQ_GB_OFFSET;
-        gb_len = params_len - (ATR_REQ_GB_OFFSET + 1);
+        gb = cmd + ATR_REQ_GB_OFFSET;
+        gb_len = resp->len - (ATR_REQ_GB_OFFSET + 1);
 
         rc = nfc_tm_activated(dev->nfc_dev, NFC_PROTO_NFC_DEP_MASK,
                               comm_mode, gb, gb_len);
@@ -1353,7 +1491,6 @@ static int pn533_init_target_complete(struct pn533 *dev, u8 *params, int params_
         }
 
         dev->tgt_mode = 1;
-
         queue_work(dev->wq, &dev->tg_work);
 
         return 0;
@@ -1361,7 +1498,7 @@ static int pn533_init_target_complete(struct pn533 *dev, u8 *params, int params_
 
 static void pn533_listen_mode_timer(unsigned long data)
 {
-        struct pn533 *dev = (struct pn533 *) data;
+        struct pn533 *dev = (struct pn533 *)data;
 
         nfc_dev_dbg(&dev->interface->dev, "Listen mode timeout");
 
@@ -1376,88 +1513,104 @@ static void pn533_listen_mode_timer(unsigned long data)
 }
 
 static int pn533_poll_complete(struct pn533 *dev, void *arg,
-                               u8 *params, int params_len)
+                               struct sk_buff *resp)
 {
         struct pn533_poll_modulations *cur_mod;
         int rc;
 
         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
 
-        if (params_len == -ENOENT) {
-                if (dev->poll_mod_count != 0)
-                        return 0;
-
-                nfc_dev_err(&dev->interface->dev,
-                            "Polling operation has been stopped");
-
-                goto stop_poll;
-        }
+        if (IS_ERR(resp)) {
+                rc = PTR_ERR(resp);
 
-        if (params_len < 0) {
-                nfc_dev_err(&dev->interface->dev,
-                            "Error %d when running poll", params_len);
+                nfc_dev_err(&dev->interface->dev, "%s  Poll complete error %d",
+                            __func__, rc);
 
-                goto stop_poll;
+                if (rc == -ENOENT) {
+                        if (dev->poll_mod_count != 0)
+                                return rc;
+                        else
+                                goto stop_poll;
+                } else if (rc < 0) {
+                        nfc_dev_err(&dev->interface->dev,
+                                    "Error %d when running poll", rc);
+                        goto stop_poll;
+                }
         }
 
         cur_mod = dev->poll_mod_active[dev->poll_mod_curr];
 
-        if (cur_mod->len == 0) {
+        if (cur_mod->len == 0) { /* Target mode */
                 del_timer(&dev->listen_timer);
-
-                return pn533_init_target_complete(dev, params, params_len);
-        } else {
-                rc = pn533_start_poll_complete(dev, params, params_len);
-                if (!rc)
-                        return rc;
+                rc = pn533_init_target_complete(dev, resp);
+                goto done;
         }
 
-        pn533_poll_next_mod(dev);
+        /* Initiator mode */
+        rc = pn533_start_poll_complete(dev, resp);
+        if (!rc)
+                goto done;
 
+        pn533_poll_next_mod(dev);
         queue_work(dev->wq, &dev->poll_work);
 
-        return 0;
+done:
+        dev_kfree_skb(resp);
+        return rc;
 
 stop_poll:
+        nfc_dev_err(&dev->interface->dev, "Polling operation has been stopped");
+
         pn533_poll_reset_mod_list(dev);
         dev->poll_protocols = 0;
-        return 0;
+        return rc;
 }
 
-static void pn533_build_poll_frame(struct pn533 *dev,
-                                   struct pn533_frame *frame,
-                                   struct pn533_poll_modulations *mod)
+static struct sk_buff *pn533_alloc_poll_in_frame(struct pn533 *dev,
+                                        struct pn533_poll_modulations *mod)
 {
-        nfc_dev_dbg(&dev->interface->dev, "mod len %d\n", mod->len);
+        struct sk_buff *skb;
 
-        if (mod->len == 0) {
-                /* Listen mode */
-                pn533_init_target_frame(frame, dev->gb, dev->gb_len);
-        } else {
-                /* Polling mode */
-                pn533_tx_frame_init(frame, PN533_CMD_IN_LIST_PASSIVE_TARGET);
+        skb = pn533_alloc_skb(dev, mod->len);
+        if (!skb)
+                return NULL;
 
-                memcpy(PN533_FRAME_CMD_PARAMS_PTR(frame), &mod->data, mod->len);
-                frame->datalen += mod->len;
+        memcpy(skb_put(skb, mod->len), &mod->data, mod->len);
 
-                pn533_tx_frame_finish(frame);
-        }
+        return skb;
 }
 
 static int pn533_send_poll_frame(struct pn533 *dev)
 {
-        struct pn533_poll_modulations *cur_mod;
+        struct pn533_poll_modulations *mod;
+        struct sk_buff *skb;
         int rc;
+        u8 cmd_code;
 
-        cur_mod = dev->poll_mod_active[dev->poll_mod_curr];
+        mod = dev->poll_mod_active[dev->poll_mod_curr];
 
-        pn533_build_poll_frame(dev, dev->out_frame, cur_mod);
+        nfc_dev_dbg(&dev->interface->dev, "%s mod len %d\n",
+                    __func__, mod->len);
 
-        rc = pn533_send_cmd_frame_async(dev, dev->out_frame, dev->in_frame,
-                                dev->in_maxlen, pn533_poll_complete,
-                                NULL, GFP_KERNEL);
-        if (rc)
+        if (mod->len == 0) {  /* Listen mode */
+                cmd_code = PN533_CMD_TG_INIT_AS_TARGET;
+                skb = pn533_alloc_poll_tg_frame(dev);
+        } else {  /* Polling mode */
+                cmd_code =  PN533_CMD_IN_LIST_PASSIVE_TARGET;
+                skb = pn533_alloc_poll_in_frame(dev, mod);
+        }
+
+        if (!skb) {
+                nfc_dev_err(&dev->interface->dev, "Failed to allocate skb.");
+                return -ENOMEM;
+        }
+
+        rc = pn533_send_cmd_async(dev, cmd_code, skb, pn533_poll_complete,
+                                  NULL);
+        if (rc < 0) {
+                dev_kfree_skb(skb);
                 nfc_dev_err(&dev->interface->dev, "Polling loop error %d", rc);
+        }
 
         return rc;
 }
@@ -1533,8 +1686,8 @@ static void pn533_stop_poll(struct nfc_dev *nfc_dev)
         del_timer(&dev->listen_timer);
 
         if (!dev->poll_mod_count) {
-                nfc_dev_dbg(&dev->interface->dev, "Polling operation was not"
-                                                                " running");
+                nfc_dev_dbg(&dev->interface->dev,
+                            "Polling operation was not running");
                 return;
         }
 
@@ -1549,38 +1702,38 @@ static void pn533_stop_poll(struct nfc_dev *nfc_dev)
 
 static int pn533_activate_target_nfcdep(struct pn533 *dev)
 {
-        struct pn533_cmd_activate_param param;
-        struct pn533_cmd_activate_response *resp;
+        struct pn533_cmd_activate_response *rsp;
         u16 gt_len;
         int rc;
 
-        nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
+        struct sk_buff *skb;
+        struct sk_buff *resp;
 
-        pn533_tx_frame_init(dev->out_frame, PN533_CMD_IN_ATR);
+        nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
 
-        param.tg = 1;
-        param.next = 0;
-        memcpy(PN533_FRAME_CMD_PARAMS_PTR(dev->out_frame), &param,
-                                sizeof(struct pn533_cmd_activate_param));
-        dev->out_frame->datalen += sizeof(struct pn533_cmd_activate_param);
+        skb = pn533_alloc_skb(dev, sizeof(u8) * 2); /*TG + Next*/
+        if (!skb)
+                return -ENOMEM;
 
-        pn533_tx_frame_finish(dev->out_frame);
+        *skb_put(skb, sizeof(u8)) = 1; /* TG */
+        *skb_put(skb, sizeof(u8)) = 0; /* Next */
 
-        rc = pn533_send_cmd_frame_sync(dev, dev->out_frame, dev->in_frame,
-                                                                dev->in_maxlen);
-        if (rc)
-                return rc;
+        resp = pn533_send_cmd_sync(dev, PN533_CMD_IN_ATR, skb);
+        if (IS_ERR(resp))
+                return PTR_ERR(resp);
 
-        resp = (struct pn533_cmd_activate_response *)
-                                PN533_FRAME_CMD_PARAMS_PTR(dev->in_frame);
-        rc = resp->status & PN533_CMD_RET_MASK;
-        if (rc != PN533_CMD_RET_SUCCESS)
+        rsp = (struct pn533_cmd_activate_response *)resp->data;
+        rc = rsp->status & PN533_CMD_RET_MASK;
+        if (rc != PN533_CMD_RET_SUCCESS) {
+                dev_kfree_skb(resp);
                 return -EIO;
+        }
 
         /* ATR_RES general bytes are located at offset 16 */
-        gt_len = PN533_FRAME_CMD_PARAMS_LEN(dev->in_frame) - 16;
-        rc = nfc_set_remote_general_bytes(dev->nfc_dev, resp->gt, gt_len);
+        gt_len = resp->len - 16;
+        rc = nfc_set_remote_general_bytes(dev->nfc_dev, rsp->gt, gt_len);
 
+        dev_kfree_skb(resp);
         return rc;
 }
 
@@ -1591,38 +1744,38 @@ static int pn533_activate_target(struct nfc_dev *nfc_dev,
         int rc;
 
         nfc_dev_dbg(&dev->interface->dev, "%s - protocol=%u", __func__,
-                                                                protocol);
+                    protocol);
 
         if (dev->poll_mod_count) {
-                nfc_dev_err(&dev->interface->dev, "Cannot activate while"
-                                                                " polling");
+                nfc_dev_err(&dev->interface->dev,
+                            "Cannot activate while polling");
                 return -EBUSY;
         }
 
         if (dev->tgt_active_prot) {
-                nfc_dev_err(&dev->interface->dev, "There is already an active"
-                                                                " target");
+                nfc_dev_err(&dev->interface->dev,
+                            "There is already an active target");
                 return -EBUSY;
         }
 
         if (!dev->tgt_available_prots) {
-                nfc_dev_err(&dev->interface->dev, "There is no available target"
-                                                                " to activate");
+                nfc_dev_err(&dev->interface->dev,
+                            "There is no available target to activate");
                 return -EINVAL;
         }
 
         if (!(dev->tgt_available_prots & (1 << protocol))) {
-                nfc_dev_err(&dev->interface->dev, "The target does not support"
-                                        " the requested protocol %u", protocol);
+                nfc_dev_err(&dev->interface->dev,
+                            "Target doesn't support requested proto %u",
+                            protocol);
                 return -EINVAL;
         }
 
         if (protocol == NFC_PROTO_NFC_DEP) {
                 rc = pn533_activate_target_nfcdep(dev);
                 if (rc) {
-                        nfc_dev_err(&dev->interface->dev, "Error %d when"
-                                                " activating target with"
-                                                " NFC_DEP protocol", rc);
+                        nfc_dev_err(&dev->interface->dev,
+                                    "Activating target with DEP failed %d", rc);
                         return rc;
                 }
         }
@@ -1637,8 +1790,10 @@ static void pn533_deactivate_target(struct nfc_dev *nfc_dev,
                                     struct nfc_target *target)
 {
         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
-        u8 tg;
-        u8 status;
+
+        struct sk_buff *skb;
+        struct sk_buff *resp;
+
         int rc;
 
         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
@@ -1649,83 +1804,69 @@ static void pn533_deactivate_target(struct nfc_dev *nfc_dev,
         }
 
         dev->tgt_active_prot = 0;
-
         skb_queue_purge(&dev->resp_q);
 
-        pn533_tx_frame_init(dev->out_frame, PN533_CMD_IN_RELEASE);
-
-        tg = 1;
-        memcpy(PN533_FRAME_CMD_PARAMS_PTR(dev->out_frame), &tg, sizeof(u8));
-        dev->out_frame->datalen += sizeof(u8);
+        skb = pn533_alloc_skb(dev, sizeof(u8));
+        if (!skb)
+                return;
 
-        pn533_tx_frame_finish(dev->out_frame);
+        *skb_put(skb, 1) = 1; /* TG*/
 
-        rc = pn533_send_cmd_frame_sync(dev, dev->out_frame, dev->in_frame,
-                                                                dev->in_maxlen);
-        if (rc) {
-                nfc_dev_err(&dev->interface->dev, "Error when sending release"
-                                                " command to the controller");
+        resp = pn533_send_cmd_sync(dev, PN533_CMD_IN_RELEASE, skb);
+        if (IS_ERR(resp))
                 return;
-        }
 
-        status = PN533_FRAME_CMD_PARAMS_PTR(dev->in_frame)[0];
-        rc = status & PN533_CMD_RET_MASK;
+        rc = resp->data[0] & PN533_CMD_RET_MASK;
         if (rc != PN533_CMD_RET_SUCCESS)
-                nfc_dev_err(&dev->interface->dev, "Error 0x%x when releasing"
-                                                        " the target", rc);
+                nfc_dev_err(&dev->interface->dev,
+                            "Error 0x%x when releasing the target", rc);
 
+        dev_kfree_skb(resp);
         return;
 }
 
 
 static int pn533_in_dep_link_up_complete(struct pn533 *dev, void *arg,
-                                                u8 *params, int params_len)
+                                         struct sk_buff *resp)
 {
-        struct pn533_cmd_jump_dep_response *resp;
-        struct nfc_target nfc_target;
+        struct pn533_cmd_jump_dep_response *rsp;
         u8 target_gt_len;
         int rc;
-        struct pn533_cmd_jump_dep *cmd = (struct pn533_cmd_jump_dep *)arg;
-        u8 active = cmd->active;
+        u8 active = *(u8 *)arg;
 
         kfree(arg);
 
-        if (params_len == -ENOENT) {
-                nfc_dev_dbg(&dev->interface->dev, "");
-                return 0;
-        }
-
-        if (params_len < 0) {
-                nfc_dev_err(&dev->interface->dev,
-                                "Error %d when bringing DEP link up",
-                                                                params_len);
-                return 0;
-        }
+        if (IS_ERR(resp))
+                return PTR_ERR(resp);
 
         if (dev->tgt_available_prots &&
             !(dev->tgt_available_prots & (1 << NFC_PROTO_NFC_DEP))) {
                 nfc_dev_err(&dev->interface->dev,
-                        "The target does not support DEP");
-                return -EINVAL;
+                            "The target does not support DEP");
+                rc =  -EINVAL;
+                goto error;
         }
 
-        resp = (struct pn533_cmd_jump_dep_response *) params;
-        rc = resp->status & PN533_CMD_RET_MASK;
+        rsp = (struct pn533_cmd_jump_dep_response *)resp->data;
+
+        rc = rsp->status & PN533_CMD_RET_MASK;
         if (rc != PN533_CMD_RET_SUCCESS) {
                 nfc_dev_err(&dev->interface->dev,
-                                "Bringing DEP link up failed %d", rc);
-                return 0;
+                            "Bringing DEP link up failed %d", rc);
+                goto error;
         }
 
         if (!dev->tgt_available_prots) {
+                struct nfc_target nfc_target;
+
                 nfc_dev_dbg(&dev->interface->dev, "Creating new target");
 
                 nfc_target.supported_protocols = NFC_PROTO_NFC_DEP_MASK;
                 nfc_target.nfcid1_len = 10;
-                memcpy(nfc_target.nfcid1, resp->nfcid3t, nfc_target.nfcid1_len);
+                memcpy(nfc_target.nfcid1, rsp->nfcid3t, nfc_target.nfcid1_len);
                 rc = nfc_targets_found(dev->nfc_dev, &nfc_target, 1);
                 if (rc)
-                        return 0;
+                        goto error;
 
                 dev->tgt_available_prots = 0;
         }
@@ -1733,15 +1874,17 @@ static int pn533_in_dep_link_up_complete(struct pn533 *dev, void *arg,
         dev->tgt_active_prot = NFC_PROTO_NFC_DEP;
 
         /* ATR_RES general bytes are located at offset 17 */
-        target_gt_len = PN533_FRAME_CMD_PARAMS_LEN(dev->in_frame) - 17;
+        target_gt_len = resp->len - 17;
         rc = nfc_set_remote_general_bytes(dev->nfc_dev,
-                                                resp->gt, target_gt_len);
+                                          rsp->gt, target_gt_len);
         if (rc == 0)
                 rc = nfc_dep_link_is_up(dev->nfc_dev,
-                                                dev->nfc_dev->targets[0].idx,
-                                                !active, NFC_RF_INITIATOR);
+                                        dev->nfc_dev->targets[0].idx,
+                                        !active, NFC_RF_INITIATOR);
 
-        return 0;
+error:
+        dev_kfree_skb(resp);
+        return rc;
 }
 
 static int pn533_mod_to_baud(struct pn533 *dev)
@@ -1760,25 +1903,26 @@ static int pn533_mod_to_baud(struct pn533 *dev)
 
 #define PASSIVE_DATA_LEN 5
 static int pn533_dep_link_up(struct nfc_dev *nfc_dev, struct nfc_target *target,
-                             u8 comm_mode, u8* gb, size_t gb_len)
+                             u8 comm_mode, u8 *gb, size_t gb_len)
 {
         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
-        struct pn533_cmd_jump_dep *cmd;
-        u8 cmd_len, *data_ptr;
+        struct sk_buff *skb;
+        int rc, baud, skb_len;
+        u8 *next, *arg;
+
         u8 passive_data[PASSIVE_DATA_LEN] = {0x00, 0xff, 0xff, 0x00, 0x3};
-        int rc, baud;
 
         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
 
         if (dev->poll_mod_count) {
                 nfc_dev_err(&dev->interface->dev,
-                                "Cannot bring the DEP link up while polling");
+                            "Cannot bring the DEP link up while polling");
                 return -EBUSY;
         }
 
         if (dev->tgt_active_prot) {
                 nfc_dev_err(&dev->interface->dev,
-                                "There is already an active target");
+                            "There is already an active target");
                 return -EBUSY;
         }
 
@@ -1789,43 +1933,48 @@ static int pn533_dep_link_up(struct nfc_dev *nfc_dev, struct nfc_target *target,
                 return baud;
         }
 
-        cmd_len = sizeof(struct pn533_cmd_jump_dep) + gb_len;
+        skb_len = 3 + gb_len; /* ActPass + BR + Next */
         if (comm_mode == NFC_COMM_PASSIVE)
-                cmd_len += PASSIVE_DATA_LEN;
+                skb_len += PASSIVE_DATA_LEN;
 
-        cmd = kzalloc(cmd_len, GFP_KERNEL);
-        if (cmd == NULL)
+        skb = pn533_alloc_skb(dev, skb_len);
+        if (!skb)
                 return -ENOMEM;
 
-        pn533_tx_frame_init(dev->out_frame, PN533_CMD_IN_JUMP_FOR_DEP);
+        *skb_put(skb, 1) = !comm_mode;  /* ActPass */
+        *skb_put(skb, 1) = baud;  /* Baud rate */
 
-        cmd->active = !comm_mode;
-        cmd->next = 0;
-        cmd->baud = baud;
-        data_ptr = cmd->data;
-        if (comm_mode == NFC_COMM_PASSIVE && cmd->baud > 0) {
-                memcpy(data_ptr, passive_data, PASSIVE_DATA_LEN);
-                cmd->next |= 1;
-                data_ptr += PASSIVE_DATA_LEN;
+        next = skb_put(skb, 1);  /* Next */
+        *next = 0;
+
+        if (comm_mode == NFC_COMM_PASSIVE && baud > 0) {
+                memcpy(skb_put(skb, PASSIVE_DATA_LEN), passive_data,
+                       PASSIVE_DATA_LEN);
+                *next |= 1;
         }
 
         if (gb != NULL && gb_len > 0) {
-                cmd->next |= 4; /* We have some Gi */
-                memcpy(data_ptr, gb, gb_len);
+                memcpy(skb_put(skb, gb_len), gb, gb_len);
+                *next |= 4; /* We have some Gi */
         } else {
-                cmd->next = 0;
+                *next = 0;
         }
 
-        memcpy(PN533_FRAME_CMD_PARAMS_PTR(dev->out_frame), cmd, cmd_len);
-        dev->out_frame->datalen += cmd_len;
+        arg = kmalloc(sizeof(*arg), GFP_KERNEL);
+        if (!arg) {
+                dev_kfree_skb(skb);
+                return -ENOMEM;
+        }
 
-        pn533_tx_frame_finish(dev->out_frame);
+        *arg = !comm_mode;
 
-        rc = pn533_send_cmd_frame_async(dev, dev->out_frame, dev->in_frame,
-                                dev->in_maxlen, pn533_in_dep_link_up_complete,
-                                cmd, GFP_KERNEL);
-        if (rc < 0)
-                kfree(cmd);
+        rc = pn533_send_cmd_async(dev, PN533_CMD_IN_JUMP_FOR_DEP, skb,
+                                  pn533_in_dep_link_up_complete, arg);
+
+        if (rc < 0) {
+                dev_kfree_skb(skb);
+                kfree(arg);
+        }
 
         return rc;
 }
@@ -1834,6 +1983,8 @@ static int pn533_dep_link_down(struct nfc_dev *nfc_dev)
 {
         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
 
+        nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
+
         pn533_poll_reset_mod_list(dev);
 
         if (dev->tgt_mode || dev->tgt_active_prot) {
@@ -1849,68 +2000,7 @@ static int pn533_dep_link_down(struct nfc_dev *nfc_dev)
         return 0;
 }
 
-static int pn533_build_tx_frame(struct pn533 *dev, struct sk_buff *skb,
-                                bool target)
-{
-        int payload_len = skb->len;
-        struct pn533_frame *out_frame;
-        u8 tg;
-
-        nfc_dev_dbg(&dev->interface->dev, "%s - Sending %d bytes", __func__,
-                                                                payload_len);
-
-        if (payload_len > PN533_CMD_DATAEXCH_DATA_MAXLEN) {
-                /* TODO: Implement support to multi-part data exchange */
-                nfc_dev_err(&dev->interface->dev, "Data length greater than the"
-                                                " max allowed: %d",
-                                                PN533_CMD_DATAEXCH_DATA_MAXLEN);
-                return -ENOSYS;
-        }
-
-        if (target == true) {
-                switch (dev->device_type) {
-                case PN533_DEVICE_PASORI:
-                        if (dev->tgt_active_prot == NFC_PROTO_FELICA) {
-                                skb_push(skb, PN533_CMD_DATAEXCH_HEAD_LEN - 1);
-                                out_frame = (struct pn533_frame *) skb->data;
-                                pn533_tx_frame_init(out_frame,
-                                                    PN533_CMD_IN_COMM_THRU);
-
-                                break;
-                        }
-
-                default:
-                        skb_push(skb, PN533_CMD_DATAEXCH_HEAD_LEN);
-                        out_frame = (struct pn533_frame *) skb->data;
-                        pn533_tx_frame_init(out_frame,
-                                            PN533_CMD_IN_DATA_EXCHANGE);
-                        tg = 1;
-                        memcpy(PN533_FRAME_CMD_PARAMS_PTR(out_frame),
-                               &tg, sizeof(u8));
-                        out_frame->datalen += sizeof(u8);
-
-                        break;
-                }
-
-        } else {
-                skb_push(skb, PN533_CMD_DATAEXCH_HEAD_LEN - 1);
-                out_frame = (struct pn533_frame *) skb->data;
-                pn533_tx_frame_init(out_frame, PN533_CMD_TG_SET_DATA);
-        }
-
-
-        /* The data is already in the out_frame, just update the datalen */
-        out_frame->datalen += payload_len;
-
-        pn533_tx_frame_finish(out_frame);
-        skb_put(skb, PN533_FRAME_TAIL_SIZE);
-
-        return 0;
-}
-
 struct pn533_data_exchange_arg {
-        struct sk_buff *skb_resp;
-        struct sk_buff *skb_out;
         data_exchange_cb_t cb;
         void *cb_context;
 };
@@ -1920,7 +2010,7 @@ static struct sk_buff *pn533_build_response(struct pn533 *dev)
         struct sk_buff *skb, *tmp, *t;
         unsigned int skb_len = 0, tmp_len = 0;
 
-        nfc_dev_dbg(&dev->interface->dev, "%s\n", __func__);
+        nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
 
         if (skb_queue_empty(&dev->resp_q))
                 return NULL;
@@ -1954,46 +2044,44 @@ out:
 }
 
 static int pn533_data_exchange_complete(struct pn533 *dev, void *_arg,
-                                                u8 *params, int params_len)
+                                        struct sk_buff *resp)
 {
         struct pn533_data_exchange_arg *arg = _arg;
-        struct sk_buff *skb = NULL, *skb_resp = arg->skb_resp;
-        struct pn533_frame *in_frame = (struct pn533_frame *) skb_resp->data;
-        int err = 0;
-        u8 status;
-        u8 cmd_ret;
+        struct sk_buff *skb;
+        int rc = 0;
+        u8 status, ret, mi;
 
         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
 
-        dev_kfree_skb(arg->skb_out);
-
-        if (params_len < 0) { /* error */
-                err = params_len;
-                goto error;
+        if (IS_ERR(resp)) {
+                rc = PTR_ERR(resp);
+                goto _error;
         }
 
-        status = params[0];
+        status = resp->data[0];
+        ret = status & PN533_CMD_RET_MASK;
+        mi = status & PN533_CMD_MI_MASK;
+
+        skb_pull(resp, sizeof(status));
 
-        cmd_ret = status & PN533_CMD_RET_MASK;
-        if (cmd_ret != PN533_CMD_RET_SUCCESS) {
-                nfc_dev_err(&dev->interface->dev, "PN533 reported error %d when"
-                                                " exchanging data", cmd_ret);
-                err = -EIO;
+        if (ret != PN533_CMD_RET_SUCCESS) {
+                nfc_dev_err(&dev->interface->dev,
+                            "PN533 reported error %d when exchanging data",
+                            ret);
+                rc = -EIO;
                 goto error;
         }
 
-        skb_put(skb_resp, PN533_FRAME_SIZE(in_frame));
-        skb_pull(skb_resp, PN533_CMD_DATAEXCH_HEAD_LEN);
-        skb_trim(skb_resp, skb_resp->len - PN533_FRAME_TAIL_SIZE);
-        skb_queue_tail(&dev->resp_q, skb_resp);
+        skb_queue_tail(&dev->resp_q, resp);
 
-        if (status & PN533_CMD_MI_MASK) {
+        if (mi) {
+                dev->cmd_complete_mi_arg = arg;
                 queue_work(dev->wq, &dev->mi_work);
                 return -EINPROGRESS;
         }
 
         skb = pn533_build_response(dev);
-        if (skb == NULL)
+        if (!skb)
                 goto error;
 
         arg->cb(arg->cb_context, skb, 0);
@@ -2001,11 +2089,12 @@ static int pn533_data_exchange_complete(struct pn533 *dev, void *_arg,
         return 0;
 
 error:
+        dev_kfree_skb(resp);
+_error:
         skb_queue_purge(&dev->resp_q);
-        dev_kfree_skb(skb_resp);
-        arg->cb(arg->cb_context, NULL, err);
+        arg->cb(arg->cb_context, NULL, rc);
         kfree(arg);
-        return 0;
+        return rc;
 }
 
 static int pn533_transceive(struct nfc_dev *nfc_dev,
@@ -2013,87 +2102,82 @@ static int pn533_transceive(struct nfc_dev *nfc_dev,
                             data_exchange_cb_t cb, void *cb_context)
 {
         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
-        struct pn533_frame *out_frame, *in_frame;
-        struct pn533_data_exchange_arg *arg;
-        struct sk_buff *skb_resp;
-        int skb_resp_len;
+        struct pn533_data_exchange_arg *arg = NULL;
         int rc;
 
         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
 
-        if (!dev->tgt_active_prot) {
-                nfc_dev_err(&dev->interface->dev, "Cannot exchange data if"
-                                                " there is no active target");
-                rc = -EINVAL;
+        if (skb->len > PN533_CMD_DATAEXCH_DATA_MAXLEN) {
+                /* TODO: Implement support to multi-part data exchange */
+                nfc_dev_err(&dev->interface->dev,
+                            "Data length greater than the max allowed: %d",
+                            PN533_CMD_DATAEXCH_DATA_MAXLEN);
+                rc = -ENOSYS;
                 goto error;
         }
 
-        rc = pn533_build_tx_frame(dev, skb, true);
-        if (rc)
-                goto error;
-
-        skb_resp_len = PN533_CMD_DATAEXCH_HEAD_LEN +
-                        PN533_CMD_DATAEXCH_DATA_MAXLEN +
-                        PN533_FRAME_TAIL_SIZE;
-
-        skb_resp = nfc_alloc_recv_skb(skb_resp_len, GFP_KERNEL);
-        if (!skb_resp) {
-                rc = -ENOMEM;
+        if (!dev->tgt_active_prot) {
+                nfc_dev_err(&dev->interface->dev,
+                            "Can't exchange data if there is no active target");
+                rc = -EINVAL;
                 goto error;
         }
 
-        in_frame = (struct pn533_frame *) skb_resp->data;
-        out_frame = (struct pn533_frame *) skb->data;
-
-        arg = kmalloc(sizeof(struct pn533_data_exchange_arg), GFP_KERNEL);
+        arg = kmalloc(sizeof(*arg), GFP_KERNEL);
         if (!arg) {
                 rc = -ENOMEM;
-                goto free_skb_resp;
+                goto error;
         }
 
-        arg->skb_resp = skb_resp;
-        arg->skb_out = skb;
         arg->cb = cb;
         arg->cb_context = cb_context;
 
-        rc = pn533_send_cmd_frame_async(dev, out_frame, in_frame, skb_resp_len,
-                                        pn533_data_exchange_complete, arg,
-                                        GFP_KERNEL);
-        if (rc) {
-                nfc_dev_err(&dev->interface->dev, "Error %d when trying to"
-                                                " perform data_exchange", rc);
-                goto free_arg;
+        switch (dev->device_type) {
+        case PN533_DEVICE_PASORI:
+                if (dev->tgt_active_prot == NFC_PROTO_FELICA) {
+                        rc = pn533_send_data_async(dev, PN533_CMD_IN_COMM_THRU,
+                                                   skb,
+                                                   pn533_data_exchange_complete,
+                                                   arg);
+
+                        break;
+                }
+        default:
+                *skb_push(skb, sizeof(u8)) =  1; /*TG*/
+
+                rc = pn533_send_data_async(dev, PN533_CMD_IN_DATA_EXCHANGE,
+                                           skb, pn533_data_exchange_complete,
+                                           arg);
+
+                break;
         }
 
+        if (rc < 0) /* rc from send_async */
+                goto error;
+
         return 0;
 
-free_arg:
-        kfree(arg);
-free_skb_resp:
-        kfree_skb(skb_resp);
 error:
-        kfree_skb(skb);
+        kfree(arg);
+        dev_kfree_skb(skb);
         return rc;
 }
 
 static int pn533_tm_send_complete(struct pn533 *dev, void *arg,
-                                  u8 *params, int params_len)
+                                  struct sk_buff *resp)
 {
-        struct sk_buff *skb_out = arg;
+        u8 status;
 
         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
 
-        dev_kfree_skb(skb_out);
+        if (IS_ERR(resp))
+                return PTR_ERR(resp);
 
-        if (params_len < 0) {
-                nfc_dev_err(&dev->interface->dev,
-                            "Error %d when sending data",
-                            params_len);
+        status = resp->data[0];
 
-                return params_len;
-        }
+        dev_kfree_skb(resp);
 
-        if (params_len > 0 && params[0] != 0) {
+        if (status != 0) {
                 nfc_tm_deactivated(dev->nfc_dev);
 
                 dev->tgt_mode = 0;
@@ -2109,30 +2193,21 @@ static int pn533_tm_send_complete(struct pn533 *dev, void *arg,
 static int pn533_tm_send(struct nfc_dev *nfc_dev, struct sk_buff *skb)
 {
         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
-        struct pn533_frame *out_frame;
         int rc;
 
         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
 
-        rc = pn533_build_tx_frame(dev, skb, false);
-        if (rc)
-                goto error;
-
-        out_frame = (struct pn533_frame *) skb->data;
-
-        rc = pn533_send_cmd_frame_async(dev, out_frame, dev->in_frame,
-                                        dev->in_maxlen, pn533_tm_send_complete,
-                                        skb, GFP_KERNEL);
-        if (rc) {
+        if (skb->len > PN533_CMD_DATAEXCH_DATA_MAXLEN) {
                 nfc_dev_err(&dev->interface->dev,
-                            "Error %d when trying to send data", rc);
-                goto error;
+                            "Data length greater than the max allowed: %d",
+                            PN533_CMD_DATAEXCH_DATA_MAXLEN);
+                return -ENOSYS;
         }
 
-        return 0;
-
-error:
-        kfree_skb(skb);
+        rc = pn533_send_data_async(dev, PN533_CMD_TG_SET_DATA, skb,
+                                   pn533_tm_send_complete, NULL);
+        if (rc < 0)
+                dev_kfree_skb(skb);
 
         return rc;
 }
@@ -2140,107 +2215,123 @@ error:
 static void pn533_wq_mi_recv(struct work_struct *work)
 {
         struct pn533 *dev = container_of(work, struct pn533, mi_work);
-        struct sk_buff *skb_cmd;
-        struct pn533_data_exchange_arg *arg = dev->cmd_complete_arg;
-        struct pn533_frame *out_frame, *in_frame;
-        struct sk_buff *skb_resp;
-        int skb_resp_len;
+
+        struct sk_buff *skb;
         int rc;
 
         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
 
-        /* This is a zero payload size skb */
-        skb_cmd = alloc_skb(PN533_CMD_DATAEXCH_HEAD_LEN + PN533_FRAME_TAIL_SIZE,
-                            GFP_KERNEL);
-        if (skb_cmd == NULL)
-                goto error_cmd;
-
-        skb_reserve(skb_cmd, PN533_CMD_DATAEXCH_HEAD_LEN);
+        skb = pn533_alloc_skb(dev, PN533_CMD_DATAEXCH_HEAD_LEN);
+        if (!skb)
+                goto error;
 
-        rc = pn533_build_tx_frame(dev, skb_cmd, true);
-        if (rc)
-                goto error_frame;
+        switch (dev->device_type) {
+        case PN533_DEVICE_PASORI:
+                if (dev->tgt_active_prot == NFC_PROTO_FELICA) {
+                        rc = pn533_send_cmd_direct_async(dev,
+                                                PN533_CMD_IN_COMM_THRU,
+                                                skb,
+                                                pn533_data_exchange_complete,
+                                                 dev->cmd_complete_mi_arg);
 
-        skb_resp_len = PN533_CMD_DATAEXCH_HEAD_LEN +
-                        PN533_CMD_DATAEXCH_DATA_MAXLEN +
-                        PN533_FRAME_TAIL_SIZE;
-        skb_resp = alloc_skb(skb_resp_len, GFP_KERNEL);
-        if (!skb_resp) {
-                rc = -ENOMEM;
-                goto error_frame;
-        }
+                        break;
+                }
+        default:
+                *skb_put(skb, sizeof(u8)) =  1; /*TG*/
 
-        in_frame = (struct pn533_frame *) skb_resp->data;
-        out_frame = (struct pn533_frame *) skb_cmd->data;
+                rc = pn533_send_cmd_direct_async(dev,
+                                                 PN533_CMD_IN_DATA_EXCHANGE,
+                                                 skb,
+                                                 pn533_data_exchange_complete,
+                                                 dev->cmd_complete_mi_arg);
 
-        arg->skb_resp = skb_resp;
-        arg->skb_out = skb_cmd;
+                break;
+        }
 
-        rc = __pn533_send_cmd_frame_async(dev, out_frame, in_frame,
-                                          skb_resp_len,
-                                          pn533_data_exchange_complete,
-                                          dev->cmd_complete_arg, GFP_KERNEL);
-        if (!rc)
+        if (rc == 0) /* success */
                 return;
 
-        nfc_dev_err(&dev->interface->dev, "Error %d when trying to"
-                                                " perform data_exchange", rc);
-
-        kfree_skb(skb_resp);
+        nfc_dev_err(&dev->interface->dev,
+                    "Error %d when trying to perform data_exchange", rc);
 
-error_frame:
-        kfree_skb(skb_cmd);
+        dev_kfree_skb(skb);
+        kfree(dev->cmd_complete_arg);
 
-error_cmd:
+error:
         pn533_send_ack(dev, GFP_KERNEL);
-
-        kfree(arg);
-
         queue_work(dev->wq, &dev->cmd_work);
 }
 
 static int pn533_set_configuration(struct pn533 *dev, u8 cfgitem, u8 *cfgdata,
                                                                 u8 cfgdata_len)
 {
-        int rc;
-        u8 *params;
+        struct sk_buff *skb;
+        struct sk_buff *resp;
+
+        int skb_len;
 
         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
 
-        pn533_tx_frame_init(dev->out_frame, PN533_CMD_RF_CONFIGURATION);
+        skb_len = sizeof(cfgitem) + cfgdata_len; /* cfgitem + cfgdata */
 
-        params = PN533_FRAME_CMD_PARAMS_PTR(dev->out_frame);
-        params[0] = cfgitem;
-        memcpy(&params[1], cfgdata, cfgdata_len);
-        dev->out_frame->datalen += (1 + cfgdata_len);
+        skb = pn533_alloc_skb(dev, skb_len);
+        if (!skb)
+                return -ENOMEM;
 
-        pn533_tx_frame_finish(dev->out_frame);
+        *skb_put(skb, sizeof(cfgitem)) = cfgitem;
+        memcpy(skb_put(skb, cfgdata_len), cfgdata, cfgdata_len);
 
-        rc = pn533_send_cmd_frame_sync(dev, dev->out_frame, dev->in_frame,
-                                                                dev->in_maxlen);
+        resp = pn533_send_cmd_sync(dev, PN533_CMD_RF_CONFIGURATION, skb);
+        if (IS_ERR(resp))
+                return PTR_ERR(resp);
 
-        return rc;
+        dev_kfree_skb(resp);
+        return 0;
+}
+
+static int pn533_get_firmware_version(struct pn533 *dev,
+                                      struct pn533_fw_version *fv)
+{
+        struct sk_buff *skb;
+        struct sk_buff *resp;
+
+        skb = pn533_alloc_skb(dev, 0);
+        if (!skb)
+                return -ENOMEM;
+
+        resp = pn533_send_cmd_sync(dev, PN533_CMD_GET_FIRMWARE_VERSION, skb);
+        if (IS_ERR(resp))
+                return PTR_ERR(resp);
+
+        fv->ic = resp->data[0];
+        fv->ver = resp->data[1];
+        fv->rev = resp->data[2];
+        fv->support = resp->data[3];
+
+        dev_kfree_skb(resp);
+        return 0;
 }
 
 static int pn533_fw_reset(struct pn533 *dev)
 {
-        int rc;
-        u8 *params;
+        struct sk_buff *skb;
+        struct sk_buff *resp;
 
         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
 
-        pn533_tx_frame_init(dev->out_frame, 0x18);
+        skb = pn533_alloc_skb(dev, sizeof(u8));
+        if (!skb)
+                return -ENOMEM;
 
-        params = PN533_FRAME_CMD_PARAMS_PTR(dev->out_frame);
-        params[0] = 0x1;
-        dev->out_frame->datalen += 1;
+        *skb_put(skb, sizeof(u8)) = 0x1;
 
-        pn533_tx_frame_finish(dev->out_frame);
+        resp = pn533_send_cmd_sync(dev, 0x18, skb);
+        if (IS_ERR(resp))
+                return PTR_ERR(resp);
 
-        rc = pn533_send_cmd_frame_sync(dev, dev->out_frame, dev->in_frame,
-                                       dev->in_maxlen);
+        dev_kfree_skb(resp);
 
-        return rc;
+        return 0;
 }
 
 static struct nfc_ops pn533_nfc_ops = {
@@ -2337,7 +2428,7 @@ static int pn533_setup(struct pn533 *dev)
 static int pn533_probe(struct usb_interface *interface,
                         const struct usb_device_id *id)
 {
-        struct pn533_fw_version *fw_ver;
+        struct pn533_fw_version fw_ver;
         struct pn533 *dev;
         struct usb_host_interface *iface_desc;
         struct usb_endpoint_descriptor *endpoint;
@@ -2359,41 +2450,32 @@ static int pn533_probe(struct usb_interface *interface,
         for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
                 endpoint = &iface_desc->endpoint[i].desc;
 
-                if (!in_endpoint && usb_endpoint_is_bulk_in(endpoint)) {
-                        dev->in_maxlen = le16_to_cpu(endpoint->wMaxPacketSize);
+                if (!in_endpoint && usb_endpoint_is_bulk_in(endpoint))
                         in_endpoint = endpoint->bEndpointAddress;
-                }
 
-                if (!out_endpoint && usb_endpoint_is_bulk_out(endpoint)) {
-                        dev->out_maxlen =
-                                le16_to_cpu(endpoint->wMaxPacketSize);
+                if (!out_endpoint && usb_endpoint_is_bulk_out(endpoint))
                         out_endpoint = endpoint->bEndpointAddress;
-                }
         }
 
         if (!in_endpoint || !out_endpoint) {
-                nfc_dev_err(&interface->dev, "Could not find bulk-in or"
-                                                        " bulk-out endpoint");
+                nfc_dev_err(&interface->dev,
+                            "Could not find bulk-in or bulk-out endpoint");
                 rc = -ENODEV;
                 goto error;
         }
 
-        dev->in_frame = kmalloc(PN533_NORMAL_FRAME_MAX_LEN, GFP_KERNEL);
         dev->in_urb = usb_alloc_urb(0, GFP_KERNEL);
-        dev->out_frame = kmalloc(PN533_NORMAL_FRAME_MAX_LEN, GFP_KERNEL);
         dev->out_urb = usb_alloc_urb(0, GFP_KERNEL);
 
-        if (!dev->in_frame || !dev->out_frame ||
-                !dev->in_urb || !dev->out_urb)
+        if (!dev->in_urb || !dev->out_urb)
                 goto error;
 
         usb_fill_bulk_urb(dev->in_urb, dev->udev,
-                        usb_rcvbulkpipe(dev->udev, in_endpoint),
-                        NULL, 0, NULL, dev);
+                          usb_rcvbulkpipe(dev->udev, in_endpoint),
+                          NULL, 0, NULL, dev);
         usb_fill_bulk_urb(dev->out_urb, dev->udev,
-                        usb_sndbulkpipe(dev->udev, out_endpoint),
-                        NULL, 0,
-                        pn533_send_complete, dev);
+                          usb_sndbulkpipe(dev->udev, out_endpoint),
+                          NULL, 0, pn533_send_complete, dev);
 
         INIT_WORK(&dev->cmd_work, pn533_wq_cmd);
         INIT_WORK(&dev->cmd_complete_work, pn533_wq_cmd_complete);
@@ -2414,18 +2496,7 @@ static int pn533_probe(struct usb_interface *interface,
 
         usb_set_intfdata(interface, dev);
 
-        pn533_tx_frame_init(dev->out_frame, PN533_CMD_GET_FIRMWARE_VERSION);
-        pn533_tx_frame_finish(dev->out_frame);
-
-        rc = pn533_send_cmd_frame_sync(dev, dev->out_frame, dev->in_frame,
-                                                                dev->in_maxlen);
-        if (rc)
-                goto destroy_wq;
-
-        fw_ver = (struct pn533_fw_version *)
-                                PN533_FRAME_CMD_PARAMS_PTR(dev->in_frame);
-        nfc_dev_info(&dev->interface->dev, "NXP PN533 firmware ver %d.%d now"
-                                        " attached", fw_ver->ver, fw_ver->rev);
+        dev->ops = &pn533_std_frame_ops;
 
         dev->device_type = id->driver_info;
         switch (dev->device_type) {
@@ -2444,9 +2515,21 @@ static int pn533_probe(struct usb_interface *interface,
                 goto destroy_wq;
         }
 
+        memset(&fw_ver, 0, sizeof(fw_ver));
+        rc = pn533_get_firmware_version(dev, &fw_ver);
+        if (rc < 0)
+                goto destroy_wq;
+
+        nfc_dev_info(&dev->interface->dev,
+                     "NXP PN533 firmware ver %d.%d now attached",
+                     fw_ver.ver, fw_ver.rev);
+
+
         dev->nfc_dev = nfc_allocate_device(&pn533_nfc_ops, protocols,
+                                           NFC_SE_NONE,
+                                           dev->ops->tx_header_len +
                                            PN533_CMD_DATAEXCH_HEAD_LEN,
-                                           PN533_FRAME_TAIL_SIZE);
+                                           dev->ops->tx_tail_len);
         if (!dev->nfc_dev)
                 goto destroy_wq;
 
@@ -2472,9 +2555,7 @@ free_nfc_dev:
 destroy_wq:
         destroy_workqueue(dev->wq);
 error:
-        kfree(dev->in_frame);
         usb_free_urb(dev->in_urb);
-        kfree(dev->out_frame);
         usb_free_urb(dev->out_urb);
         kfree(dev);
         return rc;
@@ -2505,9 +2586,7 @@ static void pn533_disconnect(struct usb_interface *interface)
                 kfree(cmd);
         }
 
-        kfree(dev->in_frame);
         usb_free_urb(dev->in_urb);
-        kfree(dev->out_frame);
         usb_free_urb(dev->out_urb);
         kfree(dev);
 
diff --git a/drivers/nfc/pn544/Kconfig b/drivers/nfc/pn544/Kconfig
new file mode 100644
index 000000000000..c277790ac71c
--- /dev/null
+++ b/drivers/nfc/pn544/Kconfig
@@ -0,0 +1,23 @@
+config NFC_PN544
+        tristate "NXP PN544 NFC driver"
+        depends on NFC_HCI
+        select CRC_CCITT
+        default n
+        ---help---
+          NXP PN544 core driver.
+          This is a driver based on the HCI NFC kernel layers and
+          will thus not work with NXP libnfc library.
+
+          To compile this driver as a module, choose m here. The module will
+          be called pn544.
+          Say N if unsure.
+
+config NFC_PN544_I2C
+        tristate "NFC PN544 i2c support"
+        depends on NFC_PN544 && I2C && NFC_SHDLC
+        ---help---
+          This module adds support for the NXP pn544 i2c interface.
+          Select this if your platform is using the i2c bus.
+
+          If you choose to build a module, it'll be called pn544_i2c.
+          Say N if unsure.
\ No newline at end of file
diff --git a/drivers/nfc/pn544/Makefile b/drivers/nfc/pn544/Makefile
index 725733881eb3..ac076793687d 100644
--- a/drivers/nfc/pn544/Makefile
+++ b/drivers/nfc/pn544/Makefile
@@ -2,6 +2,7 @@
 # Makefile for PN544 HCI based NFC driver
 #
 
-obj-$(CONFIG_PN544_HCI_NFC)     += pn544_i2c.o
+pn544_i2c-objs  = i2c.o
 
-pn544_i2c-y             := pn544.o i2c.o
+obj-$(CONFIG_NFC_PN544)     += pn544.o
+obj-$(CONFIG_NFC_PN544_I2C) += pn544_i2c.o
diff --git a/drivers/nfc/pn544/i2c.c b/drivers/nfc/pn544/i2c.c
index 7da9071b68b6..7f96ca2c46bd 100644
--- a/drivers/nfc/pn544/i2c.c
+++ b/drivers/nfc/pn544/i2c.c
@@ -376,12 +376,12 @@ static int __devinit pn544_hci_i2c_probe(struct i2c_client *client,
                 return -ENODEV;
         }
 
-        phy = kzalloc(sizeof(struct pn544_i2c_phy), GFP_KERNEL);
+        phy = devm_kzalloc(&client->dev, sizeof(struct pn544_i2c_phy),
+                           GFP_KERNEL);
         if (!phy) {
                 dev_err(&client->dev,
                         "Cannot allocate memory for pn544 i2c phy.\n");
-                r = -ENOMEM;
-                goto err_phy_alloc;
+                return -ENOMEM;
         }
 
         phy->i2c_dev = client;
@@ -390,20 +390,18 @@ static int __devinit pn544_hci_i2c_probe(struct i2c_client *client,
         pdata = client->dev.platform_data;
         if (pdata == NULL) {
                 dev_err(&client->dev, "No platform data\n");
-                r = -EINVAL;
-                goto err_pdata;
+                return -EINVAL;
         }
 
         if (pdata->request_resources == NULL) {
                 dev_err(&client->dev, "request_resources() missing\n");
-                r = -EINVAL;
-                goto err_pdata;
+                return -EINVAL;
         }
 
         r = pdata->request_resources(client);
         if (r) {
                 dev_err(&client->dev, "Cannot get platform resources\n");
-                goto err_pdata;
+                return r;
         }
 
         phy->gpio_en = pdata->get_gpio(NFC_GPIO_ENABLE);
@@ -435,10 +433,6 @@ err_rti:
         if (pdata->free_resources != NULL)
                 pdata->free_resources();
 
-err_pdata:
-        kfree(phy);
-
-err_phy_alloc:
         return r;
 }
 
@@ -458,8 +452,6 @@ static __devexit int pn544_hci_i2c_remove(struct i2c_client *client)
         if (pdata->free_resources)
                 pdata->free_resources();
 
-        kfree(phy);
-
         return 0;
 }
 
@@ -472,29 +464,7 @@ static struct i2c_driver pn544_hci_i2c_driver = {
         .remove = __devexit_p(pn544_hci_i2c_remove),
 };
 
-static int __init pn544_hci_i2c_init(void)
-{
-        int r;
-
-        pr_debug(DRIVER_DESC ": %s\n", __func__);
-
-        r = i2c_add_driver(&pn544_hci_i2c_driver);
-        if (r) {
-                pr_err(PN544_HCI_I2C_DRIVER_NAME
-                       ": driver registration failed\n");
-                return r;
-        }
-
-        return 0;
-}
-
-static void __exit pn544_hci_i2c_exit(void)
-{
-        i2c_del_driver(&pn544_hci_i2c_driver);
-}
-
-module_init(pn544_hci_i2c_init);
-module_exit(pn544_hci_i2c_exit);
+module_i2c_driver(pn544_hci_i2c_driver);
 
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION(DRIVER_DESC);
diff --git a/drivers/nfc/pn544/pn544.c b/drivers/nfc/pn544/pn544.c
index cc666de3b8e5..9c5f16e7baef 100644
--- a/drivers/nfc/pn544/pn544.c
+++ b/drivers/nfc/pn544/pn544.c
@@ -20,6 +20,7 @@
 
 #include <linux/delay.h>
 #include <linux/slab.h>
+#include <linux/module.h>
 
 #include <linux/nfc.h>
 #include <net/nfc/hci.h>
@@ -675,11 +676,17 @@ static int pn544_hci_im_transceive(struct nfc_hci_dev *hdev,
 
 static int pn544_hci_tm_send(struct nfc_hci_dev *hdev, struct sk_buff *skb)
 {
+        int r;
+
         /* Set default false for multiple information chaining */
         *skb_push(skb, 1) = 0;
 
-        return nfc_hci_send_event(hdev, PN544_RF_READER_NFCIP1_TARGET_GATE,
-                                PN544_HCI_EVT_SND_DATA, skb->data, skb->len);
+        r = nfc_hci_send_event(hdev, PN544_RF_READER_NFCIP1_TARGET_GATE,
+                               PN544_HCI_EVT_SND_DATA, skb->data, skb->len);
+
+        kfree_skb(skb);
+
+        return r;
 }
 
 static int pn544_hci_check_presence(struct nfc_hci_dev *hdev,
@@ -714,35 +721,40 @@ static int pn544_hci_check_presence(struct nfc_hci_dev *hdev,
         return 0;
 }
 
-static void pn544_hci_event_received(struct nfc_hci_dev *hdev, u8 gate,
-                                        u8 event, struct sk_buff *skb)
+/*
+ * Returns:
+ * <= 0: driver handled the event, skb consumed
+ *    1: driver does not handle the event, please do standard processing
+ */
+static int pn544_hci_event_received(struct nfc_hci_dev *hdev, u8 gate, u8 event,
+                                    struct sk_buff *skb)
 {
         struct sk_buff *rgb_skb = NULL;
-        int r = 0;
+        int r;
 
         pr_debug("hci event %d", event);
         switch (event) {
         case PN544_HCI_EVT_ACTIVATED:
-                if (gate == PN544_RF_READER_NFCIP1_INITIATOR_GATE)
-                        nfc_hci_target_discovered(hdev, gate);
-                else if (gate == PN544_RF_READER_NFCIP1_TARGET_GATE) {
+                if (gate == PN544_RF_READER_NFCIP1_INITIATOR_GATE) {
+                        r = nfc_hci_target_discovered(hdev, gate);
+                } else if (gate == PN544_RF_READER_NFCIP1_TARGET_GATE) {
                         r = nfc_hci_get_param(hdev, gate, PN544_DEP_ATR_REQ,
-                                                &rgb_skb);
-
+                                              &rgb_skb);
                         if (r < 0)
                                 goto exit;
 
-                        nfc_tm_activated(hdev->ndev, NFC_PROTO_NFC_DEP_MASK,
-                                        NFC_COMM_PASSIVE, rgb_skb->data,
-                                        rgb_skb->len);
+                        r = nfc_tm_activated(hdev->ndev, NFC_PROTO_NFC_DEP_MASK,
+                                             NFC_COMM_PASSIVE, rgb_skb->data,
+                                             rgb_skb->len);
 
                         kfree_skb(rgb_skb);
+                } else {
+                        r = -EINVAL;
                 }
-
                 break;
         case PN544_HCI_EVT_DEACTIVATED:
-                nfc_hci_send_event(hdev, gate,
-                        NFC_HCI_EVT_END_OPERATION, NULL, 0);
+                r = nfc_hci_send_event(hdev, gate, NFC_HCI_EVT_END_OPERATION,
+                                       NULL, 0);
                 break;
         case PN544_HCI_EVT_RCV_DATA:
                 if (skb->len < 2) {
@@ -757,15 +769,15 @@ static void pn544_hci_event_received(struct nfc_hci_dev *hdev, u8 gate,
                 }
 
                 skb_pull(skb, 2);
-                nfc_tm_data_received(hdev->ndev, skb);
-
-                return;
+                return nfc_tm_data_received(hdev->ndev, skb);
         default:
-                break;
+                return 1;
         }
 
 exit:
         kfree_skb(skb);
+
+        return r;
 }
 
 static struct nfc_hci_ops pn544_hci_ops = {
@@ -789,7 +801,7 @@ int pn544_hci_probe(void *phy_id, struct nfc_phy_ops *phy_ops, char *llc_name,
                     struct nfc_hci_dev **hdev)
 {
         struct pn544_hci_info *info;
-        u32 protocols;
+        u32 protocols, se;
         struct nfc_hci_init_data init_data;
         int r;
 
@@ -822,8 +834,10 @@ int pn544_hci_probe(void *phy_id, struct nfc_phy_ops *phy_ops, char *llc_name,
                     NFC_PROTO_ISO14443_B_MASK |
                     NFC_PROTO_NFC_DEP_MASK;
 
-        info->hdev = nfc_hci_allocate_device(&pn544_hci_ops, &init_data,
-                                             protocols, llc_name,
+        se = NFC_SE_UICC | NFC_SE_EMBEDDED;
+
+        info->hdev = nfc_hci_allocate_device(&pn544_hci_ops, &init_data, 0,
+                                             protocols, se, llc_name,
                                              phy_headroom + PN544_CMDS_HEADROOM,
                                              phy_tailroom, phy_payload);
         if (!info->hdev) {
@@ -851,6 +865,7 @@ err_alloc_hdev:
 err_info_alloc:
         return r;
 }
+EXPORT_SYMBOL(pn544_hci_probe);
 
 void pn544_hci_remove(struct nfc_hci_dev *hdev)
 {
@@ -860,3 +875,7 @@ void pn544_hci_remove(struct nfc_hci_dev *hdev)
         nfc_hci_free_device(hdev);
         kfree(info);
 }
+EXPORT_SYMBOL(pn544_hci_remove);
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION(DRIVER_DESC);
diff --git a/drivers/ssb/Kconfig b/drivers/ssb/Kconfig
index ff3c8a21f10d..5ff3a4f19443 100644
--- a/drivers/ssb/Kconfig
+++ b/drivers/ssb/Kconfig
@@ -136,6 +136,11 @@ config SSB_DRIVER_MIPS
 
           If unsure, say N
 
+config SSB_SFLASH
+        bool "SSB serial flash support"
+        depends on SSB_DRIVER_MIPS && BROKEN
+        default y
+
 # Assumption: We are on embedded, if we compile the MIPS core.
 config SSB_EMBEDDED
         bool
@@ -162,8 +167,7 @@ config SSB_DRIVER_GIGE
 
 config SSB_DRIVER_GPIO
         bool "SSB GPIO driver"
-        depends on SSB
-        select GPIOLIB
+        depends on SSB && GPIOLIB
         help
           Driver to provide access to the GPIO pins on the bus.
 
diff --git a/drivers/ssb/Makefile b/drivers/ssb/Makefile
index 9159ba77c388..b1ddc116d387 100644
--- a/drivers/ssb/Makefile
+++ b/drivers/ssb/Makefile
@@ -11,6 +11,7 @@ ssb-$(CONFIG_SSB_SDIOHOST)		+= sdio.o
 # built-in drivers
 ssb-y                                   += driver_chipcommon.o
 ssb-y                                   += driver_chipcommon_pmu.o
+ssb-$(CONFIG_SSB_SFLASH)                += driver_chipcommon_sflash.o
 ssb-$(CONFIG_SSB_DRIVER_MIPS)           += driver_mipscore.o
 ssb-$(CONFIG_SSB_DRIVER_EXTIF)          += driver_extif.o
 ssb-$(CONFIG_SSB_DRIVER_PCICORE)        += driver_pcicore.o
diff --git a/drivers/ssb/driver_chipcommon_sflash.c b/drivers/ssb/driver_chipcommon_sflash.c
new file mode 100644
index 000000000000..720665ca2bb1
--- /dev/null
+++ b/drivers/ssb/driver_chipcommon_sflash.c
@@ -0,0 +1,140 @@
+/*
+ * Sonics Silicon Backplane
+ * ChipCommon serial flash interface
+ *
+ * Licensed under the GNU/GPL. See COPYING for details.
+ */
+
+#include <linux/ssb/ssb.h>
+
+#include "ssb_private.h"
+
+struct ssb_sflash_tbl_e {
+        char *name;
+        u32 id;
+        u32 blocksize;
+        u16 numblocks;
+};
+
+static struct ssb_sflash_tbl_e ssb_sflash_st_tbl[] = {
+        { "M25P20", 0x11, 0x10000, 4, },
+        { "M25P40", 0x12, 0x10000, 8, },
+
+        { "M25P16", 0x14, 0x10000, 32, },
+        { "M25P32", 0x15, 0x10000, 64, },
+        { "M25P64", 0x16, 0x10000, 128, },
+        { "M25FL128", 0x17, 0x10000, 256, },
+        { 0 },
+};
+
+static struct ssb_sflash_tbl_e ssb_sflash_sst_tbl[] = {
+        { "SST25WF512", 1, 0x1000, 16, },
+        { "SST25VF512", 0x48, 0x1000, 16, },
+        { "SST25WF010", 2, 0x1000, 32, },
+        { "SST25VF010", 0x49, 0x1000, 32, },
+        { "SST25WF020", 3, 0x1000, 64, },
+        { "SST25VF020", 0x43, 0x1000, 64, },
+        { "SST25WF040", 4, 0x1000, 128, },
+        { "SST25VF040", 0x44, 0x1000, 128, },
+        { "SST25VF040B", 0x8d, 0x1000, 128, },
+        { "SST25WF080", 5, 0x1000, 256, },
+        { "SST25VF080B", 0x8e, 0x1000, 256, },
+        { "SST25VF016", 0x41, 0x1000, 512, },
+        { "SST25VF032", 0x4a, 0x1000, 1024, },
+        { "SST25VF064", 0x4b, 0x1000, 2048, },
+        { 0 },
+};
+
+static struct ssb_sflash_tbl_e ssb_sflash_at_tbl[] = {
+        { "AT45DB011", 0xc, 256, 512, },
+        { "AT45DB021", 0x14, 256, 1024, },
+        { "AT45DB041", 0x1c, 256, 2048, },
+        { "AT45DB081", 0x24, 256, 4096, },
+        { "AT45DB161", 0x2c, 512, 4096, },
+        { "AT45DB321", 0x34, 512, 8192, },
+        { "AT45DB642", 0x3c, 1024, 8192, },
+        { 0 },
+};
+
+static void ssb_sflash_cmd(struct ssb_chipcommon *cc, u32 opcode)
+{
+        int i;
+        chipco_write32(cc, SSB_CHIPCO_FLASHCTL,
+                       SSB_CHIPCO_FLASHCTL_START | opcode);
+        for (i = 0; i < 1000; i++) {
+                if (!(chipco_read32(cc, SSB_CHIPCO_FLASHCTL) &
+                      SSB_CHIPCO_FLASHCTL_BUSY))
+                        return;
+                cpu_relax();
+        }
+        pr_err("SFLASH control command failed (timeout)!\n");
+}
+
+/* Initialize serial flash access */
+int ssb_sflash_init(struct ssb_chipcommon *cc)
+{
+        struct ssb_sflash_tbl_e *e;
+        u32 id, id2;
+
+        switch (cc->capabilities & SSB_CHIPCO_CAP_FLASHT) {
+        case SSB_CHIPCO_FLASHT_STSER:
+                ssb_sflash_cmd(cc, SSB_CHIPCO_FLASHCTL_ST_DP);
+
+                chipco_write32(cc, SSB_CHIPCO_FLASHADDR, 0);
+                ssb_sflash_cmd(cc, SSB_CHIPCO_FLASHCTL_ST_RES);
+                id = chipco_read32(cc, SSB_CHIPCO_FLASHDATA);
+
+                chipco_write32(cc, SSB_CHIPCO_FLASHADDR, 1);
+                ssb_sflash_cmd(cc, SSB_CHIPCO_FLASHCTL_ST_RES);
+                id2 = chipco_read32(cc, SSB_CHIPCO_FLASHDATA);
+
+                switch (id) {
+                case 0xbf:
+                        for (e = ssb_sflash_sst_tbl; e->name; e++) {
+                                if (e->id == id2)
+                                        break;
+                        }
+                        break;
+                case 0x13:
+                        return -ENOTSUPP;
+                default:
+                        for (e = ssb_sflash_st_tbl; e->name; e++) {
+                                if (e->id == id)
+                                        break;
+                        }
+                        break;
+                }
+                if (!e->name) {
+                        pr_err("Unsupported ST serial flash (id: 0x%X, id2: 0x%X)\n",
+                               id, id2);
+                        return -ENOTSUPP;
+                }
+
+                break;
+        case SSB_CHIPCO_FLASHT_ATSER:
+                ssb_sflash_cmd(cc, SSB_CHIPCO_FLASHCTL_AT_STATUS);
+                id = chipco_read32(cc, SSB_CHIPCO_FLASHDATA) & 0x3c;
+
+                for (e = ssb_sflash_at_tbl; e->name; e++) {
+                        if (e->id == id)
+                                break;
+                }
+                if (!e->name) {
+                        pr_err("Unsupported Atmel serial flash (id: 0x%X)\n",
+                               id);
+                        return -ENOTSUPP;
+                }
+
+                break;
+        default:
+                pr_err("Unsupported flash type\n");
+                return -ENOTSUPP;
+        }
+
+        pr_info("Found %s serial flash (blocksize: 0x%X, blocks: %d)\n",
+                e->name, e->blocksize, e->numblocks);
+
+        pr_err("Serial flash support is not implemented yet!\n");
+
+        return -ENOTSUPP;
+}
diff --git a/drivers/ssb/driver_gpio.c b/drivers/ssb/driver_gpio.c
index 97ac0a38e3d0..accabe39b320 100644
--- a/drivers/ssb/driver_gpio.c
+++ b/drivers/ssb/driver_gpio.c
@@ -74,6 +74,16 @@ static void ssb_gpio_chipco_free(struct gpio_chip *chip, unsigned gpio)
         ssb_chipco_gpio_pullup(&bus->chipco, 1 << gpio, 0);
 }
 
+static int ssb_gpio_chipco_to_irq(struct gpio_chip *chip, unsigned gpio)
+{
+        struct ssb_bus *bus = ssb_gpio_get_bus(chip);
+
+        if (bus->bustype == SSB_BUSTYPE_SSB)
+                return ssb_mips_irq(bus->chipco.dev) + 2;
+        else
+                return -EINVAL;
+}
+
 static int ssb_gpio_chipco_init(struct ssb_bus *bus)
 {
         struct gpio_chip *chip = &bus->gpio;
@@ -86,6 +96,7 @@ static int ssb_gpio_chipco_init(struct ssb_bus *bus)
         chip->set               = ssb_gpio_chipco_set_value;
         chip->direction_input   = ssb_gpio_chipco_direction_input;
         chip->direction_output  = ssb_gpio_chipco_direction_output;
+        chip->to_irq            = ssb_gpio_chipco_to_irq;
         chip->ngpio             = 16;
         /* There is just one SoC in one device and its GPIO addresses should be
          * deterministic to address them more easily. The other buses could get
@@ -134,6 +145,16 @@ static int ssb_gpio_extif_direction_output(struct gpio_chip *chip,
         return 0;
 }
 
+static int ssb_gpio_extif_to_irq(struct gpio_chip *chip, unsigned gpio)
+{
+        struct ssb_bus *bus = ssb_gpio_get_bus(chip);
+
+        if (bus->bustype == SSB_BUSTYPE_SSB)
+                return ssb_mips_irq(bus->extif.dev) + 2;
+        else
+                return -EINVAL;
+}
+
 static int ssb_gpio_extif_init(struct ssb_bus *bus)
 {
         struct gpio_chip *chip = &bus->gpio;
@@ -144,6 +165,7 @@ static int ssb_gpio_extif_init(struct ssb_bus *bus)
         chip->set               = ssb_gpio_extif_set_value;
         chip->direction_input   = ssb_gpio_extif_direction_input;
         chip->direction_output  = ssb_gpio_extif_direction_output;
+        chip->to_irq            = ssb_gpio_extif_to_irq;
         chip->ngpio             = 5;
         /* There is just one SoC in one device and its GPIO addresses should be
          * deterministic to address them more easily. The other buses could get
diff --git a/drivers/ssb/driver_mipscore.c b/drivers/ssb/driver_mipscore.c
index 5bd05b136d22..33b37dac40bd 100644
--- a/drivers/ssb/driver_mipscore.c
+++ b/drivers/ssb/driver_mipscore.c
@@ -10,6 +10,7 @@
 
 #include <linux/ssb/ssb.h>
 
+#include <linux/mtd/physmap.h>
 #include <linux/serial.h>
 #include <linux/serial_core.h>
 #include <linux/serial_reg.h>
@@ -17,6 +18,25 @@
 
 #include "ssb_private.h"
 
+static const char *part_probes[] = { "bcm47xxpart", NULL };
+
+static struct physmap_flash_data ssb_pflash_data = {
+        .part_probe_types       = part_probes,
+};
+
+static struct resource ssb_pflash_resource = {
+        .name   = "ssb_pflash",
+        .flags  = IORESOURCE_MEM,
+};
+
+struct platform_device ssb_pflash_dev = {
+        .name           = "physmap-flash",
+        .dev            = {
+                .platform_data  = &ssb_pflash_data,
+        },
+        .resource       = &ssb_pflash_resource,
+        .num_resources  = 1,
+};
 
 static inline u32 mips_read32(struct ssb_mipscore *mcore,
                               u16 offset)
@@ -189,34 +209,43 @@ static void ssb_mips_serial_init(struct ssb_mipscore *mcore)
 static void ssb_mips_flash_detect(struct ssb_mipscore *mcore)
 {
         struct ssb_bus *bus = mcore->dev->bus;
+        struct ssb_pflash *pflash = &mcore->pflash;
 
         /* When there is no chipcommon on the bus there is 4MB flash */
         if (!ssb_chipco_available(&bus->chipco)) {
-                mcore->pflash.present = true;
-                mcore->pflash.buswidth = 2;
-                mcore->pflash.window = SSB_FLASH1;
-                mcore->pflash.window_size = SSB_FLASH1_SZ;
-                return;
+                pflash->present = true;
+                pflash->buswidth = 2;
+                pflash->window = SSB_FLASH1;
+                pflash->window_size = SSB_FLASH1_SZ;
+                goto ssb_pflash;
         }
 
         /* There is ChipCommon, so use it to read info about flash */
         switch (bus->chipco.capabilities & SSB_CHIPCO_CAP_FLASHT) {
         case SSB_CHIPCO_FLASHT_STSER:
         case SSB_CHIPCO_FLASHT_ATSER:
-                pr_err("Serial flash not supported\n");
+                pr_debug("Found serial flash\n");
+                ssb_sflash_init(&bus->chipco);
                 break;
         case SSB_CHIPCO_FLASHT_PARA:
                 pr_debug("Found parallel flash\n");
-                mcore->pflash.present = true;
-                mcore->pflash.window = SSB_FLASH2;
-                mcore->pflash.window_size = SSB_FLASH2_SZ;
+                pflash->present = true;
+                pflash->window = SSB_FLASH2;
+                pflash->window_size = SSB_FLASH2_SZ;
                 if ((ssb_read32(bus->chipco.dev, SSB_CHIPCO_FLASH_CFG)
                                & SSB_CHIPCO_CFG_DS16) == 0)
-                        mcore->pflash.buswidth = 1;
+                        pflash->buswidth = 1;
                 else
-                        mcore->pflash.buswidth = 2;
+                        pflash->buswidth = 2;
                 break;
         }
+
+ssb_pflash:
+        if (pflash->present) {
+                ssb_pflash_data.width = pflash->buswidth;
+                ssb_pflash_resource.start = pflash->window;
+                ssb_pflash_resource.end = pflash->window + pflash->window_size;
+        }
 }
 
 u32 ssb_cpu_clock(struct ssb_mipscore *mcore)
diff --git a/drivers/ssb/main.c b/drivers/ssb/main.c
index c82c5c95fe85..db7705743a8f 100644
--- a/drivers/ssb/main.c
+++ b/drivers/ssb/main.c
@@ -540,6 +540,14 @@ static int ssb_devices_register(struct ssb_bus *bus)
                 dev_idx++;
         }
 
+#ifdef CONFIG_SSB_DRIVER_MIPS
+        if (bus->mipscore.pflash.present) {
+                err = platform_device_register(&ssb_pflash_dev);
+                if (err)
+                        pr_err("Error registering parallel flash\n");
+        }
+#endif
+
         return 0;
 error:
         /* Unwind the already registered devices. */
diff --git a/drivers/ssb/ssb_private.h b/drivers/ssb/ssb_private.h
index 6c10b66c796c..53198dcec90e 100644
--- a/drivers/ssb/ssb_private.h
+++ b/drivers/ssb/ssb_private.h
@@ -217,6 +217,21 @@ extern u32 ssb_chipco_watchdog_timer_set_wdt(struct bcm47xx_wdt *wdt,
                                              u32 ticks);
 extern u32 ssb_chipco_watchdog_timer_set_ms(struct bcm47xx_wdt *wdt, u32 ms);
 
+/* driver_chipcommon_sflash.c */
+#ifdef CONFIG_SSB_SFLASH
+int ssb_sflash_init(struct ssb_chipcommon *cc);
+#else
+static inline int ssb_sflash_init(struct ssb_chipcommon *cc)
+{
+        pr_err("Serial flash not supported\n");
+        return 0;
+}
+#endif /* CONFIG_SSB_SFLASH */
+
+#ifdef CONFIG_SSB_DRIVER_MIPS
+extern struct platform_device ssb_pflash_dev;
+#endif
+
 #ifdef CONFIG_SSB_DRIVER_EXTIF
 extern u32 ssb_extif_watchdog_timer_set_wdt(struct bcm47xx_wdt *wdt, u32 ticks);
 extern u32 ssb_extif_watchdog_timer_set_ms(struct bcm47xx_wdt *wdt, u32 ms);
diff --git a/include/linux/bcma/bcma_driver_mips.h b/include/linux/bcma/bcma_driver_mips.h
index 0baf8a56b794..fb61f3fb4ddb 100644
--- a/include/linux/bcma/bcma_driver_mips.h
+++ b/include/linux/bcma/bcma_driver_mips.h
@@ -28,6 +28,7 @@
 #define BCMA_MIPS_MIPS74K_GPIOEN        0x0048
 #define BCMA_MIPS_MIPS74K_CLKCTLST      0x01E0
 
+#define BCMA_MIPS_OOBSELINA74           0x004
 #define BCMA_MIPS_OOBSELOUTA30          0x100
 
 struct bcma_device;
@@ -36,19 +37,23 @@ struct bcma_drv_mips {
         struct bcma_device *core;
         u8 setup_done:1;
         u8 early_setup_done:1;
-        unsigned int assigned_irqs;
 };
 
 #ifdef CONFIG_BCMA_DRIVER_MIPS
 extern void bcma_core_mips_init(struct bcma_drv_mips *mcore);
 extern void bcma_core_mips_early_init(struct bcma_drv_mips *mcore);
+
+extern unsigned int bcma_core_irq(struct bcma_device *core);
 #else
 static inline void bcma_core_mips_init(struct bcma_drv_mips *mcore) { }
 static inline void bcma_core_mips_early_init(struct bcma_drv_mips *mcore) { }
+
+static inline unsigned int bcma_core_irq(struct bcma_device *core)
+{
+        return 0;
+}
 #endif
 
 extern u32 bcma_cpu_clock(struct bcma_drv_mips *mcore);
 
-extern unsigned int bcma_core_mips_irq(struct bcma_device *dev);
-
 #endif /* LINUX_BCMA_DRIVER_MIPS_H_ */
diff --git a/include/linux/bcma/bcma_driver_pci.h b/include/linux/bcma/bcma_driver_pci.h
index 41da581e1612..31232247a1ee 100644
--- a/include/linux/bcma/bcma_driver_pci.h
+++ b/include/linux/bcma/bcma_driver_pci.h
@@ -179,6 +179,8 @@ struct pci_dev;
 #define BCMA_CORE_PCI_CFG_FUN_MASK              7       /* Function mask */
 #define BCMA_CORE_PCI_CFG_OFF_MASK              0xfff   /* Register mask */
 
+#define BCMA_CORE_PCI_CFG_DEVCTRL               0xd8
+
 /* PCIE Root Capability Register bits (Host mode only) */
 #define BCMA_CORE_PCI_RC_CRS_VISIBILITY         0x0001
 
diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index f0859cc73861..11c8bc87fdcb 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -180,7 +180,7 @@ struct ieee80211_hdr {
         u8 addr3[6];
         __le16 seq_ctrl;
         u8 addr4[6];
-} __attribute__ ((packed));
+} __packed;
 
 struct ieee80211_hdr_3addr {
         __le16 frame_control;
@@ -189,7 +189,7 @@ struct ieee80211_hdr_3addr {
         u8 addr2[6];
         u8 addr3[6];
         __le16 seq_ctrl;
-} __attribute__ ((packed));
+} __packed;
 
 struct ieee80211_qos_hdr {
         __le16 frame_control;
@@ -199,7 +199,7 @@ struct ieee80211_qos_hdr {
         u8 addr3[6];
         __le16 seq_ctrl;
         __le16 qos_ctrl;
-} __attribute__ ((packed));
+} __packed;
 
 /**
  * ieee80211_has_tods - check if IEEE80211_FCTL_TODS is set
@@ -576,7 +576,7 @@ struct ieee80211s_hdr {
         __le32 seqnum;
         u8 eaddr1[6];
         u8 eaddr2[6];
-} __attribute__ ((packed));
+} __packed;
 
 /* Mesh flags */
 #define MESH_FLAGS_AE_A4        0x1
@@ -614,7 +614,7 @@ struct ieee80211_quiet_ie {
         u8 period;
         __le16 duration;
         __le16 offset;
-} __attribute__ ((packed));
+} __packed;
 
 /**
  * struct ieee80211_msrment_ie
@@ -626,7 +626,7 @@ struct ieee80211_msrment_ie {
         u8 mode;
         u8 type;
         u8 request[0];
-} __attribute__ ((packed));
+} __packed;
 
 /**
  * struct ieee80211_channel_sw_ie
@@ -637,7 +637,7 @@ struct ieee80211_channel_sw_ie {
         u8 mode;
         u8 new_ch_num;
         u8 count;
-} __attribute__ ((packed));
+} __packed;
 
 /**
  * struct ieee80211_tim
@@ -650,7 +650,7 @@ struct ieee80211_tim_ie {
         u8 bitmap_ctrl;
         /* variable size: 1 - 251 bytes */
         u8 virtual_map[1];
-} __attribute__ ((packed));
+} __packed;
 
 /**
  * struct ieee80211_meshconf_ie
@@ -665,7 +665,7 @@ struct ieee80211_meshconf_ie {
         u8 meshconf_auth;
         u8 meshconf_form;
         u8 meshconf_cap;
-} __attribute__ ((packed));
+} __packed;
 
 /**
  * enum mesh_config_capab_flags - Mesh Configuration IE capability field flags
@@ -695,12 +695,17 @@ struct ieee80211_rann_ie {
         __le32 rann_seq;
         __le32 rann_interval;
         __le32 rann_metric;
-} __attribute__ ((packed));
+} __packed;
 
 enum ieee80211_rann_flags {
         RANN_FLAG_IS_GATE = 1 << 0,
 };
 
+enum ieee80211_ht_chanwidth_values {
+        IEEE80211_HT_CHANWIDTH_20MHZ = 0,
+        IEEE80211_HT_CHANWIDTH_ANY = 1,
+};
+
 #define WLAN_SA_QUERY_TR_ID_LEN 2
 
 struct ieee80211_mgmt {
@@ -717,33 +722,33 @@ struct ieee80211_mgmt {
                         __le16 status_code;
                         /* possibly followed by Challenge text */
                         u8 variable[0];
-                } __attribute__ ((packed)) auth;
+                } __packed auth;
                 struct {
                         __le16 reason_code;
-                } __attribute__ ((packed)) deauth;
+                } __packed deauth;
                 struct {
                         __le16 capab_info;
                         __le16 listen_interval;
                         /* followed by SSID and Supported rates */
                         u8 variable[0];
-                } __attribute__ ((packed)) assoc_req;
+                } __packed assoc_req;
                 struct {
                         __le16 capab_info;
                         __le16 status_code;
                         __le16 aid;
                         /* followed by Supported rates */
                         u8 variable[0];
-                } __attribute__ ((packed)) assoc_resp, reassoc_resp;
+                } __packed assoc_resp, reassoc_resp;
                 struct {
                         __le16 capab_info;
                         __le16 listen_interval;
                         u8 current_ap[6];
                         /* followed by SSID and Supported rates */
                         u8 variable[0];
-                } __attribute__ ((packed)) reassoc_req;
+                } __packed reassoc_req;
                 struct {
                         __le16 reason_code;
-                } __attribute__ ((packed)) disassoc;
+                } __packed disassoc;
                 struct {
                         __le64 timestamp;
                         __le16 beacon_int;
@@ -751,11 +756,11 @@ struct ieee80211_mgmt {
                         /* followed by some of SSID, Supported rates,
                          * FH Params, DS Params, CF Params, IBSS Params, TIM */
                         u8 variable[0];
-                } __attribute__ ((packed)) beacon;
+                } __packed beacon;
                 struct {
                         /* only variable items: SSID, Supported rates */
                         u8 variable[0];
-                } __attribute__ ((packed)) probe_req;
+                } __packed probe_req;
                 struct {
                         __le64 timestamp;
                         __le16 beacon_int;
@@ -763,7 +768,7 @@ struct ieee80211_mgmt {
                         /* followed by some of SSID, Supported rates,
                          * FH Params, DS Params, CF Params, IBSS Params */
                         u8 variable[0];
-                } __attribute__ ((packed)) probe_resp;
+                } __packed probe_resp;
                 struct {
                         u8 category;
                         union {
@@ -772,55 +777,59 @@ struct ieee80211_mgmt {
                                         u8 dialog_token;
                                         u8 status_code;
                                         u8 variable[0];
-                                } __attribute__ ((packed)) wme_action;
+                                } __packed wme_action;
                                 struct{
                                         u8 action_code;
                                         u8 element_id;
                                         u8 length;
                                         struct ieee80211_channel_sw_ie sw_elem;
-                                } __attribute__((packed)) chan_switch;
+                                } __packed chan_switch;
                                 struct{
                                         u8 action_code;
                                         u8 dialog_token;
                                         u8 element_id;
                                         u8 length;
                                         struct ieee80211_msrment_ie msr_elem;
-                                } __attribute__((packed)) measurement;
+                                } __packed measurement;
                                 struct{
                                         u8 action_code;
                                         u8 dialog_token;
                                         __le16 capab;
                                         __le16 timeout;
                                         __le16 start_seq_num;
-                                } __attribute__((packed)) addba_req;
+                                } __packed addba_req;
                                 struct{
                                         u8 action_code;
                                         u8 dialog_token;
                                         __le16 status;
                                         __le16 capab;
                                         __le16 timeout;
-                                } __attribute__((packed)) addba_resp;
+                                } __packed addba_resp;
                                 struct{
                                         u8 action_code;
                                         __le16 params;
                                         __le16 reason_code;
-                                } __attribute__((packed)) delba;
+                                } __packed delba;
                                 struct {
                                         u8 action_code;
                                         u8 variable[0];
-                                } __attribute__((packed)) self_prot;
+                                } __packed self_prot;
                                 struct{
                                         u8 action_code;
                                         u8 variable[0];
-                                } __attribute__((packed)) mesh_action;
+                                } __packed mesh_action;
                                 struct {
                                         u8 action;
                                         u8 trans_id[WLAN_SA_QUERY_TR_ID_LEN];
-                                } __attribute__ ((packed)) sa_query;
+                                } __packed sa_query;
                                 struct {
                                         u8 action;
                                         u8 smps_control;
-                                } __attribute__ ((packed)) ht_smps;
+                                } __packed ht_smps;
+                                struct {
+                                        u8 action_code;
+                                        u8 chanwidth;
+                                } __packed ht_notify_cw;
                                 struct {
                                         u8 action_code;
                                         u8 dialog_token;
@@ -828,9 +837,9 @@ struct ieee80211_mgmt {
                                         u8 variable[0];
                                 } __packed tdls_discover_resp;
                         } u;
-                } __attribute__ ((packed)) action;
+                } __packed action;
         } u;
-} __attribute__ ((packed));
+} __packed;
 
 /* Supported Rates value encodings in 802.11n-2009 7.3.2.2 */
 #define BSS_MEMBERSHIP_SELECTOR_HT_PHY  127
@@ -846,7 +855,7 @@ struct ieee80211_mmie {
         __le16 key_id;
         u8 sequence_number[6];
         u8 mic[8];
-} __attribute__ ((packed));
+} __packed;
 
 struct ieee80211_vendor_ie {
         u8 element_id;
@@ -861,20 +870,20 @@ struct ieee80211_rts {
         __le16 duration;
         u8 ra[6];
         u8 ta[6];
-} __attribute__ ((packed));
+} __packed;
 
 struct ieee80211_cts {
         __le16 frame_control;
         __le16 duration;
         u8 ra[6];
-} __attribute__ ((packed));
+} __packed;
 
 struct ieee80211_pspoll {
         __le16 frame_control;
         __le16 aid;
         u8 bssid[6];
         u8 ta[6];
-} __attribute__ ((packed));
+} __packed;
 
 /* TDLS */
 
@@ -967,7 +976,7 @@ struct ieee80211_bar {
         __u8 ta[6];
         __le16 control;
         __le16 start_seq_num;
-} __attribute__((packed));
+} __packed;
 
 /* 802.11 BAR control masks */
 #define IEEE80211_BAR_CTRL_ACK_POLICY_NORMAL    0x0000
@@ -992,7 +1001,7 @@ struct ieee80211_mcs_info {
         __le16 rx_highest;
         u8 tx_params;
         u8 reserved[3];
-} __attribute__((packed));
+} __packed;
 
 /* 802.11n HT capability MSC set */
 #define IEEE80211_HT_MCS_RX_HIGHEST_MASK        0x3ff
@@ -1031,7 +1040,7 @@ struct ieee80211_ht_cap {
         __le16 extended_ht_cap_info;
         __le32 tx_BF_cap_info;
         u8 antenna_selection_info;
-} __attribute__ ((packed));
+} __packed;
 
 /* 802.11n HT capabilities masks (for cap_info) */
 #define IEEE80211_HT_CAP_LDPC_CODING            0x0001
@@ -1102,7 +1111,7 @@ struct ieee80211_ht_operation {
         __le16 operation_mode;
         __le16 stbc_param;
         u8 basic_set[16];
-} __attribute__ ((packed));
+} __packed;
 
 /* for ht_param */
 #define IEEE80211_HT_PARAM_CHA_SEC_OFFSET               0x03
@@ -1311,16 +1320,21 @@ struct ieee80211_vht_operation {
 #define WLAN_CAPABILITY_SPECTRUM_MGMT   (1<<8)
 #define WLAN_CAPABILITY_QOS             (1<<9)
 #define WLAN_CAPABILITY_SHORT_SLOT_TIME (1<<10)
+#define WLAN_CAPABILITY_APSD            (1<<11)
+#define WLAN_CAPABILITY_RADIO_MEASURE   (1<<12)
 #define WLAN_CAPABILITY_DSSS_OFDM       (1<<13)
+#define WLAN_CAPABILITY_DEL_BACK        (1<<14)
+#define WLAN_CAPABILITY_IMM_BACK        (1<<15)
 
 /* DMG (60gHz) 802.11ad */
 /* type - bits 0..1 */
+#define WLAN_CAPABILITY_DMG_TYPE_MASK           (3<<0)
 #define WLAN_CAPABILITY_DMG_TYPE_IBSS           (1<<0) /* Tx by: STA */
 #define WLAN_CAPABILITY_DMG_TYPE_PBSS           (2<<0) /* Tx by: PCP */
 #define WLAN_CAPABILITY_DMG_TYPE_AP             (3<<0) /* Tx by: AP */
 
 #define WLAN_CAPABILITY_DMG_CBAP_ONLY           (1<<2)
-#define WLAN_CAPABILITY_DMG_CBAP_SOURCE (1<<3)
+#define WLAN_CAPABILITY_DMG_CBAP_SOURCE         (1<<3)
 #define WLAN_CAPABILITY_DMG_PRIVACY             (1<<4)
 #define WLAN_CAPABILITY_DMG_ECPAC               (1<<5)
 
@@ -1834,14 +1848,14 @@ struct ieee80211_country_ie_triplet {
                         u8 first_channel;
                         u8 num_channels;
                         s8 max_power;
-                } __attribute__ ((packed)) chans;
+                } __packed chans;
                 struct {
                         u8 reg_extension_id;
                         u8 reg_class;
                         u8 coverage_class;
-                } __attribute__ ((packed)) ext;
+                } __packed ext;
         };
-} __attribute__ ((packed));
+} __packed;
 
 enum ieee80211_timeout_interval_type {
         WLAN_TIMEOUT_REASSOC_DEADLINE = 1 /* 802.11r */,
@@ -1884,7 +1898,10 @@ enum ieee80211_sa_query_action {
 /* AKM suite selectors */
 #define WLAN_AKM_SUITE_8021X            0x000FAC01
 #define WLAN_AKM_SUITE_PSK              0x000FAC02
-#define WLAN_AKM_SUITE_SAE                      0x000FAC08
+#define WLAN_AKM_SUITE_8021X_SHA256     0x000FAC05
+#define WLAN_AKM_SUITE_PSK_SHA256       0x000FAC06
+#define WLAN_AKM_SUITE_TDLS             0x000FAC07
+#define WLAN_AKM_SUITE_SAE              0x000FAC08
 #define WLAN_AKM_SUITE_FT_OVER_SAE      0x000FAC09
 
 #define WLAN_MAX_KEY_LEN                32
diff --git a/include/linux/ssb/ssb_driver_mips.h b/include/linux/ssb/ssb_driver_mips.h
index 07a9c7a2e088..afe79d40a99e 100644
--- a/include/linux/ssb/ssb_driver_mips.h
+++ b/include/linux/ssb/ssb_driver_mips.h
@@ -45,6 +45,11 @@ void ssb_mipscore_init(struct ssb_mipscore *mcore)
 {
 }
 
+static inline unsigned int ssb_mips_irq(struct ssb_device *dev)
+{
+        return 0;
+}
+
 #endif /* CONFIG_SSB_DRIVER_MIPS */
 
 #endif /* LINUX_SSB_MIPSCORE_H_ */
diff --git a/include/net/bluetooth/a2mp.h b/include/net/bluetooth/a2mp.h
index 42f21766c538..487b54c1308f 100644
--- a/include/net/bluetooth/a2mp.h
+++ b/include/net/bluetooth/a2mp.h
@@ -23,6 +23,7 @@ enum amp_mgr_state {
         READ_LOC_AMP_INFO,
         READ_LOC_AMP_ASSOC,
         READ_LOC_AMP_ASSOC_FINAL,
+        WRITE_REMOTE_AMP_ASSOC,
 };
 
 struct amp_mgr {
@@ -33,7 +34,7 @@ struct amp_mgr {
         struct kref             kref;
         __u8                    ident;
         __u8                    handle;
-        enum amp_mgr_state      state;
+        unsigned long           state;
         unsigned long           flags;
 
         struct list_head        amp_ctrls;
@@ -144,5 +145,6 @@ void a2mp_discover_amp(struct l2cap_chan *chan);
 void a2mp_send_getinfo_rsp(struct hci_dev *hdev);
 void a2mp_send_getampassoc_rsp(struct hci_dev *hdev, u8 status);
 void a2mp_send_create_phy_link_req(struct hci_dev *hdev, u8 status);
+void a2mp_send_create_phy_link_rsp(struct hci_dev *hdev, u8 status);
 
 #endif /* __A2MP_H */
diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
index 2554b3f5222a..9531beee09b5 100644
--- a/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -166,6 +166,29 @@ typedef struct {
 #define BDADDR_LE_PUBLIC        0x01
 #define BDADDR_LE_RANDOM        0x02
 
+static inline bool bdaddr_type_is_valid(__u8 type)
+{
+        switch (type) {
+        case BDADDR_BREDR:
+        case BDADDR_LE_PUBLIC:
+        case BDADDR_LE_RANDOM:
+                return true;
+        }
+
+        return false;
+}
+
+static inline bool bdaddr_type_is_le(__u8 type)
+{
+        switch (type) {
+        case BDADDR_LE_PUBLIC:
+        case BDADDR_LE_RANDOM:
+                return true;
+        }
+
+        return false;
+}
+
 #define BDADDR_ANY   (&(bdaddr_t) {{0, 0, 0, 0, 0, 0} })
 #define BDADDR_LOCAL (&(bdaddr_t) {{0, 0, 0, 0xff, 0xff, 0xff} })
 
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index 45eee08157bb..7f12c25f1fca 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -943,6 +943,12 @@ struct hci_rp_le_read_buffer_size {
         __u8     le_max_pkt;
 } __packed;
 
+#define HCI_OP_LE_READ_LOCAL_FEATURES   0x2003
+struct hci_rp_le_read_local_features {
+        __u8     status;
+        __u8     features[8];
+} __packed;
+
 #define HCI_OP_LE_READ_ADV_TX_POWER     0x2007
 struct hci_rp_le_read_adv_tx_power {
         __u8    status;
@@ -995,6 +1001,12 @@ struct hci_cp_le_create_conn {
 
 #define HCI_OP_LE_CREATE_CONN_CANCEL    0x200e
 
+#define HCI_OP_LE_READ_WHITE_LIST_SIZE  0x200f
+struct hci_rp_le_read_white_list_size {
+        __u8    status;
+        __u8    size;
+} __packed;
+
 #define HCI_OP_LE_CONN_UPDATE           0x2013
 struct hci_cp_le_conn_update {
         __le16   handle;
@@ -1033,6 +1045,12 @@ struct hci_rp_le_ltk_neg_reply {
         __le16  handle;
 } __packed;
 
+#define HCI_OP_LE_READ_SUPPORTED_STATES 0x201c
+struct hci_rp_le_read_supported_states {
+        __u8    status;
+        __u8    le_states[8];
+} __packed;
+
 /* ---- HCI Events ---- */
 #define HCI_EV_INQUIRY_COMPLETE         0x01
 
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 014a2eaa5389..bcf8ffe2a843 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -152,6 +152,9 @@ struct hci_dev {
         __u8            minor_class;
         __u8            features[8];
         __u8            host_features[8];
+        __u8            le_features[8];
+        __u8            le_white_list_size;
+        __u8            le_states[8];
         __u8            commands[64];
         __u8            hci_ver;
         __u16           hci_rev;
@@ -216,6 +219,7 @@ struct hci_dev {
         unsigned long   le_last_tx;
 
         struct workqueue_struct *workqueue;
+        struct workqueue_struct *req_workqueue;
 
         struct work_struct      power_on;
         struct delayed_work     power_off;
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index 7588ef44ebaf..cdd33021f831 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -496,7 +496,6 @@ struct l2cap_chan {
         __u16           frames_sent;
         __u16           unacked_frames;
         __u8            retry_count;
-        __u16           srej_queue_next;
         __u16           sdu_len;
         struct sk_buff  *sdu;
         struct sk_buff  *sdu_last_frag;
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 8e6a6b73b9c9..36e076e374d2 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -281,9 +281,13 @@ struct ieee80211_supported_band {
 /**
  * struct vif_params - describes virtual interface parameters
  * @use_4addr: use 4-address frames
+ * @macaddr: address to use for this virtual interface. This will only
+ *      be used for non-netdevice interfaces. If this parameter is set
+ *      to zero address the driver may determine the address as needed.
  */
 struct vif_params {
        int use_4addr;
+       u8 macaddr[ETH_ALEN];
 };
 
 /**
@@ -326,7 +330,7 @@ struct cfg80211_chan_def {
  * cfg80211_get_chandef_type - return old channel type from chandef
  * @chandef: the channel definition
  *
- * Returns the old channel type (NOHT, HT20, HT40+/-) from a given
+ * Return: The old channel type (NOHT, HT20, HT40+/-) from a given
  * chandef, which must have a bandwidth allowing this conversion.
  */
 static inline enum nl80211_channel_type
@@ -364,7 +368,7 @@ void cfg80211_chandef_create(struct cfg80211_chan_def *chandef,
  * @chandef1: first channel definition
  * @chandef2: second channel definition
  *
- * Returns %true if the channels defined by the channel definitions are
+ * Return: %true if the channels defined by the channel definitions are
  * identical, %false otherwise.
  */
 static inline bool
@@ -382,7 +386,7 @@ cfg80211_chandef_identical(const struct cfg80211_chan_def *chandef1,
  * @chandef1: first channel definition
  * @chandef2: second channel definition
  *
- * Returns %NULL if the given channel definitions are incompatible,
+ * Return: %NULL if the given channel definitions are incompatible,
  * chandef1 or chandef2 otherwise.
  */
 const struct cfg80211_chan_def *
@@ -392,6 +396,7 @@ cfg80211_chandef_compatible(const struct cfg80211_chan_def *chandef1,
 /**
  * cfg80211_chandef_valid - check if a channel definition is valid
  * @chandef: the channel definition to check
+ * Return: %true if the channel definition is valid. %false otherwise.
  */
 bool cfg80211_chandef_valid(const struct cfg80211_chan_def *chandef);
 
@@ -399,7 +404,8 @@ bool cfg80211_chandef_valid(const struct cfg80211_chan_def *chandef);
  * cfg80211_chandef_usable - check if secondary channels can be used
  * @wiphy: the wiphy to validate against
  * @chandef: the channel definition to check
- * @prohibited_flags: the regulatory chanenl flags that must not be set
+ * @prohibited_flags: the regulatory channel flags that must not be set
+ * Return: %true if secondary channels are usable. %false otherwise.
  */
 bool cfg80211_chandef_usable(struct wiphy *wiphy,
                              const struct cfg80211_chan_def *chandef,
@@ -521,6 +527,26 @@ struct cfg80211_beacon_data {
         size_t probe_resp_len;
 };
 
+struct mac_address {
+        u8 addr[ETH_ALEN];
+};
+
+/**
+ * struct cfg80211_acl_data - Access control list data
+ *
+ * @acl_policy: ACL policy to be applied on the station's
+        entry specified by mac_addr
+ * @n_acl_entries: Number of MAC address entries passed
+ * @mac_addrs: List of MAC addresses of stations to be used for ACL
+ */
+struct cfg80211_acl_data {
+        enum nl80211_acl_policy acl_policy;
+        int n_acl_entries;
+
+        /* Keep it last */
+        struct mac_address mac_addrs[];
+};
+
 /**
  * struct cfg80211_ap_settings - AP configuration
  *
@@ -540,6 +566,8 @@ struct cfg80211_beacon_data {
  * @inactivity_timeout: time in seconds to determine station's inactivity.
  * @p2p_ctwindow: P2P CT Window
  * @p2p_opp_ps: P2P opportunistic PS
+ * @acl: ACL configuration used by the drivers which has support for
+ *      MAC address based access control
  */
 struct cfg80211_ap_settings {
         struct cfg80211_chan_def chandef;
@@ -556,6 +584,7 @@ struct cfg80211_ap_settings {
         int inactivity_timeout;
         u8 p2p_ctwindow;
         bool p2p_opp_ps;
+        const struct cfg80211_acl_data *acl;
 };
 
 /**
@@ -608,6 +637,8 @@ enum station_parameters_apply_mask {
  * @sta_modify_mask: bitmap indicating which parameters changed
  *      (for those that don't have a natural "no change" value),
  *      see &enum station_parameters_apply_mask
+ * @local_pm: local link-specific mesh power save mode (no change when set
+ *      to unknown)
  */
 struct station_parameters {
         u8 *supported_rates;
@@ -623,6 +654,7 @@ struct station_parameters {
         struct ieee80211_vht_cap *vht_capa;
         u8 uapsd_queues;
         u8 max_sp;
+        enum nl80211_mesh_power_mode local_pm;
 };
 
 /**
@@ -653,6 +685,9 @@ struct station_parameters {
  * @STATION_INFO_STA_FLAGS: @sta_flags filled
  * @STATION_INFO_BEACON_LOSS_COUNT: @beacon_loss_count filled
  * @STATION_INFO_T_OFFSET: @t_offset filled
+ * @STATION_INFO_LOCAL_PM: @local_pm filled
+ * @STATION_INFO_PEER_PM: @peer_pm filled
+ * @STATION_INFO_NONPEER_PM: @nonpeer_pm filled
  */
 enum station_info_flags {
         STATION_INFO_INACTIVE_TIME      = 1<<0,
@@ -676,6 +711,9 @@ enum station_info_flags {
         STATION_INFO_STA_FLAGS          = 1<<18,
         STATION_INFO_BEACON_LOSS_COUNT  = 1<<19,
         STATION_INFO_T_OFFSET           = 1<<20,
+        STATION_INFO_LOCAL_PM           = 1<<21,
+        STATION_INFO_PEER_PM            = 1<<22,
+        STATION_INFO_NONPEER_PM         = 1<<23,
 };
 
 /**
@@ -789,6 +827,9 @@ struct sta_bss_parameters {
  * @sta_flags: station flags mask & values
  * @beacon_loss_count: Number of times beacon loss event has triggered.
  * @t_offset: Time offset of the station relative to this host.
+ * @local_pm: local mesh STA power save mode
+ * @peer_pm: peer mesh STA power save mode
+ * @nonpeer_pm: non-peer mesh STA power save mode
  */
 struct station_info {
         u32 filled;
@@ -818,6 +859,9 @@ struct station_info {
 
         u32 beacon_loss_count;
         s64 t_offset;
+        enum nl80211_mesh_power_mode local_pm;
+        enum nl80211_mesh_power_mode peer_pm;
+        enum nl80211_mesh_power_mode nonpeer_pm;
 
         /*
          * Note: Add a new enum station_info_flags value for each new field and
@@ -993,6 +1037,10 @@ struct bss_parameters {
  * @dot11MeshHWMPconfirmationInterval: The minimum interval of time (in TUs)
  *      during which a mesh STA can send only one Action frame containing
  *      a PREQ element for root path confirmation.
+ * @power_mode: The default mesh power save mode which will be the initial
+ *      setting for new peer links.
+ * @dot11MeshAwakeWindowDuration: The duration in TUs the STA will remain awake
+ *      after transmitting its beacon.
  */
 struct mesh_config {
         u16 dot11MeshRetryTimeout;
@@ -1020,6 +1068,8 @@ struct mesh_config {
         u32 dot11MeshHWMPactivePathToRootTimeout;
         u16 dot11MeshHWMProotInterval;
         u16 dot11MeshHWMPconfirmationInterval;
+        enum nl80211_mesh_power_mode power_mode;
+        u16 dot11MeshAwakeWindowDuration;
 };
 
 /**
@@ -1034,6 +1084,8 @@ struct mesh_config {
  * @ie_len: length of vendor information elements
  * @is_authenticated: this mesh requires authentication
  * @is_secure: this mesh uses security
+ * @dtim_period: DTIM period to use
+ * @beacon_interval: beacon interval to use
  * @mcast_rate: multicat rate for Mesh Node [6Mbps is the default for 802.11a]
  *
  * These parameters are fixed when the mesh is created.
@@ -1049,6 +1101,8 @@ struct mesh_setup {
         u8 ie_len;
         bool is_authenticated;
         bool is_secure;
+        u8 dtim_period;
+        u16 beacon_interval;
         int mcast_rate[IEEE80211_NUM_BANDS];
 };
 
@@ -1256,7 +1310,7 @@ struct cfg80211_bss {
 
         u8 bssid[ETH_ALEN];
 
-        u8 priv[0] __attribute__((__aligned__(sizeof(void *))));
+        u8 priv[0] __aligned(sizeof(void *));
 };
 
 /**
@@ -1266,7 +1320,7 @@ struct cfg80211_bss {
  *
  * Note that the return value is an RCU-protected pointer, so
  * rcu_read_lock() must be held when calling this function.
- * Returns %NULL if not found.
+ * Return: %NULL if not found.
  */
 const u8 *ieee80211_bss_get_ie(struct cfg80211_bss *bss, u8 ie);
 
@@ -1434,6 +1488,7 @@ struct cfg80211_ibss_params {
  * @ie: IEs for association request
  * @ie_len: Length of assoc_ie in octets
  * @privacy: indicates whether privacy-enabled APs should be used
+ * @mfp: indicate whether management frame protection is used
  * @crypto: crypto settings
  * @key_len: length of WEP key for shared key authentication
  * @key_idx: index of WEP key for shared key authentication
@@ -1454,6 +1509,7 @@ struct cfg80211_connect_params {
         u8 *ie;
         size_t ie_len;
         bool privacy;
+        enum nl80211_mfp mfp;
         struct cfg80211_crypto_settings crypto;
         const u8 *key;
         u8 key_len, key_idx;
@@ -1763,6 +1819,13 @@ struct cfg80211_gtk_rekey_data {
  *
  * @start_p2p_device: Start the given P2P device.
  * @stop_p2p_device: Stop the given P2P device.
+ *
+ * @set_mac_acl: Sets MAC address control list in AP and P2P GO mode.
+ *      Parameters include ACL policy, an array of MAC address of stations
+ *      and the number of MAC addresses. If there is already a list in driver
+ *      this new list replaces the existing one. Driver has to clear its ACL
+ *      when number of MAC addresses entries is passed as 0. Drivers which
+ *      advertise the support for MAC based ACL have to implement this callback.
  */
 struct cfg80211_ops {
         int     (*suspend)(struct wiphy *wiphy, struct cfg80211_wowlan *wow);
@@ -1983,6 +2046,9 @@ struct cfg80211_ops {
                                     struct wireless_dev *wdev);
         void    (*stop_p2p_device)(struct wiphy *wiphy,
                                    struct wireless_dev *wdev);
+
+        int     (*set_mac_acl)(struct wiphy *wiphy, struct net_device *dev,
+                               const struct cfg80211_acl_data *params);
 };
 
 /*
@@ -2092,6 +2158,7 @@ struct ieee80211_iface_limit {
  * @beacon_int_infra_match: In this combination, the beacon intervals
  *      between infrastructure and AP types must match. This is required
  *      only in special cases.
+ * @radar_detect_widths: bitmap of channel widths supported for radar detection
  *
  * These examples can be expressed as follows:
  *
@@ -2144,10 +2211,7 @@ struct ieee80211_iface_combination {
         u16 max_interfaces;
         u8 n_limits;
         bool beacon_int_infra_match;
-};
-
-struct mac_address {
-        u8 addr[ETH_ALEN];
+        u8 radar_detect_widths;
 };
 
 struct ieee80211_txrx_stypes {
@@ -2290,6 +2354,9 @@ struct wiphy_wowlan_support {
  * @ap_sme_capa: AP SME capabilities, flags from &enum nl80211_ap_sme_features.
  * @ht_capa_mod_mask:  Specify what ht_cap values can be over-ridden.
  *      If null, then none can be over-ridden.
+ *
+ * @max_acl_mac_addrs: Maximum number of MAC addresses that the device
+ *      supports for ACL.
  */
 struct wiphy {
         /* assign these fields before you register the wiphy */
@@ -2311,6 +2378,8 @@ struct wiphy {
         /* Supported interface modes, OR together BIT(NL80211_IFTYPE_...) */
         u16 interface_modes;
 
+        u16 max_acl_mac_addrs;
+
         u32 flags, features;
 
         u32 ap_sme_capa;
@@ -2364,12 +2433,12 @@ struct wiphy {
         struct ieee80211_supported_band *bands[IEEE80211_NUM_BANDS];
 
         /* Lets us get back the wiphy on the callback */
-        int (*reg_notifier)(struct wiphy *wiphy,
-                            struct regulatory_request *request);
+        void (*reg_notifier)(struct wiphy *wiphy,
+                             struct regulatory_request *request);
 
         /* fields below are read-only, assigned by cfg80211 */
 
-        const struct ieee80211_regdomain *regd;
+        const struct ieee80211_regdomain __rcu *regd;
 
         /* the item in /sys/class/ieee80211/ points to this,
          * you need use set_wiphy_dev() (see below) */
@@ -2392,7 +2461,7 @@ struct wiphy {
         const struct iw_handler_def *wext;
 #endif
 
-        char priv[0] __attribute__((__aligned__(NETDEV_ALIGN)));
+        char priv[0] __aligned(NETDEV_ALIGN);
 };
 
 static inline struct net *wiphy_net(struct wiphy *wiphy)
@@ -2409,6 +2478,7 @@ static inline void wiphy_net_set(struct wiphy *wiphy, struct net *net)
  * wiphy_priv - return priv from wiphy
  *
  * @wiphy: the wiphy whose priv pointer to return
+ * Return: The priv of @wiphy.
  */
 static inline void *wiphy_priv(struct wiphy *wiphy)
 {
@@ -2420,6 +2490,7 @@ static inline void *wiphy_priv(struct wiphy *wiphy)
  * priv_to_wiphy - return the wiphy containing the priv
  *
  * @priv: a pointer previously returned by wiphy_priv
+ * Return: The wiphy of @priv.
  */
 static inline struct wiphy *priv_to_wiphy(void *priv)
 {
@@ -2442,6 +2513,7 @@ static inline void set_wiphy_dev(struct wiphy *wiphy, struct device *dev)
  * wiphy_dev - get wiphy dev pointer
  *
  * @wiphy: The wiphy whose device struct to look up
+ * Return: The dev of @wiphy.
  */
 static inline struct device *wiphy_dev(struct wiphy *wiphy)
 {
@@ -2452,6 +2524,7 @@ static inline struct device *wiphy_dev(struct wiphy *wiphy)
  * wiphy_name - get wiphy name
  *
  * @wiphy: The wiphy whose name to return
+ * Return: The name of @wiphy.
  */
 static inline const char *wiphy_name(const struct wiphy *wiphy)
 {
@@ -2467,8 +2540,8 @@ static inline const char *wiphy_name(const struct wiphy *wiphy)
  * Create a new wiphy and associate the given operations with it.
  * @sizeof_priv bytes are allocated for private use.
  *
- * The returned pointer must be assigned to each netdev's
- * ieee80211_ptr for proper operation.
+ * Return: A pointer to the new wiphy. This pointer must be
+ * assigned to each netdev's ieee80211_ptr for proper operation.
  */
 struct wiphy *wiphy_new(const struct cfg80211_ops *ops, int sizeof_priv);
 
@@ -2477,7 +2550,7 @@ struct wiphy *wiphy_new(const struct cfg80211_ops *ops, int sizeof_priv);
  *
  * @wiphy: The wiphy to register.
  *
- * Returns a non-negative wiphy index or a negative error code.
+ * Return: A non-negative wiphy index or a negative error code.
  */
 extern int wiphy_register(struct wiphy *wiphy);
 
@@ -2626,6 +2699,7 @@ static inline u8 *wdev_address(struct wireless_dev *wdev)
  * wdev_priv - return wiphy priv from wireless_dev
  *
  * @wdev: The wireless device whose wiphy's priv pointer to return
+ * Return: The wiphy priv of @wdev.
  */
 static inline void *wdev_priv(struct wireless_dev *wdev)
 {
@@ -2643,12 +2717,14 @@ static inline void *wdev_priv(struct wireless_dev *wdev)
  * ieee80211_channel_to_frequency - convert channel number to frequency
  * @chan: channel number
  * @band: band, necessary due to channel number overlap
+ * Return: The corresponding frequency (in MHz), or 0 if the conversion failed.
  */
 extern int ieee80211_channel_to_frequency(int chan, enum ieee80211_band band);
 
 /**
  * ieee80211_frequency_to_channel - convert frequency to channel number
  * @freq: center frequency
+ * Return: The corresponding channel, or 0 if the conversion failed.
  */
 extern int ieee80211_frequency_to_channel(int freq);
 
@@ -2665,6 +2741,7 @@ extern struct ieee80211_channel *__ieee80211_get_channel(struct wiphy *wiphy,
  * ieee80211_get_channel - get channel struct from wiphy for specified frequency
  * @wiphy: the struct wiphy to get the channel for
  * @freq: the center frequency of the channel
+ * Return: The channel struct from @wiphy at @freq.
  */
 static inline struct ieee80211_channel *
 ieee80211_get_channel(struct wiphy *wiphy, int freq)
@@ -2679,10 +2756,10 @@ ieee80211_get_channel(struct wiphy *wiphy, int freq)
  * @basic_rates: bitmap of basic rates
  * @bitrate: the bitrate for which to find the basic rate
  *
- * This function returns the basic rate corresponding to a given
- * bitrate, that is the next lower bitrate contained in the basic
- * rate map, which is, for this function, given as a bitmap of
- * indices of rates in the band's bitrate table.
+ * Return: The basic rate corresponding to a given bitrate, that
+ * is the next lower bitrate contained in the basic rate map,
+ * which is, for this function, given as a bitmap of indices of
+ * rates in the band's bitrate table.
  */
 struct ieee80211_rate *
 ieee80211_get_response_rate(struct ieee80211_supported_band *sband,
@@ -2775,18 +2852,21 @@ extern const unsigned char bridge_tunnel_header[6];
 /**
  * ieee80211_get_hdrlen_from_skb - get header length from data
  *
+ * @skb: the frame
+ *
  * Given an skb with a raw 802.11 header at the data pointer this function
- * returns the 802.11 header length in bytes (not including encryption
- * headers). If the data in the sk_buff is too short to contain a valid 802.11
- * header the function returns 0.
+ * returns the 802.11 header length.
  *
- * @skb: the frame
+ * Return: The 802.11 header length in bytes (not including encryption
+ * headers). Or 0 if the data in the sk_buff is too short to contain a valid
+ * 802.11 header.
  */
 unsigned int ieee80211_get_hdrlen_from_skb(const struct sk_buff *skb);
 
 /**
  * ieee80211_hdrlen - get header length in bytes from frame control
  * @fc: frame control field in little-endian format
+ * Return: The header length in bytes.
  */
 unsigned int __attribute_const__ ieee80211_hdrlen(__le16 fc);
 
@@ -2794,7 +2874,7 @@ unsigned int __attribute_const__ ieee80211_hdrlen(__le16 fc);
  * ieee80211_get_mesh_hdrlen - get mesh extension header length
  * @meshhdr: the mesh extension header, only the flags field
  *      (first byte) will be accessed
- * Returns the length of the extension header, which is always at
+ * Return: The length of the extension header, which is always at
  * least 6 bytes and at most 18 if address 5 and 6 are present.
  */
 unsigned int ieee80211_get_mesh_hdrlen(struct ieee80211s_hdr *meshhdr);
@@ -2812,6 +2892,7 @@ unsigned int ieee80211_get_mesh_hdrlen(struct ieee80211s_hdr *meshhdr);
  * @skb: the 802.11 data frame
  * @addr: the device MAC address
  * @iftype: the virtual interface type
+ * Return: 0 on success. Non-zero on error.
  */
 int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
                            enum nl80211_iftype iftype);
@@ -2823,6 +2904,7 @@ int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
  * @iftype: the virtual interface type
  * @bssid: the network bssid (used only for iftype STATION and ADHOC)
  * @qos: build 802.11 QoS data frame
+ * Return: 0 on success, or a negative error code.
  */
 int ieee80211_data_from_8023(struct sk_buff *skb, const u8 *addr,
                              enum nl80211_iftype iftype, u8 *bssid, bool qos);
@@ -2850,6 +2932,7 @@ void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list,
 /**
  * cfg80211_classify8021d - determine the 802.1p/1d tag for a data frame
  * @skb: the data frame
+ * Return: The 802.1p/1d tag.
  */
 unsigned int cfg80211_classify8021d(struct sk_buff *skb);
 
@@ -2860,12 +2943,13 @@ unsigned int cfg80211_classify8021d(struct sk_buff *skb);
  * @ies: data consisting of IEs
  * @len: length of data
  *
- * This function will return %NULL if the element ID could
- * not be found or if the element is invalid (claims to be
- * longer than the given data), or a pointer to the first byte
- * of the requested element, that is the byte containing the
- * element ID. There are no checks on the element length
- * other than having to fit into the given data.
+ * Return: %NULL if the element ID could not be found or if
+ * the element is invalid (claims to be longer than the given
+ * data), or a pointer to the first byte of the requested
+ * element, that is the byte containing the element ID.
+ *
+ * Note: There are no checks on the element length other than
+ * having to fit into the given data.
  */
 const u8 *cfg80211_find_ie(u8 eid, const u8 *ies, int len);
 
@@ -2877,12 +2961,13 @@ const u8 *cfg80211_find_ie(u8 eid, const u8 *ies, int len);
  * @ies: data consisting of IEs
  * @len: length of data
  *
- * This function will return %NULL if the vendor specific element ID
- * could not be found or if the element is invalid (claims to be
- * longer than the given data), or a pointer to the first byte
- * of the requested element, that is the byte containing the
- * element ID. There are no checks on the element length
- * other than having to fit into the given data.
+ * Return: %NULL if the vendor specific element ID could not be found or if the
+ * element is invalid (claims to be longer than the given data), or a pointer to
+ * the first byte of the requested element, that is the byte containing the
+ * element ID.
+ *
+ * Note: There are no checks on the element length other than having to fit into
+ * the given data.
  */
 const u8 *cfg80211_find_vendor_ie(unsigned int oui, u8 oui_type,
                                   const u8 *ies, int len);
@@ -2915,6 +3000,8 @@ const u8 *cfg80211_find_vendor_ie(unsigned int oui, u8 oui_type,
  *
  * Drivers should check the return value, its possible you can get
  * an -ENOMEM.
+ *
+ * Return: 0 on success. -ENOMEM.
  */
 extern int regulatory_hint(struct wiphy *wiphy, const char *alpha2);
 
@@ -2938,28 +3025,22 @@ extern void wiphy_apply_custom_regulatory(
  * freq_reg_info - get regulatory information for the given frequency
  * @wiphy: the wiphy for which we want to process this rule for
  * @center_freq: Frequency in KHz for which we want regulatory information for
- * @desired_bw_khz: the desired max bandwidth you want to use per
- *      channel. Note that this is still 20 MHz if you want to use HT40
- *      as HT40 makes use of two channels for its 40 MHz width bandwidth.
- *      If set to 0 we'll assume you want the standard 20 MHz.
- * @reg_rule: the regulatory rule which we have for this frequency
  *
  * Use this function to get the regulatory rule for a specific frequency on
  * a given wireless device. If the device has a specific regulatory domain
  * it wants to follow we respect that unless a country IE has been received
  * and processed already.
  *
- * Returns 0 if it was able to find a valid regulatory rule which does
- * apply to the given center_freq otherwise it returns non-zero. It will
- * also return -ERANGE if we determine the given center_freq does not even have
- * a regulatory rule for a frequency range in the center_freq's band. See
- * freq_in_rule_band() for our current definition of a band -- this is purely
- * subjective and right now its 802.11 specific.
+ * Return: A valid pointer, or, when an error occurs, for example if no rule
+ * can be found, the return value is encoded using ERR_PTR(). Use IS_ERR() to
+ * check and PTR_ERR() to obtain the numeric return value. The numeric return
+ * value will be -ERANGE if we determine the given center_freq does not even
+ * have a regulatory rule for a frequency range in the center_freq's band.
+ * See freq_in_rule_band() for our current definition of a band -- this is
+ * purely subjective and right now it's 802.11 specific.
  */
-extern int freq_reg_info(struct wiphy *wiphy,
-                         u32 center_freq,
-                         u32 desired_bw_khz,
-                         const struct ieee80211_reg_rule **reg_rule);
+const struct ieee80211_reg_rule *freq_reg_info(struct wiphy *wiphy,
+                                               u32 center_freq);
 
 /*
  * callbacks for asynchronous cfg80211 methods, notification
@@ -3006,7 +3087,8 @@ void cfg80211_sched_scan_stopped(struct wiphy *wiphy);
  * This informs cfg80211 that BSS information was found and
  * the BSS should be updated/added.
  *
- * NOTE: Returns a referenced struct, must be released with cfg80211_put_bss()!
+ * Return: A referenced struct, must be released with cfg80211_put_bss()!
+ * Or %NULL on error.
  */
 struct cfg80211_bss * __must_check
 cfg80211_inform_bss_frame(struct wiphy *wiphy,
@@ -3031,7 +3113,8 @@ cfg80211_inform_bss_frame(struct wiphy *wiphy,
  * This informs cfg80211 that BSS information was found and
  * the BSS should be updated/added.
  *
- * NOTE: Returns a referenced struct, must be released with cfg80211_put_bss()!
+ * Return: A referenced struct, must be released with cfg80211_put_bss()!
+ * Or %NULL on error.
  */
 struct cfg80211_bss * __must_check
 cfg80211_inform_bss(struct wiphy *wiphy,
@@ -3308,16 +3391,18 @@ void wiphy_rfkill_stop_polling(struct wiphy *wiphy);
  * the testmode command. Since it is intended for a reply, calling
  * it outside of the @testmode_cmd operation is invalid.
  *
- * The returned skb (or %NULL if any errors happen) is pre-filled
- * with the wiphy index and set up in a way that any data that is
- * put into the skb (with skb_put(), nla_put() or similar) will end
- * up being within the %NL80211_ATTR_TESTDATA attribute, so all that
- * needs to be done with the skb is adding data for the corresponding
- * userspace tool which can then read that data out of the testdata
- * attribute. You must not modify the skb in any other way.
+ * The returned skb is pre-filled with the wiphy index and set up in
+ * a way that any data that is put into the skb (with skb_put(),
+ * nla_put() or similar) will end up being within the
+ * %NL80211_ATTR_TESTDATA attribute, so all that needs to be done
+ * with the skb is adding data for the corresponding userspace tool
+ * which can then read that data out of the testdata attribute. You
+ * must not modify the skb in any other way.
  *
  * When done, call cfg80211_testmode_reply() with the skb and return
  * its error code as the result of the @testmode_cmd operation.
+ *
+ * Return: An allocated and pre-filled skb. %NULL if any errors happen.
  */
 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
                                                   int approxlen);
@@ -3327,11 +3412,12 @@ struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
  * @skb: The skb, must have been allocated with
  *      cfg80211_testmode_alloc_reply_skb()
  *
- * Returns an error code or 0 on success, since calling this
- * function will usually be the last thing before returning
- * from the @testmode_cmd you should return the error code.
- * Note that this function consumes the skb regardless of the
- * return value.
+ * Since calling this function will usually be the last thing
+ * before returning from the @testmode_cmd you should return
+ * the error code.  Note that this function consumes the skb
+ * regardless of the return value.
+ *
+ * Return: An error code or 0 on success.
  */
 int cfg80211_testmode_reply(struct sk_buff *skb);
 
@@ -3345,14 +3431,16 @@ int cfg80211_testmode_reply(struct sk_buff *skb);
  * This function allocates and pre-fills an skb for an event on the
  * testmode multicast group.
  *
- * The returned skb (or %NULL if any errors happen) is set up in the
- * same way as with cfg80211_testmode_alloc_reply_skb() but prepared
- * for an event. As there, you should simply add data to it that will
- * then end up in the %NL80211_ATTR_TESTDATA attribute. Again, you must
- * not modify the skb in any other way.
+ * The returned skb is set up in the same way as with
+ * cfg80211_testmode_alloc_reply_skb() but prepared for an event. As
+ * there, you should simply add data to it that will then end up in the
+ * %NL80211_ATTR_TESTDATA attribute. Again, you must not modify the skb
+ * in any other way.
  *
  * When done filling the skb, call cfg80211_testmode_event() with the
  * skb to send the event.
+ *
+ * Return: An allocated and pre-filled skb. %NULL if any errors happen.
  */
 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
                                                   int approxlen, gfp_t gfp);
@@ -3533,13 +3621,13 @@ void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
  * @len: length of the frame data
  * @gfp: context flags
  *
- * Returns %true if a user space application has registered for this frame.
+ * This function is called whenever an Action frame is received for a station
+ * mode interface, but is not processed in kernel.
+ *
+ * Return: %true if a user space application has registered for this frame.
  * For action frames, that makes it responsible for rejecting unrecognized
  * action frames; %false otherwise, in which case for action frames the
  * driver is responsible for rejecting the frame.
- *
- * This function is called whenever an Action frame is received for a station
- * mode interface, but is not processed in kernel.
  */
 bool cfg80211_rx_mgmt(struct wireless_dev *wdev, int freq, int sig_dbm,
                       const u8 *buf, size_t len, gfp_t gfp);
@@ -3631,7 +3719,7 @@ void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
  * This function is used in AP mode (only!) to inform userspace that
  * a spurious class 3 frame was received, to be able to deauth the
  * sender.
- * Returns %true if the frame was passed to userspace (or this failed
+ * Return: %true if the frame was passed to userspace (or this failed
  * for a reason other than not having a subscription.)
  */
 bool cfg80211_rx_spurious_frame(struct net_device *dev,
@@ -3647,7 +3735,7 @@ bool cfg80211_rx_spurious_frame(struct net_device *dev,
  * an associated station sent a 4addr frame but that wasn't expected.
  * It is allowed and desirable to send this event only once for each
  * station to avoid event flooding.
- * Returns %true if the frame was passed to userspace (or this failed
+ * Return: %true if the frame was passed to userspace (or this failed
  * for a reason other than not having a subscription.)
  */
 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
@@ -3685,8 +3773,8 @@ void cfg80211_report_obss_beacon(struct wiphy *wiphy,
  * @wiphy: the wiphy
  * @chandef: the channel definition
  *
- * This function returns true if there is no secondary channel or the secondary
- * channel(s) can be used for beaconing (i.e. is not a radar channel etc.)
+ * Return: %true if there is no secondary channel or the secondary channel(s)
+ * can be used for beaconing (i.e. is not a radar channel etc.)
  */
 bool cfg80211_reg_can_beacon(struct wiphy *wiphy,
                              struct cfg80211_chan_def *chandef);
@@ -3756,9 +3844,9 @@ void cfg80211_unregister_wdev(struct wireless_dev *wdev);
  * The function finds a given P2P attribute in the (vendor) IEs and
  * copies its contents to the given buffer.
  *
- * The return value is a negative error code (-%EILSEQ or -%ENOENT) if
- * the data is malformed or the attribute can't be found (respectively),
- * or the length of the found attribute (which can be zero).
+ * Return: A negative error code (-%EILSEQ or -%ENOENT) if the data is
+ * malformed or the attribute can't be found (respectively), or the
+ * length of the found attribute (which can be zero).
  */
 int cfg80211_get_p2p_attr(const u8 *ies, unsigned int len,
                           enum ieee80211_p2p_attr_id attr,
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index ee50c5eba50c..5c98d654fc75 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -173,7 +173,7 @@ struct ieee80211_chanctx_conf {
 
         u8 rx_chains_static, rx_chains_dynamic;
 
-        u8 drv_priv[0] __attribute__((__aligned__(sizeof(void *))));
+        u8 drv_priv[0] __aligned(sizeof(void *));
 };
 
 /**
@@ -297,11 +297,9 @@ enum ieee80211_rssi_event {
  *      may filter ARP queries targeted for other addresses than listed here.
  *      The driver must allow ARP queries targeted for all address listed here
  *      to pass through. An empty list implies no ARP queries need to pass.
- * @arp_addr_cnt: Number of addresses currently on the list.
- * @arp_filter_enabled: Enable ARP filtering - if enabled, the hardware may
- *      filter ARP queries based on the @arp_addr_list, if disabled, the
- *      hardware must not perform any ARP filtering. Note, that the filter will
- *      be enabled also in promiscuous mode.
+ * @arp_addr_cnt: Number of addresses currently on the list. Note that this
+ *      may be larger than %IEEE80211_BSS_ARP_ADDR_LIST_LEN (the arp_addr_list
+ *      array size), it's up to the driver what to do in that case.
  * @qos: This is a QoS-enabled BSS.
  * @idle: This interface is idle. There's also a global idle flag in the
  *      hardware config which may be more appropriate depending on what
@@ -338,8 +336,7 @@ struct ieee80211_bss_conf {
         u32 cqm_rssi_hyst;
         struct cfg80211_chan_def chandef;
         __be32 arp_addr_list[IEEE80211_BSS_ARP_ADDR_LIST_LEN];
-        u8 arp_addr_cnt;
-        bool arp_filter_enabled;
+        int arp_addr_cnt;
         bool qos;
         bool idle;
         bool ps;
@@ -1059,7 +1056,7 @@ struct ieee80211_vif {
         u32 driver_flags;
 
         /* must be last */
-        u8 drv_priv[0] __attribute__((__aligned__(sizeof(void *))));
+        u8 drv_priv[0] __aligned(sizeof(void *));
 };
 
 static inline bool ieee80211_vif_is_mesh(struct ieee80211_vif *vif)
@@ -1209,7 +1206,7 @@ struct ieee80211_sta {
         u8 max_sp;
 
         /* must be last */
-        u8 drv_priv[0] __attribute__((__aligned__(sizeof(void *))));
+        u8 drv_priv[0] __aligned(sizeof(void *));
 };
 
 /**
@@ -1522,6 +1519,8 @@ struct ieee80211_hw {
  * structure can then access it via hw->priv. Note that mac802111 drivers should
  * not use wiphy_priv() to try to get their private driver structure as this
  * is already used internally by mac80211.
+ *
+ * Return: The mac80211 driver hw struct of @wiphy.
  */
 struct ieee80211_hw *wiphy_to_ieee80211_hw(struct wiphy *wiphy);
 
@@ -1628,6 +1627,10 @@ void ieee80211_free_txskb(struct ieee80211_hw *hw, struct sk_buff *skb);
  * rekeying), it will not include a valid phase 1 key. The valid phase 1 key is
  * provided by update_tkip_key only. The trigger that makes mac80211 call this
  * handler is software decryption with wrap around of iv16.
+ *
+ * The set_default_unicast_key() call updates the default WEP key index
+ * configured to the hardware for WEP encryption type. This is required
+ * for devices that support offload of data packets (e.g. ARP responses).
  */
 
 /**
@@ -2033,17 +2036,29 @@ enum ieee80211_filter_flags {
  * calling ieee80211_start_tx_ba_cb_irqsafe, because the peer
  * might receive the addBA frame and send a delBA right away!
  *
- * @IEEE80211_AMPDU_RX_START: start Rx aggregation
- * @IEEE80211_AMPDU_RX_STOP: stop Rx aggregation
- * @IEEE80211_AMPDU_TX_START: start Tx aggregation
- * @IEEE80211_AMPDU_TX_STOP: stop Tx aggregation
+ * @IEEE80211_AMPDU_RX_START: start RX aggregation
+ * @IEEE80211_AMPDU_RX_STOP: stop RX aggregation
+ * @IEEE80211_AMPDU_TX_START: start TX aggregation
  * @IEEE80211_AMPDU_TX_OPERATIONAL: TX aggregation has become operational
+ * @IEEE80211_AMPDU_TX_STOP_CONT: stop TX aggregation but continue transmitting
+ *      queued packets, now unaggregated. After all packets are transmitted the
+ *      driver has to call ieee80211_stop_tx_ba_cb_irqsafe().
+ * @IEEE80211_AMPDU_TX_STOP_FLUSH: stop TX aggregation and flush all packets,
+ *      called when the station is removed. There's no need or reason to call
+ *      ieee80211_stop_tx_ba_cb_irqsafe() in this case as mac80211 assumes the
+ *      session is gone and removes the station.
+ * @IEEE80211_AMPDU_TX_STOP_FLUSH_CONT: called when TX aggregation is stopped
+ *      but the driver hasn't called ieee80211_stop_tx_ba_cb_irqsafe() yet and
+ *      now the connection is dropped and the station will be removed. Drivers
+ *      should clean up and drop remaining packets when this is called.
  */
 enum ieee80211_ampdu_mlme_action {
         IEEE80211_AMPDU_RX_START,
         IEEE80211_AMPDU_RX_STOP,
         IEEE80211_AMPDU_TX_START,
-        IEEE80211_AMPDU_TX_STOP,
+        IEEE80211_AMPDU_TX_STOP_CONT,
+        IEEE80211_AMPDU_TX_STOP_FLUSH,
+        IEEE80211_AMPDU_TX_STOP_FLUSH_CONT,
         IEEE80211_AMPDU_TX_OPERATIONAL,
 };
 
@@ -2194,6 +2209,10 @@ enum ieee80211_rate_control_changed {
  *      After rekeying was done it should (for example during resume) notify
  *      userspace of the new replay counter using ieee80211_gtk_rekey_notify().
  *
+ * @set_default_unicast_key: Set the default (unicast) key index, useful for
+ *      WEP when the device sends data packets autonomously, e.g. for ARP
+ *      offloading. The index can be 0-3, or -1 for unsetting it.
+ *
  * @hw_scan: Ask the hardware to service the scan request, no need to start
  *      the scan state machine in stack. The scan must honour the channel
  *      configuration done by the regulatory agent in the wiphy's
@@ -2474,7 +2493,13 @@ enum ieee80211_rate_control_changed {
  *
  * @restart_complete: Called after a call to ieee80211_restart_hw(), when the
  *      reconfiguration has completed. This can help the driver implement the
- *      reconfiguration step. This callback may sleep.
+ *      reconfiguration step. Also called when reconfiguring because the
+ *      driver's resume function returned 1, as this is just like an "inline"
+ *      hardware restart. This callback may sleep.
+ *
+ * @ipv6_addr_change: IPv6 address assignment on the given interface changed.
+ *      Currently, this is only called for managed or P2P client interfaces.
+ *      This callback is optional; it must not sleep.
  */
 struct ieee80211_ops {
         void (*tx)(struct ieee80211_hw *hw,
@@ -2522,6 +2547,8 @@ struct ieee80211_ops {
         void (*set_rekey_data)(struct ieee80211_hw *hw,
                                struct ieee80211_vif *vif,
                                struct cfg80211_gtk_rekey_data *data);
+        void (*set_default_unicast_key)(struct ieee80211_hw *hw,
+                                        struct ieee80211_vif *vif, int idx);
         int (*hw_scan)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                        struct cfg80211_scan_request *req);
         void (*cancel_hw_scan)(struct ieee80211_hw *hw,
@@ -2606,6 +2633,7 @@ struct ieee80211_ops {
         int (*set_bitrate_mask)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                                 const struct cfg80211_bitrate_mask *mask);
         void (*rssi_callback)(struct ieee80211_hw *hw,
+                              struct ieee80211_vif *vif,
                               enum ieee80211_rssi_event rssi_event);
 
         void (*allow_buffered_frames)(struct ieee80211_hw *hw,
@@ -2648,6 +2676,12 @@ struct ieee80211_ops {
                                      struct ieee80211_chanctx_conf *ctx);
 
         void (*restart_complete)(struct ieee80211_hw *hw);
+
+#if IS_ENABLED(CONFIG_IPV6)
+        void (*ipv6_addr_change)(struct ieee80211_hw *hw,
+                                 struct ieee80211_vif *vif,
+                                 struct inet6_dev *idev);
+#endif
 };
 
 /**
@@ -2661,6 +2695,8 @@ struct ieee80211_ops {
  *
  * @priv_data_len: length of private data
  * @ops: callbacks for this device
+ *
+ * Return: A pointer to the new hardware device, or %NULL on error.
  */
 struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
                                         const struct ieee80211_ops *ops);
@@ -2673,6 +2709,8 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
  * need to fill the contained wiphy's information.
  *
  * @hw: the device to register as returned by ieee80211_alloc_hw()
+ *
+ * Return: 0 on success. An error code otherwise.
  */
 int ieee80211_register_hw(struct ieee80211_hw *hw);
 
@@ -2719,6 +2757,8 @@ extern char *__ieee80211_create_tpt_led_trigger(
  * of the trigger so you can automatically link the LED device.
  *
  * @hw: the hardware to get the LED trigger name for
+ *
+ * Return: The name of the LED trigger. %NULL if not configured for LEDs.
  */
 static inline char *ieee80211_get_tx_led_name(struct ieee80211_hw *hw)
 {
@@ -2738,6 +2778,8 @@ static inline char *ieee80211_get_tx_led_name(struct ieee80211_hw *hw)
  * of the trigger so you can automatically link the LED device.
  *
  * @hw: the hardware to get the LED trigger name for
+ *
+ * Return: The name of the LED trigger. %NULL if not configured for LEDs.
  */
 static inline char *ieee80211_get_rx_led_name(struct ieee80211_hw *hw)
 {
@@ -2757,6 +2799,8 @@ static inline char *ieee80211_get_rx_led_name(struct ieee80211_hw *hw)
  * of the trigger so you can automatically link the LED device.
  *
  * @hw: the hardware to get the LED trigger name for
+ *
+ * Return: The name of the LED trigger. %NULL if not configured for LEDs.
  */
 static inline char *ieee80211_get_assoc_led_name(struct ieee80211_hw *hw)
 {
@@ -2776,6 +2820,8 @@ static inline char *ieee80211_get_assoc_led_name(struct ieee80211_hw *hw)
  * of the trigger so you can automatically link the LED device.
  *
  * @hw: the hardware to get the LED trigger name for
+ *
+ * Return: The name of the LED trigger. %NULL if not configured for LEDs.
  */
 static inline char *ieee80211_get_radio_led_name(struct ieee80211_hw *hw)
 {
@@ -2793,9 +2839,10 @@ static inline char *ieee80211_get_radio_led_name(struct ieee80211_hw *hw)
  * @blink_table: the blink table -- needs to be ordered by throughput
  * @blink_table_len: size of the blink table
  *
- * This function returns %NULL (in case of error, or if no LED
- * triggers are configured) or the name of the new trigger.
- * This function must be called before ieee80211_register_hw().
+ * Return: %NULL (in case of error, or if no LED triggers are
+ * configured) or the name of the new trigger.
+ *
+ * Note: This function must be called before ieee80211_register_hw().
  */
 static inline char *
 ieee80211_create_tpt_led_trigger(struct ieee80211_hw *hw, unsigned int flags,
@@ -2928,10 +2975,10 @@ static inline void ieee80211_rx_ni(struct ieee80211_hw *hw,
  * Calls to this function for a single hardware must be synchronized against
  * each other.
  *
- * The function returns -EINVAL when the requested PS mode is already set.
- *
  * @sta: currently connected sta
  * @start: start or stop PS
+ *
+ * Return: 0 on success. -EINVAL when the requested PS mode is already set.
  */
 int ieee80211_sta_ps_transition(struct ieee80211_sta *sta, bool start);
 
@@ -2945,6 +2992,8 @@ int ieee80211_sta_ps_transition(struct ieee80211_sta *sta, bool start);
  *
  * @sta: currently connected sta
  * @start: start or stop PS
+ *
+ * Return: Like ieee80211_sta_ps_transition().
  */
 static inline int ieee80211_sta_ps_transition_ni(struct ieee80211_sta *sta,
                                                   bool start)
@@ -3082,6 +3131,8 @@ void ieee80211_report_low_ack(struct ieee80211_sta *sta, u32 num_packets);
  * according to the current DTIM parameters/TIM bitmap.
  *
  * The driver is responsible for freeing the returned skb.
+ *
+ * Return: The beacon template. %NULL on error.
  */
 struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
                                          struct ieee80211_vif *vif,
@@ -3093,6 +3144,8 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
  * @vif: &struct ieee80211_vif pointer from the add_interface callback.
  *
  * See ieee80211_beacon_get_tim().
+ *
+ * Return: See ieee80211_beacon_get_tim().
  */
 static inline struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
                                                    struct ieee80211_vif *vif)
@@ -3109,6 +3162,8 @@ static inline struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
  * hardware. The destination address should be set by the caller.
  *
  * Can only be called in AP mode.
+ *
+ * Return: The Probe Response template. %NULL on error.
  */
 struct sk_buff *ieee80211_proberesp_get(struct ieee80211_hw *hw,
                                         struct ieee80211_vif *vif);
@@ -3124,6 +3179,8 @@ struct sk_buff *ieee80211_proberesp_get(struct ieee80211_hw *hw,
  *
  * Note: Caller (or hardware) is responsible for setting the
  * &IEEE80211_FCTL_PM bit.
+ *
+ * Return: The PS Poll template. %NULL on error.
  */
 struct sk_buff *ieee80211_pspoll_get(struct ieee80211_hw *hw,
                                      struct ieee80211_vif *vif);
@@ -3139,6 +3196,8 @@ struct sk_buff *ieee80211_pspoll_get(struct ieee80211_hw *hw,
  *
  * Note: Caller (or hardware) is responsible for setting the
  * &IEEE80211_FCTL_PM bit as well as Duration and Sequence Control fields.
+ *
+ * Return: The nullfunc template. %NULL on error.
  */
 struct sk_buff *ieee80211_nullfunc_get(struct ieee80211_hw *hw,
                                        struct ieee80211_vif *vif);
@@ -3153,6 +3212,8 @@ struct sk_buff *ieee80211_nullfunc_get(struct ieee80211_hw *hw,
  *
  * Creates a Probe Request template which can, for example, be uploaded to
  * hardware.
+ *
+ * Return: The Probe Request template. %NULL on error.
  */
 struct sk_buff *ieee80211_probereq_get(struct ieee80211_hw *hw,
                                        struct ieee80211_vif *vif,
@@ -3188,6 +3249,8 @@ void ieee80211_rts_get(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
  * If the RTS is generated in firmware, but the host system must provide
  * the duration field, the low-level driver uses this function to receive
  * the duration field value in little-endian byteorder.
+ *
+ * Return: The duration.
  */
 __le16 ieee80211_rts_duration(struct ieee80211_hw *hw,
                               struct ieee80211_vif *vif, size_t frame_len,
@@ -3223,6 +3286,8 @@ void ieee80211_ctstoself_get(struct ieee80211_hw *hw,
  * If the CTS-to-self is generated in firmware, but the host system must provide
  * the duration field, the low-level driver uses this function to receive
  * the duration field value in little-endian byteorder.
+ *
+ * Return: The duration.
  */
 __le16 ieee80211_ctstoself_duration(struct ieee80211_hw *hw,
                                     struct ieee80211_vif *vif,
@@ -3239,6 +3304,8 @@ __le16 ieee80211_ctstoself_duration(struct ieee80211_hw *hw,
  *
  * Calculate the duration field of some generic frame, given its
  * length and transmission rate (in 100kbps).
+ *
+ * Return: The duration.
  */
 __le16 ieee80211_generic_frame_duration(struct ieee80211_hw *hw,
                                         struct ieee80211_vif *vif,
@@ -3255,9 +3322,10 @@ __le16 ieee80211_generic_frame_duration(struct ieee80211_hw *hw,
  * hardware/firmware does not implement buffering of broadcast/multicast
  * frames when power saving is used, 802.11 code buffers them in the host
  * memory. The low-level driver uses this function to fetch next buffered
- * frame. In most cases, this is used when generating beacon frame. This
- * function returns a pointer to the next buffered skb or NULL if no more
- * buffered frames are available.
+ * frame. In most cases, this is used when generating beacon frame.
+ *
+ * Return: A pointer to the next buffered skb or NULL if no more buffered
+ * frames are available.
  *
  * Note: buffered frames are returned only after DTIM beacon frame was
  * generated with ieee80211_beacon_get() and the low-level driver must thus
@@ -3437,6 +3505,8 @@ void ieee80211_stop_queue(struct ieee80211_hw *hw, int queue);
  * @queue: queue number (counted from zero).
  *
  * Drivers should use this function instead of netif_stop_queue.
+ *
+ * Return: %true if the queue is stopped. %false otherwise.
  */
 
 int ieee80211_queue_stopped(struct ieee80211_hw *hw, int queue);
@@ -3634,7 +3704,9 @@ void ieee80211_stop_tx_ba_cb_irqsafe(struct ieee80211_vif *vif, const u8 *ra,
  * @vif: virtual interface to look for station on
  * @addr: station's address
  *
- * This function must be called under RCU lock and the
+ * Return: The station, if found. %NULL otherwise.
+ *
+ * Note: This function must be called under RCU lock and the
  * resulting pointer is only valid under RCU lock as well.
  */
 struct ieee80211_sta *ieee80211_find_sta(struct ieee80211_vif *vif,
@@ -3647,7 +3719,9 @@ struct ieee80211_sta *ieee80211_find_sta(struct ieee80211_vif *vif,
  * @addr: remote station's address
  * @localaddr: local address (vif->sdata->vif.addr). Use NULL for 'any'.
  *
- * This function must be called under RCU lock and the
+ * Return: The station, if found. %NULL otherwise.
+ *
+ * Note: This function must be called under RCU lock and the
  * resulting pointer is only valid under RCU lock as well.
  *
  * NOTE: You may pass NULL for localaddr, but then you will just get
@@ -3754,6 +3828,11 @@ void ieee80211_iter_keys(struct ieee80211_hw *hw,
  * The iterator will not find a context that's being added (during
  * the driver callback to add it) but will find it while it's being
  * removed.
+ *
+ * Note that during hardware restart, all contexts that existed
+ * before the restart are considered already present so will be
+ * found while iterating, whether they've been re-added already
+ * or not.
  */
 void ieee80211_iter_chan_contexts_atomic(
         struct ieee80211_hw *hw,
@@ -3772,7 +3851,9 @@ void ieee80211_iter_chan_contexts_atomic(
  * information. This function must only be called from within the
  * .bss_info_changed callback function and only in managed mode. The function
  * is only useful when the interface is associated, otherwise it will return
- * NULL.
+ * %NULL.
+ *
+ * Return: The Probe Request template. %NULL on error.
  */
 struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
                                           struct ieee80211_vif *vif);
@@ -4119,12 +4200,14 @@ void ieee80211_enable_rssi_reports(struct ieee80211_vif *vif,
 void ieee80211_disable_rssi_reports(struct ieee80211_vif *vif);
 
 /**
- * ieee80211_ave_rssi - report the average rssi for the specified interface
+ * ieee80211_ave_rssi - report the average RSSI for the specified interface
  *
  * @vif: the specified virtual interface
  *
- * This function return the average rssi value for the requested interface.
- * It assumes that the given vif is valid.
+ * Note: This function assumes that the given vif is valid.
+ *
+ * Return: The average RSSI value for the requested interface, or 0 if not
+ * applicable.
  */
 int ieee80211_ave_rssi(struct ieee80211_vif *vif);
 
diff --git a/include/net/nfc/hci.h b/include/net/nfc/hci.h
index 671953e11575..b87a1692b086 100644
--- a/include/net/nfc/hci.h
+++ b/include/net/nfc/hci.h
@@ -57,8 +57,10 @@ struct nfc_hci_ops {
         int (*tm_send)(struct nfc_hci_dev *hdev, struct sk_buff *skb);
         int (*check_presence)(struct nfc_hci_dev *hdev,
                               struct nfc_target *target);
-        void (*event_received)(struct nfc_hci_dev *hdev, u8 gate, u8 event,
-                                struct sk_buff *skb);
+        int (*event_received)(struct nfc_hci_dev *hdev, u8 gate, u8 event,
+                              struct sk_buff *skb);
+        int (*enable_se)(struct nfc_dev *dev, u32 secure_element);
+        int (*disable_se)(struct nfc_dev *dev, u32 secure_element);
 };
 
 /* Pipes */
@@ -82,11 +84,23 @@ typedef int (*xmit) (struct sk_buff *skb, void *cb_data);
 
 #define NFC_HCI_MAX_GATES               256
 
+/*
+ * These values can be specified by a driver to indicate it requires some
+ * adaptation of the HCI standard.
+ *
+ * NFC_HCI_QUIRK_SHORT_CLEAR - send HCI_ADM_CLEAR_ALL_PIPE cmd with no params
+ */
+enum {
+        NFC_HCI_QUIRK_SHORT_CLEAR       = 0,
+};
+
 struct nfc_hci_dev {
         struct nfc_dev *ndev;
 
         u32 max_data_link_payload;
 
+        bool shutting_down;
+
         struct mutex msg_tx_mutex;
 
         struct list_head msg_tx_queue;
@@ -129,12 +143,16 @@ struct nfc_hci_dev {
 
         u8 *gb;
         size_t gb_len;
+
+        unsigned long quirks;
 };
 
 /* hci device allocation */
 struct nfc_hci_dev *nfc_hci_allocate_device(struct nfc_hci_ops *ops,
                                             struct nfc_hci_init_data *init_data,
+                                            unsigned long quirks,
                                             u32 protocols,
+                                            u32 supported_se,
                                             const char *llc_name,
                                             int tx_headroom,
                                             int tx_tailroom,
diff --git a/include/net/nfc/nci_core.h b/include/net/nfc/nci_core.h
index d705d8674949..5bc0c460edc0 100644
--- a/include/net/nfc/nci_core.h
+++ b/include/net/nfc/nci_core.h
@@ -147,6 +147,7 @@ struct nci_dev {
 /* ----- NCI Devices ----- */
 struct nci_dev *nci_allocate_device(struct nci_ops *ops,
                                     __u32 supported_protocols,
+                                    __u32 supported_se,
                                     int tx_headroom,
                                     int tx_tailroom);
 void nci_free_device(struct nci_dev *ndev);
diff --git a/include/net/nfc/nfc.h b/include/net/nfc/nfc.h
index fce80b2f9be7..87a6417fc934 100644
--- a/include/net/nfc/nfc.h
+++ b/include/net/nfc/nfc.h
@@ -68,6 +68,8 @@ struct nfc_ops {
                              void *cb_context);
         int (*tm_send)(struct nfc_dev *dev, struct sk_buff *skb);
         int (*check_presence)(struct nfc_dev *dev, struct nfc_target *target);
+        int (*enable_se)(struct nfc_dev *dev, u32 secure_element);
+        int (*disable_se)(struct nfc_dev *dev, u32 secure_element);
 };
 
 #define NFC_TARGET_IDX_ANY -1
@@ -109,12 +111,17 @@ struct nfc_dev {
         struct nfc_genl_data genl_data;
         u32 supported_protocols;
 
+        u32 supported_se;
+        u32 active_se;
+
         int tx_headroom;
         int tx_tailroom;
 
         struct timer_list check_pres_timer;
         struct work_struct check_pres_work;
 
+        bool shutting_down;
+
         struct nfc_ops *ops;
 };
 #define to_nfc_dev(_dev) container_of(_dev, struct nfc_dev, dev)
@@ -123,6 +130,7 @@ extern struct class nfc_class;
 
 struct nfc_dev *nfc_allocate_device(struct nfc_ops *ops,
                                     u32 supported_protocols,
+                                    u32 supported_se,
                                     int tx_headroom,
                                     int tx_tailroom);
 
diff --git a/include/net/regulatory.h b/include/net/regulatory.h
index 7dcaa2794fde..f17ed590d64a 100644
--- a/include/net/regulatory.h
+++ b/include/net/regulatory.h
@@ -18,6 +18,7 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
+#include <linux/rcupdate.h>
 
 /**
  * enum environment_cap - Environment parsed from country IE
@@ -35,6 +36,7 @@ enum environment_cap {
 /**
  * struct regulatory_request - used to keep track of regulatory requests
  *
+ * @rcu_head: RCU head struct used to free the request
  * @wiphy_idx: this is set if this request's initiator is
  *      %REGDOM_SET_BY_COUNTRY_IE or %REGDOM_SET_BY_DRIVER. This
  *      can be used by the wireless core to deal with conflicts
@@ -72,6 +74,7 @@ enum environment_cap {
  * @list: used to insert into the reg_requests_list linked list
  */
 struct regulatory_request {
+        struct rcu_head rcu_head;
         int wiphy_idx;
         enum nl80211_reg_initiator initiator;
         enum nl80211_user_reg_hint_type user_reg_hint_type;
@@ -101,6 +104,7 @@ struct ieee80211_reg_rule {
 };
 
 struct ieee80211_regdomain {
+        struct rcu_head rcu_head;
         u32 n_reg_rules;
         char alpha2[2];
         u8 dfs_region;
diff --git a/include/uapi/linux/nfc.h b/include/uapi/linux/nfc.h
index 0e63cee8d810..7969f46f1bb3 100644
--- a/include/uapi/linux/nfc.h
+++ b/include/uapi/linux/nfc.h
@@ -5,20 +5,17 @@
  *    Lauro Ramos Venancio <lauro.venancio@openbossa.org>
  *    Aloisio Almeida Jr <aloisio.almeida@openbossa.org>
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
  *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the
- * Free Software Foundation, Inc.,
- * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
 #ifndef __LINUX_NFC_H
@@ -67,6 +64,11 @@
  *      subsequent CONNECT and CC messages.
  *      If one of the passed parameters is wrong none is set and -EINVAL is
  *      returned.
+ * @NFC_CMD_ENABLE_SE: Enable the physical link to a specific secure element.
+ *      Once enabled a secure element will handle card emulation mode, i.e.
+ *      starting a poll from a device which has a secure element enabled means
+ *      we want to do SE based card emulation.
+ * @NFC_CMD_DISABLE_SE: Disable the physical link to a specific secure element.
  */
 enum nfc_commands {
         NFC_CMD_UNSPEC,
@@ -86,6 +88,8 @@ enum nfc_commands {
         NFC_EVENT_TM_DEACTIVATED,
         NFC_CMD_LLC_GET_PARAMS,
         NFC_CMD_LLC_SET_PARAMS,
+        NFC_CMD_ENABLE_SE,
+        NFC_CMD_DISABLE_SE,
 /* private: internal use only */
         __NFC_CMD_AFTER_LAST
 };
@@ -114,6 +118,7 @@ enum nfc_commands {
  * @NFC_ATTR_LLC_PARAM_LTO: Link TimeOut parameter
  * @NFC_ATTR_LLC_PARAM_RW: Receive Window size parameter
  * @NFC_ATTR_LLC_PARAM_MIUX: MIU eXtension parameter
+ * @NFC_ATTR_SE: Available Secure Elements
  */
 enum nfc_attrs {
         NFC_ATTR_UNSPEC,
@@ -134,6 +139,7 @@ enum nfc_attrs {
         NFC_ATTR_LLC_PARAM_LTO,
         NFC_ATTR_LLC_PARAM_RW,
         NFC_ATTR_LLC_PARAM_MIUX,
+        NFC_ATTR_SE,
 /* private: internal use only */
         __NFC_ATTR_AFTER_LAST
 };
@@ -172,6 +178,11 @@ enum nfc_attrs {
 #define NFC_PROTO_NFC_DEP_MASK    (1 << NFC_PROTO_NFC_DEP)
 #define NFC_PROTO_ISO14443_B_MASK (1 << NFC_PROTO_ISO14443_B)
 
+/* NFC Secure Elements */
+#define NFC_SE_NONE     0x0
+#define NFC_SE_UICC     0x1
+#define NFC_SE_EMBEDDED 0x2
+
 struct sockaddr_nfc {
         sa_family_t sa_family;
         __u32 dev_idx;
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index e3e19f8b16f2..5b7dbc1ea966 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -170,7 +170,8 @@
  *      %NL80211_ATTR_HIDDEN_SSID, %NL80211_ATTR_CIPHERS_PAIRWISE,
  *      %NL80211_ATTR_CIPHER_GROUP, %NL80211_ATTR_WPA_VERSIONS,
  *      %NL80211_ATTR_AKM_SUITES, %NL80211_ATTR_PRIVACY,
- *      %NL80211_ATTR_AUTH_TYPE and %NL80211_ATTR_INACTIVITY_TIMEOUT.
+ *      %NL80211_ATTR_AUTH_TYPE, %NL80211_ATTR_INACTIVITY_TIMEOUT,
+ *      %NL80211_ATTR_ACL_POLICY and %NL80211_ATTR_MAC_ADDRS.
  *      The channel to use can be set on the interface or be given using the
  *      %NL80211_ATTR_WIPHY_FREQ and the attributes determining channel width.
  * @NL80211_CMD_NEW_BEACON: old alias for %NL80211_CMD_START_AP
@@ -374,8 +375,8 @@
  *      requests to connect to a specified network but without separating
  *      auth and assoc steps. For this, you need to specify the SSID in a
  *      %NL80211_ATTR_SSID attribute, and can optionally specify the association
- *      IEs in %NL80211_ATTR_IE, %NL80211_ATTR_AUTH_TYPE, %NL80211_ATTR_MAC,
- *      %NL80211_ATTR_WIPHY_FREQ, %NL80211_ATTR_CONTROL_PORT,
+ *      IEs in %NL80211_ATTR_IE, %NL80211_ATTR_AUTH_TYPE, %NL80211_ATTR_USE_MFP,
+ *      %NL80211_ATTR_MAC, %NL80211_ATTR_WIPHY_FREQ, %NL80211_ATTR_CONTROL_PORT,
  *      %NL80211_ATTR_CONTROL_PORT_ETHERTYPE and
  *      %NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT.
  *      Background scan period can optionally be
@@ -586,6 +587,16 @@
  * @NL80211_CMD_SET_MCAST_RATE: Change the rate used to send multicast frames
  *      for IBSS or MESH vif.
  *
+ * @NL80211_CMD_SET_MAC_ACL: sets ACL for MAC address based access control.
+ *      This is to be used with the drivers advertising the support of MAC
+ *      address based access control. List of MAC addresses is passed in
+ *      %NL80211_ATTR_MAC_ADDRS and ACL policy is passed in
+ *      %NL80211_ATTR_ACL_POLICY. Driver will enable ACL with this list, if it
+ *      is not already done. The new list will replace any existing list. Driver
+ *      will clear its ACL when the list of MAC addresses passed is empty. This
+ *      command is used in AP/P2P GO mode. Driver has to make sure to clear its
+ *      ACL list during %NL80211_CMD_STOP_AP.
+ *
  * @NL80211_CMD_MAX: highest used command number
  * @__NL80211_CMD_AFTER_LAST: internal use
  */
@@ -736,6 +747,8 @@ enum nl80211_commands {
 
         NL80211_CMD_SET_MCAST_RATE,
 
+        NL80211_CMD_SET_MAC_ACL,
+
         /* add new commands above here */
 
         /* used to define NL80211_CMD_MAX below */
@@ -958,7 +971,7 @@ enum nl80211_commands {
  * @NL80211_ATTR_USE_MFP: Whether management frame protection (IEEE 802.11w) is
  *      used for the association (&enum nl80211_mfp, represented as a u32);
  *      this attribute can be used
- *      with %NL80211_CMD_ASSOCIATE request
+ *      with %NL80211_CMD_ASSOCIATE and %NL80211_CMD_CONNECT requests
  *
  * @NL80211_ATTR_STA_FLAGS2: Attribute containing a
  *      &struct nl80211_sta_flag_update.
@@ -1310,6 +1323,19 @@ enum nl80211_commands {
  *      if not given in START_AP 0 is assumed, if not given in SET_BSS
  *      no change is made.
  *
+ * @NL80211_ATTR_LOCAL_MESH_POWER_MODE: local mesh STA link-specific power mode
+ *      defined in &enum nl80211_mesh_power_mode.
+ *
+ * @NL80211_ATTR_ACL_POLICY: ACL policy, see &enum nl80211_acl_policy,
+ *      carried in a u32 attribute
+ *
+ * @NL80211_ATTR_MAC_ADDRS: Array of nested MAC addresses, used for
+ *      MAC ACL.
+ *
+ * @NL80211_ATTR_MAC_ACL_MAX: u32 attribute to advertise the maximum
+ *      number of MAC addresses that a device can support for MAC
+ *      ACL.
+ *
  * @NL80211_ATTR_MAX: highest attribute number currently defined
  * @__NL80211_ATTR_AFTER_LAST: internal use
  */
@@ -1580,6 +1606,14 @@ enum nl80211_attrs {
         NL80211_ATTR_P2P_CTWINDOW,
         NL80211_ATTR_P2P_OPPPS,
 
+        NL80211_ATTR_LOCAL_MESH_POWER_MODE,
+
+        NL80211_ATTR_ACL_POLICY,
+
+        NL80211_ATTR_MAC_ADDRS,
+
+        NL80211_ATTR_MAC_ACL_MAX,
+
         /* add attributes here, update the policy in nl80211.c */
 
         __NL80211_ATTR_AFTER_LAST,
@@ -1697,6 +1731,9 @@ enum nl80211_iftype {
  *      flag can't be changed, it is only valid while adding a station, and
  *      attempts to change it will silently be ignored (rather than rejected
  *      as errors.)
+ * @NL80211_STA_FLAG_ASSOCIATED: station is associated; used with drivers
+ *      that support %NL80211_FEATURE_FULL_AP_CLIENT_STATE to transition a
+ *      previously added station into associated state
  * @NL80211_STA_FLAG_MAX: highest station flag number currently defined
  * @__NL80211_STA_FLAG_AFTER_LAST: internal use
  */
@@ -1708,6 +1745,7 @@ enum nl80211_sta_flags {
         NL80211_STA_FLAG_MFP,
         NL80211_STA_FLAG_AUTHENTICATED,
         NL80211_STA_FLAG_TDLS_PEER,
+        NL80211_STA_FLAG_ASSOCIATED,
 
         /* keep last */
         __NL80211_STA_FLAG_AFTER_LAST,
@@ -1834,6 +1872,10 @@ enum nl80211_sta_bss_param {
  * @NL80211_STA_INFO_STA_FLAGS: Contains a struct nl80211_sta_flag_update.
  * @NL80211_STA_INFO_BEACON_LOSS: count of times beacon loss was detected (u32)
  * @NL80211_STA_INFO_T_OFFSET: timing offset with respect to this STA (s64)
+ * @NL80211_STA_INFO_LOCAL_PM: local mesh STA link-specific power mode
+ * @NL80211_STA_INFO_PEER_PM: peer mesh STA link-specific power mode
+ * @NL80211_STA_INFO_NONPEER_PM: neighbor mesh STA power save mode towards
+ *      non-peer STA
  * @__NL80211_STA_INFO_AFTER_LAST: internal
  * @NL80211_STA_INFO_MAX: highest possible station info attribute
  */
@@ -1858,6 +1900,9 @@ enum nl80211_sta_info {
         NL80211_STA_INFO_STA_FLAGS,
         NL80211_STA_INFO_BEACON_LOSS,
         NL80211_STA_INFO_T_OFFSET,
+        NL80211_STA_INFO_LOCAL_PM,
+        NL80211_STA_INFO_PEER_PM,
+        NL80211_STA_INFO_NONPEER_PM,
 
         /* keep last */
         __NL80211_STA_INFO_AFTER_LAST,
@@ -2249,6 +2294,34 @@ enum nl80211_mntr_flags {
 };
 
 /**
+ * enum nl80211_mesh_power_mode - mesh power save modes
+ *
+ * @NL80211_MESH_POWER_UNKNOWN: The mesh power mode of the mesh STA is
+ *      not known or has not been set yet.
+ * @NL80211_MESH_POWER_ACTIVE: Active mesh power mode. The mesh STA is
+ *      in Awake state all the time.
+ * @NL80211_MESH_POWER_LIGHT_SLEEP: Light sleep mode. The mesh STA will
+ *      alternate between Active and Doze states, but will wake up for
+ *      neighbor's beacons.
+ * @NL80211_MESH_POWER_DEEP_SLEEP: Deep sleep mode. The mesh STA will
+ *      alternate between Active and Doze states, but may not wake up
+ *      for neighbor's beacons.
+ *
+ * @__NL80211_MESH_POWER_AFTER_LAST - internal use
+ * @NL80211_MESH_POWER_MAX - highest possible power save level
+ */
+
+enum nl80211_mesh_power_mode {
+        NL80211_MESH_POWER_UNKNOWN,
+        NL80211_MESH_POWER_ACTIVE,
+        NL80211_MESH_POWER_LIGHT_SLEEP,
+        NL80211_MESH_POWER_DEEP_SLEEP,
+
+        __NL80211_MESH_POWER_AFTER_LAST,
+        NL80211_MESH_POWER_MAX = __NL80211_MESH_POWER_AFTER_LAST - 1
+};
+
+/**
  * enum nl80211_meshconf_params - mesh configuration parameters
  *
  * Mesh configuration parameters. These can be changed while the mesh is
@@ -2342,6 +2415,11 @@ enum nl80211_mntr_flags {
  *      (in TUs) during which a mesh STA can send only one Action frame
  *      containing a PREQ element for root path confirmation.
  *
+ * @NL80211_MESHCONF_POWER_MODE: Default mesh power mode for new peer links.
+ *      type &enum nl80211_mesh_power_mode (u32)
+ *
+ * @NL80211_MESHCONF_AWAKE_WINDOW: awake window duration (in TUs)
+ *
  * @__NL80211_MESHCONF_ATTR_AFTER_LAST: internal use
  */
 enum nl80211_meshconf_params {
@@ -2371,6 +2449,8 @@ enum nl80211_meshconf_params {
         NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
         NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
         NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
+        NL80211_MESHCONF_POWER_MODE,
+        NL80211_MESHCONF_AWAKE_WINDOW,
 
         /* keep last */
         __NL80211_MESHCONF_ATTR_AFTER_LAST,
@@ -2933,6 +3013,8 @@ enum nl80211_iface_limit_attrs {
  *      the infrastructure network's beacon interval.
  * @NL80211_IFACE_COMB_NUM_CHANNELS: u32 attribute specifying how many
  *      different channels may be used within this group.
+ * @NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS: u32 attribute containing the bitmap
+ *      of supported channel widths for radar detection.
  * @NUM_NL80211_IFACE_COMB: number of attributes
  * @MAX_NL80211_IFACE_COMB: highest attribute number
  *
@@ -2965,6 +3047,7 @@ enum nl80211_if_combination_attrs {
         NL80211_IFACE_COMB_MAXNUM,
         NL80211_IFACE_COMB_STA_AP_BI_MATCH,
         NL80211_IFACE_COMB_NUM_CHANNELS,
+        NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
 
         /* keep last */
         NUM_NL80211_IFACE_COMB,
@@ -3140,6 +3223,17 @@ enum nl80211_ap_sme_features {
  *      setting
  * @NL80211_FEATURE_P2P_GO_OPPPS: P2P GO implementation supports opportunistic
  *      powersave
+ * @NL80211_FEATURE_FULL_AP_CLIENT_STATE: The driver supports full state
+ *      transitions for AP clients. Without this flag (and if the driver
+ *      doesn't have the AP SME in the device) the driver supports adding
+ *      stations only when they're associated and adds them in associated
+ *      state (to later be transitioned into authorized), with this flag
+ *      they should be added before even sending the authentication reply
+ *      and then transitioned into authenticated, associated and authorized
+ *      states using station flags.
+ *      Note that even for drivers that support this, the default is to add
+ *      stations in authenticated/associated state, so to add unauthenticated
+ *      stations the authenticated/associated bits have to be set in the mask.
  */
 enum nl80211_feature_flags {
         NL80211_FEATURE_SK_TX_STATUS                    = 1 << 0,
@@ -3155,6 +3249,7 @@ enum nl80211_feature_flags {
         NL80211_FEATURE_NEED_OBSS_SCAN                  = 1 << 10,
         NL80211_FEATURE_P2P_GO_CTWIN                    = 1 << 11,
         NL80211_FEATURE_P2P_GO_OPPPS                    = 1 << 12,
+        NL80211_FEATURE_FULL_AP_CLIENT_STATE            = 1 << 13,
 };
 
 /**
@@ -3182,7 +3277,7 @@ enum nl80211_probe_resp_offload_support_attr {
  * enum nl80211_connect_failed_reason - connection request failed reasons
  * @NL80211_CONN_FAIL_MAX_CLIENTS: Maximum number of clients that can be
  *      handled by the AP is reached.
- * @NL80211_CONN_FAIL_BLOCKED_CLIENT: Client's MAC is in the AP's blocklist.
+ * @NL80211_CONN_FAIL_BLOCKED_CLIENT: Connection request is rejected due to ACL.
  */
 enum nl80211_connect_failed_reason {
         NL80211_CONN_FAIL_MAX_CLIENTS,
@@ -3210,4 +3305,22 @@ enum nl80211_scan_flags {
         NL80211_SCAN_FLAG_AP                            = 1<<2,
 };
 
+/**
+ * enum nl80211_acl_policy - access control policy
+ *
+ * Access control policy is applied on a MAC list set by
+ * %NL80211_CMD_START_AP and %NL80211_CMD_SET_MAC_ACL, to
+ * be used with %NL80211_ATTR_ACL_POLICY.
+ *
+ * @NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED: Deny stations which are
+ *      listed in ACL, i.e. allow all the stations which are not listed
+ *      in ACL to authenticate.
+ * @NL80211_ACL_POLICY_DENY_UNLESS_LISTED: Allow the stations which are listed
+ *      in ACL, i.e. deny all the stations which are not listed in ACL.
+ */
+enum nl80211_acl_policy {
+        NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED,
+        NL80211_ACL_POLICY_DENY_UNLESS_LISTED,
+};
+
 #endif /* __LINUX_NL80211_H */
diff --git a/net/bluetooth/a2mp.c b/net/bluetooth/a2mp.c
index 2f67d5ecc907..eb0f4b16ff09 100644
--- a/net/bluetooth/a2mp.c
+++ b/net/bluetooth/a2mp.c
@@ -290,7 +290,7 @@ static int a2mp_getinfo_req(struct amp_mgr *mgr, struct sk_buff *skb,
                 goto done;
         }
 
-        mgr->state = READ_LOC_AMP_INFO;
+        set_bit(READ_LOC_AMP_INFO, &mgr->state);
         hci_send_cmd(hdev, HCI_OP_READ_LOCAL_AMP_INFO, 0, NULL);
 
 done:
@@ -499,8 +499,16 @@ send_rsp:
         if (hdev)
                 hci_dev_put(hdev);
 
-        a2mp_send(mgr, A2MP_CREATEPHYSLINK_RSP, hdr->ident, sizeof(rsp),
-                  &rsp);
+        /* Reply error now and success after HCI Write Remote AMP Assoc
+           command complete with success status
+         */
+        if (rsp.status != A2MP_STATUS_SUCCESS) {
+                a2mp_send(mgr, A2MP_CREATEPHYSLINK_RSP, hdr->ident,
+                          sizeof(rsp), &rsp);
+        } else {
+                set_bit(WRITE_REMOTE_AMP_ASSOC, &mgr->state);
+                mgr->ident = hdr->ident;
+        }
 
         skb_pull(skb, le16_to_cpu(hdr->len));
         return 0;
@@ -840,7 +848,7 @@ struct amp_mgr *amp_mgr_lookup_by_state(u8 state)
 
         mutex_lock(&amp_mgr_list_lock);
         list_for_each_entry(mgr, &amp_mgr_list, list) {
-                if (mgr->state == state) {
+                if (test_and_clear_bit(state, &mgr->state)) {
                         amp_mgr_get(mgr);
                         mutex_unlock(&amp_mgr_list_lock);
                         return mgr;
@@ -949,6 +957,32 @@ clean:
         kfree(req);
 }
 
+void a2mp_send_create_phy_link_rsp(struct hci_dev *hdev, u8 status)
+{
+        struct amp_mgr *mgr;
+        struct a2mp_physlink_rsp rsp;
+        struct hci_conn *hs_hcon;
+
+        mgr = amp_mgr_lookup_by_state(WRITE_REMOTE_AMP_ASSOC);
+        if (!mgr)
+                return;
+
+        hs_hcon = hci_conn_hash_lookup_state(hdev, AMP_LINK, BT_CONNECT);
+        if (!hs_hcon) {
+                rsp.status = A2MP_STATUS_UNABLE_START_LINK_CREATION;
+        } else {
+                rsp.remote_id = hs_hcon->remote_id;
+                rsp.status = A2MP_STATUS_SUCCESS;
+        }
+
+        BT_DBG("%s mgr %p hs_hcon %p status %u", hdev->name, mgr, hs_hcon,
+               status);
+
+        rsp.local_id = hdev->id;
+        a2mp_send(mgr, A2MP_CREATEPHYSLINK_RSP, mgr->ident, sizeof(rsp), &rsp);
+        amp_mgr_put(mgr);
+}
+
 void a2mp_discover_amp(struct l2cap_chan *chan)
 {
         struct l2cap_conn *conn = chan->conn;
diff --git a/net/bluetooth/amp.c b/net/bluetooth/amp.c
index 1b0d92c0643a..d459ed43c779 100644
--- a/net/bluetooth/amp.c
+++ b/net/bluetooth/amp.c
@@ -236,7 +236,7 @@ void amp_read_loc_assoc(struct hci_dev *hdev, struct amp_mgr *mgr)
 
         cp.max_len = cpu_to_le16(hdev->amp_assoc_size);
 
-        mgr->state = READ_LOC_AMP_ASSOC;
+        set_bit(READ_LOC_AMP_ASSOC, &mgr->state);
         hci_send_cmd(hdev, HCI_OP_READ_LOCAL_AMP_ASSOC, sizeof(cp), &cp);
 }
 
@@ -250,7 +250,7 @@ void amp_read_loc_assoc_final_data(struct hci_dev *hdev,
         cp.len_so_far = cpu_to_le16(0);
         cp.max_len = cpu_to_le16(hdev->amp_assoc_size);
 
-        mgr->state = READ_LOC_AMP_ASSOC_FINAL;
+        set_bit(READ_LOC_AMP_ASSOC_FINAL, &mgr->state);
 
         /* Read Local AMP Assoc final link information data */
         hci_send_cmd(hdev, HCI_OP_READ_LOCAL_AMP_ASSOC, sizeof(cp), &cp);
@@ -317,7 +317,9 @@ void amp_write_rem_assoc_continue(struct hci_dev *hdev, u8 handle)
         if (!hcon)
                 return;
 
-        amp_write_rem_assoc_frag(hdev, hcon);
+        /* Send A2MP create phylink rsp when all fragments are written */
+        if (amp_write_rem_assoc_frag(hdev, hcon))
+                a2mp_send_create_phy_link_rsp(hdev, 0);
 }
 
 void amp_write_remote_assoc(struct hci_dev *hdev, u8 handle)
@@ -403,26 +405,20 @@ void amp_physical_cfm(struct hci_conn *bredr_hcon, struct hci_conn *hs_hcon)
 
 void amp_create_logical_link(struct l2cap_chan *chan)
 {
+        struct hci_conn *hs_hcon = chan->hs_hcon;
         struct hci_cp_create_accept_logical_link cp;
-        struct hci_conn *hcon;
         struct hci_dev *hdev;
 
-        BT_DBG("chan %p", chan);
+        BT_DBG("chan %p hs_hcon %p dst %pMR", chan, hs_hcon, chan->conn->dst);
 
-        if (!chan->hs_hcon)
+        if (!hs_hcon)
                 return;
 
         hdev = hci_dev_hold(chan->hs_hcon->hdev);
         if (!hdev)
                 return;
 
-        BT_DBG("chan %p dst %pMR", chan, chan->conn->dst);
-
-        hcon = hci_conn_hash_lookup_ba(hdev, AMP_LINK, chan->conn->dst);
-        if (!hcon)
-                goto done;
-
-        cp.phy_handle = hcon->handle;
+        cp.phy_handle = hs_hcon->handle;
 
         cp.tx_flow_spec.id = chan->local_id;
         cp.tx_flow_spec.stype = chan->local_stype;
@@ -438,14 +434,13 @@ void amp_create_logical_link(struct l2cap_chan *chan)
         cp.rx_flow_spec.acc_lat = cpu_to_le32(chan->remote_acc_lat);
         cp.rx_flow_spec.flush_to = cpu_to_le32(chan->remote_flush_to);
 
-        if (hcon->out)
+        if (hs_hcon->out)
                 hci_send_cmd(hdev, HCI_OP_CREATE_LOGICAL_LINK, sizeof(cp),
                              &cp);
         else
                 hci_send_cmd(hdev, HCI_OP_ACCEPT_LOGICAL_LINK, sizeof(cp),
                              &cp);
 
-done:
         hci_dev_put(hdev);
 }
 
diff --git a/net/bluetooth/bnep/core.c b/net/bluetooth/bnep/core.c
index a5b639702637..e430b1abcd2f 100644
--- a/net/bluetooth/bnep/core.c
+++ b/net/bluetooth/bnep/core.c
@@ -33,7 +33,6 @@
 
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
-#include <net/bluetooth/l2cap.h>
 
 #include "bnep.h"
 
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 596660d37c5e..d13ce99b410a 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1146,7 +1146,8 @@ static void hci_power_on(struct work_struct *work)
                 return;
 
         if (test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
-                schedule_delayed_work(&hdev->power_off, HCI_AUTO_OFF_TIMEOUT);
+                queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
+                                   HCI_AUTO_OFF_TIMEOUT);
 
         if (test_and_clear_bit(HCI_SETUP, &hdev->dev_flags))
                 mgmt_index_added(hdev);
@@ -1621,8 +1622,8 @@ static int hci_do_le_scan(struct hci_dev *hdev, u8 type, u16 interval,
         if (err < 0)
                 return err;
 
-        schedule_delayed_work(&hdev->le_scan_disable,
-                              msecs_to_jiffies(timeout));
+        queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
+                           msecs_to_jiffies(timeout));
 
         return 0;
 }
@@ -1799,6 +1800,15 @@ int hci_register_dev(struct hci_dev *hdev)
                 goto err;
         }
 
+        hdev->req_workqueue = alloc_workqueue(hdev->name,
+                                              WQ_HIGHPRI | WQ_UNBOUND |
+                                              WQ_MEM_RECLAIM, 1);
+        if (!hdev->req_workqueue) {
+                destroy_workqueue(hdev->workqueue);
+                error = -ENOMEM;
+                goto err;
+        }
+
         error = hci_add_sysfs(hdev);
         if (error < 0)
                 goto err_wqueue;
@@ -1821,12 +1831,13 @@ int hci_register_dev(struct hci_dev *hdev)
         hci_notify(hdev, HCI_DEV_REG);
         hci_dev_hold(hdev);
 
-        schedule_work(&hdev->power_on);
+        queue_work(hdev->req_workqueue, &hdev->power_on);
 
         return id;
 
 err_wqueue:
         destroy_workqueue(hdev->workqueue);
+        destroy_workqueue(hdev->req_workqueue);
 err:
         ida_simple_remove(&hci_index_ida, hdev->id);
         write_lock(&hci_dev_list_lock);
@@ -1880,6 +1891,7 @@ void hci_unregister_dev(struct hci_dev *hdev)
         hci_del_sysfs(hdev);
 
         destroy_workqueue(hdev->workqueue);
+        destroy_workqueue(hdev->req_workqueue);
 
         hci_dev_lock(hdev);
         hci_blacklist_clear(hdev);
@@ -2810,14 +2822,6 @@ static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
         if (conn) {
                 hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
 
-                hci_dev_lock(hdev);
-                if (test_bit(HCI_MGMT, &hdev->dev_flags) &&
-                    !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
-                        mgmt_device_connected(hdev, &conn->dst, conn->type,
-                                              conn->dst_type, 0, NULL, 0,
-                                              conn->dev_class);
-                hci_dev_unlock(hdev);
-
                 /* Send to upper protocol */
                 l2cap_recv_acldata(conn, skb, flags);
                 return;
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 705078a0cc39..0a4fd642d4b9 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -609,8 +609,17 @@ static void le_setup(struct hci_dev *hdev)
         /* Read LE Buffer Size */
         hci_send_cmd(hdev, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
 
+        /* Read LE Local Supported Features */
+        hci_send_cmd(hdev, HCI_OP_LE_READ_LOCAL_FEATURES, 0, NULL);
+
         /* Read LE Advertising Channel TX Power */
         hci_send_cmd(hdev, HCI_OP_LE_READ_ADV_TX_POWER, 0, NULL);
+
+        /* Read LE White List Size */
+        hci_send_cmd(hdev, HCI_OP_LE_READ_WHITE_LIST_SIZE, 0, NULL);
+
+        /* Read LE Supported States */
+        hci_send_cmd(hdev, HCI_OP_LE_READ_SUPPORTED_STATES, 0, NULL);
 }
 
 static void hci_setup(struct hci_dev *hdev)
@@ -1090,6 +1099,19 @@ static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
         hci_req_complete(hdev, HCI_OP_LE_READ_BUFFER_SIZE, rp->status);
 }
 
+static void hci_cc_le_read_local_features(struct hci_dev *hdev,
+                                          struct sk_buff *skb)
+{
+        struct hci_rp_le_read_local_features *rp = (void *) skb->data;
+
+        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
+
+        if (!rp->status)
+                memcpy(hdev->le_features, rp->features, 8);
+
+        hci_req_complete(hdev, HCI_OP_LE_READ_LOCAL_FEATURES, rp->status);
+}
+
 static void hci_cc_le_read_adv_tx_power(struct hci_dev *hdev,
                                         struct sk_buff *skb)
 {
@@ -1290,6 +1312,19 @@ static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
         }
 }
 
+static void hci_cc_le_read_white_list_size(struct hci_dev *hdev,
+                                           struct sk_buff *skb)
+{
+        struct hci_rp_le_read_white_list_size *rp = (void *) skb->data;
+
+        BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
+
+        if (!rp->status)
+                hdev->le_white_list_size = rp->size;
+
+        hci_req_complete(hdev, HCI_OP_LE_READ_WHITE_LIST_SIZE, rp->status);
+}
+
 static void hci_cc_le_ltk_reply(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct hci_rp_le_ltk_reply *rp = (void *) skb->data;
@@ -1314,6 +1349,19 @@ static void hci_cc_le_ltk_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
         hci_req_complete(hdev, HCI_OP_LE_LTK_NEG_REPLY, rp->status);
 }
 
+static void hci_cc_le_read_supported_states(struct hci_dev *hdev,
+                                            struct sk_buff *skb)
+{
+        struct hci_rp_le_read_supported_states *rp = (void *) skb->data;
+
+        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
+
+        if (!rp->status)
+                memcpy(hdev->le_states, rp->le_states, 8);
+
+        hci_req_complete(hdev, HCI_OP_LE_READ_SUPPORTED_STATES, rp->status);
+}
+
 static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
                                            struct sk_buff *skb)
 {
@@ -2628,6 +2676,10 @@ static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
                 hci_cc_le_read_buffer_size(hdev, skb);
                 break;
 
+        case HCI_OP_LE_READ_LOCAL_FEATURES:
+                hci_cc_le_read_local_features(hdev, skb);
+                break;
+
         case HCI_OP_LE_READ_ADV_TX_POWER:
                 hci_cc_le_read_adv_tx_power(hdev, skb);
                 break;
@@ -2664,6 +2716,10 @@ static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
                 hci_cc_le_set_scan_enable(hdev, skb);
                 break;
 
+        case HCI_OP_LE_READ_WHITE_LIST_SIZE:
+                hci_cc_le_read_white_list_size(hdev, skb);
+                break;
+
         case HCI_OP_LE_LTK_REPLY:
                 hci_cc_le_ltk_reply(hdev, skb);
                 break;
@@ -2672,6 +2728,10 @@ static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
                 hci_cc_le_ltk_neg_reply(hdev, skb);
                 break;
 
+        case HCI_OP_LE_READ_SUPPORTED_STATES:
+                hci_cc_le_read_supported_states(hdev, skb);
+                break;
+
         case HCI_OP_WRITE_LE_HOST_SUPPORTED:
                 hci_cc_write_le_host_supported(hdev, skb);
                 break;
@@ -2688,7 +2748,7 @@ static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
         if (ev->opcode != HCI_OP_NOP)
                 del_timer(&hdev->cmd_timer);
 
-        if (ev->ncmd) {
+        if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
                 atomic_set(&hdev->cmd_cnt, 1);
                 if (!skb_queue_empty(&hdev->cmd_q))
                         queue_work(hdev->workqueue, &hdev->cmd_work);
diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
index 55cceee02a84..23b4e242a31a 100644
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@ -2,6 +2,7 @@
 
 #include <linux/debugfs.h>
 #include <linux/module.h>
+#include <asm/unaligned.h>
 
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
@@ -461,19 +462,18 @@ static const struct file_operations blacklist_fops = {
 
 static void print_bt_uuid(struct seq_file *f, u8 *uuid)
 {
-        __be32 data0, data4;
-        __be16 data1, data2, data3, data5;
+        u32 data0, data5;
+        u16 data1, data2, data3, data4;
 
-        memcpy(&data0, &uuid[0], 4);
-        memcpy(&data1, &uuid[4], 2);
-        memcpy(&data2, &uuid[6], 2);
-        memcpy(&data3, &uuid[8], 2);
-        memcpy(&data4, &uuid[10], 4);
-        memcpy(&data5, &uuid[14], 2);
+        data5 = get_unaligned_le32(uuid);
+        data4 = get_unaligned_le16(uuid + 4);
+        data3 = get_unaligned_le16(uuid + 6);
+        data2 = get_unaligned_le16(uuid + 8);
+        data1 = get_unaligned_le16(uuid + 10);
+        data0 = get_unaligned_le32(uuid + 12);
 
-        seq_printf(f, "%.8x-%.4x-%.4x-%.4x-%.8x%.4x\n",
-                   ntohl(data0), ntohs(data1), ntohs(data2), ntohs(data3),
-                   ntohl(data4), ntohs(data5));
+        seq_printf(f, "%.8x-%.4x-%.4x-%.4x-%.4x%.8x\n",
+                   data0, data1, data2, data3, data4, data5);
 }
 
 static int uuids_show(struct seq_file *f, void *p)
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index b2bcbe2dc328..a7352ff3fd1e 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -931,7 +931,7 @@ static int hidp_setup_hid(struct hidp_session *session,
         hid->version = req->version;
         hid->country = req->country;
 
-        strncpy(hid->name, req->name, 128);
+        strncpy(hid->name, req->name, sizeof(req->name) - 1);
 
         snprintf(hid->phys, sizeof(hid->phys), "%pMR",
                  &bt_sk(session->ctrl_sock->sk)->src);
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 2c78208d793e..7c7e9321f1ea 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1527,17 +1527,12 @@ static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon, u8 status)
         BT_DBG("hcon %p conn %p hchan %p", hcon, conn, hchan);
 
         switch (hcon->type) {
-        case AMP_LINK:
-                conn->mtu = hcon->hdev->block_mtu;
-                break;
-
         case LE_LINK:
                 if (hcon->hdev->le_mtu) {
                         conn->mtu = hcon->hdev->le_mtu;
                         break;
                 }
                 /* fall through */
-
         default:
                 conn->mtu = hcon->hdev->acl_mtu;
                 break;
@@ -3727,6 +3722,17 @@ sendresp:
 static int l2cap_connect_req(struct l2cap_conn *conn,
                              struct l2cap_cmd_hdr *cmd, u8 *data)
 {
+        struct hci_dev *hdev = conn->hcon->hdev;
+        struct hci_conn *hcon = conn->hcon;
+
+        hci_dev_lock(hdev);
+        if (test_bit(HCI_MGMT, &hdev->dev_flags) &&
+            !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &hcon->flags))
+                mgmt_device_connected(hdev, &hcon->dst, hcon->type,
+                                      hcon->dst_type, 0, NULL, 0,
+                                      hcon->dev_class);
+        hci_dev_unlock(hdev);
+
         l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP, 0);
         return 0;
 }
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index f559b966279c..e7f944f52ff2 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -777,14 +777,19 @@ static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
 
         BT_DBG("request for %s", hdev->name);
 
+        if (cp->val != 0x00 && cp->val != 0x01)
+                return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
+                                  MGMT_STATUS_INVALID_PARAMS);
+
         hci_dev_lock(hdev);
 
         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
                 cancel_delayed_work(&hdev->power_off);
 
                 if (cp->val) {
-                        err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
-                        mgmt_powered(hdev, 1);
+                        mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
+                                         data, len);
+                        err = mgmt_powered(hdev, 1);
                         goto failed;
                 }
         }
@@ -807,9 +812,9 @@ static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
         }
 
         if (cp->val)
-                schedule_work(&hdev->power_on);
+                queue_work(hdev->req_workqueue, &hdev->power_on);
         else
-                schedule_work(&hdev->power_off.work);
+                queue_work(hdev->req_workqueue, &hdev->power_off.work);
 
         err = 0;
 
@@ -872,6 +877,10 @@ static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
                                  MGMT_STATUS_NOT_SUPPORTED);
 
+        if (cp->val != 0x00 && cp->val != 0x01)
+                return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
+                                  MGMT_STATUS_INVALID_PARAMS);
+
         timeout = __le16_to_cpu(cp->timeout);
         if (!cp->val && timeout > 0)
                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
@@ -971,6 +980,10 @@ static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
                                   MGMT_STATUS_NOT_SUPPORTED);
 
+        if (cp->val != 0x00 && cp->val != 0x01)
+                return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
+                                  MGMT_STATUS_INVALID_PARAMS);
+
         hci_dev_lock(hdev);
 
         if (!hdev_is_powered(hdev)) {
@@ -1041,6 +1054,10 @@ static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
 
         BT_DBG("request for %s", hdev->name);
 
+        if (cp->val != 0x00 && cp->val != 0x01)
+                return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
+                                  MGMT_STATUS_INVALID_PARAMS);
+
         hci_dev_lock(hdev);
 
         if (cp->val)
@@ -1073,6 +1090,10 @@ static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
                                   MGMT_STATUS_NOT_SUPPORTED);
 
+        if (cp->val != 0x00 && cp->val != 0x01)
+                return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
+                                  MGMT_STATUS_INVALID_PARAMS);
+
         hci_dev_lock(hdev);
 
         if (!hdev_is_powered(hdev)) {
@@ -1133,13 +1154,15 @@ static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
 
         BT_DBG("request for %s", hdev->name);
 
-        hci_dev_lock(hdev);
+        if (!lmp_ssp_capable(hdev))
+                return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
+                                  MGMT_STATUS_NOT_SUPPORTED);
 
-        if (!lmp_ssp_capable(hdev)) {
-                err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
-                                 MGMT_STATUS_NOT_SUPPORTED);
-                goto failed;
-        }
+        if (cp->val != 0x00 && cp->val != 0x01)
+                return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
+                                  MGMT_STATUS_INVALID_PARAMS);
+
+        hci_dev_lock(hdev);
 
         val = !!cp->val;
 
@@ -1199,6 +1222,10 @@ static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
                                   MGMT_STATUS_NOT_SUPPORTED);
 
+        if (cp->val != 0x00 && cp->val != 0x01)
+                return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
+                                  MGMT_STATUS_INVALID_PARAMS);
+
         if (cp->val)
                 set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
         else
@@ -1217,13 +1244,15 @@ static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
 
         BT_DBG("request for %s", hdev->name);
 
-        hci_dev_lock(hdev);
+        if (!lmp_le_capable(hdev))
+                return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
+                                  MGMT_STATUS_NOT_SUPPORTED);
 
-        if (!lmp_le_capable(hdev)) {
-                err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
-                                 MGMT_STATUS_NOT_SUPPORTED);
-                goto unlock;
-        }
+        if (cp->val != 0x00 && cp->val != 0x01)
+                return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
+                                  MGMT_STATUS_INVALID_PARAMS);
+
+        hci_dev_lock(hdev);
 
         val = !!cp->val;
         enabled = lmp_host_le_capable(hdev);
@@ -1332,7 +1361,8 @@ static bool enable_service_cache(struct hci_dev *hdev)
                 return false;
 
         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
-                schedule_delayed_work(&hdev->service_cache, CACHE_TIMEOUT);
+                queue_delayed_work(hdev->workqueue, &hdev->service_cache,
+                                   CACHE_TIMEOUT);
                 return true;
         }
 
@@ -1422,13 +1452,19 @@ static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
 
         BT_DBG("request for %s", hdev->name);
 
-        hci_dev_lock(hdev);
+        if (!lmp_bredr_capable(hdev))
+                return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
+                                  MGMT_STATUS_NOT_SUPPORTED);
 
-        if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
-                err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
-                                 MGMT_STATUS_BUSY);
-                goto unlock;
-        }
+        if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags))
+                return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
+                                  MGMT_STATUS_BUSY);
+
+        if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0)
+                return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
+                                  MGMT_STATUS_INVALID_PARAMS);
+
+        hci_dev_lock(hdev);
 
         hdev->major_class = cp->major;
         hdev->minor_class = cp->minor;
@@ -1483,9 +1519,21 @@ static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
                                   MGMT_STATUS_INVALID_PARAMS);
         }
 
+        if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
+                return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
+                                  MGMT_STATUS_INVALID_PARAMS);
+
         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
                key_count);
 
+        for (i = 0; i < key_count; i++) {
+                struct mgmt_link_key_info *key = &cp->keys[i];
+
+                if (key->addr.type != BDADDR_BREDR)
+                        return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
+                                          MGMT_STATUS_INVALID_PARAMS);
+        }
+
         hci_dev_lock(hdev);
 
         hci_link_keys_clear(hdev);
@@ -1533,12 +1581,22 @@ static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
         struct hci_conn *conn;
         int err;
 
-        hci_dev_lock(hdev);
-
         memset(&rp, 0, sizeof(rp));
         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
         rp.addr.type = cp->addr.type;
 
+        if (!bdaddr_type_is_valid(cp->addr.type))
+                return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
+                                    MGMT_STATUS_INVALID_PARAMS,
+                                    &rp, sizeof(rp));
+
+        if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
+                return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
+                                    MGMT_STATUS_INVALID_PARAMS,
+                                    &rp, sizeof(rp));
+
+        hci_dev_lock(hdev);
+
         if (!hdev_is_powered(hdev)) {
                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
@@ -1596,6 +1654,7 @@ static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
                       u16 len)
 {
         struct mgmt_cp_disconnect *cp = data;
+        struct mgmt_rp_disconnect rp;
         struct hci_cp_disconnect dc;
         struct pending_cmd *cmd;
         struct hci_conn *conn;
@@ -1603,17 +1662,26 @@ static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
 
         BT_DBG("");
 
+        memset(&rp, 0, sizeof(rp));
+        bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
+        rp.addr.type = cp->addr.type;
+
+        if (!bdaddr_type_is_valid(cp->addr.type))
+                return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
+                                    MGMT_STATUS_INVALID_PARAMS,
+                                    &rp, sizeof(rp));
+
         hci_dev_lock(hdev);
 
         if (!test_bit(HCI_UP, &hdev->flags)) {
-                err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
-                                 MGMT_STATUS_NOT_POWERED);
+                err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
+                                   MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
                 goto failed;
         }
 
         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
-                err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
-                                 MGMT_STATUS_BUSY);
+                err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
+                                   MGMT_STATUS_BUSY, &rp, sizeof(rp));
                 goto failed;
         }
 
@@ -1624,8 +1692,8 @@ static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
 
         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
-                err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
-                                 MGMT_STATUS_NOT_CONNECTED);
+                err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
+                                   MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
                 goto failed;
         }
 
@@ -1903,11 +1971,20 @@ static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
 
         BT_DBG("");
 
+        memset(&rp, 0, sizeof(rp));
+        bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
+        rp.addr.type = cp->addr.type;
+
+        if (!bdaddr_type_is_valid(cp->addr.type))
+                return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
+                                    MGMT_STATUS_INVALID_PARAMS,
+                                    &rp, sizeof(rp));
+
         hci_dev_lock(hdev);
 
         if (!hdev_is_powered(hdev)) {
-                err = cmd_status(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
-                                 MGMT_STATUS_NOT_POWERED);
+                err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
+                                   MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
                 goto unlock;
         }
 
@@ -1924,10 +2001,6 @@ static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
                 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
                                    cp->addr.type, sec_level, auth_type);
 
-        memset(&rp, 0, sizeof(rp));
-        bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
-        rp.addr.type = cp->addr.type;
-
         if (IS_ERR(conn)) {
                 int status;
 
@@ -2254,24 +2327,16 @@ static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
 
         hci_dev_lock(hdev);
 
-        if (!hdev_is_powered(hdev)) {
-                err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
-                                   MGMT_STATUS_NOT_POWERED, &cp->addr,
-                                   sizeof(cp->addr));
-                goto unlock;
-        }
-
         err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
                                       cp->randomizer);
         if (err < 0)
                 status = MGMT_STATUS_FAILED;
         else
-                status = 0;
+                status = MGMT_STATUS_SUCCESS;
 
         err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
                            &cp->addr, sizeof(cp->addr));
 
-unlock:
         hci_dev_unlock(hdev);
         return err;
 }
@@ -2287,24 +2352,15 @@ static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
 
         hci_dev_lock(hdev);
 
-        if (!hdev_is_powered(hdev)) {
-                err = cmd_complete(sk, hdev->id,
-                                   MGMT_OP_REMOVE_REMOTE_OOB_DATA,
-                                   MGMT_STATUS_NOT_POWERED, &cp->addr,
-                                   sizeof(cp->addr));
-                goto unlock;
-        }
-
         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
         if (err < 0)
                 status = MGMT_STATUS_INVALID_PARAMS;
         else
-                status = 0;
+                status = MGMT_STATUS_SUCCESS;
 
         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
                            status, &cp->addr, sizeof(cp->addr));
 
-unlock:
         hci_dev_unlock(hdev);
         return err;
 }
@@ -2365,31 +2421,45 @@ static int start_discovery(struct sock *sk, struct hci_dev *hdev,
 
         switch (hdev->discovery.type) {
         case DISCOV_TYPE_BREDR:
-                if (lmp_bredr_capable(hdev))
-                        err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
-                else
-                        err = -ENOTSUPP;
+                if (!lmp_bredr_capable(hdev)) {
+                        err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
+                                         MGMT_STATUS_NOT_SUPPORTED);
+                        mgmt_pending_remove(cmd);
+                        goto failed;
+                }
+
+                err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
                 break;
 
         case DISCOV_TYPE_LE:
-                if (lmp_host_le_capable(hdev))
-                        err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
-                                          LE_SCAN_WIN, LE_SCAN_TIMEOUT_LE_ONLY);
-                else
-                        err = -ENOTSUPP;
+                if (!lmp_host_le_capable(hdev)) {
+                        err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
+                                         MGMT_STATUS_NOT_SUPPORTED);
+                        mgmt_pending_remove(cmd);
+                        goto failed;
+                }
+
+                err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
+                                  LE_SCAN_WIN, LE_SCAN_TIMEOUT_LE_ONLY);
                 break;
 
         case DISCOV_TYPE_INTERLEAVED:
-                if (lmp_host_le_capable(hdev) && lmp_bredr_capable(hdev))
-                        err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
-                                          LE_SCAN_WIN,
-                                          LE_SCAN_TIMEOUT_BREDR_LE);
-                else
-                        err = -ENOTSUPP;
+                if (!lmp_host_le_capable(hdev) || !lmp_bredr_capable(hdev)) {
+                        err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
+                                         MGMT_STATUS_NOT_SUPPORTED);
+                        mgmt_pending_remove(cmd);
+                        goto failed;
+                }
+
+                err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT, LE_SCAN_WIN,
+                                  LE_SCAN_TIMEOUT_BREDR_LE);
                 break;
 
         default:
-                err = -EINVAL;
+                err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
+                                 MGMT_STATUS_INVALID_PARAMS);
+                mgmt_pending_remove(cmd);
+                goto failed;
         }
 
         if (err < 0)
@@ -2510,7 +2580,8 @@ static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
                 hci_inquiry_cache_update_resolve(hdev, e);
         }
 
-        err = 0;
+        err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
+                           sizeof(cp->addr));
 
 failed:
         hci_dev_unlock(hdev);
@@ -2526,13 +2597,18 @@ static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
 
         BT_DBG("%s", hdev->name);
 
+        if (!bdaddr_type_is_valid(cp->addr.type))
+                return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
+                                    MGMT_STATUS_INVALID_PARAMS,
+                                    &cp->addr, sizeof(cp->addr));
+
         hci_dev_lock(hdev);
 
         err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
         if (err < 0)
                 status = MGMT_STATUS_FAILED;
         else
-                status = 0;
+                status = MGMT_STATUS_SUCCESS;
 
         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
                            &cp->addr, sizeof(cp->addr));
@@ -2551,13 +2627,18 @@ static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
 
         BT_DBG("%s", hdev->name);
 
+        if (!bdaddr_type_is_valid(cp->addr.type))
+                return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
+                                    MGMT_STATUS_INVALID_PARAMS,
+                                    &cp->addr, sizeof(cp->addr));
+
         hci_dev_lock(hdev);
 
         err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
         if (err < 0)
                 status = MGMT_STATUS_INVALID_PARAMS;
         else
-                status = 0;
+                status = MGMT_STATUS_SUCCESS;
 
         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
                            &cp->addr, sizeof(cp->addr));
@@ -2612,6 +2693,10 @@ static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
                                   MGMT_STATUS_NOT_SUPPORTED);
 
+        if (cp->val != 0x00 && cp->val != 0x01)
+                return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
+                                  MGMT_STATUS_INVALID_PARAMS);
+
         if (!hdev_is_powered(hdev))
                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
                                   MGMT_STATUS_NOT_POWERED);
@@ -2659,12 +2744,23 @@ done:
         return err;
 }
 
+static bool ltk_is_valid(struct mgmt_ltk_info *key)
+{
+        if (key->authenticated != 0x00 && key->authenticated != 0x01)
+                return false;
+        if (key->master != 0x00 && key->master != 0x01)
+                return false;
+        if (!bdaddr_type_is_le(key->addr.type))
+                return false;
+        return true;
+}
+
 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
                                void *cp_data, u16 len)
 {
         struct mgmt_cp_load_long_term_keys *cp = cp_data;
         u16 key_count, expected_len;
-        int i;
+        int i, err;
 
         key_count = __le16_to_cpu(cp->key_count);
 
@@ -2674,11 +2770,20 @@ static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
                        len, expected_len);
                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
-                                  EINVAL);
+                                  MGMT_STATUS_INVALID_PARAMS);
         }
 
         BT_DBG("%s key_count %u", hdev->name, key_count);
 
+        for (i = 0; i < key_count; i++) {
+                struct mgmt_ltk_info *key = &cp->keys[i];
+
+                if (!ltk_is_valid(key))
+                        return cmd_status(sk, hdev->id,
+                                          MGMT_OP_LOAD_LONG_TERM_KEYS,
+                                          MGMT_STATUS_INVALID_PARAMS);
+        }
+
         hci_dev_lock(hdev);
 
         hci_smp_ltks_clear(hdev);
@@ -2698,9 +2803,12 @@ static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
                             key->enc_size, key->ediv, key->rand);
         }
 
+        err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
+                           NULL, 0);
+
         hci_dev_unlock(hdev);
 
-        return 0;
+        return err;
 }
 
 static const struct mgmt_handler {
@@ -2946,7 +3054,13 @@ int mgmt_powered(struct hci_dev *hdev, u8 powered)
                 }
         } else {
                 u8 status = MGMT_STATUS_NOT_POWERED;
+                u8 zero_cod[] = { 0, 0, 0 };
+
                 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
+
+                if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
+                        mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
+                                   zero_cod, sizeof(zero_cod), NULL);
         }
 
         err = new_settings(hdev, match.sk);
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 531a93d613d4..57f250c20e39 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -352,7 +352,7 @@ static void __sco_sock_close(struct sock *sk)
 
         case BT_CONNECTED:
         case BT_CONFIG:
-                if (sco_pi(sk)->conn) {
+                if (sco_pi(sk)->conn->hcon) {
                         sk->sk_state = BT_DISCONN;
                         sco_sock_set_timer(sk, SCO_DISCONN_TIMEOUT);
                         hci_conn_put(sco_pi(sk)->conn->hcon);
diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index 808338a1bce5..31bf2586fb84 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -83,8 +83,8 @@ void ___ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
         if (drv_ampdu_action(local, sta->sdata, IEEE80211_AMPDU_RX_STOP,
                              &sta->sta, tid, NULL, 0))
                 sdata_info(sta->sdata,
-                           "HW problem - can not stop rx aggregation for tid %d\n",
-                           tid);
+                           "HW problem - can not stop rx aggregation for %pM tid %d\n",
+                           sta->sta.addr, tid);
 
         /* check if this is a self generated aggregation halt */
         if (initiator == WLAN_BACK_RECIPIENT && tx)
@@ -159,7 +159,8 @@ static void sta_rx_agg_session_timer_expired(unsigned long data)
         }
         rcu_read_unlock();
 
-        ht_dbg(sta->sdata, "rx session timer expired on tid %d\n", (u16)*ptid);
+        ht_dbg(sta->sdata, "RX session timer expired on %pM tid %d\n",
+               sta->sta.addr, (u16)*ptid);
 
         set_bit(*ptid, sta->ampdu_mlme.tid_rx_timer_expired);
         ieee80211_queue_work(&sta->local->hw, &sta->ampdu_mlme.work);
@@ -247,7 +248,9 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
         status = WLAN_STATUS_REQUEST_DECLINED;
 
         if (test_sta_flag(sta, WLAN_STA_BLOCK_BA)) {
-                ht_dbg(sta->sdata, "Suspend in progress - Denying ADDBA request\n");
+                ht_dbg(sta->sdata,
+                       "Suspend in progress - Denying ADDBA request (%pM tid %d)\n",
+                       sta->sta.addr, tid);
                 goto end_no_lock;
         }
 
@@ -317,7 +320,8 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
 
         ret = drv_ampdu_action(local, sta->sdata, IEEE80211_AMPDU_RX_START,
                                &sta->sta, tid, &start_seq_num, 0);
-        ht_dbg(sta->sdata, "Rx A-MPDU request on tid %d result %d\n", tid, ret);
+        ht_dbg(sta->sdata, "Rx A-MPDU request on %pM tid %d result %d\n",
+               sta->sta.addr, tid, ret);
         if (ret) {
                 kfree(tid_agg_rx->reorder_buf);
                 kfree(tid_agg_rx->reorder_time);
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index eb9df22418f0..13b7683de5a4 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -149,16 +149,133 @@ void ieee80211_assign_tid_tx(struct sta_info *sta, int tid,
         rcu_assign_pointer(sta->ampdu_mlme.tid_tx[tid], tid_tx);
 }
 
+static inline int ieee80211_ac_from_tid(int tid)
+{
+        return ieee802_1d_to_ac[tid & 7];
+}
+
+/*
+ * When multiple aggregation sessions on multiple stations
+ * are being created/destroyed simultaneously, we need to
+ * refcount the global queue stop caused by that in order
+ * to not get into a situation where one of the aggregation
+ * setup or teardown re-enables queues before the other is
+ * ready to handle that.
+ *
+ * These two functions take care of this issue by keeping
+ * a global "agg_queue_stop" refcount.
+ */
+static void __acquires(agg_queue)
+ieee80211_stop_queue_agg(struct ieee80211_sub_if_data *sdata, int tid)
+{
+        int queue = sdata->vif.hw_queue[ieee80211_ac_from_tid(tid)];
+
+        if (atomic_inc_return(&sdata->local->agg_queue_stop[queue]) == 1)
+                ieee80211_stop_queue_by_reason(
+                        &sdata->local->hw, queue,
+                        IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
+        __acquire(agg_queue);
+}
+
+static void __releases(agg_queue)
+ieee80211_wake_queue_agg(struct ieee80211_sub_if_data *sdata, int tid)
+{
+        int queue = sdata->vif.hw_queue[ieee80211_ac_from_tid(tid)];
+
+        if (atomic_dec_return(&sdata->local->agg_queue_stop[queue]) == 0)
+                ieee80211_wake_queue_by_reason(
+                        &sdata->local->hw, queue,
+                        IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
+        __release(agg_queue);
+}
+
+/*
+ * splice packets from the STA's pending to the local pending,
+ * requires a call to ieee80211_agg_splice_finish later
+ */
+static void __acquires(agg_queue)
+ieee80211_agg_splice_packets(struct ieee80211_sub_if_data *sdata,
+                             struct tid_ampdu_tx *tid_tx, u16 tid)
+{
+        struct ieee80211_local *local = sdata->local;
+        int queue = sdata->vif.hw_queue[ieee80211_ac_from_tid(tid)];
+        unsigned long flags;
+
+        ieee80211_stop_queue_agg(sdata, tid);
+
+        if (WARN(!tid_tx,
+                 "TID %d gone but expected when splicing aggregates from the pending queue\n",
+                 tid))
+                return;
+
+        if (!skb_queue_empty(&tid_tx->pending)) {
+                spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
+                /* copy over remaining packets */
+                skb_queue_splice_tail_init(&tid_tx->pending,
+                                           &local->pending[queue]);
+                spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
+        }
+}
+
+static void __releases(agg_queue)
+ieee80211_agg_splice_finish(struct ieee80211_sub_if_data *sdata, u16 tid)
+{
+        ieee80211_wake_queue_agg(sdata, tid);
+}
+
+static void ieee80211_remove_tid_tx(struct sta_info *sta, int tid)
+{
+        struct tid_ampdu_tx *tid_tx;
+
+        lockdep_assert_held(&sta->ampdu_mlme.mtx);
+        lockdep_assert_held(&sta->lock);
+
+        tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
+
+        /*
+         * When we get here, the TX path will not be lockless any more wrt.
+         * aggregation, since the OPERATIONAL bit has long been cleared.
+         * Thus it will block on getting the lock, if it occurs. So if we
+         * stop the queue now, we will not get any more packets, and any
+         * that might be being processed will wait for us here, thereby
+         * guaranteeing that no packets go to the tid_tx pending queue any
+         * more.
+         */
+
+        ieee80211_agg_splice_packets(sta->sdata, tid_tx, tid);
+
+        /* future packets must not find the tid_tx struct any more */
+        ieee80211_assign_tid_tx(sta, tid, NULL);
+
+        ieee80211_agg_splice_finish(sta->sdata, tid);
+
+        kfree_rcu(tid_tx, rcu_head);
+}
+
 int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
-                                    enum ieee80211_back_parties initiator,
-                                    bool tx)
+                                    enum ieee80211_agg_stop_reason reason)
 {
         struct ieee80211_local *local = sta->local;
         struct tid_ampdu_tx *tid_tx;
+        enum ieee80211_ampdu_mlme_action action;
         int ret;
 
         lockdep_assert_held(&sta->ampdu_mlme.mtx);
 
+        switch (reason) {
+        case AGG_STOP_DECLINED:
+        case AGG_STOP_LOCAL_REQUEST:
+        case AGG_STOP_PEER_REQUEST:
+                action = IEEE80211_AMPDU_TX_STOP_CONT;
+                break;
+        case AGG_STOP_DESTROY_STA:
+                action = IEEE80211_AMPDU_TX_STOP_FLUSH;
+                break;
+        default:
+                WARN_ON_ONCE(1);
+                return -EINVAL;
+        }
+
         spin_lock_bh(&sta->lock);
 
         tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
@@ -167,10 +284,19 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
                 return -ENOENT;
         }
 
-        /* if we're already stopping ignore any new requests to stop */
+        /*
+         * if we're already stopping ignore any new requests to stop
+         * unless we're destroying it in which case notify the driver
+         */
         if (test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
                 spin_unlock_bh(&sta->lock);
-                return -EALREADY;
+                if (reason != AGG_STOP_DESTROY_STA)
+                        return -EALREADY;
+                ret = drv_ampdu_action(local, sta->sdata,
+                                       IEEE80211_AMPDU_TX_STOP_FLUSH_CONT,
+                                       &sta->sta, tid, NULL, 0);
+                WARN_ON_ONCE(ret);
+                return 0;
         }
 
         if (test_bit(HT_AGG_STATE_WANT_START, &tid_tx->state)) {
@@ -212,11 +338,12 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
          */
         synchronize_net();
 
-        tid_tx->stop_initiator = initiator;
-        tid_tx->tx_stop = tx;
+        tid_tx->stop_initiator = reason == AGG_STOP_PEER_REQUEST ?
+                                        WLAN_BACK_RECIPIENT :
+                                        WLAN_BACK_INITIATOR;
+        tid_tx->tx_stop = reason == AGG_STOP_LOCAL_REQUEST;
 
-        ret = drv_ampdu_action(local, sta->sdata,
-                               IEEE80211_AMPDU_TX_STOP,
+        ret = drv_ampdu_action(local, sta->sdata, action,
                                &sta->sta, tid, NULL, 0);
 
         /* HW shall not deny going back to legacy */
@@ -227,7 +354,17 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
                  */
         }
 
-        return ret;
+        /*
+         * In the case of AGG_STOP_DESTROY_STA, the driver won't
+         * necessarily call ieee80211_stop_tx_ba_cb(), so this may
+         * seem like we can leave the tid_tx data pending forever.
+         * This is true, in a way, but "forever" is only until the
+         * station struct is actually destroyed. In the meantime,
+         * leaving it around ensures that we don't transmit packets
+         * to the driver on this TID which might confuse it.
+         */
+
+        return 0;
 }
 
 /*
@@ -253,91 +390,18 @@ static void sta_addba_resp_timer_expired(unsigned long data)
             test_bit(HT_AGG_STATE_RESPONSE_RECEIVED, &tid_tx->state)) {
                 rcu_read_unlock();
                 ht_dbg(sta->sdata,
-                       "timer expired on tid %d but we are not (or no longer) expecting addBA response there\n",
-                       tid);
+                       "timer expired on %pM tid %d but we are not (or no longer) expecting addBA response there\n",
+                       sta->sta.addr, tid);
                 return;
         }
 
-        ht_dbg(sta->sdata, "addBA response timer expired on tid %d\n", tid);
+        ht_dbg(sta->sdata, "addBA response timer expired on %pM tid %d\n",
+               sta->sta.addr, tid);
 
         ieee80211_stop_tx_ba_session(&sta->sta, tid);
         rcu_read_unlock();
 }
 
-static inline int ieee80211_ac_from_tid(int tid)
-{
-        return ieee802_1d_to_ac[tid & 7];
-}
-
-/*
- * When multiple aggregation sessions on multiple stations
- * are being created/destroyed simultaneously, we need to
- * refcount the global queue stop caused by that in order
- * to not get into a situation where one of the aggregation
- * setup or teardown re-enables queues before the other is
- * ready to handle that.
- *
- * These two functions take care of this issue by keeping
- * a global "agg_queue_stop" refcount.
- */
-static void __acquires(agg_queue)
-ieee80211_stop_queue_agg(struct ieee80211_sub_if_data *sdata, int tid)
-{
-        int queue = sdata->vif.hw_queue[ieee80211_ac_from_tid(tid)];
-
-        if (atomic_inc_return(&sdata->local->agg_queue_stop[queue]) == 1)
-                ieee80211_stop_queue_by_reason(
-                        &sdata->local->hw, queue,
-                        IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
-        __acquire(agg_queue);
-}
-
-static void __releases(agg_queue)
-ieee80211_wake_queue_agg(struct ieee80211_sub_if_data *sdata, int tid)
-{
-        int queue = sdata->vif.hw_queue[ieee80211_ac_from_tid(tid)];
-
-        if (atomic_dec_return(&sdata->local->agg_queue_stop[queue]) == 0)
-                ieee80211_wake_queue_by_reason(
-                        &sdata->local->hw, queue,
-                        IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
-        __release(agg_queue);
-}
-
-/*
- * splice packets from the STA's pending to the local pending,
- * requires a call to ieee80211_agg_splice_finish later
- */
-static void __acquires(agg_queue)
-ieee80211_agg_splice_packets(struct ieee80211_sub_if_data *sdata,
-                             struct tid_ampdu_tx *tid_tx, u16 tid)
-{
-        struct ieee80211_local *local = sdata->local;
-        int queue = sdata->vif.hw_queue[ieee80211_ac_from_tid(tid)];
-        unsigned long flags;
-
-        ieee80211_stop_queue_agg(sdata, tid);
-
-        if (WARN(!tid_tx,
-                 "TID %d gone but expected when splicing aggregates from the pending queue\n",
-                 tid))
-                return;
-
-        if (!skb_queue_empty(&tid_tx->pending)) {
-                spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
-                /* copy over remaining packets */
-                skb_queue_splice_tail_init(&tid_tx->pending,
-                                           &local->pending[queue]);
-                spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
-        }
-}
-
-static void __releases(agg_queue)
-ieee80211_agg_splice_finish(struct ieee80211_sub_if_data *sdata, u16 tid)
-{
-        ieee80211_wake_queue_agg(sdata, tid);
-}
-
 void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid)
 {
         struct tid_ampdu_tx *tid_tx;
@@ -369,7 +433,8 @@ void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid)
                                &sta->sta, tid, &start_seq_num, 0);
         if (ret) {
                 ht_dbg(sdata,
-                       "BA request denied - HW unavailable for tid %d\n", tid);
+                       "BA request denied - HW unavailable for %pM tid %d\n",
+                       sta->sta.addr, tid);
                 spin_lock_bh(&sta->lock);
                 ieee80211_agg_splice_packets(sdata, tid_tx, tid);
                 ieee80211_assign_tid_tx(sta, tid, NULL);
@@ -382,7 +447,8 @@ void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid)
 
         /* activate the timer for the recipient's addBA response */
         mod_timer(&tid_tx->addba_resp_timer, jiffies + ADDBA_RESP_INTERVAL);
-        ht_dbg(sdata, "activated addBA response timer on tid %d\n", tid);
+        ht_dbg(sdata, "activated addBA response timer on %pM tid %d\n",
+               sta->sta.addr, tid);
 
         spin_lock_bh(&sta->lock);
         sta->ampdu_mlme.last_addba_req_time[tid] = jiffies;
@@ -429,7 +495,8 @@ static void sta_tx_agg_session_timer_expired(unsigned long data)
 
         rcu_read_unlock();
 
-        ht_dbg(sta->sdata, "tx session timer expired on tid %d\n", (u16)*ptid);
+        ht_dbg(sta->sdata, "tx session timer expired on %pM tid %d\n",
+               sta->sta.addr, (u16)*ptid);
 
         ieee80211_stop_tx_ba_session(&sta->sta, *ptid);
 }
@@ -465,7 +532,8 @@ int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid,
 
         if (test_sta_flag(sta, WLAN_STA_BLOCK_BA)) {
                 ht_dbg(sdata,
-                       "BA sessions blocked - Denying BA session request\n");
+                       "BA sessions blocked - Denying BA session request %pM tid %d\n",
+                       sta->sta.addr, tid);
                 return -EINVAL;
         }
 
@@ -506,8 +574,8 @@ int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid,
             time_before(jiffies, sta->ampdu_mlme.last_addba_req_time[tid] +
                         HT_AGG_RETRIES_PERIOD)) {
                 ht_dbg(sdata,
-                       "BA request denied - waiting a grace period after %d failed requests on tid %u\n",
-                       sta->ampdu_mlme.addba_req_num[tid], tid);
+                       "BA request denied - waiting a grace period after %d failed requests on %pM tid %u\n",
+                       sta->ampdu_mlme.addba_req_num[tid], sta->sta.addr, tid);
                 ret = -EBUSY;
                 goto err_unlock_sta;
         }
@@ -516,8 +584,8 @@ int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid,
         /* check if the TID is not in aggregation flow already */
         if (tid_tx || sta->ampdu_mlme.tid_start_tx[tid]) {
                 ht_dbg(sdata,
-                       "BA request denied - session is not idle on tid %u\n",
-                       tid);
+                       "BA request denied - session is not idle on %pM tid %u\n",
+                       sta->sta.addr, tid);
                 ret = -EAGAIN;
                 goto err_unlock_sta;
         }
@@ -572,7 +640,8 @@ static void ieee80211_agg_tx_operational(struct ieee80211_local *local,
 
         tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
 
-        ht_dbg(sta->sdata, "Aggregation is on for tid %d\n", tid);
+        ht_dbg(sta->sdata, "Aggregation is on for %pM tid %d\n",
+               sta->sta.addr, tid);
 
         drv_ampdu_action(local, sta->sdata,
                          IEEE80211_AMPDU_TX_OPERATIONAL,
@@ -660,14 +729,13 @@ void ieee80211_start_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
 EXPORT_SYMBOL(ieee80211_start_tx_ba_cb_irqsafe);
 
 int __ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
-                                   enum ieee80211_back_parties initiator,
-                                   bool tx)
+                                   enum ieee80211_agg_stop_reason reason)
 {
         int ret;
 
         mutex_lock(&sta->ampdu_mlme.mtx);
 
-        ret = ___ieee80211_stop_tx_ba_session(sta, tid, initiator, tx);
+        ret = ___ieee80211_stop_tx_ba_session(sta, tid, reason);
 
         mutex_unlock(&sta->ampdu_mlme.mtx);
 
@@ -743,7 +811,9 @@ void ieee80211_stop_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u8 tid)
         tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
 
         if (!tid_tx || !test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
-                ht_dbg(sdata, "unexpected callback to A-MPDU stop\n");
+                ht_dbg(sdata,
+                       "unexpected callback to A-MPDU stop for %pM tid %d\n",
+                       sta->sta.addr, tid);
                 goto unlock_sta;
         }
 
@@ -751,24 +821,7 @@ void ieee80211_stop_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u8 tid)
                 ieee80211_send_delba(sta->sdata, ra, tid,
                         WLAN_BACK_INITIATOR, WLAN_REASON_QSTA_NOT_USE);
 
-        /*
-         * When we get here, the TX path will not be lockless any more wrt.
-         * aggregation, since the OPERATIONAL bit has long been cleared.
-         * Thus it will block on getting the lock, if it occurs. So if we
-         * stop the queue now, we will not get any more packets, and any
-         * that might be being processed will wait for us here, thereby
-         * guaranteeing that no packets go to the tid_tx pending queue any
-         * more.
-         */
-
-        ieee80211_agg_splice_packets(sta->sdata, tid_tx, tid);
-
-        /* future packets must not find the tid_tx struct any more */
-        ieee80211_assign_tid_tx(sta, tid, NULL);
-
-        ieee80211_agg_splice_finish(sta->sdata, tid);
-
-        kfree_rcu(tid_tx, rcu_head);
+        ieee80211_remove_tid_tx(sta, tid);
 
  unlock_sta:
         spin_unlock_bh(&sta->lock);
@@ -819,13 +872,15 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
                 goto out;
 
         if (mgmt->u.action.u.addba_resp.dialog_token != tid_tx->dialog_token) {
-                ht_dbg(sta->sdata, "wrong addBA response token, tid %d\n", tid);
+                ht_dbg(sta->sdata, "wrong addBA response token, %pM tid %d\n",
+                       sta->sta.addr, tid);
                 goto out;
         }
 
         del_timer_sync(&tid_tx->addba_resp_timer);
 
-        ht_dbg(sta->sdata, "switched off addBA timer for tid %d\n", tid);
+        ht_dbg(sta->sdata, "switched off addBA timer for %pM tid %d\n",
+               sta->sta.addr, tid);
 
         /*
          * addba_resp_timer may have fired before we got here, and
@@ -835,8 +890,8 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
         if (test_bit(HT_AGG_STATE_WANT_STOP, &tid_tx->state) ||
             test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
                 ht_dbg(sta->sdata,
-                       "got addBA resp for tid %d but we already gave up\n",
-                       tid);
+                       "got addBA resp for %pM tid %d but we already gave up\n",
+                       sta->sta.addr, tid);
                 goto out;
         }
 
@@ -868,8 +923,7 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
                 }
 
         } else {
-                ___ieee80211_stop_tx_ba_session(sta, tid, WLAN_BACK_INITIATOR,
-                                                false);
+                ___ieee80211_stop_tx_ba_session(sta, tid, AGG_STOP_DECLINED);
         }
 
  out:
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 5c61677487cf..661b878bd19c 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -164,7 +164,17 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev,
                         sta = sta_info_get(sdata, mac_addr);
                 else
                         sta = sta_info_get_bss(sdata, mac_addr);
-                if (!sta) {
+                /*
+                 * The ASSOC test makes sure the driver is ready to
+                 * receive the key. When wpa_supplicant has roamed
+                 * using FT, it attempts to set the key before
+                 * association has completed, this rejects that attempt
+                 * so it will set the key again after assocation.
+                 *
+                 * TODO: accept the key if we have a station entry and
+                 *       add it to the device after the station.
+                 */
+                if (!sta || !test_sta_flag(sta, WLAN_STA_ASSOC)) {
                         ieee80211_key_free(sdata->local, key);
                         err = -ENOENT;
                         goto out_unlock;
@@ -510,6 +520,7 @@ static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
                                 BIT(NL80211_STA_FLAG_WME) |
                                 BIT(NL80211_STA_FLAG_MFP) |
                                 BIT(NL80211_STA_FLAG_AUTHENTICATED) |
+                                BIT(NL80211_STA_FLAG_ASSOCIATED) |
                                 BIT(NL80211_STA_FLAG_TDLS_PEER);
         if (test_sta_flag(sta, WLAN_STA_AUTHORIZED))
                 sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_AUTHORIZED);
@@ -521,6 +532,8 @@ static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
                 sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_MFP);
         if (test_sta_flag(sta, WLAN_STA_AUTH))
                 sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_AUTHENTICATED);
+        if (test_sta_flag(sta, WLAN_STA_ASSOC))
+                sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_ASSOCIATED);
         if (test_sta_flag(sta, WLAN_STA_TDLS_PEER))
                 sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_TDLS_PEER);
 }
@@ -930,6 +943,7 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev,
 
         sdata->vif.bss_conf.beacon_int = params->beacon_interval;
         sdata->vif.bss_conf.dtim_period = params->dtim_period;
+        sdata->vif.bss_conf.enable_beacon = true;
 
         sdata->vif.bss_conf.ssid_len = params->ssid_len;
         if (params->ssid_len)
@@ -1009,7 +1023,16 @@ static int ieee80211_stop_ap(struct wiphy *wiphy, struct net_device *dev)
         if (old_probe_resp)
                 kfree_rcu(old_probe_resp, rcu_head);
 
-        sta_info_flush(local, sdata);
+        list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
+                sta_info_flush_defer(vlan);
+        sta_info_flush_defer(sdata);
+        rcu_barrier();
+        list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
+                sta_info_flush_cleanup(vlan);
+        sta_info_flush_cleanup(sdata);
+
+        sdata->vif.bss_conf.enable_beacon = false;
+        clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED, &sdata->state);
         ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED);
 
         drv_stop_ap(sdata->local, sdata);
@@ -1067,6 +1090,58 @@ static void ieee80211_send_layer2_update(struct sta_info *sta)
         netif_rx_ni(skb);
 }
 
+static int sta_apply_auth_flags(struct ieee80211_local *local,
+                                struct sta_info *sta,
+                                u32 mask, u32 set)
+{
+        int ret;
+
+        if (mask & BIT(NL80211_STA_FLAG_AUTHENTICATED) &&
+            set & BIT(NL80211_STA_FLAG_AUTHENTICATED) &&
+            !test_sta_flag(sta, WLAN_STA_AUTH)) {
+                ret = sta_info_move_state(sta, IEEE80211_STA_AUTH);
+                if (ret)
+                        return ret;
+        }
+
+        if (mask & BIT(NL80211_STA_FLAG_ASSOCIATED) &&
+            set & BIT(NL80211_STA_FLAG_ASSOCIATED) &&
+            !test_sta_flag(sta, WLAN_STA_ASSOC)) {
+                ret = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
+                if (ret)
+                        return ret;
+        }
+
+        if (mask & BIT(NL80211_STA_FLAG_AUTHORIZED)) {
+                if (set & BIT(NL80211_STA_FLAG_AUTHORIZED))
+                        ret = sta_info_move_state(sta, IEEE80211_STA_AUTHORIZED);
+                else if (test_sta_flag(sta, WLAN_STA_AUTHORIZED))
+                        ret = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
+                else
+                        ret = 0;
+                if (ret)
+                        return ret;
+        }
+
+        if (mask & BIT(NL80211_STA_FLAG_ASSOCIATED) &&
+            !(set & BIT(NL80211_STA_FLAG_ASSOCIATED)) &&
+            test_sta_flag(sta, WLAN_STA_ASSOC)) {
+                ret = sta_info_move_state(sta, IEEE80211_STA_AUTH);
+                if (ret)
+                        return ret;
+        }
+
+        if (mask & BIT(NL80211_STA_FLAG_AUTHENTICATED) &&
+            !(set & BIT(NL80211_STA_FLAG_AUTHENTICATED)) &&
+            test_sta_flag(sta, WLAN_STA_AUTH)) {
+                ret = sta_info_move_state(sta, IEEE80211_STA_NONE);
+                if (ret)
+                        return ret;
+        }
+
+        return 0;
+}
+
 static int sta_apply_parameters(struct ieee80211_local *local,
                                 struct sta_info *sta,
                                 struct station_parameters *params)
@@ -1084,52 +1159,20 @@ static int sta_apply_parameters(struct ieee80211_local *local,
         mask = params->sta_flags_mask;
         set = params->sta_flags_set;
 
-        /*
-         * In mesh mode, we can clear AUTHENTICATED flag but must
-         * also make ASSOCIATED follow appropriately for the driver
-         * API. See also below, after AUTHORIZED changes.
-         */
-        if (mask & BIT(NL80211_STA_FLAG_AUTHENTICATED)) {
-                /* cfg80211 should not allow this in non-mesh modes */
-                if (WARN_ON(!ieee80211_vif_is_mesh(&sdata->vif)))
-                        return -EINVAL;
-
-                if (set & BIT(NL80211_STA_FLAG_AUTHENTICATED) &&
-                    !test_sta_flag(sta, WLAN_STA_AUTH)) {
-                        ret = sta_info_move_state(sta, IEEE80211_STA_AUTH);
-                        if (ret)
-                                return ret;
-                        ret = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
-                        if (ret)
-                                return ret;
-                }
-        }
-
-        if (mask & BIT(NL80211_STA_FLAG_AUTHORIZED)) {
-                if (set & BIT(NL80211_STA_FLAG_AUTHORIZED))
-                        ret = sta_info_move_state(sta, IEEE80211_STA_AUTHORIZED);
-                else if (test_sta_flag(sta, WLAN_STA_AUTHORIZED))
-                        ret = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
-                if (ret)
-                        return ret;
-        }
-
-        if (mask & BIT(NL80211_STA_FLAG_AUTHENTICATED)) {
-                /* cfg80211 should not allow this in non-mesh modes */
-                if (WARN_ON(!ieee80211_vif_is_mesh(&sdata->vif)))
-                        return -EINVAL;
-
-                if (!(set & BIT(NL80211_STA_FLAG_AUTHENTICATED)) &&
-                    test_sta_flag(sta, WLAN_STA_AUTH)) {
-                        ret = sta_info_move_state(sta, IEEE80211_STA_AUTH);
-                        if (ret)
-                                return ret;
-                        ret = sta_info_move_state(sta, IEEE80211_STA_NONE);
-                        if (ret)
-                                return ret;
-                }
+        if (ieee80211_vif_is_mesh(&sdata->vif)) {
+                /*
+                 * In mesh mode, ASSOCIATED isn't part of the nl80211
+                 * API but must follow AUTHENTICATED for driver state.
+                 */
+                if (mask & BIT(NL80211_STA_FLAG_AUTHENTICATED))
+                        mask |= BIT(NL80211_STA_FLAG_ASSOCIATED);
+                if (set & BIT(NL80211_STA_FLAG_AUTHENTICATED))
+                        set |= BIT(NL80211_STA_FLAG_ASSOCIATED);
         }
 
+        ret = sta_apply_auth_flags(local, sta, mask, set);
+        if (ret)
+                return ret;
 
         if (mask & BIT(NL80211_STA_FLAG_SHORT_PREAMBLE)) {
                 if (set & BIT(NL80211_STA_FLAG_SHORT_PREAMBLE))
@@ -1175,10 +1218,11 @@ static int sta_apply_parameters(struct ieee80211_local *local,
                 sta->sta.aid = params->aid;
 
         /*
-         * FIXME: updating the following information is racy when this
-         *        function is called from ieee80211_change_station().
-         *        However, all this information should be static so
-         *        maybe we should just reject attemps to change it.
+         * Some of the following updates would be racy if called on an
+         * existing station, via ieee80211_change_station(). However,
+         * all such changes are rejected by cfg80211 except for updates
+         * changing the supported rates on an existing but not yet used
+         * TDLS peer.
          */
 
         if (params->listen_interval >= 0)
@@ -1209,18 +1253,33 @@ static int sta_apply_parameters(struct ieee80211_local *local,
 
         if (ieee80211_vif_is_mesh(&sdata->vif)) {
 #ifdef CONFIG_MAC80211_MESH
-                if (sdata->u.mesh.security & IEEE80211_MESH_SEC_SECURED)
+                if (sdata->u.mesh.security & IEEE80211_MESH_SEC_SECURED) {
+                        u32 changed = 0;
+
                         switch (params->plink_state) {
-                        case NL80211_PLINK_LISTEN:
                         case NL80211_PLINK_ESTAB:
+                                if (sta->plink_state != NL80211_PLINK_ESTAB)
+                                        changed = mesh_plink_inc_estab_count(
+                                                        sdata);
+                                sta->plink_state = params->plink_state;
+                                break;
+                        case NL80211_PLINK_LISTEN:
                         case NL80211_PLINK_BLOCKED:
+                        case NL80211_PLINK_OPN_SNT:
+                        case NL80211_PLINK_OPN_RCVD:
+                        case NL80211_PLINK_CNF_RCVD:
+                        case NL80211_PLINK_HOLDING:
+                                if (sta->plink_state == NL80211_PLINK_ESTAB)
+                                        changed = mesh_plink_dec_estab_count(
+                                                        sdata);
                                 sta->plink_state = params->plink_state;
                                 break;
                         default:
                                 /*  nothing  */
                                 break;
                         }
-                else
+                        ieee80211_bss_info_change_notify(sdata, changed);
+                } else {
                         switch (params->plink_action) {
                         case PLINK_ACTION_OPEN:
                                 mesh_plink_open(sta);
@@ -1229,6 +1288,7 @@ static int sta_apply_parameters(struct ieee80211_local *local,
                                 mesh_plink_block(sta);
                                 break;
                         }
+                }
 #endif
         }
 
@@ -1263,6 +1323,10 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
         if (!sta)
                 return -ENOMEM;
 
+        /*
+         * defaults -- if userspace wants something else we'll
+         * change it accordingly in sta_apply_parameters()
+         */
         sta_info_pre_move_state(sta, IEEE80211_STA_AUTH);
         sta_info_pre_move_state(sta, IEEE80211_STA_ASSOC);
 
@@ -1299,7 +1363,6 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
 static int ieee80211_del_station(struct wiphy *wiphy, struct net_device *dev,
                                  u8 *mac)
 {
-        struct ieee80211_local *local = wiphy_priv(wiphy);
         struct ieee80211_sub_if_data *sdata;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
@@ -1307,7 +1370,7 @@ static int ieee80211_del_station(struct wiphy *wiphy, struct net_device *dev,
         if (mac)
                 return sta_info_destroy_addr_bss(sdata, mac);
 
-        sta_info_flush(local, sdata);
+        sta_info_flush(sdata);
         return 0;
 }
 
@@ -1613,6 +1676,9 @@ static int copy_mesh_setup(struct ieee80211_if_mesh *ifmsh,
         memcpy(sdata->vif.bss_conf.mcast_rate, setup->mcast_rate,
                                                 sizeof(setup->mcast_rate));
 
+        sdata->vif.bss_conf.beacon_int = setup->beacon_interval;
+        sdata->vif.bss_conf.dtim_period = setup->dtim_period;
+
         return 0;
 }
 
@@ -2195,7 +2261,8 @@ static int ieee80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *dev,
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 
-        if (sdata->vif.type != NL80211_IFTYPE_STATION)
+        if (sdata->vif.type != NL80211_IFTYPE_STATION &&
+            sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
                 return -EOPNOTSUPP;
 
         if (!(local->hw.flags & IEEE80211_HW_SUPPORTS_PS))
diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
index 53f03120db55..1bfe0a8b19d2 100644
--- a/net/mac80211/chan.c
+++ b/net/mac80211/chan.c
@@ -4,6 +4,7 @@
 
 #include <linux/nl80211.h>
 #include <linux/export.h>
+#include <linux/rtnetlink.h>
 #include <net/cfg80211.h>
 #include "ieee80211_i.h"
 #include "driver-ops.h"
@@ -197,6 +198,15 @@ static void __ieee80211_vif_release_channel(struct ieee80211_sub_if_data *sdata)
 
         ctx = container_of(conf, struct ieee80211_chanctx, conf);
 
+        if (sdata->vif.type == NL80211_IFTYPE_AP) {
+                struct ieee80211_sub_if_data *vlan;
+
+                /* for the VLAN list */
+                ASSERT_RTNL();
+                list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
+                        rcu_assign_pointer(vlan->vif.chanctx_conf, NULL);
+        }
+
         ieee80211_unassign_vif_chanctx(sdata, ctx);
         if (ctx->refcount == 0)
                 ieee80211_free_chanctx(local, ctx);
@@ -316,6 +326,15 @@ int ieee80211_vif_use_channel(struct ieee80211_sub_if_data *sdata,
                 goto out;
         }
 
+        if (sdata->vif.type == NL80211_IFTYPE_AP) {
+                struct ieee80211_sub_if_data *vlan;
+
+                /* for the VLAN list */
+                ASSERT_RTNL();
+                list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
+                        rcu_assign_pointer(vlan->vif.chanctx_conf, &ctx->conf);
+        }
+
         ieee80211_recalc_smps_chanctx(local, ctx);
  out:
         mutex_unlock(&local->chanctx_mtx);
@@ -331,6 +350,25 @@ void ieee80211_vif_release_channel(struct ieee80211_sub_if_data *sdata)
         mutex_unlock(&sdata->local->chanctx_mtx);
 }
 
+void ieee80211_vif_vlan_copy_chanctx(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_sub_if_data *ap;
+        struct ieee80211_chanctx_conf *conf;
+
+        if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->bss))
+                return;
+
+        ap = container_of(sdata->bss, struct ieee80211_sub_if_data, u.ap);
+
+        mutex_lock(&local->chanctx_mtx);
+
+        conf = rcu_dereference_protected(ap->vif.chanctx_conf,
+                                         lockdep_is_held(&local->chanctx_mtx));
+        rcu_assign_pointer(sdata->vif.chanctx_conf, conf);
+        mutex_unlock(&local->chanctx_mtx);
+}
+
 void ieee80211_iter_chan_contexts_atomic(
         struct ieee80211_hw *hw,
         void (*iter)(struct ieee80211_hw *hw,
@@ -343,7 +381,8 @@ void ieee80211_iter_chan_contexts_atomic(
 
         rcu_read_lock();
         list_for_each_entry_rcu(ctx, &local->chanctx_list, list)
-                iter(hw, &ctx->conf, iter_data);
+                if (ctx->driver_present)
+                        iter(hw, &ctx->conf, iter_data);
         rcu_read_unlock();
 }
 EXPORT_SYMBOL_GPL(ieee80211_iter_chan_contexts_atomic);
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index 698dc7e6f309..434b3c4f31b5 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -207,6 +207,14 @@ static inline void drv_bss_info_changed(struct ieee80211_local *local,
 {
         might_sleep();
 
+        WARN_ON_ONCE(changed & (BSS_CHANGED_BEACON |
+                                BSS_CHANGED_BEACON_ENABLED) &&
+                     sdata->vif.type != NL80211_IFTYPE_AP &&
+                     sdata->vif.type != NL80211_IFTYPE_ADHOC &&
+                     sdata->vif.type != NL80211_IFTYPE_MESH_POINT);
+        WARN_ON_ONCE(sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE &&
+                     changed & ~BSS_CHANGED_IDLE);
+
         check_sdata_in_driver(sdata);
 
         trace_drv_bss_info_changed(local, sdata, info, changed);
@@ -561,7 +569,8 @@ static inline void drv_sta_rc_update(struct ieee80211_local *local,
         check_sdata_in_driver(sdata);
 
         WARN_ON(changed & IEEE80211_RC_SUPP_RATES_CHANGED &&
-                sdata->vif.type != NL80211_IFTYPE_ADHOC);
+                (sdata->vif.type != NL80211_IFTYPE_ADHOC &&
+                 sdata->vif.type != NL80211_IFTYPE_MESH_POINT));
 
         trace_drv_sta_rc_update(local, sdata, sta, changed);
         if (local->ops->sta_rc_update)
@@ -837,11 +846,12 @@ static inline void drv_set_rekey_data(struct ieee80211_local *local,
 }
 
 static inline void drv_rssi_callback(struct ieee80211_local *local,
+                                     struct ieee80211_sub_if_data *sdata,
                                      const enum ieee80211_rssi_event event)
 {
-        trace_drv_rssi_callback(local, event);
+        trace_drv_rssi_callback(local, sdata, event);
         if (local->ops->rssi_callback)
-                local->ops->rssi_callback(&local->hw, event);
+                local->ops->rssi_callback(&local->hw, &sdata->vif, event);
         trace_drv_return_void(local);
 }
 
@@ -913,6 +923,8 @@ static inline int drv_add_chanctx(struct ieee80211_local *local,
         if (local->ops->add_chanctx)
                 ret = local->ops->add_chanctx(&local->hw, &ctx->conf);
         trace_drv_return_int(local, ret);
+        if (!ret)
+                ctx->driver_present = true;
 
         return ret;
 }
@@ -924,6 +936,7 @@ static inline void drv_remove_chanctx(struct ieee80211_local *local,
         if (local->ops->remove_chanctx)
                 local->ops->remove_chanctx(&local->hw, &ctx->conf);
         trace_drv_return_void(local);
+        ctx->driver_present = false;
 }
 
 static inline void drv_change_chanctx(struct ieee80211_local *local,
@@ -931,8 +944,10 @@ static inline void drv_change_chanctx(struct ieee80211_local *local,
                                       u32 changed)
 {
         trace_drv_change_chanctx(local, ctx, changed);
-        if (local->ops->change_chanctx)
+        if (local->ops->change_chanctx) {
+                WARN_ON_ONCE(!ctx->driver_present);
                 local->ops->change_chanctx(&local->hw, &ctx->conf, changed);
+        }
         trace_drv_return_void(local);
 }
 
@@ -945,10 +960,12 @@ static inline int drv_assign_vif_chanctx(struct ieee80211_local *local,
         check_sdata_in_driver(sdata);
 
         trace_drv_assign_vif_chanctx(local, sdata, ctx);
-        if (local->ops->assign_vif_chanctx)
+        if (local->ops->assign_vif_chanctx) {
+                WARN_ON_ONCE(!ctx->driver_present);
                 ret = local->ops->assign_vif_chanctx(&local->hw,
                                                      &sdata->vif,
                                                      &ctx->conf);
+        }
         trace_drv_return_int(local, ret);
 
         return ret;
@@ -961,10 +978,12 @@ static inline void drv_unassign_vif_chanctx(struct ieee80211_local *local,
         check_sdata_in_driver(sdata);
 
         trace_drv_unassign_vif_chanctx(local, sdata, ctx);
-        if (local->ops->unassign_vif_chanctx)
+        if (local->ops->unassign_vif_chanctx) {
+                WARN_ON_ONCE(!ctx->driver_present);
                 local->ops->unassign_vif_chanctx(&local->hw,
                                                  &sdata->vif,
                                                  &ctx->conf);
+        }
         trace_drv_return_void(local);
 }
 
@@ -1003,4 +1022,32 @@ static inline void drv_restart_complete(struct ieee80211_local *local)
         trace_drv_return_void(local);
 }
 
+static inline void
+drv_set_default_unicast_key(struct ieee80211_local *local,
+                            struct ieee80211_sub_if_data *sdata,
+                            int key_idx)
+{
+        check_sdata_in_driver(sdata);
+
+        WARN_ON_ONCE(key_idx < -1 || key_idx > 3);
+
+        trace_drv_set_default_unicast_key(local, sdata, key_idx);
+        if (local->ops->set_default_unicast_key)
+                local->ops->set_default_unicast_key(&local->hw, &sdata->vif,
+                                                    key_idx);
+        trace_drv_return_void(local);
+}
+
+#if IS_ENABLED(CONFIG_IPV6)
+static inline void drv_ipv6_addr_change(struct ieee80211_local *local,
+                                        struct ieee80211_sub_if_data *sdata,
+                                        struct inet6_dev *idev)
+{
+        trace_drv_ipv6_addr_change(local, sdata);
+        if (local->ops->ipv6_addr_change)
+                local->ops->ipv6_addr_change(&local->hw, &sdata->vif, idev);
+        trace_drv_return_void(local);
+}
+#endif
+
 #endif /* __MAC80211_DRIVER_OPS */
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index a71d891794a4..61ac7c48ac0c 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -62,6 +62,9 @@ void ieee80211_apply_htcap_overrides(struct ieee80211_sub_if_data *sdata,
         __check_htcap_disable(sdata, ht_cap, IEEE80211_HT_CAP_SUP_WIDTH_20_40);
         __check_htcap_disable(sdata, ht_cap, IEEE80211_HT_CAP_SGI_40);
 
+        /* Allow user to disable SGI-20 (SGI-40 is handled above) */
+        __check_htcap_disable(sdata, ht_cap, IEEE80211_HT_CAP_SGI_20);
+
         /* Allow user to disable the max-AMSDU bit. */
         __check_htcap_disable(sdata, ht_cap, IEEE80211_HT_CAP_MAX_AMSDU);
 
@@ -117,6 +120,21 @@ void ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_sub_if_data *sdata,
                    IEEE80211_HT_CAP_SGI_20 |
                    IEEE80211_HT_CAP_SGI_40 |
                    IEEE80211_HT_CAP_DSSSCCK40));
+
+        /* Unset 40 MHz if we're not using a 40 MHz channel */
+        switch (sdata->vif.bss_conf.chandef.width) {
+        case NL80211_CHAN_WIDTH_20_NOHT:
+        case NL80211_CHAN_WIDTH_20:
+                ht_cap->cap &= ~IEEE80211_HT_CAP_SGI_40;
+                ht_cap->cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+                break;
+        case NL80211_CHAN_WIDTH_40:
+        case NL80211_CHAN_WIDTH_80:
+        case NL80211_CHAN_WIDTH_80P80:
+        case NL80211_CHAN_WIDTH_160:
+                break;
+        }
+
         /*
          * The STBC bits are asymmetric -- if we don't have
          * TX then mask out the peer's RX and vice versa.
@@ -179,16 +197,19 @@ void ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_sub_if_data *sdata,
         ieee80211_apply_htcap_overrides(sdata, ht_cap);
 }
 
-void ieee80211_sta_tear_down_BA_sessions(struct sta_info *sta, bool tx)
+void ieee80211_sta_tear_down_BA_sessions(struct sta_info *sta,
+                                         enum ieee80211_agg_stop_reason reason)
 {
         int i;
 
         cancel_work_sync(&sta->ampdu_mlme.work);
 
         for (i = 0; i <  IEEE80211_NUM_TIDS; i++) {
-                __ieee80211_stop_tx_ba_session(sta, i, WLAN_BACK_INITIATOR, tx);
+                __ieee80211_stop_tx_ba_session(sta, i, reason);
                 __ieee80211_stop_rx_ba_session(sta, i, WLAN_BACK_RECIPIENT,
-                                               WLAN_REASON_QSTA_LEAVE_QBSS, tx);
+                                               WLAN_REASON_QSTA_LEAVE_QBSS,
+                                               reason != AGG_STOP_DESTROY_STA &&
+                                               reason != AGG_STOP_PEER_REQUEST);
         }
 }
 
@@ -245,8 +266,7 @@ void ieee80211_ba_session_work(struct work_struct *work)
                 if (tid_tx && test_and_clear_bit(HT_AGG_STATE_WANT_STOP,
                                                  &tid_tx->state))
                         ___ieee80211_stop_tx_ba_session(sta, tid,
-                                                        WLAN_BACK_INITIATOR,
-                                                        true);
+                                                        AGG_STOP_LOCAL_REQUEST);
         }
         mutex_unlock(&sta->ampdu_mlme.mtx);
 }
@@ -314,8 +334,7 @@ void ieee80211_process_delba(struct ieee80211_sub_if_data *sdata,
                 __ieee80211_stop_rx_ba_session(sta, tid, WLAN_BACK_INITIATOR, 0,
                                                true);
         else
-                __ieee80211_stop_tx_ba_session(sta, tid, WLAN_BACK_RECIPIENT,
-                                               true);
+                __ieee80211_stop_tx_ba_session(sta, tid, AGG_STOP_PEER_REQUEST);
 }
 
 int ieee80211_send_smps_action(struct ieee80211_sub_if_data *sdata,
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 8881fc77fb13..b4b866f41919 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -67,7 +67,7 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         skb_reserve(skb, sdata->local->hw.extra_tx_headroom);
 
         if (!ether_addr_equal(ifibss->bssid, bssid))
-                sta_info_flush(sdata->local, sdata);
+                sta_info_flush(sdata);
 
         /* if merging, indicate to driver that we leave the old IBSS */
         if (sdata->vif.bss_conf.ibss_joined) {
@@ -191,6 +191,7 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
 
         rcu_assign_pointer(ifibss->presp, skb);
 
+        sdata->vif.bss_conf.enable_beacon = true;
         sdata->vif.bss_conf.beacon_int = beacon_int;
         sdata->vif.bss_conf.basic_rates = basic_rates;
         bss_change = BSS_CHANGED_BEACON_INT;
@@ -425,11 +426,9 @@ static void ieee80211_rx_mgmt_auth_ibss(struct ieee80211_sub_if_data *sdata,
 }
 
 static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
-                                  struct ieee80211_mgmt *mgmt,
-                                  size_t len,
+                                  struct ieee80211_mgmt *mgmt, size_t len,
                                   struct ieee80211_rx_status *rx_status,
-                                  struct ieee802_11_elems *elems,
-                                  bool beacon)
+                                  struct ieee802_11_elems *elems)
 {
         struct ieee80211_local *local = sdata->local;
         int freq;
@@ -530,7 +529,7 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
         }
 
         bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, elems,
-                                        channel, beacon);
+                                        channel);
         if (!bss)
                 return;
 
@@ -703,8 +702,8 @@ static void ieee80211_sta_merge_ibss(struct ieee80211_sub_if_data *sdata)
         sdata_info(sdata,
                    "No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge)\n");
 
-        ieee80211_request_internal_scan(sdata,
-                        ifibss->ssid, ifibss->ssid_len, NULL);
+        ieee80211_request_ibss_scan(sdata, ifibss->ssid, ifibss->ssid_len,
+                                    NULL);
 }
 
 static void ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata)
@@ -802,9 +801,8 @@ static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
                                         IEEE80211_SCAN_INTERVAL)) {
                 sdata_info(sdata, "Trigger new scan to find an IBSS to join\n");
 
-                ieee80211_request_internal_scan(sdata,
-                                ifibss->ssid, ifibss->ssid_len,
-                                ifibss->fixed_channel ? ifibss->channel : NULL);
+                ieee80211_request_ibss_scan(sdata, ifibss->ssid,
+                                            ifibss->ssid_len, chan);
         } else {
                 int interval = IEEE80211_SCAN_INTERVAL;
 
@@ -878,14 +876,21 @@ static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
         ieee80211_tx_skb(sdata, skb);
 }
 
-static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
-                                         struct ieee80211_mgmt *mgmt,
-                                         size_t len,
-                                         struct ieee80211_rx_status *rx_status)
+static
+void ieee80211_rx_mgmt_probe_beacon(struct ieee80211_sub_if_data *sdata,
+                                    struct ieee80211_mgmt *mgmt, size_t len,
+                                    struct ieee80211_rx_status *rx_status)
 {
         size_t baselen;
         struct ieee802_11_elems elems;
 
+        BUILD_BUG_ON(offsetof(typeof(mgmt->u.probe_resp), variable) !=
+                     offsetof(typeof(mgmt->u.beacon), variable));
+
+        /*
+         * either beacon or probe_resp but the variable field is at the
+         * same offset
+         */
         baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
         if (baselen > len)
                 return;
@@ -893,25 +898,7 @@ static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
         ieee802_11_parse_elems(mgmt->u.probe_resp.variable, len - baselen,
                                 &elems);
 
-        ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems, false);
-}
-
-static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
-                                     struct ieee80211_mgmt *mgmt,
-                                     size_t len,
-                                     struct ieee80211_rx_status *rx_status)
-{
-        size_t baselen;
-        struct ieee802_11_elems elems;
-
-        /* Process beacon from the current BSS */
-        baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
-        if (baselen > len)
-                return;
-
-        ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen, &elems);
-
-        ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems, true);
+        ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
 }
 
 void ieee80211_ibss_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
@@ -935,12 +922,9 @@ void ieee80211_ibss_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
                 ieee80211_rx_mgmt_probe_req(sdata, skb);
                 break;
         case IEEE80211_STYPE_PROBE_RESP:
-                ieee80211_rx_mgmt_probe_resp(sdata, mgmt, skb->len,
-                                             rx_status);
-                break;
         case IEEE80211_STYPE_BEACON:
-                ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len,
-                                         rx_status);
+                ieee80211_rx_mgmt_probe_beacon(sdata, mgmt, skb->len,
+                                               rx_status);
                 break;
         case IEEE80211_STYPE_AUTH:
                 ieee80211_rx_mgmt_auth_ibss(sdata, mgmt, skb->len);
@@ -1183,7 +1167,7 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
         memset(ifibss->bssid, 0, ETH_ALEN);
         ifibss->ssid_len = 0;
 
-        sta_info_flush(sdata->local, sdata);
+        sta_info_flush(sdata);
 
         spin_lock_bh(&ifibss->incomplete_lock);
         while (!list_empty(&ifibss->incomplete_stations)) {
@@ -1206,6 +1190,8 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
         RCU_INIT_POINTER(sdata->u.ibss.presp, NULL);
         sdata->vif.bss_conf.ibss_joined = false;
         sdata->vif.bss_conf.ibss_creator = false;
+        sdata->vif.bss_conf.enable_beacon = false;
+        clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED, &sdata->state);
         ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED |
                                                 BSS_CHANGED_IBSS);
         synchronize_rcu();
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 42d0d0267730..5fba867d9e2e 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -92,8 +92,6 @@ struct ieee80211_bss {
 
         u32 device_ts;
 
-        u8 dtim_period;
-
         bool wmm_used;
         bool uapsd_supported;
 
@@ -140,7 +138,6 @@ enum ieee80211_bss_corrupt_data_flags {
 
 /**
  * enum ieee80211_valid_data_flags - BSS valid data flags
- * @IEEE80211_BSS_VALID_DTIM: DTIM data was gathered from non-corrupt IE
  * @IEEE80211_BSS_VALID_WMM: WMM/UAPSD data was gathered from non-corrupt IE
  * @IEEE80211_BSS_VALID_RATES: Supported rates were gathered from non-corrupt IE
  * @IEEE80211_BSS_VALID_ERP: ERP flag was gathered from non-corrupt IE
@@ -151,7 +148,6 @@ enum ieee80211_bss_corrupt_data_flags {
  * beacon/probe response.
  */
 enum ieee80211_bss_valid_data_flags {
-        IEEE80211_BSS_VALID_DTIM                = BIT(0),
         IEEE80211_BSS_VALID_WMM                 = BIT(1),
         IEEE80211_BSS_VALID_RATES               = BIT(2),
         IEEE80211_BSS_VALID_ERP                 = BIT(3)
@@ -409,6 +405,8 @@ struct ieee80211_mgd_assoc_data {
 
         u8 ap_ht_param;
 
+        struct ieee80211_vht_cap ap_vht_cap;
+
         size_t ie_len;
         u8 ie[];
 };
@@ -440,6 +438,7 @@ struct ieee80211_if_managed {
         unsigned long timers_running; /* used for quiesce/restart */
         bool powersave; /* powersave requested for this iface */
         bool broken_ap; /* AP is broken -- turn off powersave */
+        u8 dtim_period;
         enum ieee80211_smps_mode req_smps, /* requested smps mode */
                                  driver_smps_mode; /* smps mode request */
 
@@ -662,10 +661,13 @@ enum ieee80211_sub_if_data_flags {
  *      change handling while the interface is up
  * @SDATA_STATE_OFFCHANNEL: This interface is currently in offchannel
  *      mode, so queues are stopped
+ * @SDATA_STATE_OFFCHANNEL_BEACON_STOPPED: Beaconing was stopped due
+ *      to offchannel, reset when offchannel returns
  */
 enum ieee80211_sdata_state_bits {
         SDATA_STATE_RUNNING,
         SDATA_STATE_OFFCHANNEL,
+        SDATA_STATE_OFFCHANNEL_BEACON_STOPPED,
 };
 
 /**
@@ -688,6 +690,7 @@ struct ieee80211_chanctx {
 
         enum ieee80211_chanctx_mode mode;
         int refcount;
+        bool driver_present;
 
         struct ieee80211_chanctx_conf conf;
 };
@@ -744,8 +747,6 @@ struct ieee80211_sub_if_data {
         struct work_struct work;
         struct sk_buff_head skb_queue;
 
-        bool arp_filter_state;
-
         u8 needed_rx_chains;
         enum ieee80211_smps_mode smps_mode;
 
@@ -773,6 +774,10 @@ struct ieee80211_sub_if_data {
                 u32 mntr_flags;
         } u;
 
+        spinlock_t cleanup_stations_lock;
+        struct list_head cleanup_stations;
+        struct work_struct cleanup_stations_wk;
+
 #ifdef CONFIG_MAC80211_DEBUGFS
         struct {
                 struct dentry *dir;
@@ -782,6 +787,11 @@ struct ieee80211_sub_if_data {
                 struct dentry *default_mgmt_key;
         } debugfs;
 #endif
+
+#ifdef CONFIG_PM
+        struct ieee80211_bss_conf suspend_bss_conf;
+#endif
+
         /* must be last, dynamically sized area in this! */
         struct ieee80211_vif vif;
 };
@@ -1117,6 +1127,7 @@ struct ieee80211_local {
         struct timer_list dynamic_ps_timer;
         struct notifier_block network_latency_notifier;
         struct notifier_block ifa_notifier;
+        struct notifier_block ifa6_notifier;
 
         /*
          * The dynamic ps timeout configured from user space via WEXT -
@@ -1329,9 +1340,9 @@ void ieee80211_mesh_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
 
 /* scan/BSS handling */
 void ieee80211_scan_work(struct work_struct *work);
-int ieee80211_request_internal_scan(struct ieee80211_sub_if_data *sdata,
-                                    const u8 *ssid, u8 ssid_len,
-                                    struct ieee80211_channel *chan);
+int ieee80211_request_ibss_scan(struct ieee80211_sub_if_data *sdata,
+                                const u8 *ssid, u8 ssid_len,
+                                struct ieee80211_channel *chan);
 int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata,
                            struct cfg80211_scan_request *req);
 void ieee80211_scan_cancel(struct ieee80211_local *local);
@@ -1345,8 +1356,7 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
                           struct ieee80211_mgmt *mgmt,
                           size_t len,
                           struct ieee802_11_elems *elems,
-                          struct ieee80211_channel *channel,
-                          bool beacon);
+                          struct ieee80211_channel *channel);
 void ieee80211_rx_bss_put(struct ieee80211_local *local,
                           struct ieee80211_bss *bss);
 
@@ -1357,10 +1367,8 @@ int ieee80211_request_sched_scan_stop(struct ieee80211_sub_if_data *sdata);
 void ieee80211_sched_scan_stopped_work(struct work_struct *work);
 
 /* off-channel helpers */
-void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local,
-                                    bool offchannel_ps_enable);
-void ieee80211_offchannel_return(struct ieee80211_local *local,
-                                 bool offchannel_ps_disable);
+void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local);
+void ieee80211_offchannel_return(struct ieee80211_local *local);
 void ieee80211_roc_setup(struct ieee80211_local *local);
 void ieee80211_start_next_roc(struct ieee80211_local *local);
 void ieee80211_roc_purge(struct ieee80211_sub_if_data *sdata);
@@ -1421,7 +1429,8 @@ void ___ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
                                      u16 initiator, u16 reason, bool stop);
 void __ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
                                     u16 initiator, u16 reason, bool stop);
-void ieee80211_sta_tear_down_BA_sessions(struct sta_info *sta, bool tx);
+void ieee80211_sta_tear_down_BA_sessions(struct sta_info *sta,
+                                         enum ieee80211_agg_stop_reason reason);
 void ieee80211_process_delba(struct ieee80211_sub_if_data *sdata,
                              struct sta_info *sta,
                              struct ieee80211_mgmt *mgmt, size_t len);
@@ -1435,11 +1444,9 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
                                      size_t len);
 
 int __ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
-                                   enum ieee80211_back_parties initiator,
-                                   bool tx);
+                                   enum ieee80211_agg_stop_reason reason);
 int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
-                                    enum ieee80211_back_parties initiator,
-                                    bool tx);
+                                    enum ieee80211_agg_stop_reason reason);
 void ieee80211_start_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u16 tid);
 void ieee80211_stop_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u8 tid);
 void ieee80211_ba_session_work(struct work_struct *work);
@@ -1628,6 +1635,7 @@ ieee80211_vif_use_channel(struct ieee80211_sub_if_data *sdata,
                           const struct cfg80211_chan_def *chandef,
                           enum ieee80211_chanctx_mode mode);
 void ieee80211_vif_release_channel(struct ieee80211_sub_if_data *sdata);
+void ieee80211_vif_vlan_copy_chanctx(struct ieee80211_sub_if_data *sdata);
 
 void ieee80211_recalc_smps_chanctx(struct ieee80211_local *local,
                                    struct ieee80211_chanctx *chanctx);
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 09a80b55cf5a..0a36dc6346bb 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -207,17 +207,8 @@ void ieee80211_recalc_idle(struct ieee80211_local *local)
 
 static int ieee80211_change_mtu(struct net_device *dev, int new_mtu)
 {
-        int meshhdrlen;
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-
-        meshhdrlen = (sdata->vif.type == NL80211_IFTYPE_MESH_POINT) ? 5 : 0;
-
-        /* FIX: what would be proper limits for MTU?
-         * This interface uses 802.3 frames. */
-        if (new_mtu < 256 ||
-            new_mtu > IEEE80211_MAX_DATA_LEN - 24 - 6 - meshhdrlen) {
+        if (new_mtu < 256 || new_mtu > IEEE80211_MAX_DATA_LEN)
                 return -EINVAL;
-        }
 
         dev->mtu = new_mtu;
         return 0;
@@ -586,11 +577,13 @@ int ieee80211_do_open(struct wireless_dev *wdev, bool coming_up)
 
         switch (sdata->vif.type) {
         case NL80211_IFTYPE_AP_VLAN:
-                /* no need to tell driver, but set carrier */
-                if (rtnl_dereference(sdata->bss->beacon))
+                /* no need to tell driver, but set carrier and chanctx */
+                if (rtnl_dereference(sdata->bss->beacon)) {
+                        ieee80211_vif_vlan_copy_chanctx(sdata);
                         netif_carrier_on(dev);
-                else
+                } else {
                         netif_carrier_off(dev);
+                }
                 break;
         case NL80211_IFTYPE_MONITOR:
                 if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES) {
@@ -754,7 +747,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
         unsigned long flags;
         struct sk_buff *skb, *tmp;
         u32 hw_reconf_flags = 0;
-        int i;
+        int i, flushed;
 
         clear_bit(SDATA_STATE_RUNNING, &sdata->state);
 
@@ -779,11 +772,15 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
          * (because if we remove a STA after ops->remove_interface()
          * the driver will have removed the vif info already!)
          *
-         * This is relevant only in AP, WDS and mesh modes, since in
-         * all other modes we've already removed all stations when
-         * disconnecting etc.
+         * This is relevant only in WDS mode, in all other modes we've
+         * already removed all stations when disconnecting or similar,
+         * so warn otherwise.
+         *
+         * We call sta_info_flush_cleanup() later, to combine RCU waits.
          */
-        sta_info_flush(local, sdata);
+        flushed = sta_info_flush_defer(sdata);
+        WARN_ON_ONCE((sdata->vif.type != NL80211_IFTYPE_WDS && flushed > 0) ||
+                     (sdata->vif.type == NL80211_IFTYPE_WDS && flushed != 1));
 
         /*
          * Don't count this interface for promisc/allmulti while it
@@ -839,6 +836,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
         switch (sdata->vif.type) {
         case NL80211_IFTYPE_AP_VLAN:
                 list_del(&sdata->u.vlan.list);
+                rcu_assign_pointer(sdata->vif.chanctx_conf, NULL);
                 /* no need to tell driver */
                 break;
         case NL80211_IFTYPE_MONITOR:
@@ -865,19 +863,16 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                 cancel_work_sync(&sdata->work);
                 /*
                  * When we get here, the interface is marked down.
-                 * Call rcu_barrier() to wait both for the RX path
-                 * should it be using the interface and enqueuing
-                 * frames at this very time on another CPU, and
-                 * for the sta free call_rcu callbacks.
+                 *
+                 * sta_info_flush_cleanup() requires rcu_barrier()
+                 * first to wait for the station call_rcu() calls
+                 * to complete, here we need at least sychronize_rcu()
+                 * it to wait for the RX path in case it is using the
+                 * interface and enqueuing frames at this very time on
+                 * another CPU.
                  */
                 rcu_barrier();
-
-                /*
-                 * free_sta_rcu() enqueues a work for the actual
-                 * sta cleanup, so we need to flush it while
-                 * sdata is still valid.
-                 */
-                flush_workqueue(local->workqueue);
+                sta_info_flush_cleanup(sdata);
 
                 skb_queue_purge(&sdata->skb_queue);
 
@@ -976,7 +971,6 @@ static void ieee80211_set_multicast_list(struct net_device *dev)
  */
 static void ieee80211_teardown_sdata(struct ieee80211_sub_if_data *sdata)
 {
-        struct ieee80211_local *local = sdata->local;
         int flushed;
         int i;
 
@@ -992,7 +986,7 @@ static void ieee80211_teardown_sdata(struct ieee80211_sub_if_data *sdata)
         if (ieee80211_vif_is_mesh(&sdata->vif))
                 mesh_rmc_free(sdata);
 
-        flushed = sta_info_flush(local, sdata);
+        flushed = sta_info_flush(sdata);
         WARN_ON(flushed);
 }
 
@@ -1233,6 +1227,7 @@ static void ieee80211_setup_sdata(struct ieee80211_sub_if_data *sdata,
         case NL80211_IFTYPE_AP:
                 skb_queue_head_init(&sdata->u.ap.ps.bc_buf);
                 INIT_LIST_HEAD(&sdata->u.ap.vlans);
+                sdata->vif.bss_conf.bssid = sdata->vif.addr;
                 break;
         case NL80211_IFTYPE_P2P_CLIENT:
                 type = NL80211_IFTYPE_STATION;
@@ -1240,9 +1235,11 @@ static void ieee80211_setup_sdata(struct ieee80211_sub_if_data *sdata,
                 sdata->vif.p2p = true;
                 /* fall through */
         case NL80211_IFTYPE_STATION:
+                sdata->vif.bss_conf.bssid = sdata->u.mgd.bssid;
                 ieee80211_sta_setup_sdata(sdata);
                 break;
         case NL80211_IFTYPE_ADHOC:
+                sdata->vif.bss_conf.bssid = sdata->u.ibss.bssid;
                 ieee80211_ibss_setup_sdata(sdata);
                 break;
         case NL80211_IFTYPE_MESH_POINT:
@@ -1256,8 +1253,12 @@ static void ieee80211_setup_sdata(struct ieee80211_sub_if_data *sdata,
                                       MONITOR_FLAG_OTHER_BSS;
                 break;
         case NL80211_IFTYPE_WDS:
+                sdata->vif.bss_conf.bssid = NULL;
+                break;
         case NL80211_IFTYPE_AP_VLAN:
+                break;
         case NL80211_IFTYPE_P2P_DEVICE:
+                sdata->vif.bss_conf.bssid = sdata->vif.addr;
                 break;
         case NL80211_IFTYPE_UNSPECIFIED:
         case NUM_NL80211_IFTYPES:
@@ -1498,6 +1499,15 @@ static void ieee80211_assign_perm_addr(struct ieee80211_local *local,
         mutex_unlock(&local->iflist_mtx);
 }
 
+static void ieee80211_cleanup_sdata_stas_wk(struct work_struct *wk)
+{
+        struct ieee80211_sub_if_data *sdata;
+
+        sdata = container_of(wk, struct ieee80211_sub_if_data, cleanup_stations_wk);
+
+        ieee80211_cleanup_sdata_stas(sdata);
+}
+
 int ieee80211_if_add(struct ieee80211_local *local, const char *name,
                      struct wireless_dev **new_wdev, enum nl80211_iftype type,
                      struct vif_params *params)
@@ -1564,15 +1574,16 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
         /* initialise type-independent data */
         sdata->wdev.wiphy = local->hw.wiphy;
         sdata->local = local;
-#ifdef CONFIG_INET
-        sdata->arp_filter_state = true;
-#endif
 
         for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++)
                 skb_queue_head_init(&sdata->fragments[i].skb_list);
 
         INIT_LIST_HEAD(&sdata->key_list);
 
+        spin_lock_init(&sdata->cleanup_stations_lock);
+        INIT_LIST_HEAD(&sdata->cleanup_stations);
+        INIT_WORK(&sdata->cleanup_stations_wk, ieee80211_cleanup_sdata_stas_wk);
+
         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
                 struct ieee80211_supported_band *sband;
                 sband = local->hw.wiphy->bands[i];
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index 619c5d697999..ef252eb58c36 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -204,8 +204,11 @@ static void __ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata,
         if (idx >= 0 && idx < NUM_DEFAULT_KEYS)
                 key = key_mtx_dereference(sdata->local, sdata->keys[idx]);
 
-        if (uni)
+        if (uni) {
                 rcu_assign_pointer(sdata->default_unicast_key, key);
+                drv_set_default_unicast_key(sdata->local, sdata, idx);
+        }
+
         if (multi)
                 rcu_assign_pointer(sdata->default_multicast_key, key);
 
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 1b087fff93e7..2bdd454e8bcf 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -23,6 +23,7 @@
 #include <linux/inetdevice.h>
 #include <net/net_namespace.h>
 #include <net/cfg80211.h>
+#include <net/addrconf.h>
 
 #include "ieee80211_i.h"
 #include "driver-ops.h"
@@ -207,76 +208,10 @@ void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,
                                       u32 changed)
 {
         struct ieee80211_local *local = sdata->local;
-        static const u8 zero[ETH_ALEN] = { 0 };
 
         if (!changed)
                 return;
 
-        if (sdata->vif.type == NL80211_IFTYPE_STATION) {
-                sdata->vif.bss_conf.bssid = sdata->u.mgd.bssid;
-        } else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
-                sdata->vif.bss_conf.bssid = sdata->u.ibss.bssid;
-        else if (sdata->vif.type == NL80211_IFTYPE_AP)
-                sdata->vif.bss_conf.bssid = sdata->vif.addr;
-        else if (sdata->vif.type == NL80211_IFTYPE_WDS)
-                sdata->vif.bss_conf.bssid = NULL;
-        else if (ieee80211_vif_is_mesh(&sdata->vif)) {
-                sdata->vif.bss_conf.bssid = zero;
-        } else if (sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) {
-                sdata->vif.bss_conf.bssid = sdata->vif.addr;
-                WARN_ONCE(changed & ~(BSS_CHANGED_IDLE),
-                          "P2P Device BSS changed %#x", changed);
-        } else {
-                WARN_ON(1);
-                return;
-        }
-
-        switch (sdata->vif.type) {
-        case NL80211_IFTYPE_AP:
-        case NL80211_IFTYPE_ADHOC:
-        case NL80211_IFTYPE_WDS:
-        case NL80211_IFTYPE_MESH_POINT:
-                break;
-        default:
-                /* do not warn to simplify caller in scan.c */
-                changed &= ~BSS_CHANGED_BEACON_ENABLED;
-                if (WARN_ON(changed & BSS_CHANGED_BEACON))
-                        return;
-                break;
-        }
-
-        if (changed & BSS_CHANGED_BEACON_ENABLED) {
-                if (local->quiescing || !ieee80211_sdata_running(sdata) ||
-                    test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state)) {
-                        sdata->vif.bss_conf.enable_beacon = false;
-                } else {
-                        /*
-                         * Beacon should be enabled, but AP mode must
-                         * check whether there is a beacon configured.
-                         */
-                        switch (sdata->vif.type) {
-                        case NL80211_IFTYPE_AP:
-                                sdata->vif.bss_conf.enable_beacon =
-                                        !!sdata->u.ap.beacon;
-                                break;
-                        case NL80211_IFTYPE_ADHOC:
-                                sdata->vif.bss_conf.enable_beacon =
-                                        !!sdata->u.ibss.presp;
-                                break;
-#ifdef CONFIG_MAC80211_MESH
-                        case NL80211_IFTYPE_MESH_POINT:
-                                sdata->vif.bss_conf.enable_beacon =
-                                        !!sdata->u.mesh.mesh_id_len;
-                                break;
-#endif
-                        default:
-                                /* not reached */
-                                WARN_ON(1);
-                                break;
-                        }
-                }
-        }
-
         drv_bss_info_changed(local, sdata, &sdata->vif.bss_conf, changed);
 }
 
@@ -415,27 +350,19 @@ static int ieee80211_ifa_changed(struct notifier_block *nb,
 
         /* Copy the addresses to the bss_conf list */
         ifa = idev->ifa_list;
-        while (c < IEEE80211_BSS_ARP_ADDR_LIST_LEN && ifa) {
-                bss_conf->arp_addr_list[c] = ifa->ifa_address;
+        while (ifa) {
+                if (c < IEEE80211_BSS_ARP_ADDR_LIST_LEN)
+                        bss_conf->arp_addr_list[c] = ifa->ifa_address;
                 ifa = ifa->ifa_next;
                 c++;
         }
 
-        /* If not all addresses fit the list, disable filtering */
-        if (ifa) {
-                sdata->arp_filter_state = false;
-                c = 0;
-        } else {
-                sdata->arp_filter_state = true;
-        }
         bss_conf->arp_addr_cnt = c;
 
         /* Configure driver only if associated (which also implies it is up) */
-        if (ifmgd->associated) {
-                bss_conf->arp_filter_enabled = sdata->arp_filter_state;
+        if (ifmgd->associated)
                 ieee80211_bss_info_change_notify(sdata,
                                                  BSS_CHANGED_ARP_FILTER);
-        }
 
         mutex_unlock(&ifmgd->mtx);
 
@@ -443,6 +370,37 @@ static int ieee80211_ifa_changed(struct notifier_block *nb,
 }
 #endif
 
+#if IS_ENABLED(CONFIG_IPV6)
+static int ieee80211_ifa6_changed(struct notifier_block *nb,
+                                  unsigned long data, void *arg)
+{
+        struct inet6_ifaddr *ifa = (struct inet6_ifaddr *)arg;
+        struct inet6_dev *idev = ifa->idev;
+        struct net_device *ndev = ifa->idev->dev;
+        struct ieee80211_local *local =
+                container_of(nb, struct ieee80211_local, ifa6_notifier);
+        struct wireless_dev *wdev = ndev->ieee80211_ptr;
+        struct ieee80211_sub_if_data *sdata;
+
+        /* Make sure it's our interface that got changed */
+        if (!wdev || wdev->wiphy != local->hw.wiphy)
+                return NOTIFY_DONE;
+
+        sdata = IEEE80211_DEV_TO_SUB_IF(ndev);
+
+        /*
+         * For now only support station mode. This is mostly because
+         * doing AP would have to handle AP_VLAN in some way ...
+         */
+        if (sdata->vif.type != NL80211_IFTYPE_STATION)
+                return NOTIFY_DONE;
+
+        drv_ipv6_addr_change(local, sdata, idev);
+
+        return NOTIFY_DONE;
+}
+#endif
+
 static int ieee80211_napi_poll(struct napi_struct *napi, int budget)
 {
         struct ieee80211_local *local =
@@ -537,6 +495,7 @@ static const struct ieee80211_ht_cap mac80211_ht_capa_mod_mask = {
 
         .cap_info = cpu_to_le16(IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
                                 IEEE80211_HT_CAP_MAX_AMSDU |
+                                IEEE80211_HT_CAP_SGI_20 |
                                 IEEE80211_HT_CAP_SGI_40),
         .mcs = {
                 .rx_mask = { 0xff, 0xff, 0xff, 0xff, 0xff,
@@ -606,7 +565,8 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
         wiphy->features |= NL80211_FEATURE_SK_TX_STATUS |
                            NL80211_FEATURE_SAE |
                            NL80211_FEATURE_HT_IBSS |
-                           NL80211_FEATURE_VIF_TXPOWER;
+                           NL80211_FEATURE_VIF_TXPOWER |
+                           NL80211_FEATURE_FULL_AP_CLIENT_STATE;
 
         if (!ops->hw_scan)
                 wiphy->features |= NL80211_FEATURE_LOW_PRIORITY_SCAN |
@@ -1049,12 +1009,25 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
                 goto fail_ifa;
 #endif
 
+#if IS_ENABLED(CONFIG_IPV6)
+        local->ifa6_notifier.notifier_call = ieee80211_ifa6_changed;
+        result = register_inet6addr_notifier(&local->ifa6_notifier);
+        if (result)
+                goto fail_ifa6;
+#endif
+
         netif_napi_add(&local->napi_dev, &local->napi, ieee80211_napi_poll,
                         local->hw.napi_weight);
 
         return 0;
 
+#if IS_ENABLED(CONFIG_IPV6)
+ fail_ifa6:
 #ifdef CONFIG_INET
+        unregister_inetaddr_notifier(&local->ifa_notifier);
+#endif
+#endif
+#if defined(CONFIG_INET) || defined(CONFIG_IPV6)
  fail_ifa:
         pm_qos_remove_notifier(PM_QOS_NETWORK_LATENCY,
                                &local->network_latency_notifier);
@@ -1090,6 +1063,9 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
 #ifdef CONFIG_INET
         unregister_inetaddr_notifier(&local->ifa_notifier);
 #endif
+#if IS_ENABLED(CONFIG_IPV6)
+        unregister_inet6addr_notifier(&local->ifa6_notifier);
+#endif
 
         rtnl_lock();
 
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 1bf03f9ff3ba..694e27376afa 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -20,16 +20,11 @@
 int mesh_allocated;
 static struct kmem_cache *rm_cache;
 
-#ifdef CONFIG_MAC80211_MESH
 bool mesh_action_is_path_sel(struct ieee80211_mgmt *mgmt)
 {
         return (mgmt->u.action.u.mesh_action.action_code ==
                         WLAN_MESH_ACTION_HWMP_PATH_SELECTION);
 }
-#else
-bool mesh_action_is_path_sel(struct ieee80211_mgmt *mgmt)
-{ return false; }
-#endif
 
 void ieee80211s_init(void)
 {
@@ -163,7 +158,7 @@ int mesh_rmc_init(struct ieee80211_sub_if_data *sdata)
                 return -ENOMEM;
         sdata->u.mesh.rmc->idx_mask = RMC_BUCKETS - 1;
         for (i = 0; i < RMC_BUCKETS; i++)
-                INIT_LIST_HEAD(&sdata->u.mesh.rmc->bucket[i].list);
+                INIT_LIST_HEAD(&sdata->u.mesh.rmc->bucket[i]);
         return 0;
 }
 
@@ -177,7 +172,7 @@ void mesh_rmc_free(struct ieee80211_sub_if_data *sdata)
                 return;
 
         for (i = 0; i < RMC_BUCKETS; i++)
-                list_for_each_entry_safe(p, n, &rmc->bucket[i].list, list) {
+                list_for_each_entry_safe(p, n, &rmc->bucket[i], list) {
                         list_del(&p->list);
                         kmem_cache_free(rm_cache, p);
                 }
@@ -210,7 +205,7 @@ int mesh_rmc_check(u8 *sa, struct ieee80211s_hdr *mesh_hdr,
         /* Don't care about endianness since only match matters */
         memcpy(&seqnum, &mesh_hdr->seqnum, sizeof(mesh_hdr->seqnum));
         idx = le32_to_cpu(mesh_hdr->seqnum) & rmc->idx_mask;
-        list_for_each_entry_safe(p, n, &rmc->bucket[idx].list, list) {
+        list_for_each_entry_safe(p, n, &rmc->bucket[idx], list) {
                 ++entries;
                 if (time_after(jiffies, p->exp_time) ||
                                 (entries == RMC_QUEUE_MAX_LEN)) {
@@ -229,7 +224,7 @@ int mesh_rmc_check(u8 *sa, struct ieee80211s_hdr *mesh_hdr,
         p->seqnum = seqnum;
         p->exp_time = jiffies + RMC_TIMEOUT;
         memcpy(p->sa, sa, ETH_ALEN);
-        list_add(&p->list, &rmc->bucket[idx].list);
+        list_add(&p->list, &rmc->bucket[idx]);
         return 0;
 }
 
@@ -607,6 +602,12 @@ void ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
         struct ieee80211_local *local = sdata->local;
+        u32 changed = BSS_CHANGED_BEACON |
+                      BSS_CHANGED_BEACON_ENABLED |
+                      BSS_CHANGED_HT |
+                      BSS_CHANGED_BASIC_RATES |
+                      BSS_CHANGED_BEACON_INT;
+        enum ieee80211_band band = ieee80211_get_sdata_band(sdata);
 
         local->fif_other_bss++;
         /* mesh ifaces must set allmulti to forward mcast traffic */
@@ -624,15 +625,16 @@ void ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata)
         ieee80211_queue_work(&local->hw, &sdata->work);
         sdata->vif.bss_conf.ht_operation_mode =
                                 ifmsh->mshcfg.ht_opmode;
-        sdata->vif.bss_conf.beacon_int = MESH_DEFAULT_BEACON_INTERVAL;
+        sdata->vif.bss_conf.enable_beacon = true;
         sdata->vif.bss_conf.basic_rates =
-                ieee80211_mandatory_rates(sdata->local,
-                                          ieee80211_get_sdata_band(sdata));
-        ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON |
-                                                BSS_CHANGED_BEACON_ENABLED |
-                                                BSS_CHANGED_HT |
-                                                BSS_CHANGED_BASIC_RATES |
-                                                BSS_CHANGED_BEACON_INT);
+                ieee80211_mandatory_rates(local, band);
+
+        if (band == IEEE80211_BAND_5GHZ) {
+                sdata->vif.bss_conf.use_short_slot = true;
+                changed |= BSS_CHANGED_ERP_SLOT;
+        }
+
+        ieee80211_bss_info_change_notify(sdata, changed);
 
         netif_carrier_on(sdata->dev);
 }
@@ -646,10 +648,12 @@ void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata)
 
         /* stop the beacon */
         ifmsh->mesh_id_len = 0;
+        sdata->vif.bss_conf.enable_beacon = false;
+        clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED, &sdata->state);
         ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED);
 
         /* flush STAs and mpaths on this iface */
-        sta_info_flush(sdata->local, sdata);
+        sta_info_flush(sdata);
         mesh_path_flush_by_iface(sdata);
 
         del_timer_sync(&sdata->u.mesh.housekeeping_timer);
@@ -805,6 +809,7 @@ void ieee80211_mesh_notify_scan_completed(struct ieee80211_local *local)
 void ieee80211_mesh_init_sdata(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+        static u8 zero_addr[ETH_ALEN] = {};
 
         setup_timer(&ifmsh->housekeeping_timer,
                     ieee80211_mesh_housekeeping_timer,
@@ -830,4 +835,6 @@ void ieee80211_mesh_init_sdata(struct ieee80211_sub_if_data *sdata)
         INIT_LIST_HEAD(&ifmsh->preq_queue.list);
         spin_lock_init(&ifmsh->mesh_preq_queue_lock);
         spin_lock_init(&ifmsh->sync_offset_lock);
+
+        sdata->vif.bss_conf.bssid = zero_addr;
 }
diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h
index 7c9215fb2ac8..aff301544c7f 100644
--- a/net/mac80211/mesh.h
+++ b/net/mac80211/mesh.h
@@ -184,15 +184,13 @@ struct rmc_entry {
 };
 
 struct mesh_rmc {
-        struct rmc_entry bucket[RMC_BUCKETS];
+        struct list_head bucket[RMC_BUCKETS];
         u32 idx_mask;
 };
 
 #define IEEE80211_MESH_PEER_INACTIVITY_LIMIT (1800 * HZ)
 #define IEEE80211_MESH_HOUSEKEEPING_INTERVAL (60 * HZ)
 
-#define MESH_DEFAULT_BEACON_INTERVAL            1000    /* in 1024 us units */
-
 #define MESH_PATH_EXPIRE (600 * HZ)
 
 /* Default maximum number of plinks per interface */
@@ -307,6 +305,20 @@ extern int mesh_paths_generation;
 #ifdef CONFIG_MAC80211_MESH
 extern int mesh_allocated;
 
+static inline
+u32 mesh_plink_inc_estab_count(struct ieee80211_sub_if_data *sdata)
+{
+        atomic_inc(&sdata->u.mesh.estab_plinks);
+        return mesh_accept_plinks_update(sdata);
+}
+
+static inline
+u32 mesh_plink_dec_estab_count(struct ieee80211_sub_if_data *sdata)
+{
+        atomic_dec(&sdata->u.mesh.estab_plinks);
+        return mesh_accept_plinks_update(sdata);
+}
+
 static inline int mesh_plink_free_count(struct ieee80211_sub_if_data *sdata)
 {
         return sdata->u.mesh.mshcfg.dot11MeshMaxPeerLinks -
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index 47aeee2d8db1..6b4603a90031 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -215,16 +215,19 @@ static void prepare_frame_for_deferred_tx(struct ieee80211_sub_if_data *sdata,
         skb->priority = 7;
 
         info->control.vif = &sdata->vif;
+        info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
         ieee80211_set_qos_hdr(sdata, skb);
 }
 
 /**
- * mesh_send_path error - Sends a PERR mesh management frame
+ * mesh_path_error_tx - Sends a PERR mesh management frame
  *
+ * @ttl: allowed remaining hops
  * @target: broken destination
  * @target_sn: SN of the broken destination
  * @target_rcode: reason code for this PERR
  * @ra: node this frame is addressed to
+ * @sdata: local mesh subif
  *
  * Note: This function may be called with driver locks taken that the driver
  * also acquires in the TX path.  To avoid a deadlock we don't transmit the
@@ -246,11 +249,13 @@ int mesh_path_error_tx(u8 ttl, u8 *target, __le32 target_sn,
                 return -EAGAIN;
 
         skb = dev_alloc_skb(local->tx_headroom +
+                            IEEE80211_ENCRYPT_HEADROOM +
+                            IEEE80211_ENCRYPT_TAILROOM +
                             hdr_len +
                             2 + 15 /* PERR IE */);
         if (!skb)
                 return -1;
-        skb_reserve(skb, local->tx_headroom);
+        skb_reserve(skb, local->tx_headroom + IEEE80211_ENCRYPT_HEADROOM);
         mgmt = (struct ieee80211_mgmt *) skb_put(skb, hdr_len);
         memset(mgmt, 0, hdr_len);
         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
@@ -350,6 +355,7 @@ static u32 airtime_link_metric_get(struct ieee80211_local *local,
  * @sdata: local mesh subif
  * @mgmt: mesh management frame
  * @hwmp_ie: hwmp information element (PREP or PREQ)
+ * @action: type of hwmp ie
  *
  * This function updates the path routing information to the originator and the
  * transmitter of a HWMP PREQ or PREP frame.
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index 4b274e9c91a5..81e612682bc3 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -41,20 +41,6 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
                 enum ieee80211_self_protected_actioncode action,
                 u8 *da, __le16 llid, __le16 plid, __le16 reason);
 
-static inline
-u32 mesh_plink_inc_estab_count(struct ieee80211_sub_if_data *sdata)
-{
-        atomic_inc(&sdata->u.mesh.estab_plinks);
-        return mesh_accept_plinks_update(sdata);
-}
-
-static inline
-u32 mesh_plink_dec_estab_count(struct ieee80211_sub_if_data *sdata)
-{
-        atomic_dec(&sdata->u.mesh.estab_plinks);
-        return mesh_accept_plinks_update(sdata);
-}
-
 /**
  * mesh_plink_fsm_restart - restart a mesh peer link finite state machine
  *
@@ -69,30 +55,6 @@ static inline void mesh_plink_fsm_restart(struct sta_info *sta)
         sta->plink_retries = 0;
 }
 
-/*
- * Allocate mesh sta entry and insert into station table
- */
-static struct sta_info *mesh_plink_alloc(struct ieee80211_sub_if_data *sdata,
-                                         u8 *hw_addr)
-{
-        struct sta_info *sta;
-
-        if (sdata->local->num_sta >= MESH_MAX_PLINKS)
-                return NULL;
-
-        sta = sta_info_alloc(sdata, hw_addr, GFP_KERNEL);
-        if (!sta)
-                return NULL;
-
-        sta_info_pre_move_state(sta, IEEE80211_STA_AUTH);
-        sta_info_pre_move_state(sta, IEEE80211_STA_ASSOC);
-        sta_info_pre_move_state(sta, IEEE80211_STA_AUTHORIZED);
-
-        set_sta_flag(sta, WLAN_STA_WME);
-
-        return sta;
-}
-
 /**
  * mesh_set_ht_prot_mode - set correct HT protection mode
  *
@@ -323,53 +285,27 @@ free:
         return err;
 }
 
-/**
- * mesh_peer_init - initialize new mesh peer and return resulting sta_info
- *
- * @sdata: local meshif
- * @addr: peer's address
- * @elems: IEs from beacon or mesh peering frame
- *
- * call under RCU
- */
-static struct sta_info *mesh_peer_init(struct ieee80211_sub_if_data *sdata,
-                                       u8 *addr,
-                                       struct ieee802_11_elems *elems)
+static void mesh_sta_info_init(struct ieee80211_sub_if_data *sdata,
+                               struct sta_info *sta,
+                               struct ieee802_11_elems *elems, bool insert)
 {
         struct ieee80211_local *local = sdata->local;
         enum ieee80211_band band = ieee80211_get_sdata_band(sdata);
         struct ieee80211_supported_band *sband;
-        u32 rates, basic_rates = 0;
-        struct sta_info *sta;
-        bool insert = false;
+        u32 rates, basic_rates = 0, changed = 0;
 
         sband = local->hw.wiphy->bands[band];
         rates = ieee80211_sta_get_rates(local, elems, band, &basic_rates);
 
-        sta = sta_info_get(sdata, addr);
-        if (!sta) {
-                /* Userspace handles peer allocation when security is enabled */
-                if (sdata->u.mesh.security & IEEE80211_MESH_SEC_AUTHED) {
-                        cfg80211_notify_new_peer_candidate(sdata->dev, addr,
-                                                           elems->ie_start,
-                                                           elems->total_len,
-                                                           GFP_ATOMIC);
-                        return NULL;
-                }
-
-                sta = mesh_plink_alloc(sdata, addr);
-                if (!sta)
-                        return NULL;
-                insert = true;
-        }
-
         spin_lock_bh(&sta->lock);
         sta->last_rx = jiffies;
-        if (sta->plink_state == NL80211_PLINK_ESTAB) {
-                spin_unlock_bh(&sta->lock);
-                return sta;
-        }
 
+        /* rates and capabilities don't change during peering */
+        if (sta->plink_state == NL80211_PLINK_ESTAB)
+                goto out;
+
+        if (sta->sta.supp_rates[band] != rates)
+                changed |= IEEE80211_RC_SUPP_RATES_CHANGED;
         sta->sta.supp_rates[band] = rates;
         if (elems->ht_cap_elem &&
             sdata->vif.bss_conf.chandef.width != NL80211_CHAN_WIDTH_20_NOHT)
@@ -388,27 +324,115 @@ static struct sta_info *mesh_peer_init(struct ieee80211_sub_if_data *sdata,
                                             ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
                 ieee80211_ht_oper_to_chandef(sdata->vif.bss_conf.chandef.chan,
                                              elems->ht_operation, &chandef);
+                if (sta->ch_width != chandef.width)
+                        changed |= IEEE80211_RC_BW_CHANGED;
                 sta->ch_width = chandef.width;
         }
 
         if (insert)
                 rate_control_rate_init(sta);
+        else
+                rate_control_rate_update(local, sband, sta, changed);
+out:
         spin_unlock_bh(&sta->lock);
+}
 
-        if (insert && sta_info_insert(sta))
+static struct sta_info *
+__mesh_sta_info_alloc(struct ieee80211_sub_if_data *sdata, u8 *hw_addr)
+{
+        struct sta_info *sta;
+
+        if (sdata->local->num_sta >= MESH_MAX_PLINKS)
                 return NULL;
 
+        sta = sta_info_alloc(sdata, hw_addr, GFP_KERNEL);
+        if (!sta)
+                return NULL;
+
+        sta->plink_state = NL80211_PLINK_LISTEN;
+        init_timer(&sta->plink_timer);
+
+        sta_info_pre_move_state(sta, IEEE80211_STA_AUTH);
+        sta_info_pre_move_state(sta, IEEE80211_STA_ASSOC);
+        sta_info_pre_move_state(sta, IEEE80211_STA_AUTHORIZED);
+
+        set_sta_flag(sta, WLAN_STA_WME);
+
+        return sta;
+}
+
+static struct sta_info *
+mesh_sta_info_alloc(struct ieee80211_sub_if_data *sdata, u8 *addr,
+                    struct ieee802_11_elems *elems)
+{
+        struct sta_info *sta = NULL;
+
+        /* Userspace handles peer allocation when security is enabled */
+        if (sdata->u.mesh.security & IEEE80211_MESH_SEC_AUTHED)
+                cfg80211_notify_new_peer_candidate(sdata->dev, addr,
+                                                   elems->ie_start,
+                                                   elems->total_len,
+                                                   GFP_KERNEL);
+        else
+                sta = __mesh_sta_info_alloc(sdata, addr);
+
         return sta;
 }
 
+/*
+ * mesh_sta_info_get - return mesh sta info entry for @addr.
+ *
+ * @sdata: local meshif
+ * @addr: peer's address
+ * @elems: IEs from beacon or mesh peering frame.
+ *
+ * Return existing or newly allocated sta_info under RCU read lock.
+ * (re)initialize with given IEs.
+ */
+static struct sta_info *
+mesh_sta_info_get(struct ieee80211_sub_if_data *sdata,
+                  u8 *addr, struct ieee802_11_elems *elems) __acquires(RCU)
+{
+        struct sta_info *sta = NULL;
+
+        rcu_read_lock();
+        sta = sta_info_get(sdata, addr);
+        if (sta) {
+                mesh_sta_info_init(sdata, sta, elems, false);
+        } else {
+                rcu_read_unlock();
+                /* can't run atomic */
+                sta = mesh_sta_info_alloc(sdata, addr, elems);
+                if (!sta) {
+                        rcu_read_lock();
+                        return NULL;
+                }
+
+                mesh_sta_info_init(sdata, sta, elems, true);
+
+                if (sta_info_insert_rcu(sta))
+                        return NULL;
+        }
+
+        return sta;
+}
+
+/*
+ * mesh_neighbour_update - update or initialize new mesh neighbor.
+ *
+ * @sdata: local meshif
+ * @addr: peer's address
+ * @elems: IEs from beacon or mesh peering frame
+ *
+ * Initiates peering if appropriate.
+ */
 void mesh_neighbour_update(struct ieee80211_sub_if_data *sdata,
                            u8 *hw_addr,
                            struct ieee802_11_elems *elems)
 {
         struct sta_info *sta;
 
-        rcu_read_lock();
-        sta = mesh_peer_init(sdata, hw_addr, elems);
+        sta = mesh_sta_info_get(sdata, hw_addr, elems);
         if (!sta)
                 goto out;
 
@@ -646,6 +670,7 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
             (ftype == WLAN_SP_MESH_PEERING_CLOSE && ie_len == 8))
                 memcpy(&llid, PLINK_GET_PLID(elems.peering), 2);
 
+        /* WARNING: Only for sta pointer, is dropped & re-acquired */
         rcu_read_lock();
 
         sta = sta_info_get(sdata, mgmt->sa);
@@ -749,8 +774,9 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
         }
 
         if (event == OPN_ACPT) {
+                rcu_read_unlock();
                 /* allocate sta entry if necessary and update info */
-                sta = mesh_peer_init(sdata, mgmt->sa, &elems);
+                sta = mesh_sta_info_get(sdata, mgmt->sa, &elems);
                 if (!sta) {
                         mpl_dbg(sdata, "Mesh plink: failed to init peer!\n");
                         rcu_read_unlock();
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 7753a9ca98a6..5913fb924b12 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -199,11 +199,11 @@ static u32 ieee80211_config_ht_tx(struct ieee80211_sub_if_data *sdata,
         case NL80211_CHAN_WIDTH_40:
                 if (sdata->vif.bss_conf.chandef.chan->center_freq >
                                 sdata->vif.bss_conf.chandef.center_freq1 &&
-                    chan->flags & IEEE80211_CHAN_NO_HT40PLUS)
+                    chan->flags & IEEE80211_CHAN_NO_HT40MINUS)
                         disable_40 = true;
                 if (sdata->vif.bss_conf.chandef.chan->center_freq <
                                 sdata->vif.bss_conf.chandef.center_freq1 &&
-                    chan->flags & IEEE80211_CHAN_NO_HT40MINUS)
+                    chan->flags & IEEE80211_CHAN_NO_HT40PLUS)
                         disable_40 = true;
                 break;
         default:
@@ -341,11 +341,13 @@ static void ieee80211_add_ht_ie(struct ieee80211_sub_if_data *sdata,
 
 static void ieee80211_add_vht_ie(struct ieee80211_sub_if_data *sdata,
                                  struct sk_buff *skb,
-                                 struct ieee80211_supported_band *sband)
+                                 struct ieee80211_supported_band *sband,
+                                 struct ieee80211_vht_cap *ap_vht_cap)
 {
         u8 *pos;
         u32 cap;
         struct ieee80211_sta_vht_cap vht_cap;
+        int i;
 
         BUILD_BUG_ON(sizeof(vht_cap) != sizeof(sband->vht_cap));
 
@@ -364,6 +366,42 @@ static void ieee80211_add_vht_ie(struct ieee80211_sub_if_data *sdata,
                 cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
         }
 
+        /*
+         * Some APs apparently get confused if our capabilities are better
+         * than theirs, so restrict what we advertise in the assoc request.
+         */
+        if (!(ap_vht_cap->vht_cap_info &
+                        cpu_to_le32(IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE)))
+                cap &= ~IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE;
+
+        if (!(ap_vht_cap->vht_cap_info &
+                        cpu_to_le32(IEEE80211_VHT_CAP_TXSTBC)))
+                cap &= ~(IEEE80211_VHT_CAP_RXSTBC_1 |
+                         IEEE80211_VHT_CAP_RXSTBC_3 |
+                         IEEE80211_VHT_CAP_RXSTBC_4);
+
+        for (i = 0; i < 8; i++) {
+                int shift = i * 2;
+                u16 mask = IEEE80211_VHT_MCS_NOT_SUPPORTED << shift;
+                u16 ap_mcs, our_mcs;
+
+                ap_mcs = (le16_to_cpu(ap_vht_cap->supp_mcs.tx_mcs_map) &
+                                                                mask) >> shift;
+                our_mcs = (le16_to_cpu(vht_cap.vht_mcs.rx_mcs_map) &
+                                                                mask) >> shift;
+
+                switch (ap_mcs) {
+                default:
+                        if (our_mcs <= ap_mcs)
+                                break;
+                        /* fall through */
+                case IEEE80211_VHT_MCS_NOT_SUPPORTED:
+                        vht_cap.vht_mcs.rx_mcs_map &= cpu_to_le16(~mask);
+                        vht_cap.vht_mcs.rx_mcs_map |=
+                                cpu_to_le16(ap_mcs << shift);
+                }
+        }
+
         /* reserve and fill IE */
         pos = skb_put(skb, sizeof(struct ieee80211_vht_cap) + 2);
         ieee80211_ie_build_vht_cap(pos, &vht_cap, cap);
@@ -562,7 +600,8 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
                                     sband, chan, sdata->smps_mode);
 
         if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
-                ieee80211_add_vht_ie(sdata, skb, sband);
+                ieee80211_add_vht_ie(sdata, skb, sband,
+                                     &assoc_data->ap_vht_cap);
 
         /* if present, add any custom non-vendor IEs that go after HT */
         if (assoc_data->ie_len && assoc_data->ie) {
@@ -1074,12 +1113,8 @@ void ieee80211_recalc_ps(struct ieee80211_local *local, s32 latency)
                 if (beaconint_us > latency) {
                         local->ps_sdata = NULL;
                 } else {
-                        struct ieee80211_bss *bss;
                         int maxslp = 1;
-                        u8 dtimper;
-
-                        bss = (void *)found->u.mgd.associated->priv;
-                        dtimper = bss->dtim_period;
+                        u8 dtimper = found->u.mgd.dtim_period;
 
                         /* If the TIM IE is invalid, pretend the value is 1 */
                         if (!dtimper)
@@ -1410,10 +1445,17 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
 
         ieee80211_led_assoc(local, 1);
 
-        if (local->hw.flags & IEEE80211_HW_NEED_DTIM_PERIOD)
-                bss_conf->dtim_period = bss->dtim_period;
-        else
+        if (local->hw.flags & IEEE80211_HW_NEED_DTIM_PERIOD) {
+                /*
+                 * If the AP is buggy we may get here with no DTIM period
+                 * known, so assume it's 1 which is the only safe assumption
+                 * in that case, although if the TIM IE is broken powersave
+                 * probably just won't work at all.
+                 */
+                bss_conf->dtim_period = sdata->u.mgd.dtim_period ?: 1;
+        } else {
                 bss_conf->dtim_period = 0;
+        }
 
         bss_conf->assoc = 1;
 
@@ -1423,10 +1465,8 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
                 bss_info_changed |= BSS_CHANGED_CQM;
 
         /* Enable ARP filtering */
-        if (bss_conf->arp_filter_enabled != sdata->arp_filter_state) {
-                bss_conf->arp_filter_enabled = sdata->arp_filter_state;
+        if (bss_conf->arp_addr_cnt)
                 bss_info_changed |= BSS_CHANGED_ARP_FILTER;
-        }
 
         ieee80211_bss_info_change_notify(sdata, bss_info_changed);
 
@@ -1447,7 +1487,6 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
-        struct sta_info *sta;
         u32 changed = 0;
 
         ASSERT_MGD_MTX(ifmgd);
@@ -1479,14 +1518,6 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         netif_tx_stop_all_queues(sdata->dev);
         netif_carrier_off(sdata->dev);
 
-        mutex_lock(&local->sta_mtx);
-        sta = sta_info_get(sdata, ifmgd->bssid);
-        if (sta) {
-                set_sta_flag(sta, WLAN_STA_BLOCK_BA);
-                ieee80211_sta_tear_down_BA_sessions(sta, false);
-        }
-        mutex_unlock(&local->sta_mtx);
-
         /*
          * if we want to get out of ps before disassoc (why?) we have
          * to do it before sending disassoc, as otherwise the null-packet
@@ -1518,7 +1549,7 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         memset(ifmgd->bssid, 0, ETH_ALEN);
 
         /* remove AP and TDLS peers */
-        sta_info_flush(local, sdata);
+        sta_info_flush_defer(sdata);
 
         /* finally reset all BSS / config parameters */
         changed |= ieee80211_reset_erp_info(sdata);
@@ -1540,10 +1571,8 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         cancel_work_sync(&local->dynamic_ps_enable_work);
 
         /* Disable ARP filtering */
-        if (sdata->vif.bss_conf.arp_filter_enabled) {
-                sdata->vif.bss_conf.arp_filter_enabled = false;
+        if (sdata->vif.bss_conf.arp_addr_cnt)
                 changed |= BSS_CHANGED_ARP_FILTER;
-        }
 
         sdata->vif.bss_conf.qos = false;
         changed |= BSS_CHANGED_QOS;
@@ -1562,6 +1591,8 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
 
         sdata->u.mgd.timers_running = 0;
 
+        sdata->vif.bss_conf.dtim_period = 0;
+
         ifmgd->flags = 0;
         ieee80211_vif_release_channel(sdata);
 }
@@ -2364,8 +2395,7 @@ ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
 static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                                   struct ieee80211_mgmt *mgmt, size_t len,
                                   struct ieee80211_rx_status *rx_status,
-                                  struct ieee802_11_elems *elems,
-                                  bool beacon)
+                                  struct ieee802_11_elems *elems)
 {
         struct ieee80211_local *local = sdata->local;
         int freq;
@@ -2373,11 +2403,18 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_channel *channel;
         bool need_ps = false;
 
-        if (sdata->u.mgd.associated &&
-            ether_addr_equal(mgmt->bssid, sdata->u.mgd.associated->bssid)) {
-                bss = (void *)sdata->u.mgd.associated->priv;
+        if ((sdata->u.mgd.associated &&
+             ether_addr_equal(mgmt->bssid, sdata->u.mgd.associated->bssid)) ||
+            (sdata->u.mgd.assoc_data &&
+             ether_addr_equal(mgmt->bssid,
+                              sdata->u.mgd.assoc_data->bss->bssid))) {
                 /* not previously set so we may need to recalc */
-                need_ps = !bss->dtim_period;
+                need_ps = sdata->u.mgd.associated && !sdata->u.mgd.dtim_period;
+
+                if (elems->tim && !elems->parse_error) {
+                        struct ieee80211_tim_ie *tim_ie = elems->tim;
+                        sdata->u.mgd.dtim_period = tim_ie->dtim_period;
+                }
         }
 
         if (elems->ds_params && elems->ds_params_len == 1)
@@ -2392,7 +2429,7 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                 return;
 
         bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, elems,
-                                        channel, beacon);
+                                        channel);
         if (bss)
                 ieee80211_rx_bss_put(local, bss);
 
@@ -2435,7 +2472,7 @@ static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
         ieee802_11_parse_elems(mgmt->u.probe_resp.variable, len - baselen,
                                 &elems);
 
-        ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems, false);
+        ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
 
         if (ifmgd->associated &&
             ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
@@ -2516,8 +2553,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                 ieee802_11_parse_elems(mgmt->u.beacon.variable,
                                        len - baselen, &elems);
 
-                ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems,
-                                      false);
+                ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
                 ifmgd->assoc_data->have_beacon = true;
                 ifmgd->assoc_data->sent_assoc = false;
                 /* continue assoc process */
@@ -2559,12 +2595,12 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                 if (sig > ifmgd->rssi_max_thold &&
                     (last_sig <= ifmgd->rssi_min_thold || last_sig == 0)) {
                         ifmgd->last_ave_beacon_signal = sig;
-                        drv_rssi_callback(local, RSSI_EVENT_HIGH);
+                        drv_rssi_callback(local, sdata, RSSI_EVENT_HIGH);
                 } else if (sig < ifmgd->rssi_min_thold &&
                            (last_sig >= ifmgd->rssi_max_thold ||
                            last_sig == 0)) {
                         ifmgd->last_ave_beacon_signal = sig;
-                        drv_rssi_callback(local, RSSI_EVENT_LOW);
+                        drv_rssi_callback(local, sdata, RSSI_EVENT_LOW);
                 }
         }
 
@@ -2670,8 +2706,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
         ifmgd->beacon_crc = ncrc;
         ifmgd->beacon_crc_valid = true;
 
-        ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems,
-                              true);
+        ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
 
         if (ieee80211_sta_wmm_params(local, sdata, elems.wmm_param,
                                      elems.wmm_param_len))
@@ -3121,23 +3156,22 @@ void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 
-        if (!ifmgd->associated)
+        mutex_lock(&ifmgd->mtx);
+        if (!ifmgd->associated) {
+                mutex_unlock(&ifmgd->mtx);
                 return;
+        }
 
         if (sdata->flags & IEEE80211_SDATA_DISCONNECT_RESUME) {
                 sdata->flags &= ~IEEE80211_SDATA_DISCONNECT_RESUME;
-                mutex_lock(&ifmgd->mtx);
-                if (ifmgd->associated) {
-                        mlme_dbg(sdata,
-                                 "driver requested disconnect after resume\n");
-                        ieee80211_sta_connection_lost(sdata,
-                                ifmgd->associated->bssid,
-                                WLAN_REASON_UNSPECIFIED);
-                        mutex_unlock(&ifmgd->mtx);
-                        return;
-                }
+                mlme_dbg(sdata, "driver requested disconnect after resume\n");
+                ieee80211_sta_connection_lost(sdata,
+                                              ifmgd->associated->bssid,
+                                              WLAN_REASON_UNSPECIFIED);
                 mutex_unlock(&ifmgd->mtx);
+                return;
         }
+        mutex_unlock(&ifmgd->mtx);
 
         if (test_and_clear_bit(TMR_RUNNING_TIMER, &ifmgd->timers_running))
                 add_timer(&ifmgd->timer);
@@ -3744,7 +3778,7 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_bss *bss = (void *)req->bss->priv;
         struct ieee80211_mgd_assoc_data *assoc_data;
         struct ieee80211_supported_band *sband;
-        const u8 *ssidie, *ht_ie;
+        const u8 *ssidie, *ht_ie, *vht_ie;
         int i, err;
 
         assoc_data = kzalloc(sizeof(*assoc_data) + req->ie_len, GFP_KERNEL);
@@ -3863,6 +3897,12 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
                         ((struct ieee80211_ht_operation *)(ht_ie + 2))->ht_param;
         else
                 ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
+        vht_ie = ieee80211_bss_get_ie(req->bss, WLAN_EID_VHT_CAPABILITY);
+        if (vht_ie && vht_ie[1] >= sizeof(struct ieee80211_vht_cap))
+                memcpy(&assoc_data->ap_vht_cap, vht_ie + 2,
+                       sizeof(struct ieee80211_vht_cap));
+        else
+                ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
         rcu_read_unlock();
 
         if (bss->wmm_used && bss->uapsd_supported &&
@@ -3896,20 +3936,41 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
         /* kick off associate process */
 
         ifmgd->assoc_data = assoc_data;
+        ifmgd->dtim_period = 0;
 
         err = ieee80211_prep_connection(sdata, req->bss, true);
         if (err)
                 goto err_clear;
 
-        if (!bss->dtim_period &&
-            sdata->local->hw.flags & IEEE80211_HW_NEED_DTIM_PERIOD) {
-                /*
-                 * Wait up to one beacon interval ...
-                 * should this be more if we miss one?
-                 */
-                sdata_info(sdata, "waiting for beacon from %pM\n",
-                           ifmgd->bssid);
-                assoc_data->timeout = TU_TO_EXP_TIME(req->bss->beacon_interval);
+        if (sdata->local->hw.flags & IEEE80211_HW_NEED_DTIM_PERIOD) {
+                const struct cfg80211_bss_ies *beacon_ies;
+
+                rcu_read_lock();
+                beacon_ies = rcu_dereference(req->bss->beacon_ies);
+                if (!beacon_ies) {
+                        /*
+                         * Wait up to one beacon interval ...
+                         * should this be more if we miss one?
+                         */
+                        sdata_info(sdata, "waiting for beacon from %pM\n",
+                                   ifmgd->bssid);
+                        assoc_data->timeout =
+                                TU_TO_EXP_TIME(req->bss->beacon_interval);
+                } else {
+                        const u8 *tim_ie = cfg80211_find_ie(WLAN_EID_TIM,
+                                                            beacon_ies->data,
+                                                            beacon_ies->len);
+                        if (tim_ie && tim_ie[1] >=
+                                        sizeof(struct ieee80211_tim_ie)) {
+                                const struct ieee80211_tim_ie *tim;
+                                tim = (void *)(tim_ie + 2);
+                                ifmgd->dtim_period = tim->dtim_period;
+                        }
+                        assoc_data->have_beacon = true;
+                        assoc_data->sent_assoc = false;
+                        assoc_data->timeout = jiffies;
+                }
+                rcu_read_unlock();
         } else {
                 assoc_data->have_beacon = true;
                 assoc_data->sent_assoc = false;
diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
index a5379aea7d09..82baf5b6ecf4 100644
--- a/net/mac80211/offchannel.c
+++ b/net/mac80211/offchannel.c
@@ -102,8 +102,7 @@ static void ieee80211_offchannel_ps_disable(struct ieee80211_sub_if_data *sdata)
         ieee80211_sta_reset_conn_monitor(sdata);
 }
 
-void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local,
-                                    bool offchannel_ps_enable)
+void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local)
 {
         struct ieee80211_sub_if_data *sdata;
 
@@ -126,16 +125,17 @@ void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local,
                         set_bit(SDATA_STATE_OFFCHANNEL, &sdata->state);
 
                 /* Check to see if we should disable beaconing. */
-                if (sdata->vif.type == NL80211_IFTYPE_AP ||
-                    sdata->vif.type == NL80211_IFTYPE_ADHOC ||
-                    sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
+                if (sdata->vif.bss_conf.enable_beacon) {
+                        set_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED,
+                                &sdata->state);
+                        sdata->vif.bss_conf.enable_beacon = false;
                         ieee80211_bss_info_change_notify(
                                 sdata, BSS_CHANGED_BEACON_ENABLED);
+                }
 
                 if (sdata->vif.type != NL80211_IFTYPE_MONITOR) {
                         netif_tx_stop_all_queues(sdata->dev);
-                        if (offchannel_ps_enable &&
-                            (sdata->vif.type == NL80211_IFTYPE_STATION) &&
+                        if (sdata->vif.type == NL80211_IFTYPE_STATION &&
                             sdata->u.mgd.associated)
                                 ieee80211_offchannel_ps_enable(sdata);
                 }
@@ -143,8 +143,7 @@ void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local,
         mutex_unlock(&local->iflist_mtx);
 }
 
-void ieee80211_offchannel_return(struct ieee80211_local *local,
-                                 bool offchannel_ps_disable)
+void ieee80211_offchannel_return(struct ieee80211_local *local)
 {
         struct ieee80211_sub_if_data *sdata;
 
@@ -163,11 +162,9 @@ void ieee80211_offchannel_return(struct ieee80211_local *local,
                         continue;
 
                 /* Tell AP we're back */
-                if (offchannel_ps_disable &&
-                    sdata->vif.type == NL80211_IFTYPE_STATION) {
-                        if (sdata->u.mgd.associated)
-                                ieee80211_offchannel_ps_disable(sdata);
-                }
+                if (sdata->vif.type == NL80211_IFTYPE_STATION &&
+                    sdata->u.mgd.associated)
+                        ieee80211_offchannel_ps_disable(sdata);
 
                 if (sdata->vif.type != NL80211_IFTYPE_MONITOR) {
                         /*
@@ -183,11 +180,12 @@ void ieee80211_offchannel_return(struct ieee80211_local *local,
                         netif_tx_wake_all_queues(sdata->dev);
                 }
 
-                if (sdata->vif.type == NL80211_IFTYPE_AP ||
-                    sdata->vif.type == NL80211_IFTYPE_ADHOC ||
-                    sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
+                if (test_and_clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED,
+                                       &sdata->state)) {
+                        sdata->vif.bss_conf.enable_beacon = true;
                         ieee80211_bss_info_change_notify(
                                 sdata, BSS_CHANGED_BEACON_ENABLED);
+                }
         }
         mutex_unlock(&local->iflist_mtx);
 }
@@ -385,7 +383,7 @@ void ieee80211_sw_roc_work(struct work_struct *work)
                         local->tmp_channel = NULL;
                         ieee80211_hw_config(local, 0);
 
-                        ieee80211_offchannel_return(local, true);
+                        ieee80211_offchannel_return(local);
                 }
 
                 ieee80211_recalc_idle(local);
diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
index 79a48f37d409..e45b83610e85 100644
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -7,25 +7,23 @@
 #include "led.h"
 
 /* return value indicates whether the driver should be further notified */
-static bool ieee80211_quiesce(struct ieee80211_sub_if_data *sdata)
+static void ieee80211_quiesce(struct ieee80211_sub_if_data *sdata)
 {
         switch (sdata->vif.type) {
         case NL80211_IFTYPE_STATION:
                 ieee80211_sta_quiesce(sdata);
-                return true;
+                break;
         case NL80211_IFTYPE_ADHOC:
                 ieee80211_ibss_quiesce(sdata);
-                return true;
+                break;
         case NL80211_IFTYPE_MESH_POINT:
                 ieee80211_mesh_quiesce(sdata);
-                return true;
-        case NL80211_IFTYPE_AP_VLAN:
-        case NL80211_IFTYPE_MONITOR:
-                /* don't tell driver about this */
-                return false;
+                break;
         default:
-                return true;
+                break;
         }
+
+        cancel_work_sync(&sdata->work);
 }
 
 int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
@@ -44,7 +42,8 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
                 mutex_lock(&local->sta_mtx);
                 list_for_each_entry(sta, &local->sta_list, list) {
                         set_sta_flag(sta, WLAN_STA_BLOCK_BA);
-                        ieee80211_sta_tear_down_BA_sessions(sta, true);
+                        ieee80211_sta_tear_down_BA_sessions(
+                                        sta, AGG_STOP_LOCAL_REQUEST);
                 }
                 mutex_unlock(&local->sta_mtx);
         }
@@ -94,10 +93,9 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
                         WARN_ON(err != 1);
                         local->wowlan = false;
                 } else {
-                        list_for_each_entry(sdata, &local->interfaces, list) {
-                                cancel_work_sync(&sdata->work);
-                                ieee80211_quiesce(sdata);
-                        }
+                        list_for_each_entry(sdata, &local->interfaces, list)
+                                if (ieee80211_sdata_running(sdata))
+                                        ieee80211_quiesce(sdata);
                         goto suspend;
                 }
         }
@@ -124,17 +122,43 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
 
         /* remove all interfaces */
         list_for_each_entry(sdata, &local->interfaces, list) {
-                cancel_work_sync(&sdata->work);
+                static u8 zero_addr[ETH_ALEN] = {};
+                u32 changed = 0;
 
-                if (!ieee80211_quiesce(sdata))
+                if (!ieee80211_sdata_running(sdata))
                         continue;
 
-                if (!ieee80211_sdata_running(sdata))
+                switch (sdata->vif.type) {
+                case NL80211_IFTYPE_AP_VLAN:
+                case NL80211_IFTYPE_MONITOR:
+                        /* skip these */
                         continue;
+                case NL80211_IFTYPE_STATION:
+                        if (sdata->vif.bss_conf.assoc)
+                                changed = BSS_CHANGED_ASSOC |
+                                          BSS_CHANGED_BSSID |
+                                          BSS_CHANGED_IDLE;
+                        break;
+                case NL80211_IFTYPE_AP:
+                case NL80211_IFTYPE_ADHOC:
+                case NL80211_IFTYPE_MESH_POINT:
+                        if (sdata->vif.bss_conf.enable_beacon)
+                                changed = BSS_CHANGED_BEACON_ENABLED;
+                        break;
+                default:
+                        break;
+                }
+
+                ieee80211_quiesce(sdata);
+
+                sdata->suspend_bss_conf = sdata->vif.bss_conf;
+                memset(&sdata->vif.bss_conf, 0, sizeof(sdata->vif.bss_conf));
+                sdata->vif.bss_conf.idle = true;
+                if (sdata->suspend_bss_conf.bssid)
+                        sdata->vif.bss_conf.bssid = zero_addr;
 
-                /* disable beaconing */
-                ieee80211_bss_info_change_notify(sdata,
-                        BSS_CHANGED_BEACON_ENABLED);
+                /* disable beaconing or remove association */
+                ieee80211_bss_info_change_notify(sdata, changed);
 
                 if (sdata->vif.type == NL80211_IFTYPE_AP &&
                     rcu_access_pointer(sdata->u.ap.beacon))
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 580704eba8b8..a19089565c4b 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2353,7 +2353,7 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
                     sdata->vif.type != NL80211_IFTYPE_ADHOC)
                         break;
 
-                /* verify action & smps_control are present */
+                /* verify action & smps_control/chanwidth are present */
                 if (len < IEEE80211_MIN_ACTION_SIZE + 2)
                         goto invalid;
 
@@ -2392,6 +2392,35 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
                                                  IEEE80211_RC_SMPS_CHANGED);
                         goto handled;
                 }
+                case WLAN_HT_ACTION_NOTIFY_CHANWIDTH: {
+                        struct ieee80211_supported_band *sband;
+                        u8 chanwidth = mgmt->u.action.u.ht_notify_cw.chanwidth;
+                        bool old_40mhz, new_40mhz;
+
+                        /* If it doesn't support 40 MHz it can't change ... */
+                        if (!rx->sta->supports_40mhz)
+                                goto handled;
+
+                        old_40mhz = rx->sta->sta.ht_cap.cap &
+                                        IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+                        new_40mhz = chanwidth == IEEE80211_HT_CHANWIDTH_ANY;
+
+                        if (old_40mhz == new_40mhz)
+                                goto handled;
+
+                        if (new_40mhz)
+                                rx->sta->sta.ht_cap.cap |=
+                                        IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+                        else
+                                rx->sta->sta.ht_cap.cap &=
+                                        ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+
+                        sband = rx->local->hw.wiphy->bands[status->band];
+
+                        rate_control_rate_update(local, sband, rx->sta,
+                                                 IEEE80211_RC_BW_CHANGED);
+                        goto handled;
+                }
                 default:
                         goto invalid;
                 }
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 8ed83dcc149f..607684c47d55 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -65,12 +65,11 @@ static bool is_uapsd_supported(struct ieee802_11_elems *elems)
 struct ieee80211_bss *
 ieee80211_bss_info_update(struct ieee80211_local *local,
                           struct ieee80211_rx_status *rx_status,
-                          struct ieee80211_mgmt *mgmt,
-                          size_t len,
+                          struct ieee80211_mgmt *mgmt, size_t len,
                           struct ieee802_11_elems *elems,
-                          struct ieee80211_channel *channel,
-                          bool beacon)
+                          struct ieee80211_channel *channel)
 {
+        bool beacon = ieee80211_is_beacon(mgmt->frame_control);
         struct cfg80211_bss *cbss;
         struct ieee80211_bss *bss;
         int clen, srlen;
@@ -113,18 +112,6 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
                         bss->valid_data |= IEEE80211_BSS_VALID_ERP;
         }
 
-        if (elems->tim && (!elems->parse_error ||
-                           !(bss->valid_data & IEEE80211_BSS_VALID_DTIM))) {
-                struct ieee80211_tim_ie *tim_ie = elems->tim;
-                bss->dtim_period = tim_ie->dtim_period;
-                if (!elems->parse_error)
-                        bss->valid_data |= IEEE80211_BSS_VALID_DTIM;
-        }
-
-        /* If the beacon had no TIM IE, or it was invalid, use 1 */
-        if (beacon && !bss->dtim_period)
-                bss->dtim_period = 1;
-
         /* replace old supported rates if we get new values */
         if (!elems->parse_error ||
             !(bss->valid_data & IEEE80211_BSS_VALID_RATES)) {
@@ -215,7 +202,7 @@ void ieee80211_scan_rx(struct ieee80211_local *local, struct sk_buff *skb)
 
         bss = ieee80211_bss_info_update(local, rx_status,
                                         mgmt, skb->len, &elems,
-                                        channel, beacon);
+                                        channel);
         if (bss)
                 ieee80211_rx_bss_put(local, bss);
 }
@@ -304,7 +291,7 @@ static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted,
         if (!was_hw_scan) {
                 ieee80211_configure_filter(local);
                 drv_sw_scan_complete(local);
-                ieee80211_offchannel_return(local, true);
+                ieee80211_offchannel_return(local);
         }
 
         ieee80211_recalc_idle(local);
@@ -353,7 +340,7 @@ static int ieee80211_start_sw_scan(struct ieee80211_local *local)
         local->next_scan_state = SCAN_DECISION;
         local->scan_channel_idx = 0;
 
-        ieee80211_offchannel_stop_vifs(local, true);
+        ieee80211_offchannel_stop_vifs(local);
 
         ieee80211_configure_filter(local);
 
@@ -690,12 +677,8 @@ static void ieee80211_scan_state_suspend(struct ieee80211_local *local,
         local->scan_channel = NULL;
         ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
 
-        /*
-         * Re-enable vifs and beaconing.  Leave PS
-         * in off-channel state..will put that back
-         * on-channel at the end of scanning.
-         */
-        ieee80211_offchannel_return(local, false);
+        /* disable PS */
+        ieee80211_offchannel_return(local);
 
         *next_delay = HZ / 5;
         /* afterwards, resume scan & go to next channel */
@@ -705,8 +688,7 @@ static void ieee80211_scan_state_suspend(struct ieee80211_local *local,
 static void ieee80211_scan_state_resume(struct ieee80211_local *local,
                                         unsigned long *next_delay)
 {
-        /* PS already is in off-channel mode */
-        ieee80211_offchannel_stop_vifs(local, false);
+        ieee80211_offchannel_stop_vifs(local);
 
         if (local->ops->flush) {
                 drv_flush(local, false);
@@ -832,9 +814,9 @@ int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata,
         return res;
 }
 
-int ieee80211_request_internal_scan(struct ieee80211_sub_if_data *sdata,
-                                    const u8 *ssid, u8 ssid_len,
-                                    struct ieee80211_channel *chan)
+int ieee80211_request_ibss_scan(struct ieee80211_sub_if_data *sdata,
+                                const u8 *ssid, u8 ssid_len,
+                                struct ieee80211_channel *chan)
 {
         struct ieee80211_local *local = sdata->local;
         int ret = -EBUSY;
@@ -848,22 +830,36 @@ int ieee80211_request_internal_scan(struct ieee80211_sub_if_data *sdata,
 
         /* fill internal scan request */
         if (!chan) {
-                int i, nchan = 0;
+                int i, max_n;
+                int n_ch = 0;
 
                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
                         if (!local->hw.wiphy->bands[band])
                                 continue;
-                        for (i = 0;
-                             i < local->hw.wiphy->bands[band]->n_channels;
-                             i++) {
-                                local->int_scan_req->channels[nchan] =
+
+                        max_n = local->hw.wiphy->bands[band]->n_channels;
+                        for (i = 0; i < max_n; i++) {
+                                struct ieee80211_channel *tmp_ch =
                                     &local->hw.wiphy->bands[band]->channels[i];
-                                nchan++;
+
+                                if (tmp_ch->flags & (IEEE80211_CHAN_NO_IBSS |
+                                                     IEEE80211_CHAN_DISABLED))
+                                        continue;
+
+                                local->int_scan_req->channels[n_ch] = tmp_ch;
+                                n_ch++;
                         }
                 }
 
-                local->int_scan_req->n_channels = nchan;
+                if (WARN_ON_ONCE(n_ch == 0))
+                        goto unlock;
+
+                local->int_scan_req->n_channels = n_ch;
         } else {
+                if (WARN_ON_ONCE(chan->flags & (IEEE80211_CHAN_NO_IBSS |
+                                                IEEE80211_CHAN_DISABLED)))
+                        goto unlock;
+
                 local->int_scan_req->channels[0] = chan;
                 local->int_scan_req->n_channels = 1;
         }
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index f3e502502fee..227233c3ff7f 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -91,9 +91,8 @@ static int sta_info_hash_del(struct ieee80211_local *local,
         return -ENOENT;
 }
 
-static void free_sta_work(struct work_struct *wk)
+static void cleanup_single_sta(struct sta_info *sta)
 {
-        struct sta_info *sta = container_of(wk, struct sta_info, free_sta_wk);
         int ac, i;
         struct tid_ampdu_tx *tid_tx;
         struct ieee80211_sub_if_data *sdata = sta->sdata;
@@ -105,6 +104,16 @@ static void free_sta_work(struct work_struct *wk)
          * neither mac80211 nor the driver can reference this
          * sta struct any more except by still existing timers
          * associated with this station that we clean up below.
+         *
+         * Note though that this still uses the sdata and even
+         * calls the driver in AP and mesh mode, so interfaces
+         * of those types mush use call sta_info_flush_cleanup()
+         * (typically via sta_info_flush()) before deconfiguring
+         * the driver.
+         *
+         * In station mode, nothing happens here so it doesn't
+         * have to (and doesn't) do that, this is intentional to
+         * speed up roaming.
          */
 
         if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
@@ -153,11 +162,35 @@ static void free_sta_work(struct work_struct *wk)
         sta_info_free(local, sta);
 }
 
+void ieee80211_cleanup_sdata_stas(struct ieee80211_sub_if_data *sdata)
+{
+        struct sta_info *sta;
+
+        spin_lock_bh(&sdata->cleanup_stations_lock);
+        while (!list_empty(&sdata->cleanup_stations)) {
+                sta = list_first_entry(&sdata->cleanup_stations,
+                                       struct sta_info, list);
+                list_del(&sta->list);
+                spin_unlock_bh(&sdata->cleanup_stations_lock);
+
+                cleanup_single_sta(sta);
+
+                spin_lock_bh(&sdata->cleanup_stations_lock);
+        }
+
+        spin_unlock_bh(&sdata->cleanup_stations_lock);
+}
+
 static void free_sta_rcu(struct rcu_head *h)
 {
         struct sta_info *sta = container_of(h, struct sta_info, rcu_head);
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
+
+        spin_lock(&sdata->cleanup_stations_lock);
+        list_add_tail(&sta->list, &sdata->cleanup_stations);
+        spin_unlock(&sdata->cleanup_stations_lock);
 
-        ieee80211_queue_work(&sta->local->hw, &sta->free_sta_wk);
+        ieee80211_queue_work(&sdata->local->hw, &sdata->cleanup_stations_wk);
 }
 
 /* protected by RCU */
@@ -310,7 +343,6 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
 
         spin_lock_init(&sta->lock);
         INIT_WORK(&sta->drv_unblock_wk, sta_unblock);
-        INIT_WORK(&sta->free_sta_wk, free_sta_work);
         INIT_WORK(&sta->ampdu_mlme.work, ieee80211_ba_session_work);
         mutex_init(&sta->ampdu_mlme.mtx);
 
@@ -348,11 +380,6 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
 
         sta_dbg(sdata, "Allocated STA %pM\n", sta->sta.addr);
 
-#ifdef CONFIG_MAC80211_MESH
-        sta->plink_state = NL80211_PLINK_LISTEN;
-        init_timer(&sta->plink_timer);
-#endif
-
         return sta;
 }
 
@@ -752,7 +779,7 @@ int __must_check __sta_info_destroy(struct sta_info *sta)
          * will be sufficient.
          */
         set_sta_flag(sta, WLAN_STA_BLOCK_BA);
-        ieee80211_sta_tear_down_BA_sessions(sta, false);
+        ieee80211_sta_tear_down_BA_sessions(sta, AGG_STOP_DESTROY_STA);
 
         ret = sta_info_hash_del(local, sta);
         if (ret)
@@ -862,21 +889,13 @@ void sta_info_init(struct ieee80211_local *local)
 
 void sta_info_stop(struct ieee80211_local *local)
 {
-        del_timer(&local->sta_cleanup);
-        sta_info_flush(local, NULL);
+        del_timer_sync(&local->sta_cleanup);
 }
 
-/**
- * sta_info_flush - flush matching STA entries from the STA table
- *
- * Returns the number of removed STA entries.
- *
- * @local: local interface data
- * @sdata: matching rule for the net device (sta->dev) or %NULL to match all STAs
- */
-int sta_info_flush(struct ieee80211_local *local,
-                   struct ieee80211_sub_if_data *sdata)
+
+int sta_info_flush_defer(struct ieee80211_sub_if_data *sdata)
 {
+        struct ieee80211_local *local = sdata->local;
         struct sta_info *sta, *tmp;
         int ret = 0;
 
@@ -884,7 +903,7 @@ int sta_info_flush(struct ieee80211_local *local,
 
         mutex_lock(&local->sta_mtx);
         list_for_each_entry_safe(sta, tmp, &local->sta_list, list) {
-                if (!sdata || sdata == sta->sdata) {
+                if (sdata == sta->sdata) {
                         WARN_ON(__sta_info_destroy(sta));
                         ret++;
                 }
@@ -894,6 +913,12 @@ int sta_info_flush(struct ieee80211_local *local,
         return ret;
 }
 
+void sta_info_flush_cleanup(struct ieee80211_sub_if_data *sdata)
+{
+        ieee80211_cleanup_sdata_stas(sdata);
+        cancel_work_sync(&sdata->cleanup_stations_wk);
+}
+
 void ieee80211_sta_expire(struct ieee80211_sub_if_data *sdata,
                           unsigned long exp_time)
 {
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 1489bca9ea97..af7d78aa5523 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -92,6 +92,13 @@ enum ieee80211_sta_info_flags {
 #define HT_AGG_STATE_WANT_START         4
 #define HT_AGG_STATE_WANT_STOP          5
 
+enum ieee80211_agg_stop_reason {
+        AGG_STOP_DECLINED,
+        AGG_STOP_LOCAL_REQUEST,
+        AGG_STOP_PEER_REQUEST,
+        AGG_STOP_DESTROY_STA,
+};
+
 /**
  * struct tid_ampdu_tx - TID aggregation information (Tx).
  *
@@ -299,7 +306,6 @@ struct sta_info {
         spinlock_t lock;
 
         struct work_struct drv_unblock_wk;
-        struct work_struct free_sta_wk;
 
         u16 listen_interval;
 
@@ -549,8 +555,39 @@ void sta_info_recalc_tim(struct sta_info *sta);
 
 void sta_info_init(struct ieee80211_local *local);
 void sta_info_stop(struct ieee80211_local *local);
-int sta_info_flush(struct ieee80211_local *local,
-                   struct ieee80211_sub_if_data *sdata);
+int sta_info_flush_defer(struct ieee80211_sub_if_data *sdata);
+
+/**
+ * sta_info_flush_cleanup - flush the sta_info cleanup queue
+ * @sdata: the interface
+ *
+ * Flushes the sta_info cleanup queue for a given interface;
+ * this is necessary before the interface is removed or, for
+ * AP/mesh interfaces, before it is deconfigured.
+ *
+ * Note an rcu_barrier() must precede the function, after all
+ * stations have been flushed/removed to ensure the call_rcu()
+ * calls that add stations to the cleanup queue have completed.
+ */
+void sta_info_flush_cleanup(struct ieee80211_sub_if_data *sdata);
+
+/**
+ * sta_info_flush - flush matching STA entries from the STA table
+ *
+ * Returns the number of removed STA entries.
+ *
+ * @sdata: sdata to remove all stations from
+ */
+static inline int sta_info_flush(struct ieee80211_sub_if_data *sdata)
+{
+        int ret = sta_info_flush_defer(sdata);
+
+        rcu_barrier();
+        sta_info_flush_cleanup(sdata);
+
+        return ret;
+}
+
 void sta_set_rate_info_tx(struct sta_info *sta,
                           const struct ieee80211_tx_rate *rate,
                           struct rate_info *rinfo);
@@ -563,4 +600,6 @@ void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta);
 void ieee80211_sta_ps_deliver_poll_response(struct sta_info *sta);
 void ieee80211_sta_ps_deliver_uapsd(struct sta_info *sta);
 
+void ieee80211_cleanup_sdata_stas(struct ieee80211_sub_if_data *sdata);
+
 #endif /* STA_INFO_H */
diff --git a/net/mac80211/trace.h b/net/mac80211/trace.h
index a8270b441a6f..6ca53d64cb28 100644
--- a/net/mac80211/trace.h
+++ b/net/mac80211/trace.h
@@ -28,21 +28,27 @@
 #define VIF_PR_FMT      " vif:%s(%d%s)"
 #define VIF_PR_ARG      __get_str(vif_name), __entry->vif_type, __entry->p2p ? "/p2p" : ""
 
-#define CHANCTX_ENTRY   __field(u32, control_freq)                              \
+#define CHANDEF_ENTRY   __field(u32, control_freq)                              \
                         __field(u32, chan_width)                                \
                         __field(u32, center_freq1)                              \
-                        __field(u32, center_freq2)                              \
+                        __field(u32, center_freq2)
+#define CHANDEF_ASSIGN(c)                                                       \
+                        __entry->control_freq = (c)->chan->center_freq;         \
+                        __entry->chan_width = (c)->width;                       \
+                        __entry->center_freq1 = (c)->center_freq1;              \
+                        __entry->center_freq1 = (c)->center_freq2;
+#define CHANDEF_PR_FMT  " control:%d MHz width:%d center: %d/%d MHz"
+#define CHANDEF_PR_ARG  __entry->control_freq, __entry->chan_width,             \
+                        __entry->center_freq1, __entry->center_freq2
+
+#define CHANCTX_ENTRY   CHANDEF_ENTRY                                           \
                         __field(u8, rx_chains_static)                           \
                         __field(u8, rx_chains_dynamic)
-#define CHANCTX_ASSIGN  __entry->control_freq = ctx->conf.def.chan->center_freq;\
-                        __entry->chan_width = ctx->conf.def.width;              \
-                        __entry->center_freq1 = ctx->conf.def.center_freq1;     \
-                        __entry->center_freq2 = ctx->conf.def.center_freq2;     \
+#define CHANCTX_ASSIGN  CHANDEF_ASSIGN(&ctx->conf.def)                          \
                         __entry->rx_chains_static = ctx->conf.rx_chains_static; \
                         __entry->rx_chains_dynamic = ctx->conf.rx_chains_dynamic
-#define CHANCTX_PR_FMT  " control:%d MHz width:%d center: %d/%d MHz chains:%d/%d"
-#define CHANCTX_PR_ARG  __entry->control_freq, __entry->chan_width,             \
-                        __entry->center_freq1, __entry->center_freq2,           \
+#define CHANCTX_PR_FMT  CHANDEF_PR_FMT " chains:%d/%d"
+#define CHANCTX_PR_ARG  CHANDEF_PR_ARG,                                         \
                         __entry->rx_chains_static, __entry->rx_chains_dynamic
 
 
@@ -341,8 +347,11 @@ TRACE_EVENT(drv_bss_info_changed,
                 __field(s32, cqm_rssi_hyst);
                 __field(u32, channel_width);
                 __field(u32, channel_cfreq1);
-                __dynamic_array(u32, arp_addr_list, info->arp_addr_cnt);
-                __field(bool, arp_filter_enabled);
+                __dynamic_array(u32, arp_addr_list,
+                                info->arp_addr_cnt > IEEE80211_BSS_ARP_ADDR_LIST_LEN ?
+                                        IEEE80211_BSS_ARP_ADDR_LIST_LEN :
+                                        info->arp_addr_cnt);
+                __field(int, arp_addr_cnt);
                 __field(bool, qos);
                 __field(bool, idle);
                 __field(bool, ps);
@@ -378,9 +387,11 @@ TRACE_EVENT(drv_bss_info_changed,
                 __entry->cqm_rssi_hyst = info->cqm_rssi_hyst;
                 __entry->channel_width = info->chandef.width;
                 __entry->channel_cfreq1 = info->chandef.center_freq1;
+                __entry->arp_addr_cnt = info->arp_addr_cnt;
                 memcpy(__get_dynamic_array(arp_addr_list), info->arp_addr_list,
-                       sizeof(u32) * info->arp_addr_cnt);
-                __entry->arp_filter_enabled = info->arp_filter_enabled;
+                       sizeof(u32) * (info->arp_addr_cnt > IEEE80211_BSS_ARP_ADDR_LIST_LEN ?
+                                        IEEE80211_BSS_ARP_ADDR_LIST_LEN :
+                                        info->arp_addr_cnt));
                 __entry->qos = info->qos;
                 __entry->idle = info->idle;
                 __entry->ps = info->ps;
@@ -1178,23 +1189,26 @@ TRACE_EVENT(drv_set_rekey_data,
 
 TRACE_EVENT(drv_rssi_callback,
         TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_sub_if_data *sdata,
                  enum ieee80211_rssi_event rssi_event),
 
-        TP_ARGS(local, rssi_event),
+        TP_ARGS(local, sdata, rssi_event),
 
         TP_STRUCT__entry(
                 LOCAL_ENTRY
+                VIF_ENTRY
                 __field(u32, rssi_event)
         ),
 
         TP_fast_assign(
                 LOCAL_ASSIGN;
+                VIF_ASSIGN;
                 __entry->rssi_event = rssi_event;
         ),
 
         TP_printk(
-                LOCAL_PR_FMT " rssi_event:%d",
-                LOCAL_PR_ARG, __entry->rssi_event
+                LOCAL_PR_FMT VIF_PR_FMT " rssi_event:%d",
+                LOCAL_PR_ARG, VIF_PR_ARG, __entry->rssi_event
         )
 );
 
@@ -1426,6 +1440,14 @@ DEFINE_EVENT(local_only_evt, drv_restart_complete,
         TP_ARGS(local)
 );
 
+#if IS_ENABLED(CONFIG_IPV6)
+DEFINE_EVENT(local_sdata_evt, drv_ipv6_addr_change,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_sub_if_data *sdata),
+        TP_ARGS(local, sdata)
+);
+#endif
+
 /*
  * Tracing for API calls that drivers call.
  */
@@ -1815,6 +1837,29 @@ TRACE_EVENT(stop_queue,
         )
 );
 
+TRACE_EVENT(drv_set_default_unicast_key,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_sub_if_data *sdata,
+                 int key_idx),
+
+        TP_ARGS(local, sdata, key_idx),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                VIF_ENTRY
+                __field(int, key_idx)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                VIF_ASSIGN;
+                __entry->key_idx = key_idx;
+        ),
+
+        TP_printk(LOCAL_PR_FMT VIF_PR_FMT " key_idx:%d",
+                  LOCAL_PR_ARG, VIF_PR_ARG, __entry->key_idx)
+);
+
 #ifdef CONFIG_MAC80211_MESSAGE_TRACING
 #undef TRACE_SYSTEM
 #define TRACE_SYSTEM mac80211_msg
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index e9eadc40c09c..a2cb6a302cc7 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1673,10 +1673,13 @@ netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb,
                         chanctx_conf =
                                 rcu_dereference(tmp_sdata->vif.chanctx_conf);
         }
-        if (!chanctx_conf)
-                goto fail_rcu;
 
-        chan = chanctx_conf->def.chan;
+        if (chanctx_conf)
+                chan = chanctx_conf->def.chan;
+        else if (!local->use_chanctx)
+                chan = local->_oper_channel;
+        else
+                goto fail_rcu;
 
         /*
          * Frame injection is not allowed if beaconing is not allowed
@@ -1784,16 +1787,16 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                         break;
                 /* fall through */
         case NL80211_IFTYPE_AP:
+                if (sdata->vif.type == NL80211_IFTYPE_AP)
+                        chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
+                if (!chanctx_conf)
+                        goto fail_rcu;
                 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS);
                 /* DA BSSID SA */
                 memcpy(hdr.addr1, skb->data, ETH_ALEN);
                 memcpy(hdr.addr2, sdata->vif.addr, ETH_ALEN);
                 memcpy(hdr.addr3, skb->data + ETH_ALEN, ETH_ALEN);
                 hdrlen = 24;
-                if (sdata->vif.type == NL80211_IFTYPE_AP)
-                        chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
-                if (!chanctx_conf)
-                        goto fail_rcu;
                 band = chanctx_conf->def.chan->band;
                 break;
         case NL80211_IFTYPE_WDS:
@@ -2261,9 +2264,8 @@ void ieee80211_tx_pending(unsigned long data)
 
 /* functions for drivers to get certain frames */
 
-static void ieee80211_beacon_add_tim(struct ieee80211_sub_if_data *sdata,
-                                     struct ps_data *ps,
-                                     struct sk_buff *skb)
+static void __ieee80211_beacon_add_tim(struct ieee80211_sub_if_data *sdata,
+                                       struct ps_data *ps, struct sk_buff *skb)
 {
         u8 *pos, *tim;
         int aid0 = 0;
@@ -2325,6 +2327,31 @@ static void ieee80211_beacon_add_tim(struct ieee80211_sub_if_data *sdata,
         }
 }
 
+static int ieee80211_beacon_add_tim(struct ieee80211_sub_if_data *sdata,
+                                    struct ps_data *ps, struct sk_buff *skb)
+{
+        struct ieee80211_local *local = sdata->local;
+
+        /*
+         * Not very nice, but we want to allow the driver to call
+         * ieee80211_beacon_get() as a response to the set_tim()
+         * callback. That, however, is already invoked under the
+         * sta_lock to guarantee consistent and race-free update
+         * of the tim bitmap in mac80211 and the driver.
+         */
+        if (local->tim_in_locked_section) {
+                __ieee80211_beacon_add_tim(sdata, ps, skb);
+        } else {
+                unsigned long flags;
+
+                spin_lock_irqsave(&local->tim_lock, flags);
+                __ieee80211_beacon_add_tim(sdata, ps, skb);
+                spin_unlock_irqrestore(&local->tim_lock, flags);
+        }
+
+        return 0;
+}
+
 struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
                                          struct ieee80211_vif *vif,
                                          u16 *tim_offset, u16 *tim_length)
@@ -2369,22 +2396,7 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
                         memcpy(skb_put(skb, beacon->head_len), beacon->head,
                                beacon->head_len);
 
-                        /*
-                         * Not very nice, but we want to allow the driver to call
-                         * ieee80211_beacon_get() as a response to the set_tim()
-                         * callback. That, however, is already invoked under the
-                         * sta_lock to guarantee consistent and race-free update
-                         * of the tim bitmap in mac80211 and the driver.
-                         */
-                        if (local->tim_in_locked_section) {
-                                ieee80211_beacon_add_tim(sdata, &ap->ps, skb);
-                        } else {
-                                unsigned long flags;
-
-                                spin_lock_irqsave(&local->tim_lock, flags);
-                                ieee80211_beacon_add_tim(sdata, &ap->ps, skb);
-                                spin_unlock_irqrestore(&local->tim_lock, flags);
-                        }
+                        ieee80211_beacon_add_tim(sdata, &ap->ps, skb);
 
                         if (tim_offset)
                                 *tim_offset = beacon->head_len;
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index f11e8c540db4..7519018ff71a 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -1358,6 +1358,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
         struct ieee80211_chanctx *ctx;
         struct sta_info *sta;
         int res, i;
+        bool reconfig_due_to_wowlan = false;
 
 #ifdef CONFIG_PM
         if (local->suspended)
@@ -1377,6 +1378,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                  * res is 1, which means the driver requested
                  * to go through a regular reset on wakeup.
                  */
+                reconfig_due_to_wowlan = true;
         }
 #endif
         /* everything else happens only if HW was up & running */
@@ -1526,6 +1528,11 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                           BSS_CHANGED_IDLE |
                           BSS_CHANGED_TXPOWER;
 
+#ifdef CONFIG_PM
+                if (local->resuming && !reconfig_due_to_wowlan)
+                        sdata->vif.bss_conf = sdata->suspend_bss_conf;
+#endif
+
                 switch (sdata->vif.type) {
                 case NL80211_IFTYPE_STATION:
                         changed |= BSS_CHANGED_ASSOC |
@@ -1550,9 +1557,11 @@ int ieee80211_reconfig(struct ieee80211_local *local)
 
                         /* fall through */
                 case NL80211_IFTYPE_MESH_POINT:
-                        changed |= BSS_CHANGED_BEACON |
-                                   BSS_CHANGED_BEACON_ENABLED;
-                        ieee80211_bss_info_change_notify(sdata, changed);
+                        if (sdata->vif.bss_conf.enable_beacon) {
+                                changed |= BSS_CHANGED_BEACON |
+                                           BSS_CHANGED_BEACON_ENABLED;
+                                ieee80211_bss_info_change_notify(sdata, changed);
+                        }
                         break;
                 case NL80211_IFTYPE_WDS:
                         break;
@@ -1632,7 +1641,8 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                 mutex_lock(&local->sta_mtx);
 
                 list_for_each_entry(sta, &local->sta_list, list) {
-                        ieee80211_sta_tear_down_BA_sessions(sta, true);
+                        ieee80211_sta_tear_down_BA_sessions(
+                                        sta, AGG_STOP_LOCAL_REQUEST);
                         clear_sta_flag(sta, WLAN_STA_BLOCK_BA);
                 }
 
@@ -1646,10 +1656,11 @@ int ieee80211_reconfig(struct ieee80211_local *local)
          * If this is for hw restart things are still running.
          * We may want to change that later, however.
          */
-        if (!local->suspended) {
+        if (!local->suspended || reconfig_due_to_wowlan)
                 drv_restart_complete(local);
+
+        if (!local->suspended)
                 return 0;
-        }
 
 #ifdef CONFIG_PM
         /* first set suspended false, then resuming */
@@ -1864,7 +1875,7 @@ u8 *ieee80211_ie_build_ht_cap(u8 *pos, struct ieee80211_sta_ht_cap *ht_cap,
 }
 
 u8 *ieee80211_ie_build_vht_cap(u8 *pos, struct ieee80211_sta_vht_cap *vht_cap,
-                                                           u32 cap)
+                               u32 cap)
 {
         __le32 tmp;
 
diff --git a/net/nfc/core.c b/net/nfc/core.c
index aa64ea441676..25522e56d350 100644
--- a/net/nfc/core.c
+++ b/net/nfc/core.c
@@ -338,7 +338,7 @@ int nfc_activate_target(struct nfc_dev *dev, u32 target_idx, u32 protocol)
                 dev->active_target = target;
                 dev->rf_mode = NFC_RF_INITIATOR;
 
-                if (dev->ops->check_presence)
+                if (dev->ops->check_presence && !dev->shutting_down)
                         mod_timer(&dev->check_pres_timer, jiffies +
                                   msecs_to_jiffies(NFC_CHECK_PRES_FREQ_MS));
         }
@@ -429,7 +429,7 @@ int nfc_data_exchange(struct nfc_dev *dev, u32 target_idx, struct sk_buff *skb,
                 rc = dev->ops->im_transceive(dev, dev->active_target, skb, cb,
                                              cb_context);
 
-                if (!rc && dev->ops->check_presence)
+                if (!rc && dev->ops->check_presence && !dev->shutting_down)
                         mod_timer(&dev->check_pres_timer, jiffies +
                                   msecs_to_jiffies(NFC_CHECK_PRES_FREQ_MS));
         } else if (dev->rf_mode == NFC_RF_TARGET && dev->ops->tm_send != NULL) {
@@ -684,11 +684,6 @@ static void nfc_release(struct device *d)
 
         pr_debug("dev_name=%s\n", dev_name(&dev->dev));
 
-        if (dev->ops->check_presence) {
-                del_timer_sync(&dev->check_pres_timer);
-                cancel_work_sync(&dev->check_pres_work);
-        }
-
         nfc_genl_data_exit(&dev->genl_data);
         kfree(dev->targets);
         kfree(dev);
@@ -706,15 +701,16 @@ static void nfc_check_pres_work(struct work_struct *work)
                 rc = dev->ops->check_presence(dev, dev->active_target);
                 if (rc == -EOPNOTSUPP)
                         goto exit;
-                if (!rc) {
-                        mod_timer(&dev->check_pres_timer, jiffies +
-                                  msecs_to_jiffies(NFC_CHECK_PRES_FREQ_MS));
-                } else {
+                if (rc) {
                         u32 active_target_idx = dev->active_target->idx;
                         device_unlock(&dev->dev);
                         nfc_target_lost(dev, active_target_idx);
                         return;
                 }
+
+                if (!dev->shutting_down)
+                        mod_timer(&dev->check_pres_timer, jiffies +
+                                  msecs_to_jiffies(NFC_CHECK_PRES_FREQ_MS));
         }
 
 exit:
@@ -761,6 +757,7 @@ struct nfc_dev *nfc_get_device(unsigned int idx)
  */
 struct nfc_dev *nfc_allocate_device(struct nfc_ops *ops,
                                     u32 supported_protocols,
+                                    u32 supported_se,
                                     int tx_headroom, int tx_tailroom)
 {
         struct nfc_dev *dev;
@@ -778,6 +775,8 @@ struct nfc_dev *nfc_allocate_device(struct nfc_ops *ops,
 
         dev->ops = ops;
         dev->supported_protocols = supported_protocols;
+        dev->supported_se = supported_se;
+        dev->active_se = NFC_SE_NONE;
         dev->tx_headroom = tx_headroom;
         dev->tx_tailroom = tx_tailroom;
 
@@ -853,26 +852,27 @@ void nfc_unregister_device(struct nfc_dev *dev)
 
         id = dev->idx;
 
-        mutex_lock(&nfc_devlist_mutex);
-        nfc_devlist_generation++;
-
-        /* lock to avoid unregistering a device while an operation
-           is in progress */
-        device_lock(&dev->dev);
-        device_del(&dev->dev);
-        device_unlock(&dev->dev);
+        if (dev->ops->check_presence) {
+                device_lock(&dev->dev);
+                dev->shutting_down = true;
+                device_unlock(&dev->dev);
+                del_timer_sync(&dev->check_pres_timer);
+                cancel_work_sync(&dev->check_pres_work);
+        }
 
-        mutex_unlock(&nfc_devlist_mutex);
+        rc = nfc_genl_device_removed(dev);
+        if (rc)
+                pr_debug("The userspace won't be notified that the device %s "
+                         "was removed\n", dev_name(&dev->dev));
 
         nfc_llcp_unregister_device(dev);
 
-        rc = nfc_genl_device_removed(dev);
-        if (rc)
-                pr_debug("The userspace won't be notified that the device %s was removed\n",
-                         dev_name(&dev->dev));
+        mutex_lock(&nfc_devlist_mutex);
+        nfc_devlist_generation++;
+        device_del(&dev->dev);
+        mutex_unlock(&nfc_devlist_mutex);
 
         ida_simple_remove(&nfc_index_ida, id);
-
 }
 EXPORT_SYMBOL(nfc_unregister_device);
 
diff --git a/net/nfc/hci/command.c b/net/nfc/hci/command.c
index 7d99410e6c1a..64f922be9281 100644
--- a/net/nfc/hci/command.c
+++ b/net/nfc/hci/command.c
@@ -280,14 +280,19 @@ static int nfc_hci_delete_pipe(struct nfc_hci_dev *hdev, u8 pipe)
 static int nfc_hci_clear_all_pipes(struct nfc_hci_dev *hdev)
 {
         u8 param[2];
+        size_t param_len = 2;
 
         /* TODO: Find out what the identity reference data is
          * and fill param with it. HCI spec 6.1.3.5 */
 
         pr_debug("\n");
 
+        if (test_bit(NFC_HCI_QUIRK_SHORT_CLEAR, &hdev->quirks))
+                param_len = 0;
+
         return nfc_hci_execute_cmd(hdev, NFC_HCI_ADMIN_PIPE,
-                                   NFC_HCI_ADM_CLEAR_ALL_PIPE, param, 2, NULL);
+                                   NFC_HCI_ADM_CLEAR_ALL_PIPE, param, param_len,
+                                   NULL);
 }
 
 int nfc_hci_disconnect_gate(struct nfc_hci_dev *hdev, u8 gate)
diff --git a/net/nfc/hci/core.c b/net/nfc/hci/core.c
index 7bea574d5934..91020b210d87 100644
--- a/net/nfc/hci/core.c
+++ b/net/nfc/hci/core.c
@@ -57,6 +57,8 @@ static void nfc_hci_msg_tx_work(struct work_struct *work)
         int r = 0;
 
         mutex_lock(&hdev->msg_tx_mutex);
+        if (hdev->shutting_down)
+                goto exit;
 
         if (hdev->cmd_pending_msg) {
                 if (timer_pending(&hdev->cmd_timer) == 0) {
@@ -295,6 +297,12 @@ void nfc_hci_event_received(struct nfc_hci_dev *hdev, u8 pipe, u8 event,
                 goto exit;
         }
 
+        if (hdev->ops->event_received) {
+                r = hdev->ops->event_received(hdev, gate, event, skb);
+                if (r <= 0)
+                        goto exit_noskb;
+        }
+
         switch (event) {
         case NFC_HCI_EVT_TARGET_DISCOVERED:
                 if (skb->len < 1) {     /* no status data? */
@@ -320,17 +328,15 @@ void nfc_hci_event_received(struct nfc_hci_dev *hdev, u8 pipe, u8 event,
                 r = nfc_hci_target_discovered(hdev, gate);
                 break;
         default:
-                if (hdev->ops->event_received) {
-                        hdev->ops->event_received(hdev, gate, event, skb);
-                        return;
-                }
-
+                pr_info("Discarded unknown event %x to gate %x\n", event, gate);
+                r = -EINVAL;
                 break;
         }
 
 exit:
         kfree_skb(skb);
 
+exit_noskb:
         if (r) {
                 /* TODO: There was an error dispatching the event,
                  * how to propagate up to nfc core?
@@ -669,8 +675,10 @@ static int hci_tm_send(struct nfc_dev *nfc_dev, struct sk_buff *skb)
 
         if (hdev->ops->tm_send)
                 return hdev->ops->tm_send(hdev, skb);
-        else
-                return -ENOTSUPP;
+
+        kfree_skb(skb);
+
+        return -ENOTSUPP;
 }
 
 static int hci_check_presence(struct nfc_dev *nfc_dev,
@@ -787,7 +795,9 @@ static struct nfc_ops hci_nfc_ops = {
 
 struct nfc_hci_dev *nfc_hci_allocate_device(struct nfc_hci_ops *ops,
                                             struct nfc_hci_init_data *init_data,
+                                            unsigned long quirks,
                                             u32 protocols,
+                                            u32 supported_se,
                                             const char *llc_name,
                                             int tx_headroom,
                                             int tx_tailroom,
@@ -813,7 +823,7 @@ struct nfc_hci_dev *nfc_hci_allocate_device(struct nfc_hci_ops *ops,
                 return NULL;
         }
 
-        hdev->ndev = nfc_allocate_device(&hci_nfc_ops, protocols,
+        hdev->ndev = nfc_allocate_device(&hci_nfc_ops, protocols, supported_se,
                                          tx_headroom + HCI_CMDS_HEADROOM,
                                          tx_tailroom);
         if (!hdev->ndev) {
@@ -830,6 +840,8 @@ struct nfc_hci_dev *nfc_hci_allocate_device(struct nfc_hci_ops *ops,
 
         memset(hdev->gate2pipe, NFC_HCI_INVALID_PIPE, sizeof(hdev->gate2pipe));
 
+        hdev->quirks = quirks;
+
         return hdev;
 }
 EXPORT_SYMBOL(nfc_hci_allocate_device);
@@ -868,6 +880,28 @@ void nfc_hci_unregister_device(struct nfc_hci_dev *hdev)
 {
         struct hci_msg *msg, *n;
 
+        mutex_lock(&hdev->msg_tx_mutex);
+
+        if (hdev->cmd_pending_msg) {
+                if (hdev->cmd_pending_msg->cb)
+                        hdev->cmd_pending_msg->cb(
+                                             hdev->cmd_pending_msg->cb_context,
+                                             NULL, -ESHUTDOWN);
+                kfree(hdev->cmd_pending_msg);
+                hdev->cmd_pending_msg = NULL;
+        }
+
+        hdev->shutting_down = true;
+
+        mutex_unlock(&hdev->msg_tx_mutex);
+
+        del_timer_sync(&hdev->cmd_timer);
+        cancel_work_sync(&hdev->msg_tx_work);
+
+        cancel_work_sync(&hdev->msg_rx_work);
+
+        nfc_unregister_device(hdev->ndev);
+
         skb_queue_purge(&hdev->rx_hcp_frags);
         skb_queue_purge(&hdev->msg_rx_queue);
 
@@ -876,13 +910,6 @@ void nfc_hci_unregister_device(struct nfc_hci_dev *hdev)
                 skb_queue_purge(&msg->msg_frags);
                 kfree(msg);
         }
-
-        del_timer_sync(&hdev->cmd_timer);
-
-        nfc_unregister_device(hdev->ndev);
-
-        cancel_work_sync(&hdev->msg_tx_work);
-        cancel_work_sync(&hdev->msg_rx_work);
 }
 EXPORT_SYMBOL(nfc_hci_unregister_device);
 
diff --git a/net/nfc/hci/hcp.c b/net/nfc/hci/hcp.c
index bc308a7ca609..b6b4109f2343 100644
--- a/net/nfc/hci/hcp.c
+++ b/net/nfc/hci/hcp.c
@@ -105,6 +105,13 @@ int nfc_hci_hcp_message_tx(struct nfc_hci_dev *hdev, u8 pipe,
         }
 
         mutex_lock(&hdev->msg_tx_mutex);
+
+        if (hdev->shutting_down) {
+                err = -ESHUTDOWN;
+                mutex_unlock(&hdev->msg_tx_mutex);
+                goto out_skb_err;
+        }
+
         list_add_tail(&cmd->msg_l, &hdev->msg_tx_queue);
         mutex_unlock(&hdev->msg_tx_mutex);
 
diff --git a/net/nfc/llcp/commands.c b/net/nfc/llcp/commands.c
index df24be48d4da..c6bc3bd95052 100644
--- a/net/nfc/llcp/commands.c
+++ b/net/nfc/llcp/commands.c
@@ -304,6 +304,8 @@ int nfc_llcp_send_symm(struct nfc_dev *dev)
 
         skb = llcp_add_header(skb, 0, 0, LLCP_PDU_SYMM);
 
+        __net_timestamp(skb);
+
         nfc_llcp_send_to_raw_sock(local, skb, NFC_LLCP_DIRECTION_TX);
 
         return nfc_data_exchange(dev, local->target_idx, skb,
diff --git a/net/nfc/llcp/llcp.c b/net/nfc/llcp/llcp.c
index ec43914c92a9..85bc75c38dea 100644
--- a/net/nfc/llcp/llcp.c
+++ b/net/nfc/llcp/llcp.c
@@ -54,7 +54,6 @@ static void nfc_llcp_socket_purge(struct nfc_llcp_sock *sock)
 
         skb_queue_purge(&sock->tx_queue);
         skb_queue_purge(&sock->tx_pending_queue);
-        skb_queue_purge(&sock->tx_backlog_queue);
 
         if (local == NULL)
                 return;
@@ -668,6 +667,8 @@ static void nfc_llcp_tx_work(struct work_struct *work)
                         if (ptype == LLCP_PDU_I)
                                 copy_skb = skb_copy(skb, GFP_ATOMIC);
 
+                        __net_timestamp(skb);
+
                         nfc_llcp_send_to_raw_sock(local, skb,
                                                   NFC_LLCP_DIRECTION_TX);
 
@@ -781,9 +782,15 @@ static void nfc_llcp_recv_ui(struct nfc_llcp_local *local,
 
         /* There is no sequence with UI frames */
         skb_pull(skb, LLCP_HEADER_SIZE);
-        if (sock_queue_rcv_skb(&llcp_sock->sk, skb)) {
-                pr_err("receive queue is full\n");
-                skb_queue_head(&llcp_sock->tx_backlog_queue, skb);
+        if (!sock_queue_rcv_skb(&llcp_sock->sk, skb)) {
+                /*
+                 * UI frames will be freed from the socket layer, so we
+                 * need to keep them alive until someone receives them.
+                 */
+                skb_get(skb);
+        } else {
+                pr_err("Receive queue is full\n");
+                kfree_skb(skb);
         }
 
         nfc_llcp_sock_put(llcp_sock);
@@ -976,9 +983,15 @@ static void nfc_llcp_recv_hdlc(struct nfc_llcp_local *local,
                         pr_err("Received out of sequence I PDU\n");
 
                 skb_pull(skb, LLCP_HEADER_SIZE + LLCP_SEQUENCE_SIZE);
-                if (sock_queue_rcv_skb(&llcp_sock->sk, skb)) {
-                        pr_err("receive queue is full\n");
-                        skb_queue_head(&llcp_sock->tx_backlog_queue, skb);
+                if (!sock_queue_rcv_skb(&llcp_sock->sk, skb)) {
+                        /*
+                         * I frames will be freed from the socket layer, so we
+                         * need to keep them alive until someone receives them.
+                         */
+                        skb_get(skb);
+                } else {
+                        pr_err("Receive queue is full\n");
+                        kfree_skb(skb);
                 }
         }
 
@@ -1245,6 +1258,8 @@ static void nfc_llcp_rx_work(struct work_struct *work)
                 print_hex_dump(KERN_DEBUG, "LLCP Rx: ", DUMP_PREFIX_OFFSET,
                                16, 1, skb->data, skb->len, true);
 
+        __net_timestamp(skb);
+
         nfc_llcp_send_to_raw_sock(local, skb, NFC_LLCP_DIRECTION_RX);
 
         switch (ptype) {
@@ -1296,6 +1311,13 @@ static void nfc_llcp_rx_work(struct work_struct *work)
         local->rx_pending = NULL;
 }
 
+static void __nfc_llcp_recv(struct nfc_llcp_local *local, struct sk_buff *skb)
+{
+        local->rx_pending = skb;
+        del_timer(&local->link_timer);
+        schedule_work(&local->rx_work);
+}
+
 void nfc_llcp_recv(void *data, struct sk_buff *skb, int err)
 {
         struct nfc_llcp_local *local = (struct nfc_llcp_local *) data;
@@ -1306,9 +1328,7 @@ void nfc_llcp_recv(void *data, struct sk_buff *skb, int err)
                 return;
         }
 
-        local->rx_pending = skb_get(skb);
-        del_timer(&local->link_timer);
-        schedule_work(&local->rx_work);
+        __nfc_llcp_recv(local, skb);
 }
 
 int nfc_llcp_data_received(struct nfc_dev *dev, struct sk_buff *skb)
@@ -1319,9 +1339,7 @@ int nfc_llcp_data_received(struct nfc_dev *dev, struct sk_buff *skb)
         if (local == NULL)
                 return -ENODEV;
 
-        local->rx_pending = skb_get(skb);
-        del_timer(&local->link_timer);
-        schedule_work(&local->rx_work);
+        __nfc_llcp_recv(local, skb);
 
         return 0;
 }
diff --git a/net/nfc/llcp/llcp.h b/net/nfc/llcp/llcp.h
index 0d62366f8cc3..0eae5c509504 100644
--- a/net/nfc/llcp/llcp.h
+++ b/net/nfc/llcp/llcp.h
@@ -121,7 +121,6 @@ struct nfc_llcp_sock {
 
         struct sk_buff_head tx_queue;
         struct sk_buff_head tx_pending_queue;
-        struct sk_buff_head tx_backlog_queue;
 
         struct list_head accept_queue;
         struct sock *parent;
diff --git a/net/nfc/llcp/sock.c b/net/nfc/llcp/sock.c
index fea22eb41b82..5332751943a9 100644
--- a/net/nfc/llcp/sock.c
+++ b/net/nfc/llcp/sock.c
@@ -672,25 +672,27 @@ static int llcp_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
         copied = min_t(unsigned int, rlen, len);
 
         cskb = skb;
-        if (memcpy_toiovec(msg->msg_iov, cskb->data, copied)) {
+        if (skb_copy_datagram_iovec(cskb, 0, msg->msg_iov, copied)) {
                 if (!(flags & MSG_PEEK))
                         skb_queue_head(&sk->sk_receive_queue, skb);
                 return -EFAULT;
         }
 
+        sock_recv_timestamp(msg, sk, skb);
+
         if (sk->sk_type == SOCK_DGRAM && msg->msg_name) {
                 struct nfc_llcp_ui_cb *ui_cb = nfc_llcp_ui_skb_cb(skb);
-                struct sockaddr_nfc_llcp sockaddr;
+                struct sockaddr_nfc_llcp *sockaddr =
+                        (struct sockaddr_nfc_llcp *) msg->msg_name;
 
-                pr_debug("Datagram socket %d %d\n", ui_cb->dsap, ui_cb->ssap);
+                msg->msg_namelen = sizeof(struct sockaddr_nfc_llcp);
 
-                sockaddr.sa_family = AF_NFC;
-                sockaddr.nfc_protocol = NFC_PROTO_NFC_DEP;
-                sockaddr.dsap = ui_cb->dsap;
-                sockaddr.ssap = ui_cb->ssap;
+                pr_debug("Datagram socket %d %d\n", ui_cb->dsap, ui_cb->ssap);
 
-                memcpy(msg->msg_name, &sockaddr, sizeof(sockaddr));
-                msg->msg_namelen = sizeof(sockaddr);
+                sockaddr->sa_family = AF_NFC;
+                sockaddr->nfc_protocol = NFC_PROTO_NFC_DEP;
+                sockaddr->dsap = ui_cb->dsap;
+                sockaddr->ssap = ui_cb->ssap;
         }
 
         /* Mark read part of skb as used */
@@ -806,7 +808,6 @@ struct sock *nfc_llcp_sock_alloc(struct socket *sock, int type, gfp_t gfp)
         llcp_sock->reserved_ssap = LLCP_SAP_MAX;
         skb_queue_head_init(&llcp_sock->tx_queue);
         skb_queue_head_init(&llcp_sock->tx_pending_queue);
-        skb_queue_head_init(&llcp_sock->tx_backlog_queue);
         INIT_LIST_HEAD(&llcp_sock->accept_queue);
 
         if (sock != NULL)
@@ -821,7 +822,6 @@ void nfc_llcp_sock_free(struct nfc_llcp_sock *sock)
 
         skb_queue_purge(&sock->tx_queue);
         skb_queue_purge(&sock->tx_pending_queue);
-        skb_queue_purge(&sock->tx_backlog_queue);
 
         list_del_init(&sock->accept_queue);
 
diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c
index 5f98dc1bf039..48ada0ec749e 100644
--- a/net/nfc/nci/core.c
+++ b/net/nfc/nci/core.c
@@ -658,6 +658,7 @@ static struct nfc_ops nci_nfc_ops = {
  */
 struct nci_dev *nci_allocate_device(struct nci_ops *ops,
                                     __u32 supported_protocols,
+                                    __u32 supported_se,
                                     int tx_headroom, int tx_tailroom)
 {
         struct nci_dev *ndev;
@@ -680,6 +681,7 @@ struct nci_dev *nci_allocate_device(struct nci_ops *ops,
 
         ndev->nfc_dev = nfc_allocate_device(&nci_nfc_ops,
                                             supported_protocols,
+                                            supported_se,
                                             tx_headroom + NCI_DATA_HDR_SIZE,
                                             tx_tailroom);
         if (!ndev->nfc_dev)
diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c
index 3568ae16786d..504b883439f1 100644
--- a/net/nfc/netlink.c
+++ b/net/nfc/netlink.c
@@ -366,6 +366,7 @@ static int nfc_genl_send_device(struct sk_buff *msg, struct nfc_dev *dev,
         if (nla_put_string(msg, NFC_ATTR_DEVICE_NAME, nfc_device_name(dev)) ||
             nla_put_u32(msg, NFC_ATTR_DEVICE_INDEX, dev->idx) ||
             nla_put_u32(msg, NFC_ATTR_PROTOCOLS, dev->supported_protocols) ||
+            nla_put_u32(msg, NFC_ATTR_SE, dev->supported_se) ||
             nla_put_u8(msg, NFC_ATTR_DEVICE_POWERED, dev->dev_up) ||
             nla_put_u8(msg, NFC_ATTR_RF_MODE, dev->rf_mode))
                 goto nla_put_failure;
diff --git a/net/wireless/ap.c b/net/wireless/ap.c
index 324e8d851dc4..a4a14e8f55cc 100644
--- a/net/wireless/ap.c
+++ b/net/wireless/ap.c
@@ -46,3 +46,65 @@ int cfg80211_stop_ap(struct cfg80211_registered_device *rdev,
 
         return err;
 }
+
+void cfg80211_ch_switch_notify(struct net_device *dev,
+                               struct cfg80211_chan_def *chandef)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct wiphy *wiphy = wdev->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+
+        trace_cfg80211_ch_switch_notify(dev, chandef);
+
+        wdev_lock(wdev);
+
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
+                    wdev->iftype != NL80211_IFTYPE_P2P_GO))
+                goto out;
+
+        wdev->channel = chandef->chan;
+        nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL);
+out:
+        wdev_unlock(wdev);
+        return;
+}
+EXPORT_SYMBOL(cfg80211_ch_switch_notify);
+
+bool cfg80211_rx_spurious_frame(struct net_device *dev,
+                                const u8 *addr, gfp_t gfp)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        bool ret;
+
+        trace_cfg80211_rx_spurious_frame(dev, addr);
+
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
+                    wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
+                trace_cfg80211_return_bool(false);
+                return false;
+        }
+        ret = nl80211_unexpected_frame(dev, addr, gfp);
+        trace_cfg80211_return_bool(ret);
+        return ret;
+}
+EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
+
+bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
+                                        const u8 *addr, gfp_t gfp)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        bool ret;
+
+        trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
+
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
+                    wdev->iftype != NL80211_IFTYPE_P2P_GO &&
+                    wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
+                trace_cfg80211_return_bool(false);
+                return false;
+        }
+        ret = nl80211_unexpected_4addr_frame(dev, addr, gfp);
+        trace_cfg80211_return_bool(ret);
+        return ret;
+}
+EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
diff --git a/net/wireless/chan.c b/net/wireless/chan.c
index a7990bb16529..396373f3ec26 100644
--- a/net/wireless/chan.c
+++ b/net/wireless/chan.c
@@ -76,6 +76,10 @@ bool cfg80211_chandef_valid(const struct cfg80211_chan_def *chandef)
                         return false;
                 if (!chandef->center_freq2)
                         return false;
+                /* adjacent is not allowed -- that's a 160 MHz channel */
+                if (chandef->center_freq1 - chandef->center_freq2 == 80 ||
+                    chandef->center_freq2 - chandef->center_freq1 == 80)
+                        return false;
                 break;
         case NL80211_CHAN_WIDTH_80:
                 if (chandef->center_freq1 != control_freq + 30 &&
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 14d990400354..ce827242f390 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -57,9 +57,6 @@ struct cfg80211_registered_device *cfg80211_rdev_by_wiphy_idx(int wiphy_idx)
 {
         struct cfg80211_registered_device *result = NULL, *rdev;
 
-        if (!wiphy_idx_valid(wiphy_idx))
-                return NULL;
-
         assert_cfg80211_lock();
 
         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
@@ -74,10 +71,8 @@ struct cfg80211_registered_device *cfg80211_rdev_by_wiphy_idx(int wiphy_idx)
 
 int get_wiphy_idx(struct wiphy *wiphy)
 {
-        struct cfg80211_registered_device *rdev;
-        if (!wiphy)
-                return WIPHY_IDX_STALE;
-        rdev = wiphy_to_dev(wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+
         return rdev->wiphy_idx;
 }
 
@@ -86,9 +81,6 @@ struct wiphy *wiphy_idx_to_wiphy(int wiphy_idx)
 {
         struct cfg80211_registered_device *rdev;
 
-        if (!wiphy_idx_valid(wiphy_idx))
-                return NULL;
-
         assert_cfg80211_lock();
 
         rdev = cfg80211_rdev_by_wiphy_idx(wiphy_idx);
@@ -309,7 +301,7 @@ struct wiphy *wiphy_new(const struct cfg80211_ops *ops, int sizeof_priv)
 
         rdev->wiphy_idx = wiphy_counter++;
 
-        if (unlikely(!wiphy_idx_valid(rdev->wiphy_idx))) {
+        if (unlikely(rdev->wiphy_idx < 0)) {
                 wiphy_counter--;
                 mutex_unlock(&cfg80211_mutex);
                 /* ugh, wrapped! */
@@ -390,8 +382,11 @@ static int wiphy_verify_combinations(struct wiphy *wiphy)
 
                 c = &wiphy->iface_combinations[i];
 
-                /* Combinations with just one interface aren't real */
-                if (WARN_ON(c->max_interfaces < 2))
+                /*
+                 * Combinations with just one interface aren't real,
+                 * however we make an exception for DFS.
+                 */
+                if (WARN_ON((c->max_interfaces < 2) && !c->radar_detect_widths))
                         return -EINVAL;
 
                 /* Need at least one channel */
@@ -406,6 +401,11 @@ static int wiphy_verify_combinations(struct wiphy *wiphy)
                                 CFG80211_MAX_NUM_DIFFERENT_CHANNELS))
                         return -EINVAL;
 
+                /* DFS only works on one channel. */
+                if (WARN_ON(c->radar_detect_widths &&
+                            (c->num_different_channels > 1)))
+                        return -EINVAL;
+
                 if (WARN_ON(!c->n_limits))
                         return -EINVAL;
 
@@ -478,6 +478,11 @@ int wiphy_register(struct wiphy *wiphy)
                            ETH_ALEN)))
                 return -EINVAL;
 
+        if (WARN_ON(wiphy->max_acl_mac_addrs &&
+                    (!(wiphy->flags & WIPHY_FLAG_HAVE_AP_SME) ||
+                     !rdev->ops->set_mac_acl)))
+                return -EINVAL;
+
         if (wiphy->addresses)
                 memcpy(wiphy->perm_addr, wiphy->addresses[0].addr, ETH_ALEN);
 
diff --git a/net/wireless/core.h b/net/wireless/core.h
index 3563097169cb..8396f7671c8d 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -18,6 +18,9 @@
 #include <net/cfg80211.h>
 #include "reg.h"
 
+
+#define WIPHY_IDX_INVALID       -1
+
 struct cfg80211_registered_device {
         const struct cfg80211_ops *ops;
         struct list_head list;
@@ -86,7 +89,7 @@ struct cfg80211_registered_device {
 
         /* must be last because of the way we do wiphy_priv(),
          * and it should at least be aligned to NETDEV_ALIGN */
-        struct wiphy wiphy __attribute__((__aligned__(NETDEV_ALIGN)));
+        struct wiphy wiphy __aligned(NETDEV_ALIGN);
 };
 
 static inline
@@ -96,13 +99,6 @@ struct cfg80211_registered_device *wiphy_to_dev(struct wiphy *wiphy)
         return container_of(wiphy, struct cfg80211_registered_device, wiphy);
 }
 
-/* Note 0 is valid, hence phy0 */
-static inline
-bool wiphy_idx_valid(int wiphy_idx)
-{
-        return wiphy_idx >= 0;
-}
-
 static inline void
 cfg80211_rdev_free_wowlan(struct cfg80211_registered_device *rdev)
 {
@@ -126,12 +122,6 @@ static inline void assert_cfg80211_lock(void)
         lockdep_assert_held(&cfg80211_mutex);
 }
 
-/*
- * You can use this to mark a wiphy_idx as not having an associated wiphy.
- * It guarantees cfg80211_rdev_by_wiphy_idx(wiphy_idx) will return NULL
- */
-#define WIPHY_IDX_STALE -1
-
 struct cfg80211_internal_bss {
         struct list_head list;
         struct rb_node rbn;
@@ -435,7 +425,8 @@ int cfg80211_can_use_iftype_chan(struct cfg80211_registered_device *rdev,
                                  struct wireless_dev *wdev,
                                  enum nl80211_iftype iftype,
                                  struct ieee80211_channel *chan,
-                                 enum cfg80211_chan_mode chanmode);
+                                 enum cfg80211_chan_mode chanmode,
+                                 u8 radar_detect);
 
 static inline int
 cfg80211_can_change_interface(struct cfg80211_registered_device *rdev,
@@ -443,7 +434,7 @@ cfg80211_can_change_interface(struct cfg80211_registered_device *rdev,
                               enum nl80211_iftype iftype)
 {
         return cfg80211_can_use_iftype_chan(rdev, wdev, iftype, NULL,
-                                            CHAN_MODE_UNDEFINED);
+                                            CHAN_MODE_UNDEFINED, 0);
 }
 
 static inline int
@@ -460,7 +451,7 @@ cfg80211_can_use_chan(struct cfg80211_registered_device *rdev,
                       enum cfg80211_chan_mode chanmode)
 {
         return cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
-                                            chan, chanmode);
+                                            chan, chanmode, 0);
 }
 
 void
diff --git a/net/wireless/mesh.c b/net/wireless/mesh.c
index f9d6ce5cfabb..55957a284f6c 100644
--- a/net/wireless/mesh.c
+++ b/net/wireless/mesh.c
@@ -44,6 +44,10 @@
 
 #define MESH_SYNC_NEIGHBOR_OFFSET_MAX 50
 
+#define MESH_DEFAULT_BEACON_INTERVAL    1000    /* in 1024 us units (=TUs) */
+#define MESH_DEFAULT_DTIM_PERIOD        2
+#define MESH_DEFAULT_AWAKE_WINDOW       10      /* in 1024 us units (=TUs) */
+
 const struct mesh_config default_mesh_config = {
         .dot11MeshRetryTimeout = MESH_RET_T,
         .dot11MeshConfirmTimeout = MESH_CONF_T,
@@ -69,6 +73,8 @@ const struct mesh_config default_mesh_config = {
         .dot11MeshHWMPactivePathToRootTimeout = MESH_PATH_TO_ROOT_TIMEOUT,
         .dot11MeshHWMProotInterval = MESH_ROOT_INTERVAL,
         .dot11MeshHWMPconfirmationInterval = MESH_ROOT_CONFIRMATION_INTERVAL,
+        .power_mode = NL80211_MESH_POWER_ACTIVE,
+        .dot11MeshAwakeWindowDuration = MESH_DEFAULT_AWAKE_WINDOW,
 };
 
 const struct mesh_setup default_mesh_setup = {
@@ -79,6 +85,8 @@ const struct mesh_setup default_mesh_setup = {
         .ie = NULL,
         .ie_len = 0,
         .is_secure = false,
+        .beacon_interval = MESH_DEFAULT_BEACON_INTERVAL,
+        .dtim_period = MESH_DEFAULT_DTIM_PERIOD,
 };
 
 int __cfg80211_join_mesh(struct cfg80211_registered_device *rdev,
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index 5e8123ee63fd..461e692cdfec 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -987,65 +987,3 @@ void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
 }
 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
-
-void cfg80211_ch_switch_notify(struct net_device *dev,
-                               struct cfg80211_chan_def *chandef)
-{
-        struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct wiphy *wiphy = wdev->wiphy;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
-
-        trace_cfg80211_ch_switch_notify(dev, chandef);
-
-        wdev_lock(wdev);
-
-        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
-                    wdev->iftype != NL80211_IFTYPE_P2P_GO))
-                goto out;
-
-        wdev->channel = chandef->chan;
-        nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL);
-out:
-        wdev_unlock(wdev);
-        return;
-}
-EXPORT_SYMBOL(cfg80211_ch_switch_notify);
-
-bool cfg80211_rx_spurious_frame(struct net_device *dev,
-                                const u8 *addr, gfp_t gfp)
-{
-        struct wireless_dev *wdev = dev->ieee80211_ptr;
-        bool ret;
-
-        trace_cfg80211_rx_spurious_frame(dev, addr);
-
-        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
-                    wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
-                trace_cfg80211_return_bool(false);
-                return false;
-        }
-        ret = nl80211_unexpected_frame(dev, addr, gfp);
-        trace_cfg80211_return_bool(ret);
-        return ret;
-}
-EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
-
-bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
-                                        const u8 *addr, gfp_t gfp)
-{
-        struct wireless_dev *wdev = dev->ieee80211_ptr;
-        bool ret;
-
-        trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
-
-        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
-                    wdev->iftype != NL80211_IFTYPE_P2P_GO &&
-                    wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
-                trace_cfg80211_return_bool(false);
-                return false;
-        }
-        ret = nl80211_unexpected_4addr_frame(dev, addr, gfp);
-        trace_cfg80211_return_bool(ret);
-        return ret;
-}
-EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index f45706adaf34..b5978ab4ad7a 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -365,6 +365,8 @@ static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
         [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
         [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
+        [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
+        [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 };
 
 /* policy for the key attributes */
@@ -856,6 +858,9 @@ static int nl80211_put_iface_combinations(struct wiphy *wiphy,
                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
                                 c->max_interfaces))
                         goto nla_put_failure;
+                if (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
+                                c->radar_detect_widths))
+                        goto nla_put_failure;
 
                 nla_nest_end(msg, nl_combi);
         }
@@ -1265,6 +1270,12 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 portid, u32 seq, int flag
                     dev->wiphy.ht_capa_mod_mask))
                 goto nla_put_failure;
 
+        if (dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
+            dev->wiphy.max_acl_mac_addrs &&
+            nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
+                        dev->wiphy.max_acl_mac_addrs))
+                goto nla_put_failure;
+
         return genlmsg_end(msg, hdr);
 
  nla_put_failure:
@@ -2079,6 +2090,13 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
             !(rdev->wiphy.interface_modes & (1 << type)))
                 return -EOPNOTSUPP;
 
+        if (type == NL80211_IFTYPE_P2P_DEVICE && info->attrs[NL80211_ATTR_MAC]) {
+                nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
+                           ETH_ALEN);
+                if (!is_valid_ether_addr(params.macaddr))
+                        return -EADDRNOTAVAIL;
+        }
+
         if (info->attrs[NL80211_ATTR_4ADDR]) {
                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
@@ -2481,6 +2499,97 @@ static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
         return err;
 }
 
+/* This function returns an error or the number of nested attributes */
+static int validate_acl_mac_addrs(struct nlattr *nl_attr)
+{
+        struct nlattr *attr;
+        int n_entries = 0, tmp;
+
+        nla_for_each_nested(attr, nl_attr, tmp) {
+                if (nla_len(attr) != ETH_ALEN)
+                        return -EINVAL;
+
+                n_entries++;
+        }
+
+        return n_entries;
+}
+
+/*
+ * This function parses ACL information and allocates memory for ACL data.
+ * On successful return, the calling function is responsible to free the
+ * ACL buffer returned by this function.
+ */
+static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
+                                                struct genl_info *info)
+{
+        enum nl80211_acl_policy acl_policy;
+        struct nlattr *attr;
+        struct cfg80211_acl_data *acl;
+        int i = 0, n_entries, tmp;
+
+        if (!wiphy->max_acl_mac_addrs)
+                return ERR_PTR(-EOPNOTSUPP);
+
+        if (!info->attrs[NL80211_ATTR_ACL_POLICY])
+                return ERR_PTR(-EINVAL);
+
+        acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
+        if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
+            acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
+                return ERR_PTR(-EINVAL);
+
+        if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
+                return ERR_PTR(-EINVAL);
+
+        n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
+        if (n_entries < 0)
+                return ERR_PTR(n_entries);
+
+        if (n_entries > wiphy->max_acl_mac_addrs)
+                return ERR_PTR(-ENOTSUPP);
+
+        acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
+                      GFP_KERNEL);
+        if (!acl)
+                return ERR_PTR(-ENOMEM);
+
+        nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
+                memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
+                i++;
+        }
+
+        acl->n_acl_entries = n_entries;
+        acl->acl_policy = acl_policy;
+
+        return acl;
+}
+
+static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev = info->user_ptr[0];
+        struct net_device *dev = info->user_ptr[1];
+        struct cfg80211_acl_data *acl;
+        int err;
+
+        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
+            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
+                return -EOPNOTSUPP;
+
+        if (!dev->ieee80211_ptr->beacon_interval)
+                return -EINVAL;
+
+        acl = parse_acl_data(&rdev->wiphy, info);
+        if (IS_ERR(acl))
+                return PTR_ERR(acl);
+
+        err = rdev_set_mac_acl(rdev, dev, acl);
+
+        kfree(acl);
+
+        return err;
+}
+
 static int nl80211_parse_beacon(struct genl_info *info,
                                 struct cfg80211_beacon_data *bcn)
 {
@@ -2724,6 +2833,12 @@ static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
         if (err)
                 return err;
 
+        if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
+                params.acl = parse_acl_data(&rdev->wiphy, info);
+                if (IS_ERR(params.acl))
+                        return PTR_ERR(params.acl);
+        }
+
         err = rdev_start_ap(rdev, dev, &params);
         if (!err) {
                 wdev->preset_chandef = params.chandef;
@@ -2732,6 +2847,9 @@ static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
                 wdev->ssid_len = params.ssid_len;
                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
         }
+
+        kfree(params.acl);
+
         return err;
 }
 
@@ -3001,6 +3119,18 @@ static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
             nla_put_u32(msg, NL80211_STA_INFO_BEACON_LOSS,
                         sinfo->beacon_loss_count))
                 goto nla_put_failure;
+        if ((sinfo->filled & STATION_INFO_LOCAL_PM) &&
+            nla_put_u32(msg, NL80211_STA_INFO_LOCAL_PM,
+                        sinfo->local_pm))
+                goto nla_put_failure;
+        if ((sinfo->filled & STATION_INFO_PEER_PM) &&
+            nla_put_u32(msg, NL80211_STA_INFO_PEER_PM,
+                        sinfo->peer_pm))
+                goto nla_put_failure;
+        if ((sinfo->filled & STATION_INFO_NONPEER_PM) &&
+            nla_put_u32(msg, NL80211_STA_INFO_NONPEER_PM,
+                        sinfo->nonpeer_pm))
+                goto nla_put_failure;
         if (sinfo->filled & STATION_INFO_BSS_PARAM) {
                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
                 if (!bss_param)
@@ -3188,13 +3318,9 @@ static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
         }
 
-        if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
-                params.listen_interval =
-                    nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
-
-        if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
-                params.ht_capa =
-                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
+        if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL] ||
+            info->attrs[NL80211_ATTR_HT_CAPABILITY])
+                return -EINVAL;
 
         if (!rdev->ops->change_station)
                 return -EOPNOTSUPP;
@@ -3210,6 +3336,17 @@ static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
                 params.plink_state =
                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
 
+        if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
+                enum nl80211_mesh_power_mode pm = nla_get_u32(
+                        info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
+
+                if (pm <= NL80211_MESH_POWER_UNKNOWN ||
+                    pm > NL80211_MESH_POWER_MAX)
+                        return -EINVAL;
+
+                params.local_pm = pm;
+        }
+
         switch (dev->ieee80211_ptr->iftype) {
         case NL80211_IFTYPE_AP:
         case NL80211_IFTYPE_AP_VLAN:
@@ -3217,6 +3354,8 @@ static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
                 /* disallow mesh-specific things */
                 if (params.plink_action)
                         return -EINVAL;
+                if (params.local_pm)
+                        return -EINVAL;
 
                 /* TDLS can't be set, ... */
                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
@@ -3231,11 +3370,25 @@ static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
                 /* accept only the listed bits */
                 if (params.sta_flags_mask &
                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
+                                  BIT(NL80211_STA_FLAG_AUTHENTICATED) |
+                                  BIT(NL80211_STA_FLAG_ASSOCIATED) |
                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
                                   BIT(NL80211_STA_FLAG_WME) |
                                   BIT(NL80211_STA_FLAG_MFP)))
                         return -EINVAL;
 
+                /* but authenticated/associated only if driver handles it */
+                if (!(rdev->wiphy.features &
+                                NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
+                    params.sta_flags_mask &
+                                (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
+                                 BIT(NL80211_STA_FLAG_ASSOCIATED)))
+                        return -EINVAL;
+
+                /* reject other things that can't change */
+                if (params.supported_rates)
+                        return -EINVAL;
+
                 /* must be last in here for error handling */
                 params.vlan = get_vlan(info, rdev);
                 if (IS_ERR(params.vlan))
@@ -3255,9 +3408,7 @@ static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
                 /* disallow things sta doesn't support */
                 if (params.plink_action)
                         return -EINVAL;
-                if (params.ht_capa)
-                        return -EINVAL;
-                if (params.listen_interval >= 0)
+                if (params.local_pm)
                         return -EINVAL;
                 /* reject any changes other than AUTHORIZED */
                 if (params.sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
@@ -3267,9 +3418,7 @@ static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
                 /* disallow things mesh doesn't support */
                 if (params.vlan)
                         return -EINVAL;
-                if (params.ht_capa)
-                        return -EINVAL;
-                if (params.listen_interval >= 0)
+                if (params.supported_rates)
                         return -EINVAL;
                 /*
                  * No special handling for TDLS here -- the userspace
@@ -3393,17 +3542,31 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
                 /* but don't bother the driver with it */
                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
 
+                /* allow authenticated/associated only if driver handles it */
+                if (!(rdev->wiphy.features &
+                                NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
+                    params.sta_flags_mask &
+                                (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
+                                 BIT(NL80211_STA_FLAG_ASSOCIATED)))
+                        return -EINVAL;
+
                 /* must be last in here for error handling */
                 params.vlan = get_vlan(info, rdev);
                 if (IS_ERR(params.vlan))
                         return PTR_ERR(params.vlan);
                 break;
         case NL80211_IFTYPE_MESH_POINT:
+                /* associated is disallowed */
+                if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
+                        return -EINVAL;
                 /* TDLS peers cannot be added */
                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
                         return -EINVAL;
                 break;
         case NL80211_IFTYPE_STATION:
+                /* associated is disallowed */
+                if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
+                        return -EINVAL;
                 /* Only TDLS peers can be added */
                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
                         return -EINVAL;
@@ -3787,12 +3950,8 @@ static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
          * window between nl80211_init() and regulatory_init(), if that is
          * even possible.
          */
-        mutex_lock(&cfg80211_mutex);
-        if (unlikely(!cfg80211_regdomain)) {
-                mutex_unlock(&cfg80211_mutex);
+        if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
                 return -EINPROGRESS;
-        }
-        mutex_unlock(&cfg80211_mutex);
 
         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
                 return -EINVAL;
@@ -3908,7 +4067,11 @@ static int nl80211_get_mesh_config(struct sk_buff *skb,
             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
                         cur_params.dot11MeshHWMProotInterval) ||
             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
-                        cur_params.dot11MeshHWMPconfirmationInterval))
+                        cur_params.dot11MeshHWMPconfirmationInterval) ||
+            nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
+                        cur_params.power_mode) ||
+            nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
+                        cur_params.dot11MeshAwakeWindowDuration))
                 goto nla_put_failure;
         nla_nest_end(msg, pinfoattr);
         genlmsg_end(msg, hdr);
@@ -3947,6 +4110,8 @@ static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_A
         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
+        [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
+        [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
 };
 
 static const struct nla_policy
@@ -3967,13 +4132,15 @@ static int nl80211_parse_mesh_config(struct genl_info *info,
         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
         u32 mask = 0;
 
-#define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
-do {\
-        if (table[attr_num]) {\
-                cfg->param = nla_fn(table[attr_num]); \
-                mask |= (1 << (attr_num - 1)); \
-        } \
-} while (0);\
+#define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
+do {                                                                        \
+        if (tb[attr]) {                                                     \
+                if (fn(tb[attr]) < min || fn(tb[attr]) > max)               \
+                        return -EINVAL;                                     \
+                cfg->param = fn(tb[attr]);                                  \
+                mask |= (1 << (attr - 1));                                  \
+        }                                                                   \
+} while (0)
 
 
         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
@@ -3988,83 +4155,98 @@ do {\
         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
 
         /* Fill in the params struct */
-        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
                                   mask, NL80211_MESHCONF_RETRY_TIMEOUT,
                                   nla_get_u16);
-        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
                                   mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
                                   nla_get_u16);
-        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
                                   mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
                                   nla_get_u16);
-        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
                                   mask, NL80211_MESHCONF_MAX_PEER_LINKS,
                                   nla_get_u16);
-        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
                                   mask, NL80211_MESHCONF_MAX_RETRIES,
                                   nla_get_u8);
-        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
                                   mask, NL80211_MESHCONF_TTL, nla_get_u8);
-        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl,
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
                                   mask, NL80211_MESHCONF_ELEMENT_TTL,
                                   nla_get_u8);
-        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
                                   mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
                                   nla_get_u8);
-        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor, mask,
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
+                                  1, 255, mask,
                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
                                   nla_get_u32);
-        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
                                   mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
                                   nla_get_u8);
-        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
                                   mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
                                   nla_get_u32);
-        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
                                   mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
                                   nla_get_u16);
-        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout, mask,
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
+                                  1, 65535, mask,
                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
                                   nla_get_u32);
         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
-                                  mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
+                                  1, 65535, mask,
+                                  NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
                                   nla_get_u16);
         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
-                                  mask, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
+                                  1, 65535, mask,
+                                  NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
                                   nla_get_u16);
         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
-                                  dot11MeshHWMPnetDiameterTraversalTime, mask,
+                                  dot11MeshHWMPnetDiameterTraversalTime,
+                                  1, 65535, mask,
                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
                                   nla_get_u16);
-        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, mask,
-                                  NL80211_MESHCONF_HWMP_ROOTMODE, nla_get_u8);
-        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, mask,
-                                  NL80211_MESHCONF_HWMP_RANN_INTERVAL,
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
+                                  mask, NL80211_MESHCONF_HWMP_ROOTMODE,
+                                  nla_get_u8);
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
+                                  mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
                                   nla_get_u16);
         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
-                                  dot11MeshGateAnnouncementProtocol, mask,
-                                  NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
+                                  dot11MeshGateAnnouncementProtocol, 0, 1,
+                                  mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
                                   nla_get_u8);
-        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding,
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
                                   mask, NL80211_MESHCONF_FORWARDING,
                                   nla_get_u8);
-        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold,
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, 1, 255,
                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
                                   nla_get_u32);
-        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode,
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode, 0, 16,
                                   mask, NL80211_MESHCONF_HT_OPMODE,
                                   nla_get_u16);
         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
-                                  mask,
+                                  1, 65535, mask,
                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
                                   nla_get_u32);
-        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval,
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
                                   mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
                                   nla_get_u16);
         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
-                                  dot11MeshHWMPconfirmationInterval, mask,
+                                  dot11MeshHWMPconfirmationInterval,
+                                  1, 65535, mask,
                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
                                   nla_get_u16);
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
+                                  NL80211_MESH_POWER_ACTIVE,
+                                  NL80211_MESH_POWER_MAX,
+                                  mask, NL80211_MESHCONF_POWER_MODE,
+                                  nla_get_u32);
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
+                                  0, 65535, mask,
+                                  NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
         if (mask_out)
                 *mask_out = mask;
 
@@ -4152,6 +4334,7 @@ static int nl80211_update_mesh_config(struct sk_buff *skb,
 
 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
 {
+        const struct ieee80211_regdomain *regdom;
         struct sk_buff *msg;
         void *hdr = NULL;
         struct nlattr *nl_reg_rules;
@@ -4174,35 +4357,36 @@ static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
         if (!hdr)
                 goto put_failure;
 
-        if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
-                           cfg80211_regdomain->alpha2) ||
-            (cfg80211_regdomain->dfs_region &&
-             nla_put_u8(msg, NL80211_ATTR_DFS_REGION,
-                        cfg80211_regdomain->dfs_region)))
-                goto nla_put_failure;
-
         if (reg_last_request_cell_base() &&
             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
                         NL80211_USER_REG_HINT_CELL_BASE))
                 goto nla_put_failure;
 
+        rcu_read_lock();
+        regdom = rcu_dereference(cfg80211_regdomain);
+
+        if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
+            (regdom->dfs_region &&
+             nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
+                goto nla_put_failure_rcu;
+
         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
         if (!nl_reg_rules)
-                goto nla_put_failure;
+                goto nla_put_failure_rcu;
 
-        for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
+        for (i = 0; i < regdom->n_reg_rules; i++) {
                 struct nlattr *nl_reg_rule;
                 const struct ieee80211_reg_rule *reg_rule;
                 const struct ieee80211_freq_range *freq_range;
                 const struct ieee80211_power_rule *power_rule;
 
-                reg_rule = &cfg80211_regdomain->reg_rules[i];
+                reg_rule = &regdom->reg_rules[i];
                 freq_range = &reg_rule->freq_range;
                 power_rule = &reg_rule->power_rule;
 
                 nl_reg_rule = nla_nest_start(msg, i);
                 if (!nl_reg_rule)
-                        goto nla_put_failure;
+                        goto nla_put_failure_rcu;
 
                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
                                 reg_rule->flags) ||
@@ -4216,10 +4400,11 @@ static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
                                 power_rule->max_antenna_gain) ||
                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
                                 power_rule->max_eirp))
-                        goto nla_put_failure;
+                        goto nla_put_failure_rcu;
 
                 nla_nest_end(msg, nl_reg_rule);
         }
+        rcu_read_unlock();
 
         nla_nest_end(msg, nl_reg_rules);
 
@@ -4227,6 +4412,8 @@ static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
         err = genlmsg_reply(msg, info);
         goto out;
 
+nla_put_failure_rcu:
+        rcu_read_unlock();
 nla_put_failure:
         genlmsg_cancel(msg, hdr);
 put_failure:
@@ -4259,27 +4446,18 @@ static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
 
         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
-                        rem_reg_rules) {
+                            rem_reg_rules) {
                 num_rules++;
                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
                         return -EINVAL;
         }
 
-        mutex_lock(&cfg80211_mutex);
-
-        if (!reg_is_valid_request(alpha2)) {
-                r = -EINVAL;
-                goto bad_reg;
-        }
-
         size_of_regd = sizeof(struct ieee80211_regdomain) +
-                (num_rules * sizeof(struct ieee80211_reg_rule));
+                       num_rules * sizeof(struct ieee80211_reg_rule);
 
         rd = kzalloc(size_of_regd, GFP_KERNEL);
-        if (!rd) {
-                r = -ENOMEM;
-                goto bad_reg;
-        }
+        if (!rd)
+                return -ENOMEM;
 
         rd->n_reg_rules = num_rules;
         rd->alpha2[0] = alpha2[0];
@@ -4293,10 +4471,10 @@ static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
                 rd->dfs_region = dfs_region;
 
         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
-                        rem_reg_rules) {
+                            rem_reg_rules) {
                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
-                        nla_data(nl_reg_rule), nla_len(nl_reg_rule),
-                        reg_rule_policy);
+                          nla_data(nl_reg_rule), nla_len(nl_reg_rule),
+                          reg_rule_policy);
                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
                 if (r)
                         goto bad_reg;
@@ -4309,16 +4487,14 @@ static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
                 }
         }
 
-        BUG_ON(rule_idx != num_rules);
+        mutex_lock(&cfg80211_mutex);
 
         r = set_regdom(rd);
-
+        /* set_regdom took ownership */
+        rd = NULL;
         mutex_unlock(&cfg80211_mutex);
 
-        return r;
-
  bad_reg:
-        mutex_unlock(&cfg80211_mutex);
         kfree(rd);
         return r;
 }
@@ -5867,6 +6043,15 @@ static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
         }
 
+        if (info->attrs[NL80211_ATTR_USE_MFP]) {
+                connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
+                if (connect.mfp != NL80211_MFP_REQUIRED &&
+                    connect.mfp != NL80211_MFP_NO)
+                        return -EINVAL;
+        } else {
+                connect.mfp = NL80211_MFP_NO;
+        }
+
         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
                 connect.channel =
                         ieee80211_get_channel(wiphy,
@@ -6652,6 +6837,21 @@ static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
                         return -EINVAL;
 
+        if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
+                setup.beacon_interval =
+                        nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
+                if (setup.beacon_interval < 10 ||
+                    setup.beacon_interval > 10000)
+                        return -EINVAL;
+        }
+
+        if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
+                setup.dtim_period =
+                        nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
+                if (setup.dtim_period < 1 || setup.dtim_period > 100)
+                        return -EINVAL;
+        }
+
         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
                 /* parse additional setup parameters if given */
                 err = nl80211_parse_mesh_setup(info, &setup);
@@ -7784,6 +7984,14 @@ static struct genl_ops nl80211_ops[] = {
                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
                                   NL80211_FLAG_NEED_RTNL,
         },
+        {
+                .cmd = NL80211_CMD_SET_MAC_ACL,
+                .doit = nl80211_set_mac_acl,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                                  NL80211_FLAG_NEED_RTNL,
+        },
 };
 
 static struct genl_multicast_group nl80211_mlme_mcgrp = {
@@ -8051,7 +8259,7 @@ void nl80211_send_reg_change_event(struct regulatory_request *request)
                         goto nla_put_failure;
         }
 
-        if (wiphy_idx_valid(request->wiphy_idx) &&
+        if (request->wiphy_idx != WIPHY_IDX_INVALID &&
             nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
                 goto nla_put_failure;
 
diff --git a/net/wireless/rdev-ops.h b/net/wireless/rdev-ops.h
index 6c0c8191f837..422d38291d66 100644
--- a/net/wireless/rdev-ops.h
+++ b/net/wireless/rdev-ops.h
@@ -875,4 +875,16 @@ static inline void rdev_stop_p2p_device(struct cfg80211_registered_device *rdev,
         rdev->ops->stop_p2p_device(&rdev->wiphy, wdev);
         trace_rdev_return_void(&rdev->wiphy);
 }                                       
+
+static inline int rdev_set_mac_acl(struct cfg80211_registered_device *rdev,
+                                   struct net_device *dev,
+                                   struct cfg80211_acl_data *params)
+{
+        int ret;
+
+        trace_rdev_set_mac_acl(&rdev->wiphy, dev, params);
+        ret = rdev->ops->set_mac_acl(&rdev->wiphy, dev, params);
+        trace_rdev_return_int(&rdev->wiphy, ret);
+        return ret;
+}
 #endif /* __CFG80211_RDEV_OPS */
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 6e5308998e30..6ea626b30a2a 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -48,7 +48,6 @@
 #include <linux/export.h>
 #include <linux/slab.h>
 #include <linux/list.h>
-#include <linux/random.h>
 #include <linux/ctype.h>
 #include <linux/nl80211.h>
 #include <linux/platform_device.h>
@@ -66,6 +65,13 @@
 #define REG_DBG_PRINT(args...)
 #endif
 
+enum reg_request_treatment {
+        REG_REQ_OK,
+        REG_REQ_IGNORE,
+        REG_REQ_INTERSECT,
+        REG_REQ_ALREADY_SET,
+};
+
 static struct regulatory_request core_request_world = {
         .initiator = NL80211_REGDOM_SET_BY_CORE,
         .alpha2[0] = '0',
@@ -76,7 +82,8 @@ static struct regulatory_request core_request_world = {
 };
 
 /* Receipt of information from last regulatory request */
-static struct regulatory_request *last_request = &core_request_world;
+static struct regulatory_request __rcu *last_request =
+        (void __rcu *)&core_request_world;
 
 /* To trigger userspace events */
 static struct platform_device *reg_pdev;
@@ -88,16 +95,16 @@ static struct device_type reg_device_type = {
 /*
  * Central wireless core regulatory domains, we only need two,
  * the current one and a world regulatory domain in case we have no
- * information to give us an alpha2
+ * information to give us an alpha2.
  */
-const struct ieee80211_regdomain *cfg80211_regdomain;
+const struct ieee80211_regdomain __rcu *cfg80211_regdomain;
 
 /*
  * Protects static reg.c components:
- *     - cfg80211_world_regdom
- *     - cfg80211_regdom
- *     - last_request
- *     - reg_num_devs_support_basehint
+ *      - cfg80211_regdomain (if not used with RCU)
+ *      - cfg80211_world_regdom
+ *      - last_request (if not used with RCU)
+ *      - reg_num_devs_support_basehint
  */
 static DEFINE_MUTEX(reg_mutex);
 
@@ -112,6 +119,31 @@ static inline void assert_reg_lock(void)
         lockdep_assert_held(&reg_mutex);
 }
 
+static const struct ieee80211_regdomain *get_cfg80211_regdom(void)
+{
+        return rcu_dereference_protected(cfg80211_regdomain,
+                                         lockdep_is_held(&reg_mutex));
+}
+
+static const struct ieee80211_regdomain *get_wiphy_regdom(struct wiphy *wiphy)
+{
+        return rcu_dereference_protected(wiphy->regd,
+                                         lockdep_is_held(&reg_mutex));
+}
+
+static void rcu_free_regdom(const struct ieee80211_regdomain *r)
+{
+        if (!r)
+                return;
+        kfree_rcu((struct ieee80211_regdomain *)r, rcu_head);
+}
+
+static struct regulatory_request *get_last_request(void)
+{
+        return rcu_dereference_check(last_request,
+                                     lockdep_is_held(&reg_mutex));
+}
+
 /* Used to queue up regulatory hints */
 static LIST_HEAD(reg_requests_list);
 static spinlock_t reg_requests_lock;
@@ -177,28 +209,37 @@ static char user_alpha2[2];
 module_param(ieee80211_regdom, charp, 0444);
 MODULE_PARM_DESC(ieee80211_regdom, "IEEE 802.11 regulatory domain code");
 
-static void reset_regdomains(bool full_reset)
+static void reset_regdomains(bool full_reset,
+                             const struct ieee80211_regdomain *new_regdom)
 {
+        const struct ieee80211_regdomain *r;
+        struct regulatory_request *lr;
+
+        assert_reg_lock();
+
+        r = get_cfg80211_regdom();
+
         /* avoid freeing static information or freeing something twice */
-        if (cfg80211_regdomain == cfg80211_world_regdom)
-                cfg80211_regdomain = NULL;
+        if (r == cfg80211_world_regdom)
+                r = NULL;
         if (cfg80211_world_regdom == &world_regdom)
                 cfg80211_world_regdom = NULL;
-        if (cfg80211_regdomain == &world_regdom)
-                cfg80211_regdomain = NULL;
+        if (r == &world_regdom)
+                r = NULL;
 
-        kfree(cfg80211_regdomain);
-        kfree(cfg80211_world_regdom);
+        rcu_free_regdom(r);
+        rcu_free_regdom(cfg80211_world_regdom);
 
         cfg80211_world_regdom = &world_regdom;
-        cfg80211_regdomain = NULL;
+        rcu_assign_pointer(cfg80211_regdomain, new_regdom);
 
         if (!full_reset)
                 return;
 
-        if (last_request != &core_request_world)
-                kfree(last_request);
-        last_request = &core_request_world;
+        lr = get_last_request();
+        if (lr != &core_request_world && lr)
+                kfree_rcu(lr, rcu_head);
+        rcu_assign_pointer(last_request, &core_request_world);
 }
 
 /*
@@ -207,30 +248,29 @@ static void reset_regdomains(bool full_reset)
  */
 static void update_world_regdomain(const struct ieee80211_regdomain *rd)
 {
-        BUG_ON(!last_request);
+        struct regulatory_request *lr;
+
+        lr = get_last_request();
+
+        WARN_ON(!lr);
 
-        reset_regdomains(false);
+        reset_regdomains(false, rd);
 
         cfg80211_world_regdom = rd;
-        cfg80211_regdomain = rd;
 }
 
 bool is_world_regdom(const char *alpha2)
 {
         if (!alpha2)
                 return false;
-        if (alpha2[0] == '0' && alpha2[1] == '0')
-                return true;
-        return false;
+        return alpha2[0] == '0' && alpha2[1] == '0';
 }
 
 static bool is_alpha2_set(const char *alpha2)
 {
         if (!alpha2)
                 return false;
-        if (alpha2[0] != 0 && alpha2[1] != 0)
-                return true;
-        return false;
+        return alpha2[0] && alpha2[1];
 }
 
 static bool is_unknown_alpha2(const char *alpha2)
@@ -241,9 +281,7 @@ static bool is_unknown_alpha2(const char *alpha2)
          * Special case where regulatory domain was built by driver
          * but a specific alpha2 cannot be determined
          */
-        if (alpha2[0] == '9' && alpha2[1] == '9')
-                return true;
-        return false;
+        return alpha2[0] == '9' && alpha2[1] == '9';
 }
 
 static bool is_intersected_alpha2(const char *alpha2)
@@ -255,39 +293,30 @@ static bool is_intersected_alpha2(const char *alpha2)
          * result of an intersection between two regulatory domain
          * structures
          */
-        if (alpha2[0] == '9' && alpha2[1] == '8')
-                return true;
-        return false;
+        return alpha2[0] == '9' && alpha2[1] == '8';
 }
 
 static bool is_an_alpha2(const char *alpha2)
 {
         if (!alpha2)
                 return false;
-        if (isalpha(alpha2[0]) && isalpha(alpha2[1]))
-                return true;
-        return false;
+        return isalpha(alpha2[0]) && isalpha(alpha2[1]);
 }
 
 static bool alpha2_equal(const char *alpha2_x, const char *alpha2_y)
 {
         if (!alpha2_x || !alpha2_y)
                 return false;
-        if (alpha2_x[0] == alpha2_y[0] &&
-                alpha2_x[1] == alpha2_y[1])
-                return true;
-        return false;
+        return alpha2_x[0] == alpha2_y[0] && alpha2_x[1] == alpha2_y[1];
 }
 
 static bool regdom_changes(const char *alpha2)
 {
-        assert_cfg80211_lock();
+        const struct ieee80211_regdomain *r = get_cfg80211_regdom();
 
-        if (!cfg80211_regdomain)
+        if (!r)
                 return true;
-        if (alpha2_equal(cfg80211_regdomain->alpha2, alpha2))
-                return false;
-        return true;
+        return !alpha2_equal(r->alpha2, alpha2);
 }
 
 /*
@@ -301,38 +330,36 @@ static bool is_user_regdom_saved(void)
                 return false;
 
         /* This would indicate a mistake on the design */
-        if (WARN((!is_world_regdom(user_alpha2) &&
-                  !is_an_alpha2(user_alpha2)),
+        if (WARN(!is_world_regdom(user_alpha2) && !is_an_alpha2(user_alpha2),
                  "Unexpected user alpha2: %c%c\n",
-                 user_alpha2[0],
-                 user_alpha2[1]))
+                 user_alpha2[0], user_alpha2[1]))
                 return false;
 
         return true;
 }
 
-static int reg_copy_regd(const struct ieee80211_regdomain **dst_regd,
-                         const struct ieee80211_regdomain *src_regd)
+static const struct ieee80211_regdomain *
+reg_copy_regd(const struct ieee80211_regdomain *src_regd)
 {
         struct ieee80211_regdomain *regd;
-        int size_of_regd = 0;
+        int size_of_regd;
         unsigned int i;
 
-        size_of_regd = sizeof(struct ieee80211_regdomain) +
-          ((src_regd->n_reg_rules + 1) * sizeof(struct ieee80211_reg_rule));
+        size_of_regd =
+                sizeof(struct ieee80211_regdomain) +
+                src_regd->n_reg_rules * sizeof(struct ieee80211_reg_rule);
 
         regd = kzalloc(size_of_regd, GFP_KERNEL);
         if (!regd)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         memcpy(regd, src_regd, sizeof(struct ieee80211_regdomain));
 
         for (i = 0; i < src_regd->n_reg_rules; i++)
                 memcpy(&regd->reg_rules[i], &src_regd->reg_rules[i],
-                        sizeof(struct ieee80211_reg_rule));
+                       sizeof(struct ieee80211_reg_rule));
 
-        *dst_regd = regd;
-        return 0;
+        return regd;
 }
 
 #ifdef CONFIG_CFG80211_INTERNAL_REGDB
@@ -347,9 +374,8 @@ static DEFINE_MUTEX(reg_regdb_search_mutex);
 static void reg_regdb_search(struct work_struct *work)
 {
         struct reg_regdb_search_request *request;
-        const struct ieee80211_regdomain *curdom, *regdom;
-        int i, r;
-        bool set_reg = false;
+        const struct ieee80211_regdomain *curdom, *regdom = NULL;
+        int i;
 
         mutex_lock(&cfg80211_mutex);
 
@@ -360,14 +386,11 @@ static void reg_regdb_search(struct work_struct *work)
                                            list);
                 list_del(&request->list);
 
-                for (i=0; i<reg_regdb_size; i++) {
+                for (i = 0; i < reg_regdb_size; i++) {
                         curdom = reg_regdb[i];
 
-                        if (!memcmp(request->alpha2, curdom->alpha2, 2)) {
-                                r = reg_copy_regd(&regdom, curdom);
-                                if (r)
-                                        break;
-                                set_reg = true;
+                        if (alpha2_equal(request->alpha2, curdom->alpha2)) {
+                                regdom = reg_copy_regd(curdom);
                                 break;
                         }
                 }
@@ -376,7 +399,7 @@ static void reg_regdb_search(struct work_struct *work)
         }
         mutex_unlock(&reg_regdb_search_mutex);
 
-        if (set_reg)
+        if (!IS_ERR_OR_NULL(regdom))
                 set_regdom(regdom);
 
         mutex_unlock(&cfg80211_mutex);
@@ -434,15 +457,14 @@ static int call_crda(const char *alpha2)
         return kobject_uevent(&reg_pdev->dev.kobj, KOBJ_CHANGE);
 }
 
-/* Used by nl80211 before kmalloc'ing our regulatory domain */
-bool reg_is_valid_request(const char *alpha2)
+static bool reg_is_valid_request(const char *alpha2)
 {
-        assert_cfg80211_lock();
+        struct regulatory_request *lr = get_last_request();
 
-        if (!last_request)
+        if (!lr || lr->processed)
                 return false;
 
-        return alpha2_equal(last_request->alpha2, alpha2);
+        return alpha2_equal(lr->alpha2, alpha2);
 }
 
 /* Sanity check on a regulatory rule */
@@ -460,7 +482,7 @@ static bool is_valid_reg_rule(const struct ieee80211_reg_rule *rule)
         freq_diff = freq_range->end_freq_khz - freq_range->start_freq_khz;
 
         if (freq_range->end_freq_khz <= freq_range->start_freq_khz ||
-                        freq_range->max_bandwidth_khz > freq_diff)
+            freq_range->max_bandwidth_khz > freq_diff)
                 return false;
 
         return true;
@@ -487,8 +509,7 @@ static bool is_valid_rd(const struct ieee80211_regdomain *rd)
 }
 
 static bool reg_does_bw_fit(const struct ieee80211_freq_range *freq_range,
-                            u32 center_freq_khz,
-                            u32 bw_khz)
+                            u32 center_freq_khz, u32 bw_khz)
 {
         u32 start_freq_khz, end_freq_khz;
 
@@ -518,7 +539,7 @@ static bool reg_does_bw_fit(const struct ieee80211_freq_range *freq_range,
  * regulatory rule support for other "bands".
  **/
 static bool freq_in_rule_band(const struct ieee80211_freq_range *freq_range,
-        u32 freq_khz)
+                              u32 freq_khz)
 {
 #define ONE_GHZ_IN_KHZ  1000000
         /*
@@ -540,10 +561,9 @@ static bool freq_in_rule_band(const struct ieee80211_freq_range *freq_range,
  * Helper for regdom_intersect(), this does the real
  * mathematical intersection fun
  */
-static int reg_rules_intersect(
-        const struct ieee80211_reg_rule *rule1,
-        const struct ieee80211_reg_rule *rule2,
-        struct ieee80211_reg_rule *intersected_rule)
+static int reg_rules_intersect(const struct ieee80211_reg_rule *rule1,
+                               const struct ieee80211_reg_rule *rule2,
+                               struct ieee80211_reg_rule *intersected_rule)
 {
         const struct ieee80211_freq_range *freq_range1, *freq_range2;
         struct ieee80211_freq_range *freq_range;
@@ -560,11 +580,11 @@ static int reg_rules_intersect(
         power_rule = &intersected_rule->power_rule;
 
         freq_range->start_freq_khz = max(freq_range1->start_freq_khz,
-                freq_range2->start_freq_khz);
+                                         freq_range2->start_freq_khz);
         freq_range->end_freq_khz = min(freq_range1->end_freq_khz,
-                freq_range2->end_freq_khz);
+                                       freq_range2->end_freq_khz);
         freq_range->max_bandwidth_khz = min(freq_range1->max_bandwidth_khz,
-                freq_range2->max_bandwidth_khz);
+                                            freq_range2->max_bandwidth_khz);
 
         freq_diff = freq_range->end_freq_khz - freq_range->start_freq_khz;
         if (freq_range->max_bandwidth_khz > freq_diff)
@@ -575,7 +595,7 @@ static int reg_rules_intersect(
         power_rule->max_antenna_gain = min(power_rule1->max_antenna_gain,
                 power_rule2->max_antenna_gain);
 
-        intersected_rule->flags = (rule1->flags | rule2->flags);
+        intersected_rule->flags = rule1->flags | rule2->flags;
 
         if (!is_valid_reg_rule(intersected_rule))
                 return -EINVAL;
@@ -596,9 +616,9 @@ static int reg_rules_intersect(
  * resulting intersection of rules between rd1 and rd2. We will
  * kzalloc() this structure for you.
  */
-static struct ieee80211_regdomain *regdom_intersect(
-        const struct ieee80211_regdomain *rd1,
-        const struct ieee80211_regdomain *rd2)
+static struct ieee80211_regdomain *
+regdom_intersect(const struct ieee80211_regdomain *rd1,
+                 const struct ieee80211_regdomain *rd2)
 {
         int r, size_of_regd;
         unsigned int x, y;
@@ -607,12 +627,7 @@ static struct ieee80211_regdomain *regdom_intersect(
         struct ieee80211_reg_rule *intersected_rule;
         struct ieee80211_regdomain *rd;
         /* This is just a dummy holder to help us count */
-        struct ieee80211_reg_rule irule;
-
-        /* Uses the stack temporarily for counter arithmetic */
-        intersected_rule = &irule;
-
-        memset(intersected_rule, 0, sizeof(struct ieee80211_reg_rule));
+        struct ieee80211_reg_rule dummy_rule;
 
         if (!rd1 || !rd2)
                 return NULL;
@@ -629,11 +644,8 @@ static struct ieee80211_regdomain *regdom_intersect(
                 rule1 = &rd1->reg_rules[x];
                 for (y = 0; y < rd2->n_reg_rules; y++) {
                         rule2 = &rd2->reg_rules[y];
-                        if (!reg_rules_intersect(rule1, rule2,
-                                        intersected_rule))
+                        if (!reg_rules_intersect(rule1, rule2, &dummy_rule))
                                 num_rules++;
-                        memset(intersected_rule, 0,
-                                        sizeof(struct ieee80211_reg_rule));
                 }
         }
 
@@ -641,15 +653,15 @@ static struct ieee80211_regdomain *regdom_intersect(
                 return NULL;
 
         size_of_regd = sizeof(struct ieee80211_regdomain) +
-                ((num_rules + 1) * sizeof(struct ieee80211_reg_rule));
+                       num_rules * sizeof(struct ieee80211_reg_rule);
 
         rd = kzalloc(size_of_regd, GFP_KERNEL);
         if (!rd)
                 return NULL;
 
-        for (x = 0; x < rd1->n_reg_rules; x++) {
+        for (x = 0; x < rd1->n_reg_rules && rule_idx < num_rules; x++) {
                 rule1 = &rd1->reg_rules[x];
-                for (y = 0; y < rd2->n_reg_rules; y++) {
+                for (y = 0; y < rd2->n_reg_rules && rule_idx < num_rules; y++) {
                         rule2 = &rd2->reg_rules[y];
                         /*
                          * This time around instead of using the stack lets
@@ -657,8 +669,7 @@ static struct ieee80211_regdomain *regdom_intersect(
                          * a memcpy()
                          */
                         intersected_rule = &rd->reg_rules[rule_idx];
-                        r = reg_rules_intersect(rule1, rule2,
-                                intersected_rule);
+                        r = reg_rules_intersect(rule1, rule2, intersected_rule);
                         /*
                          * No need to memset here the intersected rule here as
                          * we're not using the stack anymore
@@ -699,34 +710,16 @@ static u32 map_regdom_flags(u32 rd_flags)
         return channel_flags;
 }
 
-static int freq_reg_info_regd(struct wiphy *wiphy,
-                              u32 center_freq,
-                              u32 desired_bw_khz,
-                              const struct ieee80211_reg_rule **reg_rule,
-                              const struct ieee80211_regdomain *custom_regd)
+static const struct ieee80211_reg_rule *
+freq_reg_info_regd(struct wiphy *wiphy, u32 center_freq,
+                   const struct ieee80211_regdomain *regd)
 {
         int i;
         bool band_rule_found = false;
-        const struct ieee80211_regdomain *regd;
         bool bw_fits = false;
 
-        if (!desired_bw_khz)
-                desired_bw_khz = MHZ_TO_KHZ(20);
-
-        regd = custom_regd ? custom_regd : cfg80211_regdomain;
-
-        /*
-         * Follow the driver's regulatory domain, if present, unless a country
-         * IE has been processed or a user wants to help complaince further
-         */
-        if (!custom_regd &&
-            last_request->initiator != NL80211_REGDOM_SET_BY_COUNTRY_IE &&
-            last_request->initiator != NL80211_REGDOM_SET_BY_USER &&
-            wiphy->regd)
-                regd = wiphy->regd;
-
         if (!regd)
-                return -EINVAL;
+                return ERR_PTR(-EINVAL);
 
         for (i = 0; i < regd->n_reg_rules; i++) {
                 const struct ieee80211_reg_rule *rr;
@@ -743,33 +736,36 @@ static int freq_reg_info_regd(struct wiphy *wiphy,
                 if (!band_rule_found)
                         band_rule_found = freq_in_rule_band(fr, center_freq);
 
-                bw_fits = reg_does_bw_fit(fr,
-                                          center_freq,
-                                          desired_bw_khz);
+                bw_fits = reg_does_bw_fit(fr, center_freq, MHZ_TO_KHZ(20));
 
-                if (band_rule_found && bw_fits) {
-                        *reg_rule = rr;
-                        return 0;
-                }
+                if (band_rule_found && bw_fits)
+                        return rr;
         }
 
         if (!band_rule_found)
-                return -ERANGE;
+                return ERR_PTR(-ERANGE);
 
-        return -EINVAL;
+        return ERR_PTR(-EINVAL);
 }
 
-int freq_reg_info(struct wiphy *wiphy,
-                  u32 center_freq,
-                  u32 desired_bw_khz,
-                  const struct ieee80211_reg_rule **reg_rule)
+const struct ieee80211_reg_rule *freq_reg_info(struct wiphy *wiphy,
+                                               u32 center_freq)
 {
-        assert_cfg80211_lock();
-        return freq_reg_info_regd(wiphy,
-                                  center_freq,
-                                  desired_bw_khz,
-                                  reg_rule,
-                                  NULL);
+        const struct ieee80211_regdomain *regd;
+        struct regulatory_request *lr = get_last_request();
+
+        /*
+         * Follow the driver's regulatory domain, if present, unless a country
+         * IE has been processed or a user wants to help complaince further
+         */
+        if (lr->initiator != NL80211_REGDOM_SET_BY_COUNTRY_IE &&
+            lr->initiator != NL80211_REGDOM_SET_BY_USER &&
+            wiphy->regd)
+                regd = get_wiphy_regdom(wiphy);
+        else
+                regd = get_cfg80211_regdom();
+
+        return freq_reg_info_regd(wiphy, center_freq, regd);
 }
 EXPORT_SYMBOL(freq_reg_info);
 
@@ -792,7 +788,6 @@ static const char *reg_initiator_name(enum nl80211_reg_initiator initiator)
 }
 
 static void chan_reg_rule_print_dbg(struct ieee80211_channel *chan,
-                                    u32 desired_bw_khz,
                                     const struct ieee80211_reg_rule *reg_rule)
 {
         const struct ieee80211_power_rule *power_rule;
@@ -807,21 +802,16 @@ static void chan_reg_rule_print_dbg(struct ieee80211_channel *chan,
         else
                 snprintf(max_antenna_gain, 32, "%d", power_rule->max_antenna_gain);
 
-        REG_DBG_PRINT("Updating information on frequency %d MHz "
-                      "for a %d MHz width channel with regulatory rule:\n",
-                      chan->center_freq,
-                      KHZ_TO_MHZ(desired_bw_khz));
+        REG_DBG_PRINT("Updating information on frequency %d MHz with regulatory rule:\n",
+                      chan->center_freq);
 
         REG_DBG_PRINT("%d KHz - %d KHz @ %d KHz), (%s mBi, %d mBm)\n",
-                      freq_range->start_freq_khz,
-                      freq_range->end_freq_khz,
-                      freq_range->max_bandwidth_khz,
-                      max_antenna_gain,
+                      freq_range->start_freq_khz, freq_range->end_freq_khz,
+                      freq_range->max_bandwidth_khz, max_antenna_gain,
                       power_rule->max_eirp);
 }
 #else
 static void chan_reg_rule_print_dbg(struct ieee80211_channel *chan,
-                                    u32 desired_bw_khz,
                                     const struct ieee80211_reg_rule *reg_rule)
 {
         return;
@@ -831,43 +821,25 @@ static void chan_reg_rule_print_dbg(struct ieee80211_channel *chan,
 /*
  * Note that right now we assume the desired channel bandwidth
  * is always 20 MHz for each individual channel (HT40 uses 20 MHz
- * per channel, the primary and the extension channel). To support
- * smaller custom bandwidths such as 5 MHz or 10 MHz we'll need a
- * new ieee80211_channel.target_bw and re run the regulatory check
- * on the wiphy with the target_bw specified. Then we can simply use
- * that below for the desired_bw_khz below.
+ * per channel, the primary and the extension channel).
  */
 static void handle_channel(struct wiphy *wiphy,
                            enum nl80211_reg_initiator initiator,
-                           enum ieee80211_band band,
-                           unsigned int chan_idx)
+                           struct ieee80211_channel *chan)
 {
-        int r;
         u32 flags, bw_flags = 0;
-        u32 desired_bw_khz = MHZ_TO_KHZ(20);
         const struct ieee80211_reg_rule *reg_rule = NULL;
         const struct ieee80211_power_rule *power_rule = NULL;
         const struct ieee80211_freq_range *freq_range = NULL;
-        struct ieee80211_supported_band *sband;
-        struct ieee80211_channel *chan;
         struct wiphy *request_wiphy = NULL;
+        struct regulatory_request *lr = get_last_request();
 
-        assert_cfg80211_lock();
-
-        request_wiphy = wiphy_idx_to_wiphy(last_request->wiphy_idx);
-
-        sband = wiphy->bands[band];
-        BUG_ON(chan_idx >= sband->n_channels);
-        chan = &sband->channels[chan_idx];
+        request_wiphy = wiphy_idx_to_wiphy(lr->wiphy_idx);
 
         flags = chan->orig_flags;
 
-        r = freq_reg_info(wiphy,
-                          MHZ_TO_KHZ(chan->center_freq),
-                          desired_bw_khz,
-                          &reg_rule);
-
-        if (r) {
+        reg_rule = freq_reg_info(wiphy, MHZ_TO_KHZ(chan->center_freq));
+        if (IS_ERR(reg_rule)) {
                 /*
                  * We will disable all channels that do not match our
                  * received regulatory rule unless the hint is coming
@@ -879,7 +851,7 @@ static void handle_channel(struct wiphy *wiphy,
                  * while 5 GHz is still supported.
                  */
                 if (initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE &&
-                    r == -ERANGE)
+                    PTR_ERR(reg_rule) == -ERANGE)
                         return;
 
                 REG_DBG_PRINT("Disabling freq %d MHz\n", chan->center_freq);
@@ -887,7 +859,7 @@ static void handle_channel(struct wiphy *wiphy,
                 return;
         }
 
-        chan_reg_rule_print_dbg(chan, desired_bw_khz, reg_rule);
+        chan_reg_rule_print_dbg(chan, reg_rule);
 
         power_rule = &reg_rule->power_rule;
         freq_range = &reg_rule->freq_range;
@@ -895,7 +867,7 @@ static void handle_channel(struct wiphy *wiphy,
         if (freq_range->max_bandwidth_khz < MHZ_TO_KHZ(40))
                 bw_flags = IEEE80211_CHAN_NO_HT40;
 
-        if (last_request->initiator == NL80211_REGDOM_SET_BY_DRIVER &&
+        if (lr->initiator == NL80211_REGDOM_SET_BY_DRIVER &&
             request_wiphy && request_wiphy == wiphy &&
             request_wiphy->flags & WIPHY_FLAG_STRICT_REGULATORY) {
                 /*
@@ -914,8 +886,9 @@ static void handle_channel(struct wiphy *wiphy,
 
         chan->beacon_found = false;
         chan->flags = flags | bw_flags | map_regdom_flags(reg_rule->flags);
-        chan->max_antenna_gain = min(chan->orig_mag,
-                (int) MBI_TO_DBI(power_rule->max_antenna_gain));
+        chan->max_antenna_gain =
+                min_t(int, chan->orig_mag,
+                      MBI_TO_DBI(power_rule->max_antenna_gain));
         chan->max_reg_power = (int) MBM_TO_DBM(power_rule->max_eirp);
         if (chan->orig_mpwr) {
                 /*
@@ -935,68 +908,65 @@ static void handle_channel(struct wiphy *wiphy,
 }
 
 static void handle_band(struct wiphy *wiphy,
-                        enum ieee80211_band band,
-                        enum nl80211_reg_initiator initiator)
+                        enum nl80211_reg_initiator initiator,
+                        struct ieee80211_supported_band *sband)
 {
         unsigned int i;
-        struct ieee80211_supported_band *sband;
 
-        BUG_ON(!wiphy->bands[band]);
-        sband = wiphy->bands[band];
+        if (!sband)
+                return;
 
         for (i = 0; i < sband->n_channels; i++)
-                handle_channel(wiphy, initiator, band, i);
+                handle_channel(wiphy, initiator, &sband->channels[i]);
 }
 
 static bool reg_request_cell_base(struct regulatory_request *request)
 {
         if (request->initiator != NL80211_REGDOM_SET_BY_USER)
                 return false;
-        if (request->user_reg_hint_type != NL80211_USER_REG_HINT_CELL_BASE)
-                return false;
-        return true;
+        return request->user_reg_hint_type == NL80211_USER_REG_HINT_CELL_BASE;
 }
 
 bool reg_last_request_cell_base(void)
 {
         bool val;
-        assert_cfg80211_lock();
 
         mutex_lock(&reg_mutex);
-        val = reg_request_cell_base(last_request);
+        val = reg_request_cell_base(get_last_request());
         mutex_unlock(&reg_mutex);
+
         return val;
 }
 
 #ifdef CONFIG_CFG80211_CERTIFICATION_ONUS
-
 /* Core specific check */
-static int reg_ignore_cell_hint(struct regulatory_request *pending_request)
+static enum reg_request_treatment
+reg_ignore_cell_hint(struct regulatory_request *pending_request)
 {
+        struct regulatory_request *lr = get_last_request();
+
         if (!reg_num_devs_support_basehint)
-                return -EOPNOTSUPP;
+                return REG_REQ_IGNORE;
 
-        if (reg_request_cell_base(last_request)) {
-                if (!regdom_changes(pending_request->alpha2))
-                        return -EALREADY;
-                return 0;
-        }
-        return 0;
+        if (reg_request_cell_base(lr) &&
+            !regdom_changes(pending_request->alpha2))
+                return REG_REQ_ALREADY_SET;
+
+        return REG_REQ_OK;
 }
 
 /* Device specific check */
 static bool reg_dev_ignore_cell_hint(struct wiphy *wiphy)
 {
-        if (!(wiphy->features & NL80211_FEATURE_CELL_BASE_REG_HINTS))
-                return true;
-        return false;
+        return !(wiphy->features & NL80211_FEATURE_CELL_BASE_REG_HINTS);
 }
 #else
 static int reg_ignore_cell_hint(struct regulatory_request *pending_request)
 {
-        return -EOPNOTSUPP;
+        return REG_REQ_IGNORE;
 }
-static int reg_dev_ignore_cell_hint(struct wiphy *wiphy)
+
+static bool reg_dev_ignore_cell_hint(struct wiphy *wiphy)
 {
         return true;
 }
@@ -1006,18 +976,17 @@ static int reg_dev_ignore_cell_hint(struct wiphy *wiphy)
 static bool ignore_reg_update(struct wiphy *wiphy,
                               enum nl80211_reg_initiator initiator)
 {
-        if (!last_request) {
-                REG_DBG_PRINT("Ignoring regulatory request %s since "
-                              "last_request is not set\n",
+        struct regulatory_request *lr = get_last_request();
+
+        if (!lr) {
+                REG_DBG_PRINT("Ignoring regulatory request %s since last_request is not set\n",
                               reg_initiator_name(initiator));
                 return true;
         }
 
         if (initiator == NL80211_REGDOM_SET_BY_CORE &&
             wiphy->flags & WIPHY_FLAG_CUSTOM_REGULATORY) {
-                REG_DBG_PRINT("Ignoring regulatory request %s "
-                              "since the driver uses its own custom "
-                              "regulatory domain\n",
+                REG_DBG_PRINT("Ignoring regulatory request %s since the driver uses its own custom regulatory domain\n",
                               reg_initiator_name(initiator));
                 return true;
         }
@@ -1028,22 +997,35 @@ static bool ignore_reg_update(struct wiphy *wiphy,
          */
         if (wiphy->flags & WIPHY_FLAG_STRICT_REGULATORY && !wiphy->regd &&
             initiator != NL80211_REGDOM_SET_BY_COUNTRY_IE &&
-            !is_world_regdom(last_request->alpha2)) {
-                REG_DBG_PRINT("Ignoring regulatory request %s "
-                              "since the driver requires its own regulatory "
-                              "domain to be set first\n",
+            !is_world_regdom(lr->alpha2)) {
+                REG_DBG_PRINT("Ignoring regulatory request %s since the driver requires its own regulatory domain to be set first\n",
                               reg_initiator_name(initiator));
                 return true;
         }
 
-        if (reg_request_cell_base(last_request))
+        if (reg_request_cell_base(lr))
                 return reg_dev_ignore_cell_hint(wiphy);
 
         return false;
 }
 
-static void handle_reg_beacon(struct wiphy *wiphy,
-                              unsigned int chan_idx,
+static bool reg_is_world_roaming(struct wiphy *wiphy)
+{
+        const struct ieee80211_regdomain *cr = get_cfg80211_regdom();
+        const struct ieee80211_regdomain *wr = get_wiphy_regdom(wiphy);
+        struct regulatory_request *lr = get_last_request();
+
+        if (is_world_regdom(cr->alpha2) || (wr && is_world_regdom(wr->alpha2)))
+                return true;
+
+        if (lr && lr->initiator != NL80211_REGDOM_SET_BY_COUNTRY_IE &&
+            wiphy->flags & WIPHY_FLAG_CUSTOM_REGULATORY)
+                return true;
+
+        return false;
+}
+
+static void handle_reg_beacon(struct wiphy *wiphy, unsigned int chan_idx,
                               struct reg_beacon *reg_beacon)
 {
         struct ieee80211_supported_band *sband;
@@ -1051,8 +1033,6 @@ static void handle_reg_beacon(struct wiphy *wiphy,
         bool channel_changed = false;
         struct ieee80211_channel chan_before;
 
-        assert_cfg80211_lock();
-
         sband = wiphy->bands[reg_beacon->chan.band];
         chan = &sband->channels[chan_idx];
 
@@ -1064,6 +1044,9 @@ static void handle_reg_beacon(struct wiphy *wiphy,
 
         chan->beacon_found = true;
 
+        if (!reg_is_world_roaming(wiphy))
+                return;
+
         if (wiphy->flags & WIPHY_FLAG_DISABLE_BEACON_HINTS)
                 return;
 
@@ -1094,8 +1077,6 @@ static void wiphy_update_new_beacon(struct wiphy *wiphy,
         unsigned int i;
         struct ieee80211_supported_band *sband;
 
-        assert_cfg80211_lock();
-
         if (!wiphy->bands[reg_beacon->chan.band])
                 return;
 
@@ -1114,11 +1095,6 @@ static void wiphy_update_beacon_reg(struct wiphy *wiphy)
         struct ieee80211_supported_band *sband;
         struct reg_beacon *reg_beacon;
 
-        assert_cfg80211_lock();
-
-        if (list_empty(&reg_beacon_list))
-                return;
-
         list_for_each_entry(reg_beacon, &reg_beacon_list, list) {
                 if (!wiphy->bands[reg_beacon->chan.band])
                         continue;
@@ -1128,18 +1104,6 @@ static void wiphy_update_beacon_reg(struct wiphy *wiphy)
         }
 }
 
-static bool reg_is_world_roaming(struct wiphy *wiphy)
-{
-        if (is_world_regdom(cfg80211_regdomain->alpha2) ||
-            (wiphy->regd && is_world_regdom(wiphy->regd->alpha2)))
-                return true;
-        if (last_request &&
-            last_request->initiator != NL80211_REGDOM_SET_BY_COUNTRY_IE &&
-            wiphy->flags & WIPHY_FLAG_CUSTOM_REGULATORY)
-                return true;
-        return false;
-}
-
 /* Reap the advantages of previously found beacons */
 static void reg_process_beacons(struct wiphy *wiphy)
 {
@@ -1149,39 +1113,29 @@ static void reg_process_beacons(struct wiphy *wiphy)
          */
         if (!last_request)
                 return;
-        if (!reg_is_world_roaming(wiphy))
-                return;
         wiphy_update_beacon_reg(wiphy);
 }
 
-static bool is_ht40_not_allowed(struct ieee80211_channel *chan)
+static bool is_ht40_allowed(struct ieee80211_channel *chan)
 {
         if (!chan)
-                return true;
+                return false;
         if (chan->flags & IEEE80211_CHAN_DISABLED)
-                return true;
+                return false;
         /* This would happen when regulatory rules disallow HT40 completely */
-        if (IEEE80211_CHAN_NO_HT40 == (chan->flags & (IEEE80211_CHAN_NO_HT40)))
-                return true;
-        return false;
+        if ((chan->flags & IEEE80211_CHAN_NO_HT40) == IEEE80211_CHAN_NO_HT40)
+                return false;
+        return true;
 }
 
 static void reg_process_ht_flags_channel(struct wiphy *wiphy,
-                                         enum ieee80211_band band,
-                                         unsigned int chan_idx)
+                                         struct ieee80211_channel *channel)
 {
-        struct ieee80211_supported_band *sband;
-        struct ieee80211_channel *channel;
+        struct ieee80211_supported_band *sband = wiphy->bands[channel->band];
         struct ieee80211_channel *channel_before = NULL, *channel_after = NULL;
         unsigned int i;
 
-        assert_cfg80211_lock();
-
-        sband = wiphy->bands[band];
-        BUG_ON(chan_idx >= sband->n_channels);
-        channel = &sband->channels[chan_idx];
-
-        if (is_ht40_not_allowed(channel)) {
+        if (!is_ht40_allowed(channel)) {
                 channel->flags |= IEEE80211_CHAN_NO_HT40;
                 return;
         }
@@ -1192,6 +1146,7 @@ static void reg_process_ht_flags_channel(struct wiphy *wiphy,
          */
         for (i = 0; i < sband->n_channels; i++) {
                 struct ieee80211_channel *c = &sband->channels[i];
+
                 if (c->center_freq == (channel->center_freq - 20))
                         channel_before = c;
                 if (c->center_freq == (channel->center_freq + 20))
@@ -1203,28 +1158,27 @@ static void reg_process_ht_flags_channel(struct wiphy *wiphy,
          * if that ever changes we also need to change the below logic
          * to include that as well.
          */
-        if (is_ht40_not_allowed(channel_before))
+        if (!is_ht40_allowed(channel_before))
                 channel->flags |= IEEE80211_CHAN_NO_HT40MINUS;
         else
                 channel->flags &= ~IEEE80211_CHAN_NO_HT40MINUS;
 
-        if (is_ht40_not_allowed(channel_after))
+        if (!is_ht40_allowed(channel_after))
                 channel->flags |= IEEE80211_CHAN_NO_HT40PLUS;
         else
                 channel->flags &= ~IEEE80211_CHAN_NO_HT40PLUS;
 }
 
 static void reg_process_ht_flags_band(struct wiphy *wiphy,
-                                      enum ieee80211_band band)
+                                      struct ieee80211_supported_band *sband)
 {
         unsigned int i;
-        struct ieee80211_supported_band *sband;
 
-        BUG_ON(!wiphy->bands[band]);
-        sband = wiphy->bands[band];
+        if (!sband)
+                return;
 
         for (i = 0; i < sband->n_channels; i++)
-                reg_process_ht_flags_channel(wiphy, band, i);
+                reg_process_ht_flags_channel(wiphy, &sband->channels[i]);
 }
 
 static void reg_process_ht_flags(struct wiphy *wiphy)
@@ -1234,34 +1188,29 @@ static void reg_process_ht_flags(struct wiphy *wiphy)
         if (!wiphy)
                 return;
 
-        for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
-                if (wiphy->bands[band])
-                        reg_process_ht_flags_band(wiphy, band);
-        }
-
+        for (band = 0; band < IEEE80211_NUM_BANDS; band++)
+                reg_process_ht_flags_band(wiphy, wiphy->bands[band]);
 }
 
 static void wiphy_update_regulatory(struct wiphy *wiphy,
                                     enum nl80211_reg_initiator initiator)
 {
         enum ieee80211_band band;
-
-        assert_reg_lock();
+        struct regulatory_request *lr = get_last_request();
 
         if (ignore_reg_update(wiphy, initiator))
                 return;
 
-        last_request->dfs_region = cfg80211_regdomain->dfs_region;
+        lr->dfs_region = get_cfg80211_regdom()->dfs_region;
 
-        for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
-                if (wiphy->bands[band])
-                        handle_band(wiphy, band, initiator);
-        }
+        for (band = 0; band < IEEE80211_NUM_BANDS; band++)
+                handle_band(wiphy, initiator, wiphy->bands[band]);
 
         reg_process_beacons(wiphy);
         reg_process_ht_flags(wiphy);
+
         if (wiphy->reg_notifier)
-                wiphy->reg_notifier(wiphy, last_request);
+                wiphy->reg_notifier(wiphy, lr);
 }
 
 static void update_all_wiphy_regulatory(enum nl80211_reg_initiator initiator)
@@ -1269,6 +1218,8 @@ static void update_all_wiphy_regulatory(enum nl80211_reg_initiator initiator)
         struct cfg80211_registered_device *rdev;
         struct wiphy *wiphy;
 
+        assert_cfg80211_lock();
+
         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
                 wiphy = &rdev->wiphy;
                 wiphy_update_regulatory(wiphy, initiator);
@@ -1280,47 +1231,30 @@ static void update_all_wiphy_regulatory(enum nl80211_reg_initiator initiator)
                 if (initiator == NL80211_REGDOM_SET_BY_CORE &&
                     wiphy->flags & WIPHY_FLAG_CUSTOM_REGULATORY &&
                     wiphy->reg_notifier)
-                        wiphy->reg_notifier(wiphy, last_request);
+                        wiphy->reg_notifier(wiphy, get_last_request());
         }
 }
 
 static void handle_channel_custom(struct wiphy *wiphy,
-                                  enum ieee80211_band band,
-                                  unsigned int chan_idx,
+                                  struct ieee80211_channel *chan,
                                   const struct ieee80211_regdomain *regd)
 {
-        int r;
-        u32 desired_bw_khz = MHZ_TO_KHZ(20);
         u32 bw_flags = 0;
         const struct ieee80211_reg_rule *reg_rule = NULL;
         const struct ieee80211_power_rule *power_rule = NULL;
         const struct ieee80211_freq_range *freq_range = NULL;
-        struct ieee80211_supported_band *sband;
-        struct ieee80211_channel *chan;
-
-        assert_reg_lock();
 
-        sband = wiphy->bands[band];
-        BUG_ON(chan_idx >= sband->n_channels);
-        chan = &sband->channels[chan_idx];
-
-        r = freq_reg_info_regd(wiphy,
-                               MHZ_TO_KHZ(chan->center_freq),
-                               desired_bw_khz,
-                               &reg_rule,
-                               regd);
+        reg_rule = freq_reg_info_regd(wiphy, MHZ_TO_KHZ(chan->center_freq),
+                                      regd);
 
-        if (r) {
-                REG_DBG_PRINT("Disabling freq %d MHz as custom "
-                              "regd has no rule that fits a %d MHz "
-                              "wide channel\n",
-                              chan->center_freq,
-                              KHZ_TO_MHZ(desired_bw_khz));
+        if (IS_ERR(reg_rule)) {
+                REG_DBG_PRINT("Disabling freq %d MHz as custom regd has no rule that fits it\n",
+                              chan->center_freq);
                 chan->flags = IEEE80211_CHAN_DISABLED;
                 return;
         }
 
-        chan_reg_rule_print_dbg(chan, desired_bw_khz, reg_rule);
+        chan_reg_rule_print_dbg(chan, reg_rule);
 
         power_rule = &reg_rule->power_rule;
         freq_range = &reg_rule->freq_range;
@@ -1334,17 +1268,17 @@ static void handle_channel_custom(struct wiphy *wiphy,
                 (int) MBM_TO_DBM(power_rule->max_eirp);
 }
 
-static void handle_band_custom(struct wiphy *wiphy, enum ieee80211_band band,
+static void handle_band_custom(struct wiphy *wiphy,
+                               struct ieee80211_supported_band *sband,
                                const struct ieee80211_regdomain *regd)
 {
         unsigned int i;
-        struct ieee80211_supported_band *sband;
 
-        BUG_ON(!wiphy->bands[band]);
-        sband = wiphy->bands[band];
+        if (!sband)
+                return;
 
         for (i = 0; i < sband->n_channels; i++)
-                handle_channel_custom(wiphy, band, i, regd);
+                handle_channel_custom(wiphy, &sband->channels[i], regd);
 }
 
 /* Used by drivers prior to wiphy registration */
@@ -1354,60 +1288,50 @@ void wiphy_apply_custom_regulatory(struct wiphy *wiphy,
         enum ieee80211_band band;
         unsigned int bands_set = 0;
 
-        mutex_lock(&reg_mutex);
         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
                 if (!wiphy->bands[band])
                         continue;
-                handle_band_custom(wiphy, band, regd);
+                handle_band_custom(wiphy, wiphy->bands[band], regd);
                 bands_set++;
         }
-        mutex_unlock(&reg_mutex);
 
         /*
          * no point in calling this if it won't have any effect
-         * on your device's supportd bands.
+         * on your device's supported bands.
          */
         WARN_ON(!bands_set);
 }
 EXPORT_SYMBOL(wiphy_apply_custom_regulatory);
 
-/*
- * Return value which can be used by ignore_request() to indicate
- * it has been determined we should intersect two regulatory domains
- */
-#define REG_INTERSECT   1
-
 /* This has the logic which determines when a new request
  * should be ignored. */
-static int ignore_request(struct wiphy *wiphy,
+static enum reg_request_treatment
+get_reg_request_treatment(struct wiphy *wiphy,
                           struct regulatory_request *pending_request)
 {
         struct wiphy *last_wiphy = NULL;
-
-        assert_cfg80211_lock();
+        struct regulatory_request *lr = get_last_request();
 
         /* All initial requests are respected */
-        if (!last_request)
-                return 0;
+        if (!lr)
+                return REG_REQ_OK;
 
         switch (pending_request->initiator) {
         case NL80211_REGDOM_SET_BY_CORE:
-                return 0;
+                return REG_REQ_OK;
         case NL80211_REGDOM_SET_BY_COUNTRY_IE:
-
-                if (reg_request_cell_base(last_request)) {
+                if (reg_request_cell_base(lr)) {
                         /* Trust a Cell base station over the AP's country IE */
                         if (regdom_changes(pending_request->alpha2))
-                                return -EOPNOTSUPP;
-                        return -EALREADY;
+                                return REG_REQ_IGNORE;
+                        return REG_REQ_ALREADY_SET;
                 }
 
-                last_wiphy = wiphy_idx_to_wiphy(last_request->wiphy_idx);
+                last_wiphy = wiphy_idx_to_wiphy(lr->wiphy_idx);
 
                 if (unlikely(!is_an_alpha2(pending_request->alpha2)))
                         return -EINVAL;
-                if (last_request->initiator ==
-                    NL80211_REGDOM_SET_BY_COUNTRY_IE) {
+                if (lr->initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE) {
                         if (last_wiphy != wiphy) {
                                 /*
                                  * Two cards with two APs claiming different
@@ -1416,23 +1340,23 @@ static int ignore_request(struct wiphy *wiphy,
                                  * to be correct. Reject second one for now.
                                  */
                                 if (regdom_changes(pending_request->alpha2))
-                                        return -EOPNOTSUPP;
-                                return -EALREADY;
+                                        return REG_REQ_IGNORE;
+                                return REG_REQ_ALREADY_SET;
                         }
                         /*
                          * Two consecutive Country IE hints on the same wiphy.
                          * This should be picked up early by the driver/stack
                          */
                         if (WARN_ON(regdom_changes(pending_request->alpha2)))
-                                return 0;
-                        return -EALREADY;
+                                return REG_REQ_OK;
+                        return REG_REQ_ALREADY_SET;
                 }
                 return 0;
         case NL80211_REGDOM_SET_BY_DRIVER:
-                if (last_request->initiator == NL80211_REGDOM_SET_BY_CORE) {
+                if (lr->initiator == NL80211_REGDOM_SET_BY_CORE) {
                         if (regdom_changes(pending_request->alpha2))
-                                return 0;
-                        return -EALREADY;
+                                return REG_REQ_OK;
+                        return REG_REQ_ALREADY_SET;
                 }
 
                 /*
@@ -1440,59 +1364,59 @@ static int ignore_request(struct wiphy *wiphy,
                  * back in or if you add a new device for which the previously
                  * loaded card also agrees on the regulatory domain.
                  */
-                if (last_request->initiator == NL80211_REGDOM_SET_BY_DRIVER &&
+                if (lr->initiator == NL80211_REGDOM_SET_BY_DRIVER &&
                     !regdom_changes(pending_request->alpha2))
-                        return -EALREADY;
+                        return REG_REQ_ALREADY_SET;
 
-                return REG_INTERSECT;
+                return REG_REQ_INTERSECT;
         case NL80211_REGDOM_SET_BY_USER:
                 if (reg_request_cell_base(pending_request))
                         return reg_ignore_cell_hint(pending_request);
 
-                if (reg_request_cell_base(last_request))
-                        return -EOPNOTSUPP;
+                if (reg_request_cell_base(lr))
+                        return REG_REQ_IGNORE;
 
-                if (last_request->initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE)
-                        return REG_INTERSECT;
+                if (lr->initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE)
+                        return REG_REQ_INTERSECT;
                 /*
                  * If the user knows better the user should set the regdom
                  * to their country before the IE is picked up
                  */
-                if (last_request->initiator == NL80211_REGDOM_SET_BY_USER &&
-                          last_request->intersect)
-                        return -EOPNOTSUPP;
+                if (lr->initiator == NL80211_REGDOM_SET_BY_USER &&
+                    lr->intersect)
+                        return REG_REQ_IGNORE;
                 /*
                  * Process user requests only after previous user/driver/core
                  * requests have been processed
                  */
-                if (last_request->initiator == NL80211_REGDOM_SET_BY_CORE ||
-                    last_request->initiator == NL80211_REGDOM_SET_BY_DRIVER ||
-                    last_request->initiator == NL80211_REGDOM_SET_BY_USER) {
-                        if (regdom_changes(last_request->alpha2))
-                                return -EAGAIN;
-                }
+                if ((lr->initiator == NL80211_REGDOM_SET_BY_CORE ||
+                     lr->initiator == NL80211_REGDOM_SET_BY_DRIVER ||
+                     lr->initiator == NL80211_REGDOM_SET_BY_USER) &&
+                    regdom_changes(lr->alpha2))
+                        return REG_REQ_IGNORE;
 
                 if (!regdom_changes(pending_request->alpha2))
-                        return -EALREADY;
+                        return REG_REQ_ALREADY_SET;
 
-                return 0;
+                return REG_REQ_OK;
         }
 
-        return -EINVAL;
+        return REG_REQ_IGNORE;
 }
 
 static void reg_set_request_processed(void)
 {
         bool need_more_processing = false;
+        struct regulatory_request *lr = get_last_request();
 
-        last_request->processed = true;
+        lr->processed = true;
 
         spin_lock(&reg_requests_lock);
         if (!list_empty(&reg_requests_list))
                 need_more_processing = true;
         spin_unlock(&reg_requests_lock);
 
-        if (last_request->initiator == NL80211_REGDOM_SET_BY_USER)
+        if (lr->initiator == NL80211_REGDOM_SET_BY_USER)
                 cancel_delayed_work(&reg_timeout);
 
         if (need_more_processing)
@@ -1508,116 +1432,122 @@ static void reg_set_request_processed(void)
  * The Wireless subsystem can use this function to hint to the wireless core
  * what it believes should be the current regulatory domain.
  *
- * Returns zero if all went fine, %-EALREADY if a regulatory domain had
- * already been set or other standard error codes.
+ * Returns one of the different reg request treatment values.
  *
- * Caller must hold &cfg80211_mutex and &reg_mutex
+ * Caller must hold &reg_mutex
  */
-static int __regulatory_hint(struct wiphy *wiphy,
-                             struct regulatory_request *pending_request)
+static enum reg_request_treatment
+__regulatory_hint(struct wiphy *wiphy,
+                  struct regulatory_request *pending_request)
 {
+        const struct ieee80211_regdomain *regd;
         bool intersect = false;
-        int r = 0;
-
-        assert_cfg80211_lock();
+        enum reg_request_treatment treatment;
+        struct regulatory_request *lr;
 
-        r = ignore_request(wiphy, pending_request);
+        treatment = get_reg_request_treatment(wiphy, pending_request);
 
-        if (r == REG_INTERSECT) {
+        switch (treatment) {
+        case REG_REQ_INTERSECT:
                 if (pending_request->initiator ==
                     NL80211_REGDOM_SET_BY_DRIVER) {
-                        r = reg_copy_regd(&wiphy->regd, cfg80211_regdomain);
-                        if (r) {
+                        regd = reg_copy_regd(get_cfg80211_regdom());
+                        if (IS_ERR(regd)) {
                                 kfree(pending_request);
-                                return r;
+                                return PTR_ERR(regd);
                         }
+                        rcu_assign_pointer(wiphy->regd, regd);
                 }
                 intersect = true;
-        } else if (r) {
+                break;
+        case REG_REQ_OK:
+                break;
+        default:
                 /*
                  * If the regulatory domain being requested by the
                  * driver has already been set just copy it to the
                  * wiphy
                  */
-                if (r == -EALREADY &&
-                    pending_request->initiator ==
-                    NL80211_REGDOM_SET_BY_DRIVER) {
-                        r = reg_copy_regd(&wiphy->regd, cfg80211_regdomain);
-                        if (r) {
+                if (treatment == REG_REQ_ALREADY_SET &&
+                    pending_request->initiator == NL80211_REGDOM_SET_BY_DRIVER) {
+                        regd = reg_copy_regd(get_cfg80211_regdom());
+                        if (IS_ERR(regd)) {
                                 kfree(pending_request);
-                                return r;
+                                return REG_REQ_IGNORE;
                         }
-                        r = -EALREADY;
+                        treatment = REG_REQ_ALREADY_SET;
+                        rcu_assign_pointer(wiphy->regd, regd);
                         goto new_request;
                 }
                 kfree(pending_request);
-                return r;
+                return treatment;
         }
 
 new_request:
-        if (last_request != &core_request_world)
-                kfree(last_request);
+        lr = get_last_request();
+        if (lr != &core_request_world && lr)
+                kfree_rcu(lr, rcu_head);
 
-        last_request = pending_request;
-        last_request->intersect = intersect;
+        pending_request->intersect = intersect;
+        pending_request->processed = false;
+        rcu_assign_pointer(last_request, pending_request);
+        lr = pending_request;
 
         pending_request = NULL;
 
-        if (last_request->initiator == NL80211_REGDOM_SET_BY_USER) {
-                user_alpha2[0] = last_request->alpha2[0];
-                user_alpha2[1] = last_request->alpha2[1];
+        if (lr->initiator == NL80211_REGDOM_SET_BY_USER) {
+                user_alpha2[0] = lr->alpha2[0];
+                user_alpha2[1] = lr->alpha2[1];
         }
 
-        /* When r == REG_INTERSECT we do need to call CRDA */
-        if (r < 0) {
+        /* When r == REG_REQ_INTERSECT we do need to call CRDA */
+        if (treatment != REG_REQ_OK && treatment != REG_REQ_INTERSECT) {
                 /*
                  * Since CRDA will not be called in this case as we already
                  * have applied the requested regulatory domain before we just
                  * inform userspace we have processed the request
                  */
-                if (r == -EALREADY) {
-                        nl80211_send_reg_change_event(last_request);
+                if (treatment == REG_REQ_ALREADY_SET) {
+                        nl80211_send_reg_change_event(lr);
                         reg_set_request_processed();
                 }
-                return r;
+                return treatment;
         }
 
-        return call_crda(last_request->alpha2);
+        if (call_crda(lr->alpha2))
+                return REG_REQ_IGNORE;
+        return REG_REQ_OK;
 }
 
 /* This processes *all* regulatory hints */
 static void reg_process_hint(struct regulatory_request *reg_request,
                              enum nl80211_reg_initiator reg_initiator)
 {
-        int r = 0;
         struct wiphy *wiphy = NULL;
 
-        BUG_ON(!reg_request->alpha2);
+        if (WARN_ON(!reg_request->alpha2))
+                return;
 
-        if (wiphy_idx_valid(reg_request->wiphy_idx))
+        if (reg_request->wiphy_idx != WIPHY_IDX_INVALID)
                 wiphy = wiphy_idx_to_wiphy(reg_request->wiphy_idx);
 
-        if (reg_initiator == NL80211_REGDOM_SET_BY_DRIVER &&
-            !wiphy) {
+        if (reg_initiator == NL80211_REGDOM_SET_BY_DRIVER && !wiphy) {
                 kfree(reg_request);
                 return;
         }
 
-        r = __regulatory_hint(wiphy, reg_request);
-        /* This is required so that the orig_* parameters are saved */
-        if (r == -EALREADY && wiphy &&
-            wiphy->flags & WIPHY_FLAG_STRICT_REGULATORY) {
-                wiphy_update_regulatory(wiphy, reg_initiator);
-                return;
+        switch (__regulatory_hint(wiphy, reg_request)) {
+        case REG_REQ_ALREADY_SET:
+                /* This is required so that the orig_* parameters are saved */
+                if (wiphy && wiphy->flags & WIPHY_FLAG_STRICT_REGULATORY)
+                        wiphy_update_regulatory(wiphy, reg_initiator);
+                break;
+        default:
+                if (reg_initiator == NL80211_REGDOM_SET_BY_USER)
+                        schedule_delayed_work(&reg_timeout,
+                                              msecs_to_jiffies(3142));
+                break;
         }
-
-        /*
-         * We only time out user hints, given that they should be the only
-         * source of bogus requests.
-         */
-        if (r != -EALREADY &&
-            reg_initiator == NL80211_REGDOM_SET_BY_USER)
-                schedule_delayed_work(&reg_timeout, msecs_to_jiffies(3142));
 }
 
 /*
@@ -1627,15 +1557,15 @@ static void reg_process_hint(struct regulatory_request *reg_request,
  */
 static void reg_process_pending_hints(void)
 {
-        struct regulatory_request *reg_request;
+        struct regulatory_request *reg_request, *lr;
 
         mutex_lock(&cfg80211_mutex);
         mutex_lock(&reg_mutex);
+        lr = get_last_request();
 
         /* When last_request->processed becomes true this will be rescheduled */
-        if (last_request && !last_request->processed) {
-                REG_DBG_PRINT("Pending regulatory request, waiting "
-                              "for it to be processed...\n");
+        if (lr && !lr->processed) {
+                REG_DBG_PRINT("Pending regulatory request, waiting for it to be processed...\n");
                 goto out;
         }
 
@@ -1666,23 +1596,14 @@ static void reg_process_pending_beacon_hints(void)
         struct cfg80211_registered_device *rdev;
         struct reg_beacon *pending_beacon, *tmp;
 
-        /*
-         * No need to hold the reg_mutex here as we just touch wiphys
-         * and do not read or access regulatory variables.
-         */
         mutex_lock(&cfg80211_mutex);
+        mutex_lock(&reg_mutex);
 
         /* This goes through the _pending_ beacon list */
         spin_lock_bh(&reg_pending_beacons_lock);
 
-        if (list_empty(&reg_pending_beacons)) {
-                spin_unlock_bh(&reg_pending_beacons_lock);
-                goto out;
-        }
-
         list_for_each_entry_safe(pending_beacon, tmp,
                                  &reg_pending_beacons, list) {
-
                 list_del_init(&pending_beacon->list);
 
                 /* Applies the beacon hint to current wiphys */
@@ -1694,7 +1615,7 @@ static void reg_process_pending_beacon_hints(void)
         }
 
         spin_unlock_bh(&reg_pending_beacons_lock);
-out:
+        mutex_unlock(&reg_mutex);
         mutex_unlock(&cfg80211_mutex);
 }
 
@@ -1706,10 +1627,8 @@ static void reg_todo(struct work_struct *work)
 
 static void queue_regulatory_request(struct regulatory_request *request)
 {
-        if (isalpha(request->alpha2[0]))
-                request->alpha2[0] = toupper(request->alpha2[0]);
-        if (isalpha(request->alpha2[1]))
-                request->alpha2[1] = toupper(request->alpha2[1]);
+        request->alpha2[0] = toupper(request->alpha2[0]);
+        request->alpha2[1] = toupper(request->alpha2[1]);
 
         spin_lock(&reg_requests_lock);
         list_add_tail(&request->list, &reg_requests_list);
@@ -1726,8 +1645,7 @@ static int regulatory_hint_core(const char *alpha2)
 {
         struct regulatory_request *request;
 
-        request = kzalloc(sizeof(struct regulatory_request),
-                          GFP_KERNEL);
+        request = kzalloc(sizeof(struct regulatory_request), GFP_KERNEL);
         if (!request)
                 return -ENOMEM;
 
@@ -1746,13 +1664,14 @@ int regulatory_hint_user(const char *alpha2,
 {
         struct regulatory_request *request;
 
-        BUG_ON(!alpha2);
+        if (WARN_ON(!alpha2))
+                return -EINVAL;
 
         request = kzalloc(sizeof(struct regulatory_request), GFP_KERNEL);
         if (!request)
                 return -ENOMEM;
 
-        request->wiphy_idx = WIPHY_IDX_STALE;
+        request->wiphy_idx = WIPHY_IDX_INVALID;
         request->alpha2[0] = alpha2[0];
         request->alpha2[1] = alpha2[1];
         request->initiator = NL80211_REGDOM_SET_BY_USER;
@@ -1768,8 +1687,8 @@ int regulatory_hint(struct wiphy *wiphy, const char *alpha2)
 {
         struct regulatory_request *request;
 
-        BUG_ON(!alpha2);
-        BUG_ON(!wiphy);
+        if (WARN_ON(!alpha2 || !wiphy))
+                return -EINVAL;
 
         request = kzalloc(sizeof(struct regulatory_request), GFP_KERNEL);
         if (!request)
@@ -1777,9 +1696,6 @@ int regulatory_hint(struct wiphy *wiphy, const char *alpha2)
 
         request->wiphy_idx = get_wiphy_idx(wiphy);
 
-        /* Must have registered wiphy first */
-        BUG_ON(!wiphy_idx_valid(request->wiphy_idx));
-
         request->alpha2[0] = alpha2[0];
         request->alpha2[1] = alpha2[1];
         request->initiator = NL80211_REGDOM_SET_BY_DRIVER;
@@ -1794,18 +1710,17 @@ EXPORT_SYMBOL(regulatory_hint);
  * We hold wdev_lock() here so we cannot hold cfg80211_mutex() and
  * therefore cannot iterate over the rdev list here.
  */
-void regulatory_hint_11d(struct wiphy *wiphy,
-                         enum ieee80211_band band,
-                         const u8 *country_ie,
-                         u8 country_ie_len)
+void regulatory_hint_11d(struct wiphy *wiphy, enum ieee80211_band band,
+                         const u8 *country_ie, u8 country_ie_len)
 {
         char alpha2[2];
         enum environment_cap env = ENVIRON_ANY;
-        struct regulatory_request *request;
+        struct regulatory_request *request, *lr;
 
         mutex_lock(&reg_mutex);
+        lr = get_last_request();
 
-        if (unlikely(!last_request))
+        if (unlikely(!lr))
                 goto out;
 
         /* IE len must be evenly divisible by 2 */
@@ -1828,9 +1743,8 @@ void regulatory_hint_11d(struct wiphy *wiphy,
          * We leave conflict resolution to the workqueue, where can hold
          * cfg80211_mutex.
          */
-        if (likely(last_request->initiator ==
-            NL80211_REGDOM_SET_BY_COUNTRY_IE &&
-            wiphy_idx_valid(last_request->wiphy_idx)))
+        if (lr->initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE &&
+            lr->wiphy_idx != WIPHY_IDX_INVALID)
                 goto out;
 
         request = kzalloc(sizeof(struct regulatory_request), GFP_KERNEL);
@@ -1843,12 +1757,7 @@ void regulatory_hint_11d(struct wiphy *wiphy,
         request->initiator = NL80211_REGDOM_SET_BY_COUNTRY_IE;
         request->country_ie_env = env;
 
-        mutex_unlock(&reg_mutex);
-
         queue_regulatory_request(request);
-
-        return;
-
 out:
         mutex_unlock(&reg_mutex);
 }
@@ -1863,8 +1772,7 @@ static void restore_alpha2(char *alpha2, bool reset_user)
         if (is_user_regdom_saved()) {
                 /* Unless we're asked to ignore it and reset it */
                 if (reset_user) {
-                        REG_DBG_PRINT("Restoring regulatory settings "
-                               "including user preference\n");
+                        REG_DBG_PRINT("Restoring regulatory settings including user preference\n");
                         user_alpha2[0] = '9';
                         user_alpha2[1] = '7';
 
@@ -1874,26 +1782,20 @@ static void restore_alpha2(char *alpha2, bool reset_user)
                          * back as they were for a full restore.
                          */
                         if (!is_world_regdom(ieee80211_regdom)) {
-                                REG_DBG_PRINT("Keeping preference on "
-                                       "module parameter ieee80211_regdom: %c%c\n",
-                                       ieee80211_regdom[0],
-                                       ieee80211_regdom[1]);
+                                REG_DBG_PRINT("Keeping preference on module parameter ieee80211_regdom: %c%c\n",
+                                              ieee80211_regdom[0], ieee80211_regdom[1]);
                                 alpha2[0] = ieee80211_regdom[0];
                                 alpha2[1] = ieee80211_regdom[1];
                         }
                 } else {
-                        REG_DBG_PRINT("Restoring regulatory settings "
-                               "while preserving user preference for: %c%c\n",
-                               user_alpha2[0],
-                               user_alpha2[1]);
+                        REG_DBG_PRINT("Restoring regulatory settings while preserving user preference for: %c%c\n",
+                                      user_alpha2[0], user_alpha2[1]);
                         alpha2[0] = user_alpha2[0];
                         alpha2[1] = user_alpha2[1];
                 }
         } else if (!is_world_regdom(ieee80211_regdom)) {
-                REG_DBG_PRINT("Keeping preference on "
-                       "module parameter ieee80211_regdom: %c%c\n",
-                       ieee80211_regdom[0],
-                       ieee80211_regdom[1]);
+                REG_DBG_PRINT("Keeping preference on module parameter ieee80211_regdom: %c%c\n",
+                              ieee80211_regdom[0], ieee80211_regdom[1]);
                 alpha2[0] = ieee80211_regdom[0];
                 alpha2[1] = ieee80211_regdom[1];
         } else
@@ -1948,7 +1850,7 @@ static void restore_regulatory_settings(bool reset_user)
         mutex_lock(&cfg80211_mutex);
         mutex_lock(&reg_mutex);
 
-        reset_regdomains(true);
+        reset_regdomains(true, &world_regdom);
         restore_alpha2(alpha2, reset_user);
 
         /*
@@ -1958,49 +1860,35 @@ static void restore_regulatory_settings(bool reset_user)
          * settings.
          */
         spin_lock(&reg_requests_lock);
-        if (!list_empty(&reg_requests_list)) {
-                list_for_each_entry_safe(reg_request, tmp,
-                                         &reg_requests_list, list) {
-                        if (reg_request->initiator !=
-                            NL80211_REGDOM_SET_BY_USER)
-                                continue;
-                        list_move_tail(&reg_request->list, &tmp_reg_req_list);
-                }
+        list_for_each_entry_safe(reg_request, tmp, &reg_requests_list, list) {
+                if (reg_request->initiator != NL80211_REGDOM_SET_BY_USER)
+                        continue;
+                list_move_tail(&reg_request->list, &tmp_reg_req_list);
         }
         spin_unlock(&reg_requests_lock);
 
         /* Clear beacon hints */
         spin_lock_bh(&reg_pending_beacons_lock);
-        if (!list_empty(&reg_pending_beacons)) {
-                list_for_each_entry_safe(reg_beacon, btmp,
-                                         &reg_pending_beacons, list) {
-                        list_del(&reg_beacon->list);
-                        kfree(reg_beacon);
-                }
+        list_for_each_entry_safe(reg_beacon, btmp, &reg_pending_beacons, list) {
+                list_del(&reg_beacon->list);
+                kfree(reg_beacon);
         }
         spin_unlock_bh(&reg_pending_beacons_lock);
 
-        if (!list_empty(&reg_beacon_list)) {
-                list_for_each_entry_safe(reg_beacon, btmp,
-                                         &reg_beacon_list, list) {
-                        list_del(&reg_beacon->list);
-                        kfree(reg_beacon);
-                }
+        list_for_each_entry_safe(reg_beacon, btmp, &reg_beacon_list, list) {
+                list_del(&reg_beacon->list);
+                kfree(reg_beacon);
         }
 
         /* First restore to the basic regulatory settings */
-        cfg80211_regdomain = cfg80211_world_regdom;
-        world_alpha2[0] = cfg80211_regdomain->alpha2[0];
-        world_alpha2[1] = cfg80211_regdomain->alpha2[1];
+        world_alpha2[0] = cfg80211_world_regdom->alpha2[0];
+        world_alpha2[1] = cfg80211_world_regdom->alpha2[1];
 
         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
                 if (rdev->wiphy.flags & WIPHY_FLAG_CUSTOM_REGULATORY)
                         restore_custom_reg_settings(&rdev->wiphy);
         }
 
-        mutex_unlock(&reg_mutex);
-        mutex_unlock(&cfg80211_mutex);
-
         regulatory_hint_core(world_alpha2);
 
         /*
@@ -2011,20 +1899,8 @@ static void restore_regulatory_settings(bool reset_user)
         if (is_an_alpha2(alpha2))
                 regulatory_hint_user(user_alpha2, NL80211_USER_REG_HINT_USER);
 
-        if (list_empty(&tmp_reg_req_list))
-                return;
-
-        mutex_lock(&cfg80211_mutex);
-        mutex_lock(&reg_mutex);
-
         spin_lock(&reg_requests_lock);
-        list_for_each_entry_safe(reg_request, tmp, &tmp_reg_req_list, list) {
-                REG_DBG_PRINT("Adding request for country %c%c back "
-                              "into the queue\n",
-                              reg_request->alpha2[0],
-                              reg_request->alpha2[1]);
-                list_move_tail(&reg_request->list, &reg_requests_list);
-        }
+        list_splice_tail_init(&tmp_reg_req_list, &reg_requests_list);
         spin_unlock(&reg_requests_lock);
 
         mutex_unlock(&reg_mutex);
@@ -2037,8 +1913,7 @@ static void restore_regulatory_settings(bool reset_user)
 
 void regulatory_hint_disconnect(void)
 {
-        REG_DBG_PRINT("All devices are disconnected, going to "
-                      "restore regulatory settings\n");
+        REG_DBG_PRINT("All devices are disconnected, going to restore regulatory settings\n");
         restore_regulatory_settings(false);
 }
 
@@ -2051,31 +1926,48 @@ static bool freq_is_chan_12_13_14(u16 freq)
         return false;
 }
 
+static bool pending_reg_beacon(struct ieee80211_channel *beacon_chan)
+{
+        struct reg_beacon *pending_beacon;
+
+        list_for_each_entry(pending_beacon, &reg_pending_beacons, list)
+                if (beacon_chan->center_freq ==
+                    pending_beacon->chan.center_freq)
+                        return true;
+        return false;
+}
+
 int regulatory_hint_found_beacon(struct wiphy *wiphy,
                                  struct ieee80211_channel *beacon_chan,
                                  gfp_t gfp)
 {
         struct reg_beacon *reg_beacon;
+        bool processing;
 
-        if (likely((beacon_chan->beacon_found ||
-            (beacon_chan->flags & IEEE80211_CHAN_RADAR) ||
+        if (beacon_chan->beacon_found ||
+            beacon_chan->flags & IEEE80211_CHAN_RADAR ||
             (beacon_chan->band == IEEE80211_BAND_2GHZ &&
-             !freq_is_chan_12_13_14(beacon_chan->center_freq)))))
+             !freq_is_chan_12_13_14(beacon_chan->center_freq)))
+                return 0;
+
+        spin_lock_bh(&reg_pending_beacons_lock);
+        processing = pending_reg_beacon(beacon_chan);
+        spin_unlock_bh(&reg_pending_beacons_lock);
+
+        if (processing)
                 return 0;
 
         reg_beacon = kzalloc(sizeof(struct reg_beacon), gfp);
         if (!reg_beacon)
                 return -ENOMEM;
 
-        REG_DBG_PRINT("Found new beacon on "
-                      "frequency: %d MHz (Ch %d) on %s\n",
+        REG_DBG_PRINT("Found new beacon on frequency: %d MHz (Ch %d) on %s\n",
                       beacon_chan->center_freq,
                       ieee80211_frequency_to_channel(beacon_chan->center_freq),
                       wiphy_name(wiphy));
 
         memcpy(&reg_beacon->chan, beacon_chan,
-                sizeof(struct ieee80211_channel));
-
+               sizeof(struct ieee80211_channel));
 
         /*
          * Since we can be called from BH or and non-BH context
@@ -2155,21 +2047,19 @@ static void print_dfs_region(u8 dfs_region)
                 pr_info(" DFS Master region JP");
                 break;
         default:
-                pr_info(" DFS Master region Uknown");
+                pr_info(" DFS Master region Unknown");
                 break;
         }
 }
 
 static void print_regdomain(const struct ieee80211_regdomain *rd)
 {
+        struct regulatory_request *lr = get_last_request();
 
         if (is_intersected_alpha2(rd->alpha2)) {
-
-                if (last_request->initiator ==
-                    NL80211_REGDOM_SET_BY_COUNTRY_IE) {
+                if (lr->initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE) {
                         struct cfg80211_registered_device *rdev;
-                        rdev = cfg80211_rdev_by_wiphy_idx(
-                                last_request->wiphy_idx);
+                        rdev = cfg80211_rdev_by_wiphy_idx(lr->wiphy_idx);
                         if (rdev) {
                                 pr_info("Current regulatory domain updated by AP to: %c%c\n",
                                         rdev->country_ie_alpha2[0],
@@ -2178,22 +2068,21 @@ static void print_regdomain(const struct ieee80211_regdomain *rd)
                                 pr_info("Current regulatory domain intersected:\n");
                 } else
                         pr_info("Current regulatory domain intersected:\n");
-        } else if (is_world_regdom(rd->alpha2))
+        } else if (is_world_regdom(rd->alpha2)) {
                 pr_info("World regulatory domain updated:\n");
-        else {
+        } else {
                 if (is_unknown_alpha2(rd->alpha2))
                         pr_info("Regulatory domain changed to driver built-in settings (unknown country)\n");
                 else {
-                        if (reg_request_cell_base(last_request))
-                                pr_info("Regulatory domain changed "
-                                        "to country: %c%c by Cell Station\n",
+                        if (reg_request_cell_base(lr))
+                                pr_info("Regulatory domain changed to country: %c%c by Cell Station\n",
                                         rd->alpha2[0], rd->alpha2[1]);
                         else
-                                pr_info("Regulatory domain changed "
-                                        "to country: %c%c\n",
+                                pr_info("Regulatory domain changed to country: %c%c\n",
                                         rd->alpha2[0], rd->alpha2[1]);
                 }
         }
+
         print_dfs_region(rd->dfs_region);
         print_rd_rules(rd);
 }
@@ -2207,22 +2096,23 @@ static void print_regdomain_info(const struct ieee80211_regdomain *rd)
 /* Takes ownership of rd only if it doesn't fail */
 static int __set_regdom(const struct ieee80211_regdomain *rd)
 {
+        const struct ieee80211_regdomain *regd;
         const struct ieee80211_regdomain *intersected_rd = NULL;
         struct wiphy *request_wiphy;
+        struct regulatory_request *lr = get_last_request();
+
         /* Some basic sanity checks first */
 
+        if (!reg_is_valid_request(rd->alpha2))
+                return -EINVAL;
+
         if (is_world_regdom(rd->alpha2)) {
-                if (WARN_ON(!reg_is_valid_request(rd->alpha2)))
-                        return -EINVAL;
                 update_world_regdomain(rd);
                 return 0;
         }
 
         if (!is_alpha2_set(rd->alpha2) && !is_an_alpha2(rd->alpha2) &&
-                        !is_unknown_alpha2(rd->alpha2))
-                return -EINVAL;
-
-        if (!last_request)
+            !is_unknown_alpha2(rd->alpha2))
                 return -EINVAL;
 
         /*
@@ -2230,7 +2120,7 @@ static int __set_regdom(const struct ieee80211_regdomain *rd)
          * rd is non static (it means CRDA was present and was used last)
          * and the pending request came in from a country IE
          */
-        if (last_request->initiator != NL80211_REGDOM_SET_BY_COUNTRY_IE) {
+        if (lr->initiator != NL80211_REGDOM_SET_BY_COUNTRY_IE) {
                 /*
                  * If someone else asked us to change the rd lets only bother
                  * checking if the alpha2 changes if CRDA was already called
@@ -2246,29 +2136,23 @@ static int __set_regdom(const struct ieee80211_regdomain *rd)
          * internal EEPROM data
          */
 
-        if (WARN_ON(!reg_is_valid_request(rd->alpha2)))
-                return -EINVAL;
-
         if (!is_valid_rd(rd)) {
                 pr_err("Invalid regulatory domain detected:\n");
                 print_regdomain_info(rd);
                 return -EINVAL;
         }
 
-        request_wiphy = wiphy_idx_to_wiphy(last_request->wiphy_idx);
+        request_wiphy = wiphy_idx_to_wiphy(lr->wiphy_idx);
         if (!request_wiphy &&
-            (last_request->initiator == NL80211_REGDOM_SET_BY_DRIVER ||
-             last_request->initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE)) {
+            (lr->initiator == NL80211_REGDOM_SET_BY_DRIVER ||
+             lr->initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE)) {
                 schedule_delayed_work(&reg_timeout, 0);
                 return -ENODEV;
         }
 
-        if (!last_request->intersect) {
-                int r;
-
-                if (last_request->initiator != NL80211_REGDOM_SET_BY_DRIVER) {
-                        reset_regdomains(false);
-                        cfg80211_regdomain = rd;
+        if (!lr->intersect) {
+                if (lr->initiator != NL80211_REGDOM_SET_BY_DRIVER) {
+                        reset_regdomains(false, rd);
                         return 0;
                 }
 
@@ -2284,20 +2168,19 @@ static int __set_regdom(const struct ieee80211_regdomain *rd)
                 if (request_wiphy->regd)
                         return -EALREADY;
 
-                r = reg_copy_regd(&request_wiphy->regd, rd);
-                if (r)
-                        return r;
+                regd = reg_copy_regd(rd);
+                if (IS_ERR(regd))
+                        return PTR_ERR(regd);
 
-                reset_regdomains(false);
-                cfg80211_regdomain = rd;
+                rcu_assign_pointer(request_wiphy->regd, regd);
+                reset_regdomains(false, rd);
                 return 0;
         }
 
         /* Intersection requires a bit more work */
 
-        if (last_request->initiator != NL80211_REGDOM_SET_BY_COUNTRY_IE) {
-
-                intersected_rd = regdom_intersect(rd, cfg80211_regdomain);
+        if (lr->initiator != NL80211_REGDOM_SET_BY_COUNTRY_IE) {
+                intersected_rd = regdom_intersect(rd, get_cfg80211_regdom());
                 if (!intersected_rd)
                         return -EINVAL;
 
@@ -2306,15 +2189,14 @@ static int __set_regdom(const struct ieee80211_regdomain *rd)
                  * However if a driver requested this specific regulatory
                  * domain we keep it for its private use
                  */
-                if (last_request->initiator == NL80211_REGDOM_SET_BY_DRIVER)
-                        request_wiphy->regd = rd;
+                if (lr->initiator == NL80211_REGDOM_SET_BY_DRIVER)
+                        rcu_assign_pointer(request_wiphy->regd, rd);
                 else
                         kfree(rd);
 
                 rd = NULL;
 
-                reset_regdomains(false);
-                cfg80211_regdomain = intersected_rd;
+                reset_regdomains(false, intersected_rd);
 
                 return 0;
         }
@@ -2326,15 +2208,15 @@ static int __set_regdom(const struct ieee80211_regdomain *rd)
 /*
  * Use this call to set the current regulatory domain. Conflicts with
  * multiple drivers can be ironed out later. Caller must've already
- * kmalloc'd the rd structure. Caller must hold cfg80211_mutex
+ * kmalloc'd the rd structure.
  */
 int set_regdom(const struct ieee80211_regdomain *rd)
 {
+        struct regulatory_request *lr;
         int r;
 
-        assert_cfg80211_lock();
-
         mutex_lock(&reg_mutex);
+        lr = get_last_request();
 
         /* Note that this doesn't update the wiphys, this is done below */
         r = __set_regdom(rd);
@@ -2343,23 +2225,25 @@ int set_regdom(const struct ieee80211_regdomain *rd)
                         reg_set_request_processed();
 
                 kfree(rd);
-                mutex_unlock(&reg_mutex);
-                return r;
+                goto out;
         }
 
         /* This would make this whole thing pointless */
-        if (!last_request->intersect)
-                BUG_ON(rd != cfg80211_regdomain);
+        if (WARN_ON(!lr->intersect && rd != get_cfg80211_regdom())) {
+                r = -EINVAL;
+                goto out;
+        }
 
         /* update all wiphys now with the new established regulatory domain */
-        update_all_wiphy_regulatory(last_request->initiator);
+        update_all_wiphy_regulatory(lr->initiator);
 
-        print_regdomain(cfg80211_regdomain);
+        print_regdomain(get_cfg80211_regdom());
 
-        nl80211_send_reg_change_event(last_request);
+        nl80211_send_reg_change_event(lr);
 
         reg_set_request_processed();
 
+ out:
         mutex_unlock(&reg_mutex);
 
         return r;
@@ -2368,13 +2252,21 @@ int set_regdom(const struct ieee80211_regdomain *rd)
 #ifdef CONFIG_HOTPLUG
 int reg_device_uevent(struct device *dev, struct kobj_uevent_env *env)
 {
-        if (last_request && !last_request->processed) {
-                if (add_uevent_var(env, "COUNTRY=%c%c",
-                                   last_request->alpha2[0],
-                                   last_request->alpha2[1]))
-                        return -ENOMEM;
+        struct regulatory_request *lr;
+        u8 alpha2[2];
+        bool add = false;
+
+        rcu_read_lock();
+        lr = get_last_request();
+        if (lr && !lr->processed) {
+                memcpy(alpha2, lr->alpha2, 2);
+                add = true;
         }
+        rcu_read_unlock();
 
+        if (add)
+                return add_uevent_var(env, "COUNTRY=%c%c",
+                                      alpha2[0], alpha2[1]);
         return 0;
 }
 #else
@@ -2386,8 +2278,6 @@ int reg_device_uevent(struct device *dev, struct kobj_uevent_env *env)
 
 void wiphy_regulatory_register(struct wiphy *wiphy)
 {
-        assert_cfg80211_lock();
-
         mutex_lock(&reg_mutex);
 
         if (!reg_dev_ignore_cell_hint(wiphy))
@@ -2402,32 +2292,32 @@ void wiphy_regulatory_register(struct wiphy *wiphy)
 void wiphy_regulatory_deregister(struct wiphy *wiphy)
 {
         struct wiphy *request_wiphy = NULL;
-
-        assert_cfg80211_lock();
+        struct regulatory_request *lr;
 
         mutex_lock(&reg_mutex);
+        lr = get_last_request();
 
         if (!reg_dev_ignore_cell_hint(wiphy))
                 reg_num_devs_support_basehint--;
 
-        kfree(wiphy->regd);
+        rcu_free_regdom(get_wiphy_regdom(wiphy));
+        rcu_assign_pointer(wiphy->regd, NULL);
 
-        if (last_request)
-                request_wiphy = wiphy_idx_to_wiphy(last_request->wiphy_idx);
+        if (lr)
+                request_wiphy = wiphy_idx_to_wiphy(lr->wiphy_idx);
 
         if (!request_wiphy || request_wiphy != wiphy)
                 goto out;
 
-        last_request->wiphy_idx = WIPHY_IDX_STALE;
-        last_request->country_ie_env = ENVIRON_ANY;
+        lr->wiphy_idx = WIPHY_IDX_INVALID;
+        lr->country_ie_env = ENVIRON_ANY;
 out:
         mutex_unlock(&reg_mutex);
 }
 
 static void reg_timeout_work(struct work_struct *work)
 {
-        REG_DBG_PRINT("Timeout while waiting for CRDA to reply, "
-                      "restoring regulatory settings\n");
+        REG_DBG_PRINT("Timeout while waiting for CRDA to reply, restoring regulatory settings\n");
         restore_regulatory_settings(true);
 }
 
@@ -2446,13 +2336,13 @@ int __init regulatory_init(void)
 
         reg_regdb_size_check();
 
-        cfg80211_regdomain = cfg80211_world_regdom;
+        rcu_assign_pointer(cfg80211_regdomain, cfg80211_world_regdom);
 
         user_alpha2[0] = '9';
         user_alpha2[1] = '7';
 
         /* We always try to get an update for the static regdomain */
-        err = regulatory_hint_core(cfg80211_regdomain->alpha2);
+        err = regulatory_hint_core(cfg80211_world_regdom->alpha2);
         if (err) {
                 if (err == -ENOMEM)
                         return err;
@@ -2464,10 +2354,6 @@ int __init regulatory_init(void)
                  * errors as non-fatal.
                  */
                 pr_err("kobject_uevent_env() was unable to call CRDA during init\n");
-#ifdef CONFIG_CFG80211_REG_DEBUG
-                /* We want to find out exactly why when debugging */
-                WARN_ON(err);
-#endif
         }
 
         /*
@@ -2481,7 +2367,7 @@ int __init regulatory_init(void)
         return 0;
 }
 
-void /* __init_or_exit */ regulatory_exit(void)
+void regulatory_exit(void)
 {
         struct regulatory_request *reg_request, *tmp;
         struct reg_beacon *reg_beacon, *btmp;
@@ -2489,43 +2375,27 @@ void /* __init_or_exit */ regulatory_exit(void)
         cancel_work_sync(&reg_work);
         cancel_delayed_work_sync(&reg_timeout);
 
-        mutex_lock(&cfg80211_mutex);
+        /* Lock to suppress warnings */
         mutex_lock(&reg_mutex);
-
-        reset_regdomains(true);
+        reset_regdomains(true, NULL);
+        mutex_unlock(&reg_mutex);
 
         dev_set_uevent_suppress(&reg_pdev->dev, true);
 
         platform_device_unregister(reg_pdev);
 
-        spin_lock_bh(&reg_pending_beacons_lock);
-        if (!list_empty(&reg_pending_beacons)) {
-                list_for_each_entry_safe(reg_beacon, btmp,
-                                         &reg_pending_beacons, list) {
-                        list_del(&reg_beacon->list);
-                        kfree(reg_beacon);
-                }
+        list_for_each_entry_safe(reg_beacon, btmp, &reg_pending_beacons, list) {
+                list_del(&reg_beacon->list);
+                kfree(reg_beacon);
         }
-        spin_unlock_bh(&reg_pending_beacons_lock);
 
-        if (!list_empty(&reg_beacon_list)) {
-                list_for_each_entry_safe(reg_beacon, btmp,
-                                         &reg_beacon_list, list) {
-                        list_del(&reg_beacon->list);
-                        kfree(reg_beacon);
-                }
+        list_for_each_entry_safe(reg_beacon, btmp, &reg_beacon_list, list) {
+                list_del(&reg_beacon->list);
+                kfree(reg_beacon);
         }
 
-        spin_lock(&reg_requests_lock);
-        if (!list_empty(&reg_requests_list)) {
-                list_for_each_entry_safe(reg_request, tmp,
-                                         &reg_requests_list, list) {
-                        list_del(&reg_request->list);
-                        kfree(reg_request);
-                }
+        list_for_each_entry_safe(reg_request, tmp, &reg_requests_list, list) {
+                list_del(&reg_request->list);
+                kfree(reg_request);
         }
-        spin_unlock(&reg_requests_lock);
-
-        mutex_unlock(&reg_mutex);
-        mutex_unlock(&cfg80211_mutex);
 }
diff --git a/net/wireless/reg.h b/net/wireless/reg.h
index 4c0a32ffd530..af2d5f8a5d82 100644
--- a/net/wireless/reg.h
+++ b/net/wireless/reg.h
@@ -16,10 +16,9 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-extern const struct ieee80211_regdomain *cfg80211_regdomain;
+extern const struct ieee80211_regdomain __rcu *cfg80211_regdomain;
 
 bool is_world_regdom(const char *alpha2);
-bool reg_is_valid_request(const char *alpha2);
 bool reg_supported_dfs_region(u8 dfs_region);
 
 int regulatory_hint_user(const char *alpha2,
@@ -55,8 +54,8 @@ bool reg_last_request_cell_base(void);
  * set the wiphy->disable_beacon_hints to true.
  */
 int regulatory_hint_found_beacon(struct wiphy *wiphy,
-                                        struct ieee80211_channel *beacon_chan,
-                                        gfp_t gfp);
+                                 struct ieee80211_channel *beacon_chan,
+                                 gfp_t gfp);
 
 /**
  * regulatory_hint_11d - hints a country IE as a regulatory domain
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index f2431e41a373..a825dfe12cf7 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -192,7 +192,8 @@ static int cfg80211_conn_do_work(struct wireless_dev *wdev)
                                             prev_bssid,
                                             params->ssid, params->ssid_len,
                                             params->ie, params->ie_len,
-                                            false, &params->crypto,
+                                            params->mfp != NL80211_MFP_NO,
+                                            &params->crypto,
                                             params->flags, &params->ht_capa,
                                             &params->ht_capa_mask);
                 if (err)
@@ -519,10 +520,8 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
          * - country_ie + 2, the start of the country ie data, and
          * - and country_ie[1] which is the IE length
          */
-        regulatory_hint_11d(wdev->wiphy,
-                            bss->channel->band,
-                            country_ie + 2,
-                            country_ie[1]);
+        regulatory_hint_11d(wdev->wiphy, bss->channel->band,
+                            country_ie + 2, country_ie[1]);
         kfree(country_ie);
 }
 
diff --git a/net/wireless/trace.h b/net/wireless/trace.h
index 2134576f426e..8bc553199686 100644
--- a/net/wireless/trace.h
+++ b/net/wireless/trace.h
@@ -1767,6 +1767,24 @@ DEFINE_EVENT(wiphy_wdev_evt, rdev_stop_p2p_device,
         TP_ARGS(wiphy, wdev)
 );
 
+TRACE_EVENT(rdev_set_mac_acl,
+        TP_PROTO(struct wiphy *wiphy, struct net_device *netdev,
+                 struct cfg80211_acl_data *params),
+        TP_ARGS(wiphy, netdev, params),
+        TP_STRUCT__entry(
+                WIPHY_ENTRY
+                NETDEV_ENTRY
+                __field(u32, acl_policy)
+        ),
+        TP_fast_assign(
+                WIPHY_ASSIGN;
+                WIPHY_ASSIGN;
+                __entry->acl_policy = params->acl_policy;
+        ),
+        TP_printk(WIPHY_PR_FMT ", " NETDEV_PR_FMT ", acl policy: %d",
+                  WIPHY_PR_ARG, NETDEV_PR_ARG, __entry->acl_policy)
+);
+
 /*************************************************************
  *           cfg80211 exported functions traces              *
  *************************************************************/
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 16d76a807c2f..d7873c7ae0ec 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -1184,7 +1184,8 @@ int cfg80211_can_use_iftype_chan(struct cfg80211_registered_device *rdev,
                                  struct wireless_dev *wdev,
                                  enum nl80211_iftype iftype,
                                  struct ieee80211_channel *chan,
-                                 enum cfg80211_chan_mode chanmode)
+                                 enum cfg80211_chan_mode chanmode,
+                                 u8 radar_detect)
 {
         struct wireless_dev *wdev_iter;
         u32 used_iftypes = BIT(iftype);
@@ -1195,14 +1196,46 @@ int cfg80211_can_use_iftype_chan(struct cfg80211_registered_device *rdev,
         enum cfg80211_chan_mode chmode;
         int num_different_channels = 0;
         int total = 1;
+        bool radar_required;
         int i, j;
 
         ASSERT_RTNL();
         lockdep_assert_held(&rdev->devlist_mtx);
 
+        if (WARN_ON(hweight32(radar_detect) > 1))
+                return -EINVAL;
+
+        switch (iftype) {
+        case NL80211_IFTYPE_ADHOC:
+        case NL80211_IFTYPE_AP:
+        case NL80211_IFTYPE_AP_VLAN:
+        case NL80211_IFTYPE_MESH_POINT:
+        case NL80211_IFTYPE_P2P_GO:
+        case NL80211_IFTYPE_WDS:
+                radar_required = !!(chan &&
+                                    (chan->flags & IEEE80211_CHAN_RADAR));
+                break;
+        case NL80211_IFTYPE_P2P_CLIENT:
+        case NL80211_IFTYPE_STATION:
+        case NL80211_IFTYPE_MONITOR:
+                radar_required = false;
+                break;
+        case NL80211_IFTYPE_P2P_DEVICE:
+        case NUM_NL80211_IFTYPES:
+        case NL80211_IFTYPE_UNSPECIFIED:
+        default:
+                return -EINVAL;
+        }
+
+        if (radar_required && !radar_detect)
+                return -EINVAL;
+
         /* Always allow software iftypes */
-        if (rdev->wiphy.software_iftypes & BIT(iftype))
+        if (rdev->wiphy.software_iftypes & BIT(iftype)) {
+                if (radar_detect)
+                        return -EINVAL;
                 return 0;
+        }
 
         memset(num, 0, sizeof(num));
         memset(used_channels, 0, sizeof(used_channels));
@@ -1275,7 +1308,7 @@ int cfg80211_can_use_iftype_chan(struct cfg80211_registered_device *rdev,
                 used_iftypes |= BIT(wdev_iter->iftype);
         }
 
-        if (total == 1)
+        if (total == 1 && !radar_detect)
                 return 0;
 
         for (i = 0; i < rdev->wiphy.n_iface_combinations; i++) {
@@ -1308,6 +1341,9 @@ int cfg80211_can_use_iftype_chan(struct cfg80211_registered_device *rdev,
                         }
                 }
 
+                if (radar_detect && !(c->radar_detect_widths & radar_detect))
+                        goto cont;
+
                 /*
                  * Finally check that all iftypes that we're currently
                  * using are actually part of this combination. If they